[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Getting Off the Patch



On Thu, 20 Jan 2011 13:06:16 +1100, Pete Smith said:
> Can anyone seriously say that they patch every time Cisco releases a new
> version of IOS?

Running the latest-and-greatest IOS in production is pretty much a sign that
you're not a very large network provider, or don't intend on staying a large
network provider.

IOS is generally acknowledged to be a steaming morass of bugs, so most sane
users of Cisco gear will find a version that provides most of the features they
need and the least number of SLA-invoking issues, stick with it, and pray.  By
the time you fight through all the "this version won't boot on a 6509 with a
SUP2, and this other version will boot with a SUP2 but won't do MPLS to a 
Juniper at
the other end unless the line card is between EC levels x and y, except if you
turn on IPv6, in which case you need to be between EC levels y and z *and* have
at least 32M more space available on the itty-bitty flash card and an
additional 64M of RAM if you have a full BGP feed, but 4M additional RAM if you
don't", your eyes are glazed over and you're actually glad when you see that
a security fix is only shipping on the T train and not the S train, so you have 
a
legitimate reason to not try to get it to run on your S-train boxes....

(You think I'm kidding? Look at the thread starting here:
http://www.mail-archive.com/cisco-nsp@xxxxxxxxxxxxxxx/msg29241.html

Attachment: pgpgnPO7t2Ai3.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/