Date: Mon, 24 May 1999 00:52:32 -0700 From: "Jordan K. Hubbard" <jkh@zippy.cdrom.com> To: Andreas Klemm <andreas@klemm.gtn.com> Cc: hackers@FreeBSD.ORG Subject: Re: security: what does OpenBSD have, that FreeBSD doesn't have... Message-ID: <29354.927532352@zippy.cdrom.com> In-Reply-To: Your message of "Sun, 23 May 1999 09:45:55 %2B0200." <19990523094555.A33370@titan.klemm.gtn.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> What make OpenBSD so "secure" ? Or can this kind of security be > reproduced with FreeBSD ports ? I think of tools like: It's not the tools but the amount of time supposedly invested in improving security. I say "supposedly" because a lot of the buffer overflow issues they've dealt with haven't been actual, proven security holes per-se but rather just more examples of defensive programming. Sometimes it's actually preventative, other times it's just an exercise in replacing every strcpy() with strncpy() (and so on) because that's an easy thing to do. It's a bit like the approach of putting more locks on your front door. Maybe those extra locks will save your butt, maybe they'll just be expensive extras for a house with nothing worth stealing and maybe the thieves will use the window instead and just bypass the door altogether - it's very hard to say. What is certain is that having ANY faith in ANYONE'S security claims as a substitute for properly diligent system administration is just complete and utter foolishness. Most attacks I've seen, in fact, compromise *BSD (for all values of *BSD) and Linux equally through well-known 3rd party utilities, like popper or sendmail, rather than the "OS" itself. I doubt that any group has enough resources to completely audit even a small fraction of the 3rd party packages which users are likely to run and, even if they did, each revision of a package would necessitate auditing it all over again. Don't trust anyone's security claims, *especially* when they claim to be uncrackable or even "extremely secure." Operating systems are built by engineers, the same sort of engineers who built "unsinkable ships" like the Titanic, and I think that pretty much says it all. :-) - Jordan To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?29354.927532352>