Re: [gentoo-hardened] Updates: a way too simplified security question I am asking anyway

[Javier Martínez]

Well, then neither GNU/Linux and OpenBSD are systems for you, since
them both are not reliable since both are only a C2 systems by default
under the orange book, maybe you should look for a system as CaprOS
that reach to the A1 level and with other things has an exokernel
(instead of an monolithic kernel as OpenBSD and Linux).

Sorry but as I said you before, you can't make an OpenBSD trusted
since it needs a B1 classification, and the B1 needs Mandatory Access
Controls that doesn't exist in OpenBSD, at least in GNU/Linux we could
reach to the B1, enough to mark it as "trusted Operating system".

Conclussion: You will never find an secure from the box Operating
system, you will have to work (hard) to assure it under yours needs,
and for this you will need and MAC system.

2008/8/20, Jan Klod <janklodvan@×××××.com>:
> On Wednesday 20 August 2008 22:31:30 RB wrote:
>> On Wed, Aug 20, 2008 at 12:14 PM, Jan Klod <janklodvan@×××××.com> wrote:
>> <snip rambling flame>
> No problem, we can cut it.
>
>> I'm not going to address each of the fallacies I see in your
>> statements, but you have an exceedingly idealistic view of software
>> development and particular OS' perceived security.  [Insert project
>> here] may have a slogan, but the developers are still human and thus
>> still make mistakes and are inherently lazy.  Short of being powered
>> by unicorn farts, there is no way any reasonably complex system can
>> approach that ideal.
> [sorry, as you see, writing what I don't know much about]
> In this light I was assuming, that file server is much less complex than it
> is. Give you my word to remember this when I write my next code :)
>
>>
>> In regard to your philosophy of updates, do you build a wall and not
>> defend it?  Do you plant a garden and not water it?  In the same
>> light, no system can be "permanently" secured.  Safes are rated by the
>> amount of time it would take a dedicated, skilled cracker to open it;
>> none are ever deemed uncrackable.  If you want more time, you purchase
>> [or build] one that better matches your needs.  System security is no
>> different.
> Complexity matter again... Theoretically.. is it possible to enumerate all
> the
> possible scenarios for a file server? (or, I might have wrote - all of its
> states) Oh, sure, it has finite amount of memory :)
> Human problem.
> Is easy to say "security", hard to give an action for all the possibilities
> (right action by our judgement)...
>
> I started this as a "flame", but the rest might go out of scope of this list
> and send me to theoretical computer science.
>
> Javier Martínez:
> "control the execution of perl an python (between
> others) scripts (in the way of perl blablabla.pl, which does not need
> execution rights). You under this two frameworks you can do it. Can
> you do this under OpenBSD ;)"
>
> Thanks, just you put me on my way, if I really need a reliable system, that
> I
> can get NOW AND HERE :)
>
>