full-disclosure - What is wrong with schools these days?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200604260114.k3Q1EKtP004315@turing-police.cc.vt.edu>
Date: Wed Apr 26 02:15:47 2006
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: What is wrong with schools these days? 

On Tue, 25 Apr 2006 17:14:20 CDT, Paul Schmehl said:

> I also have a policy that I avoid software that has a poor security 
> track record.  So, I don't use Internet Explorer - on any platform - and 
> I don't use sendmail - on any platform.  The first thing I do, when I 
> set up a FreeBSD box is uninstall sendmail and install Postfix.  It's 
> not that I like Postfix more.  It's that Postfix has had very few 
> vulnerabilities in it, and sendmail has them routinely.  It tells me 
> that the programmers writing the former understand security better than 
> the programmers writing the latter.  It's nothing personal.  They both 
> do a job that needs to be done.  One makes me worry less.

There's another very important factor to consider - the black hats will
want to invest for the best cost/benefit ratio.  There's a very real
possibility that Sendmail has programmers that are *just* as interested
in security as the Postfix crew, but more bugs are found in Sendmail because
finding a Sendmail bug can get you 80% of the Unixoid boxes out there, and
Postfix will only snag you 5% or so (or whatever the exact ratio is).

Real life example:

For a long time, IE was being routinely exploited, and there were almost no
holes found in Mozilla/Firefox.  Now that enough people run Firefox to make it
worth trying to exploit, holes are being found.  Is this saying that  the
Firefox crew used to be interested in security, and have given up, or is it
saying that they've always had the same level of concern, but holes are present
in *any* large package, and they're being found more because more people are
looking?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060425/d6b09918/attachment.bin