full-disclosure - Re: Getting Off the Patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <49032.1295517884@localhost>
Date: Thu, 20 Jan 2011 05:04:44 -0500
From: Valdis.Kletnieks@...edu
To: Pete Smith <seclists@...apitate.us>
Cc: "Cor Rosielle \(cor@...post24.nl\)" <cor@...post24.nl>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Getting Off the Patch

On Thu, 20 Jan 2011 13:06:16 +1100, Pete Smith said:
> Can anyone seriously say that they patch every time Cisco releases a new
> version of IOS?

Running the latest-and-greatest IOS in production is pretty much a sign that
you're not a very large network provider, or don't intend on staying a large
network provider.

IOS is generally acknowledged to be a steaming morass of bugs, so most sane
users of Cisco gear will find a version that provides most of the features they
need and the least number of SLA-invoking issues, stick with it, and pray.  By
the time you fight through all the "this version won't boot on a 6509 with a
SUP2, and this other version will boot with a SUP2 but won't do MPLS to a Juniper at
the other end unless the line card is between EC levels x and y, except if you
turn on IPv6, in which case you need to be between EC levels y and z *and* have
at least 32M more space available on the itty-bitty flash card and an
additional 64M of RAM if you have a full BGP feed, but 4M additional RAM if you
don't", your eyes are glazed over and you're actually glad when you see that
a security fix is only shipping on the T train and not the S train, so you have a
legitimate reason to not try to get it to run on your S-train boxes....

(You think I'm kidding? Look at the thread starting here:
http://www.mail-archive.com/cisco-nsp@puck.nether.net/msg29241.html

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/