On Tue, 25 Apr 2006 17:14:20 CDT, Paul Schmehl said: > I also have a policy that I avoid software that has a poor security > track record. So, I don't use Internet Explorer - on any platform - and > I don't use sendmail - on any platform. The first thing I do, when I > set up a FreeBSD box is uninstall sendmail and install Postfix. It's > not that I like Postfix more. It's that Postfix has had very few > vulnerabilities in it, and sendmail has them routinely. It tells me > that the programmers writing the former understand security better than > the programmers writing the latter. It's nothing personal. They both > do a job that needs to be done. One makes me worry less. There's another very important factor to consider - the black hats will want to invest for the best cost/benefit ratio. There's a very real possibility that Sendmail has programmers that are *just* as interested in security as the Postfix crew, but more bugs are found in Sendmail because finding a Sendmail bug can get you 80% of the Unixoid boxes out there, and Postfix will only snag you 5% or so (or whatever the exact ratio is). Real life example: For a long time, IE was being routinely exploited, and there were almost no holes found in Mozilla/Firefox. Now that enough people run Firefox to make it worth trying to exploit, holes are being found. Is this saying that the Firefox crew used to be interested in security, and have given up, or is it saying that they've always had the same level of concern, but holes are present in *any* large package, and they're being found more because more people are looking?
Attachment:
pgp2cB6iE5B5b.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/