Full Disclosure mailing list archives
Re: [inbox] Re: RE: Linux (in)security
From: Paul Schmehl <pauls () utdallas edu>
Date: Thu, 23 Oct 2003 21:40:13 -0500
--On Thursday, October 23, 2003 5:11 PM -0700 Dan Wilder <dan () ssc com> wrote:
Nor will you with Windows. Look at the 47 bulletins for this year and you'll find things like Messenger, Internet Explorer, Outlook, Access, Content Management Server, ISA Server, etc., etc., none of which are part of the OS, despite MS's bs claims in court.Among those advisories you mention on the Linux sites, I see subjects including tomcat4, openssl, freesweep, marbles, gopher, sendmail, mah-jong, wu-ftpd, exim, perl, phpgroupware, mutt, qpopper, squirrelmail. And many more that are similar in that they've no relationship with the OS save being shipped with it. Hardly *just* the Linux OS. Some of those packages mentioned on the Debian site were begun long before there _was_ such a thing as Linux. Even if you classify things like XFRee86 and Samba as being part of the OS for purposes of comparing with Windows, which features much tighter coupling between the OS and some of its services than do the UNIX-like OSs, I believe you're going to be hard-pressed to come up with 47 advisories against the OS. Or anything remotely near that number.
But *none* of this childish tit for tat is the point. The point is that lots of software has significant, security related bugs, and the way software is taught and done obviously needs to change. It's evident to an impartial observer that buffer overflows are a problem in almost *everyone's* software. So something is wrong with the way software is "done", *not* with the end result, which is OSes and applications.
I've read here that it's not possible to write software that doesn't have flaws because programmers are human. I think that's a crutch that allows us to accept less than the best. There was an article in Fortune, back in March of this year, that refutes that. I'll give you the URL, but you'd have to pay to read it. <http://www.fortune.com/fortune/imt/0,15704,427288,00.html>
The bottom line is that there is a company in Canada, QNX Software Systems, that writes an OS that simply does not fail and does not have bugs in it. Their website is here if you want to take a look: <http://www.qnx.com/>. Their software powers cars and laser surgery devices and it simply *cannot* fail, and so they make sure that it doesn't by doing it right the first time.
Let's compare apples to apples, so to speak, if we're going to invest the effort in the first place, into making silly comparisons.
Do you really believe it matters what the exact numbers are? Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: [inbox] Re: RE: Linux (in)security, (continued)
- RE: [inbox] Re: RE: Linux (in)security Curt Purdy (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Michal Zalewski (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Ron DuFresne (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security William Warren (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security Ron DuFresne (Oct 24)
- Re: [inbox] Re: RE: Linux (in)security Jeremiah Cornelius (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Paul Schmehl (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Andy Wood (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Paul Schmehl (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security Dan Wilder (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security Paul Schmehl (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security Peter Busser (Oct 24)
- Re: [inbox] Re: RE: Linux (in)security Shawn McMahon (Oct 24)
- RE: [inbox] Re: RE: Linux (in)security Arcturus (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security Peter Busser (Oct 24)
- Re: [inbox] Re: RE: Linux (in)security Shawn McMahon (Oct 24)
- Re: [inbox] Re: Linux (in)security Chris Ruvolo (Oct 24)
- Re: [inbox] Re: RE: Linux (in)security Valdis . Kletnieks (Oct 24)
- Re: [inbox] Re: RE: Linux (in)security Henning Brauer (Oct 30)
- Re: RE: Linux (in)security Ron DuFresne (Oct 23)
- Re: RE: Linux (in)security Peter Busser (Oct 23)