lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: draht at suse.de (Roman Drahtmueller)
Subject: The new Microsoft math:  1 patch for 14
 vulnerabilities, MS04-011

>  
> I use Linux, OpenBSD and Windows in my enterprise.  Linux and OpenBSD use
> the "1 patch for 1 vulnerability" rule.  Seems to me that MS is bunching
> their patches together in order to make it seem on the surface that Windows
> has less patches than other Oses, therefore it is more secure.  CIOs, take
> note. 

It happens from time to time (today...) that several bugs get fixed with
one update package on SUSE Linux (and other Linuxes). But: One update 
package fixes one package, whereas one patch can consist of several update 
packages (in our patch management framework).

After all, it is a matter of transparency if you can manually,
individually select what update package you want on your system and which 
not. Probably even more important: You should also be able to see what 
_changes_ have been applied to every single update package. Otherwise, you 
just can't know what else has been "fixed"...

Regards,
Roman.
-- 
 -                                                                      -
| Roman Drahtm?ller      <draht@...e.de> // "You don't need eyes to see, |
  SUSE Linux AG - Security       Phone: //             you need vision!"
| N?rnberg, Germany     +49-911-740530 //           Maxi Jazz, Faithless |
 -                                                                      -


Powered by blists - more mailing lists