lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <855215054.1066945213@[192.168.2.119]>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: [inbox] Re: RE: Linux (in)security

--On Thursday, October 23, 2003 5:11 PM -0700 Dan Wilder <dan@....com> 
wrote:
>
> Among those advisories you mention on the Linux sites, I see subjects
> including tomcat4, openssl, freesweep, marbles, gopher, sendmail,
> mah-jong, wu-ftpd, exim, perl, phpgroupware, mutt, qpopper, squirrelmail.
> And many more that are similar in that they've no relationship with
> the OS save being shipped with it.  Hardly *just* the Linux OS.  Some
> of those packages mentioned on the Debian site were begun long before
> there _was_ such a thing as Linux.
>
> Even if you classify things like XFRee86 and Samba as being part of the
> OS for purposes of comparing with Windows, which features much tighter
> coupling between the OS and some of its services than do the UNIX-like
> OSs, I believe you're going to be hard-pressed to come up with 47
> advisories against the OS.  Or anything remotely near that number.
>
Nor will you with Windows.  Look at the 47 bulletins for this year and 
you'll find things like Messenger, Internet Explorer, Outlook, Access, 
Content Management Server, ISA Server, etc., etc., none of which are part 
of the OS, despite MS's bs claims in court.

But *none* of this childish tit for tat is the point.  The point is that 
lots of software has significant, security related bugs, and the way 
software is taught and done obviously needs to change.  It's evident to an 
impartial observer that buffer overflows are a problem in almost 
*everyone's* software.  So something is wrong with the way software is 
"done", *not* with the end result, which is OSes and applications.

I've read here that it's not possible to write software that doesn't have 
flaws because programmers are human.  I think that's a crutch that allows 
us to accept less than the best.  There was an article in Fortune, back in 
March of this year, that refutes that.  I'll give you the URL, but you'd 
have to pay to read it. 
<http://www.fortune.com/fortune/imt/0,15704,427288,00.html>

The bottom line is that there is a company in Canada, QNX Software Systems, 
that writes an OS that simply does not fail and does not have bugs in it. 
Their website is here if you want to take a look:
<http://www.qnx.com/>.  Their software powers cars and laser surgery 
devices and it simply *cannot* fail, and so they make sure that it doesn't 
by doing it right the first time.

> Let's compare apples to apples, so to speak, if we're going to
> invest the effort in the first place, into making silly comparisons.
>
Do you really believe it matters what the exact numbers are?

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ