bugtraq - Re: Windows Update: A single point of failure for the world's economy?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 3 Sep 2003 16:02:05 -0600
From: "Kurt Seifried" <bt@...fried.org>
To: "Paul Schmehl" <pauls@...allas.edu>,
	"Stefano Zanero" <stefano.zanero@...e.org>,
	"BugTraq" <BUGTRAQ@...URITYFOCUS.COM>
Subject: Re: Windows Update: A single point of failure for the world's economy?

> > Enabling a world-wide auto-update feature does indeed seem much of a
> > security risk to me.
> >
> More of a risk than up2date for RedHat or emerge -u system for Gentoo?  Or
> cvsup for *BSD?

Yes. These systems are voluntary. The structure of UNIX systems, and updates
makes it much easier to test and update and less likely to kill a system
even if it is flawed. Updating user space applications in Red Hat, other
then SSH causes me essentially no nervousness. If Apache bombs out I can
trivially roll it back to an older version, or if it's totally screwed up
remove, and replace (and not lose my config files either since most RPM
packages are designed to protect old/original config files). I cannot
selectively install say 90% of Service Pack 4 in Windows 2000, it's pretty
much all or  nothing. In Red Hat (and Linux/BSD in general) there are no
roll up security fixes (exceptions being appliance vendors, but those are
much more tightly bound environments and less likely to suffer update
related problems).

To put it bluntly:

Compare the number of times MS has had to re-release patches/updates or
additional fixes because it kills/breaks something vs.s. the number of times
Red Hat or SuSE does.

P.S. even if MS does solve most of these issues they still have painted
themselves into a corner due to their rather insane file locking which
requires a reboot in virtually every circumstance you want to replace
important files.

> Paul Schmehl (pauls@...allas.edu)

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/