Re: [inbox] Re: [Full-Disclosure] RE: Linux (in)security

[Paul Schmehl <pauls@utdallas.edu>]

--On Thursday, October 23, 2003 5:11 PM -0700 Dan Wilder <dan@ssc.com> 
wrote:
> Among those advisories you mention on the Linux sites, I see subjects
> including tomcat4, openssl, freesweep, marbles, gopher, sendmail,
> mah-jong, wu-ftpd, exim, perl, phpgroupware, mutt, qpopper, squirrelmail.
> And many more that are similar in that they've no relationship with
> the OS save being shipped with it.  Hardly *just* the Linux OS.  Some
> of those packages mentioned on the Debian site were begun long before
> there _was_ such a thing as Linux.
>
> Even if you classify things like XFRee86 and Samba as being part of the
> OS for purposes of comparing with Windows, which features much tighter
> coupling between the OS and some of its services than do the UNIX-like
> OSs, I believe you're going to be hard-pressed to come up with 47
> advisories against the OS.  Or anything remotely near that number.
Nor will you with Windows.  Look at the 47 bulletins for this year and 
you'll find things like Messenger, Internet Explorer, Outlook, Access, 
Content Management Server, ISA Server, etc., etc., none of which are part 
of the OS, despite MS's bs claims in court.

But *none* of this childish tit for tat is the point.  The point is that 
lots of software has significant, security related bugs, and the way 
software is taught and done obviously needs to change.  It's evident to an 
impartial observer that buffer overflows are a problem in almost 
*everyone's* software.  So something is wrong with the way software is 
"done", *not* with the end result, which is OSes and applications.

I've read here that it's not possible to write software that doesn't have 
flaws because programmers are human.  I think that's a crutch that allows 
us to accept less than the best.  There was an article in Fortune, back in 
March of this year, that refutes that.  I'll give you the URL, but you'd 
have to pay to read it. 
<http://www.fortune.com/fortune/imt/0,15704,427288,00.html>

The bottom line is that there is a company in Canada, QNX Software Systems, 
that writes an OS that simply does not fail and does not have bugs in it. 
Their website is here if you want to take a look:
<http://www.qnx.com/>.  Their software powers cars and laser surgery 
devices and it simply *cannot* fail, and so they make sure that it doesn't 
by doing it right the first time.

> Let's compare apples to apples, so to speak, if we're going to
> invest the effort in the first place, into making silly comparisons.
Do you really believe it matters what the exact numbers are?

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html