Full Disclosure mailing list archives
Re: What is wrong with schools these days?
From: Valdis.Kletnieks () vt edu
Date: Tue, 25 Apr 2006 21:14:04 -0400
On Tue, 25 Apr 2006 17:14:20 CDT, Paul Schmehl said:
I also have a policy that I avoid software that has a poor security track record. So, I don't use Internet Explorer - on any platform - and I don't use sendmail - on any platform. The first thing I do, when I set up a FreeBSD box is uninstall sendmail and install Postfix. It's not that I like Postfix more. It's that Postfix has had very few vulnerabilities in it, and sendmail has them routinely. It tells me that the programmers writing the former understand security better than the programmers writing the latter. It's nothing personal. They both do a job that needs to be done. One makes me worry less.
There's another very important factor to consider - the black hats will want to invest for the best cost/benefit ratio. There's a very real possibility that Sendmail has programmers that are *just* as interested in security as the Postfix crew, but more bugs are found in Sendmail because finding a Sendmail bug can get you 80% of the Unixoid boxes out there, and Postfix will only snag you 5% or so (or whatever the exact ratio is). Real life example: For a long time, IE was being routinely exploited, and there were almost no holes found in Mozilla/Firefox. Now that enough people run Firefox to make it worth trying to exploit, holes are being found. Is this saying that the Firefox crew used to be interested in security, and have given up, or is it saying that they've always had the same level of concern, but holes are present in *any* large package, and they're being found more because more people are looking?
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: What is wrong with schools these days?, (continued)
- Re: What is wrong with schools these days? CrYpTiC MauleR (Apr 24)
- Re: What is wrong with schools these days? Dave Alanis (Apr 24)
- Re: What is wrong with schools these days? ipatches (Apr 24)
- Re: What is wrong with schools these days? CrYpTiC MauleR (Apr 24)
- Re: What is wrong with schools these days? bart.lansing (Apr 25)
- Re: What is wrong with schools these days? Bipin Gautam (Apr 25)
- RE: What is wrong with schools these days? Bill Stout (Apr 25)
- Re: What is wrong with schools these days? Michael Holstein (Apr 25)
- Re: What is wrong with schools these days? Valdis . Kletnieks (Apr 25)
- Re: What is wrong with schools these days? Paul Schmehl (Apr 25)
- Re: What is wrong with schools these days? Valdis . Kletnieks (Apr 25)
- Re: What is wrong with schools these days? bkfsec (Apr 25)
- RE: What is wrong with schools these days? Bill Stout (Apr 25)
- Re: What is wrong with schools these days? Dave Alanis (Apr 25)
- Re: What is wrong with schools these days? CrYpTiC MauleR (Apr 25)
- Re: What is wrong with schools these days? CrYpTiC MauleR (Apr 25)