lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: esper at sherohman.org (Dave Sherohman)
Subject: no more public exploits

On Tue, Apr 27, 2004 at 12:52:26PM -0500, Duquette, John wrote:
> That is a terrible policy to follow.  If the vulnerability is real enough
> for the vendor to publish a patch, then sysadmins should patch their
> systems.  Haven't all the recent worms taught people anything?

The problem is that many vendors don't publish pure security patches,
instead bundling new features with the security fix.  This places
sysadmins in the position of having to evaluate the existing
vulnerability against the chance of new holes and/or broken features
in the patch.

If you're dealing with a vendor who does pure security patches, then
I agree with you.  (That's why I run Debian stable - they backport
all security patches, so you know that your security upgrade is
_just_ a security upgrade.)  If you're dealing with '90s-era
Microsoft, where the only security patches are bundled with dozens of
other changes and "enhancements" in a Service Pack that's liable to
break more things than it fixes, then the situation isn't so clear-
cut.

-- 
The freedoms that we enjoy presently are the most important victories of the
White Hats over the past several millennia, and it is vitally important that
we don't give them up now, only because we are frightened.
  - Eolake Stobblehouse (http://stobblehouse.com/text/battle.html)


Powered by blists - more mailing lists