Re: [gentoo-hardened] Updates: a way too simplified security question I am asking anyway

[Arne Morten Johansen]

Interesting points. But I don't think the hardened mailinglist is the 
right place to discuss general software-design, even if it's security 
related. But who am  I to say what's allowed here? :-)

My personal view is that software will always have bugs and security 
holes. That's why it's important to have multiple layers of security. If 
a program/package has a software bug that could lead to security issues 
it doesn't make the whole system unsafe. I think the hardened-project 
comes a long way to address this. It's never gonna be perfect but 
atleast it is IMO a very good start. Secure your services with good 
secure network design, educated users (this goes a long way), patched 
software, correctly and securely configured software, and lastly 
hardening technologies like the stuff gentoo-hardened provides.

Claiming that Linux-developers don't think about security is pretty 
unfair. Even if openbsd have had few remote exploits in its default 
install. There have been alot of remote exploits after you start adding 
usefull applications. An OS is nothing without its apps ;)

As for updates, just upgrade stuff with known holes? Limit the number of 
packages and the number of holes to fix won't be so big. I've also set 
up a glsa-check script to run on cron to e-mail me warnings. No need to 
do emerge -uavD world every week. But I do agree the patching arms-race 
is not optimal. But openBSD and other platforms suffers from the very 
same problem. I don't think we're gonna see a solution to that problem 
in the nearest future.

Probably not the educated answer you were looking for. I mainly wrote it 
for my self to see what i'd come up with. Hope someone else will answer to.

Arne Morten

Jan Klod skrev:
> Hello,
> some people in gentoo forum made me ask this one: it is supposed, that regular
> updates of system is a wise thing to do, but, excuse me, ... those bugs and
> holes are there before someone say "update them" -- so do you agree, nowdays
> Linux is never safe?
> OpenBSD has its own slogan about only very few remote holes in long time -- so
> it makes an impression, I can install an OpenBSD machine and let it do it's
> job.
> Can anyone crash my impression about OpenBSD (and is it still alive enough, by
> the way?)?
> How about hardened gentoo in this regard (create system for few, specific
> purposes and leave it for years without damn update hustle)?
>
> I realize, this is "in general", but the question is about software writing
> style (think when write it or wait for someone to find what is wrong) and
> ways to protect from bugs (like overflows etc) in software.
>
> In ideal world, updates are necessary only to get software, that has new
> functions -- do we seam to approach it?
>
> Jan
>
>