full-disclosure - Re: AFS - The Ultimate Sulution? -- What is the point?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200609171403.k8HE34KI020471@turing-police.cc.vt.edu>
Date: Sun, 17 Sep 2006 10:03:03 -0400
From: Valdis.Kletnieks@...edu
To: Paul Sebastian Ziegler <psz@...erved.de>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: AFS - The Ultimate Sulution? -- What is the
	point?

On Sun, 17 Sep 2006 13:38:32 +0200, Paul Sebastian Ziegler said:

> As you said this requires that the AFS-Server is being kept up to date.
> But the Images wouldn't have to be. Apart from this AFS hasn't had a
> major security-issue in the past several years.

AFS hasn't had a magor security issue in the past several years for about the
same reasons that RSTS/E and whatever IBM is calling MVS these days (z/OS?)
don't have major security issues you hear about.  You don't *hear* about holes
because there's not enough sites using it to draw the attention of a competent
hacker.  And in fact, IBM is still issuing 'Integrity APARs' against z/OS,
they're just able to keep it quiet.

Go back and re-read the last few batches of AFS updates, and ask youself
for each bugfix "Could this *potentially* have been leveraged by a clued
hacker?".

Then decide if you *still* feel as confident. :)

If, as Dijkstra said, "Testing can reveal the presence of bugs, but not their
absence", what does lack of widespread testing reveal?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/