full-disclosure - Solaris security patches.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20031002205912.GA7487@deneb.enyo.de>
From: fw at deneb.enyo.de (Florian Weimer)
Subject: Solaris security patches.

Len Rose wrote:

> NOTE: These are personal opinions and as such I do not speak 
> for any entity other than myself.

> It's been quite a while for those who rely on ssh and sendmail,
> so generally everyone eventually is forced to ditch "official"
> versions of ssh and sendmail in favour of building these critical
> pieces of software from source from the open source development
> teams.

Furthermore, you can't be sure that a maintainance upgrade introduces
code with known, widely-published security issues (so seen with BIND).
And no, you aren't told at once. 8-(

Let's face it, if you run Solaris, you don't do that for its security.
Sun customers as a whole have a wide range of priorities, and security
is just one of them.  In some environments where Sun servers are
traditionally used, I can fully understand that it's more important to
fix certain non-security defects or deliver additional features.