Re: SANS Top Ten and Commercial Firewalls

["Paul D. Robertson" <proberts () patriot net>]

On Thu, 3 Oct 2002, Anton A. Chuvakin wrote:

> > proftpd, vsftpd, pureftpd
> > ...
> > Postfix/Qmail
> > ...
>
> Is there any evidence that helps decide whether its more secure because
> its written better or because its used less?

(A) Project history- Postfix and Qmail have held up well, proftpd erm, 
hasn't.  I haven't followed the other two, since FTP is on my list of "Horribly 
broken protocols I'll never support."

(B) Look at the code.

(C) Developer history.

(D) Developer's understanding of the protocol and its weaknesses.

It's worth factoring in frequency of attack as well as tool prevalence.

HTH,

Paul 
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts () patriot net      which may have no basis whatsoever in fact."
probertson () trusecure com Director of Risk Assessment TruSecure Corporation

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards