Debian Struggling With Security

Masq666 wrote to mention a ZDNet article discussing difficulties Debian is having with security updates. From the article: "...Lack of manpower also appears to be adding to Debian's security woes. Michael Stone, another member of Debian's security team, expressed his frustration to the organisation's security e-mail mailing list in mid-June, saying there was no effective tracking of security problems."

Comments

Solution is obvious, move to Windows

[VisualVoice]

They have a huge team focusing on security.

Re:Solution is obvious, move to Windows

[sharkey]

They have a huge team focusing on security.

Too bad none of them work at Microsoft :(

Pick any two

[mcrbids]

Secure, Convenient, Cheap.

Pick any two.

(General rule, but it does generally follow)

Re:Pick any two

[diamondsw]

Or pick Windows and get none!

Re:Pick any two

[HawkingMattress]

Yep but it doesn't apply here. Debian can be secure, convenient and cheap. It could probably be more secure and less convenient but still it is generally a very secure distro... and it's certainly cheap and convenient too
The problem is not that you can't mix those three in debian particular setting, it's that the debian team seems to serverely lack redundancy. Read: one person has obligations somewhere else and the whole stable security updates process hangs !
I really hope that Debian is going to make something about it fast, and in a definitive way. I don't want to run something else than debian, really. But this is really embarassing, especially if you have production servers running sarge. And this situation ain't new, Slashdot was very slow to catch it but i read about it last week. Things haven't moved a lot since (well 1 security update was released, but some major exploits have been found in iirc at least two other packages, and nothing coming yet... Other distros had everything fixed by the end of last month)

I think Debian should clarify the issue, and call for help if it's necessary. And maybe simplify the whole debian democratic process if as it seems from the outside every decision has to go through days and days of pointless discussion.

Re:Pick any two

[GNUALMAFUERTE]

Slackware is secure.
Slackware is convenient (I Know that many will say otherwise, but if you have Unix experience, it's the best solution, really easy to manage)-
It's cheap, it doesn't contain any proprietary software.

Also, Debian can be as safe as Slackware, the problem with this kind of Distro (Debian) is that the people using it pretends that someone else takes care of their security. A Sysadmin doesn't need some stupid organization to submit patches to him automatically or anything like that. He just has to download and compile all of the critical services of his system, and update them when necesary. Anyone that says otherwise is an Amateur, not a Sysadmin, and if he's an amateur, he shoudln't be running any system bigger than he can manage, and he shoudln't run any critical services, and for the kind of things that an amateur should host the kind of security provided by allmost any Unix system is more than enough. The problem with all this shit is that there are lots of amateurs out there calling themselves sysadmins ...

simple solution

[Geekboy(Wizard)]

$ apt-get update security-officer

Problem Solved.

(Its funny. Laugh.)

Re:simple solution

[goofyheadedpunk]

If you actually have to tell us it's funny, is it really?

Re:simple solution

[Anonymous Coward]

That was so stupid I unlaughed and sucked the happiness from the room.

there was no effective tracking of security probl

[frovingslosh]

there was no effective tracking of security problems

Now that this has been published on /. it will have to be revised to "no effective tracking of security problems by the good guys".

How the mighty have fallen...

[Gorath99]

Disturbing to see how the distro that was always renowned for its reliability is now having such troubles.

I wish the debian team all the luck in the world in fixing this matter. They're in a difficult position now that they're both lagging behind (though much less so than a while back) and cannot claim unparalleled reliability.

Re:How the mighty have fallen...

[Ingolfke]

I wish the debian team all the luck

I think this is probably part of the problem... too many people are wishing them luck and not enough people are actually doing anything to address the problem.

Re:How the mighty have fallen...

[tacocat]

It would be a hell of a lot easier if they only supported X86 architecture like all those other Distros you refer to as the ones to lag behind.

I think what they really suffer from, and I am not expert, is politics of a large system and the perception of lots of power sitting on top. I could be wrong.

Regardless of what anyone might want to say against Debian, I still believe that they are extremely good at what they do and don't get credit for it. There is no other distro out there that attempts to support as many architectures as effectively (or at all) and if Debian decided to just delete them all except X86/X86-64 then their job would be a hell of a lot easier to execute.

Re:How the mighty have fallen...

[dmaxwell]

Supporting arches that span the gamet of bitness and endianness shakes out bugs and bad assumptions that can be hard to find otherwise. These fixes get pushed upstream whenever possible. So Debian is raising the water for a heck of a lot of boats. Until the great license blowup, Debian's X-Strike Force was also a major reason why XFree86 ran on so many platforms. The bit and endian issues THERE are a bitch.

It might be better in some respects if Debian were x86 only like everybody else but we would all be poorer for it.

Now If This Was Microsoft...

[Anonymous Coward]

The tone of the story would be laden with arrogance and derision towards the "Borg", painfully unfunny and unoriginal jokes would follow, and everyone would point to Apple and Linux as the greatest and secure OSes on the planet.

But since it's not Microsoft, it's a fairly sober writeup, and Microsoft jokes would just follow a little bit later.

Funny how things work here at slashdot. no i'm not new here. I'd just figure some people would grow up sooner or later.

Re:Now If This Was Microsoft...

[Brandybuck]

I'd just figure some people would grow up sooner or later.

Oh we do indeed grow up. Unfortunately Slashdot has an unending supply of new posters straight out of kindergarten who have no problems at all firmly believing in the rightness of double standards and the logic of conflicting axioms.

Re:Now If This Was Microsoft...

[DogDude]

Linux is supposed to be an enterprise-class secure, stable operating system regardless of whether it's being sold, given away or traded for cheezy knobs. Or so I've heard around here.

Come with me... I have a bridge to sell you...

Re:Now If This Was Microsoft...

[Ernesto Alvarez]

You've got to admit there is a fundamental difference that would also cause that change of attitudes.

Debian security guys tend to have an attitude of trying to do things right. You're talking about the same people that chose to stop everything when they were compromised last year (and that was two days before a woody revision release). It's no surprise that people think of them as a good team without the necesary resources that need help. After all, they appear to do what they can with whatever resources they've got.

Microsoft, however, is known for turning a blind eye to big problems, trusting no one will find out and trying to NDA the hell out of everyone. Considering people pay big $$$ to them, and they do play dumb more often than they should, guess what the attitude toward them would be.

MS has been doing things a little better lately, but years of treating security like they did in the '90s aren't forgotten that easily.

I like Debian, and really hope they can solve their staff shortage. I wouldn't like them to go under because of this.

Boring jobs

[ignorant_coward]

It isn't any suprise that the boring and the mundane tasks fall short in manpower.

This is why there needs to be more commercial involvement in FOSS, so that people who just want a day job and a paycheck can do these sorts of things.

Re:Boring jobs

[SirSlud]

I understand what you're trying to say with your sig, but when you're as smug as you seem to be, you lose the priviledge of calling somebody else on their biases.

That out of the way, capitalism is about capitalizing labour; that is, putting people together that create more value than if they worked seperately. That is the fundamental reason why we CAN sell things; we're able to capitalize labour and create things for less cost than would be born upon people if everybody created said thing individually.

Statements like your are grossly off the mark. BSD licenses, any other open source licenses that allow you to use the source but not have to open up your own, have helped many a person make money. What folks like you fail to realize is that you use the term open source as if its a catch all for anybody creating software for free. In fact, irony of ironies, the patent system was designed to FORCE your methods and secrets in the open in return for protection from the government. So who's being anticapitalist now? The very tennants of innovation in capitalism are strongly tied to having people share information. The anti-capitalist yahoo's of whom you speak simply have a much broader, more historically acturate understanding of the balance between technological progress and motivation to innovate. I'm not against selling stuff, I'm not against capitalism, I'm simply suggesting that once the fear dies down in a decade or so, and code itself becomes more commoditized, it will be in the interest of those who wanna make a shit load of money to patent software based on the source, not a description of what the thing does.

Look at early patents; its not what you can do, its HOW you do it. Its the means, not the end. Nobody could patent the generation of electricity; only METHODs for generating electriciy. I predict that at the rate of current software patent filing, litigation will become too expensive for the market versus the costs of opening up source in order to protect your invention. I guess thats ironic, given people's fear of open source licenses.

Re:I ditched debian over the weekend

[Zemplar]

Switch to Solaris 10. Even in the very unlikley event you hose your system, just reboot from your last "live upgrade" partition and your back into production.

Too many packages?

[slavemowgli]

It's just a random thought, but have the Debian people ever contemplated whether their problems in this regard may stem from the fact that they have too many packages? The package list for the latest stable lists an incredible 16834 individual packages, and even though there are many programs which come in different flavours and thus contribute as more than one package, this still is a huge number.

I can certainly see why security management gets a problem here. Maybe the Debian project should cut down on these and see just how many packages are really needed.

Re:Too many packages?

[sneakers563]

I wonder whether it's that, combined with the effort required to backport security fixes to versions that are often (let's face it) several years old. I'm not trying to start a flamewar, but I'm curious, why does backporting a security fix make for a more "stable" program then simply embracing a new version of the software that's been fixed upstream? It seems like the upstream people would do a better job anyway, as they are presumably more familiar with the software to begin with. Or is it when the Debian people say "stable", they mean a stable feature set and not necessarily stable security-wise?

Re:Too many packages?

[Chmarr]

Well, it works for the OpenBSD people... OpenBSD is the most secure system out of the box because the box is really small, and it's hard to get it open :)

My karma is now really, really shot.

Re:Too many packages?

[jpc]

It is certainly the case that many upstream maintainers really dont care about old versions of their software (and if different distros are using different old versions so much the worse). The problem is if it is something that other packages depend on and you end up in a hell of many twisty interfaces all different.

I wouldnt support packages in stable that cannot guarantee to keep their interfaces stable for a reasonable period. They could be available as addons with no guarantees of secutity fixes.

I think the situation is a bit better than it was as interfaces in things like gnome stabilise and people work out how to manage very big very distributed projects like that.

Re:Too many packages?

[arivanov]

That is not the problem. Problem is elsewhere.

Redhat supports x86, x86_64, i64 and some power and zSeries stuff. Compared to that Debian supports Alpha, ARM, HP PA-RISC, Intel x86, Intel IA-64, Motorola 680x0, MIPS, MIPS (DEC), PowerPC, IBM S/390, SPARC. It also has the outrageously silly policy of trying to release updates for all of them at the same time.

Frankly, all the "problematic" architectures for which there are build problems are "security through obscurity" by themselves. If an update for them is delayed by up to 2 weeks it is usually a "Who cares, only two living people know how to write an exploit for this platform anyway".

Re:Too many packages?

[lakeland]

Consider a situation where a server has been set up and is running well in a company. That server has been working for several years, and while it may not have whiz-bang features, it keeps working every day just as well as it did the day before -- nothing ever breaks.

Now, if a security issue is discovered in a package running on that machine, they do not want to upgrade to the latest release because they would worry about what it changes -- they want that one issue fixed and everything else to continue the same as before. Debian Stable is designed for people like this, the joke at the end of your post was actually close to the truth -- people really do want debian stable to be stable feature wise.

Consider another situation, where somebody wants a fairly reliable and a fairly up-to-date server. When a bug is discovered, and especially security-related bugs, they'd like an updated package. On the other hand, they don't want to be sent the latest buggy software, they'd like it restricted to software that appears pretty stable. Debian Testing is designed for people like this.

It sounds from your post that you cannot imagine people preferring a quirky, somewhat old, consistant distro over one kept up to date with bug fixes. I assure you that there is a large market for the stable distro, but if you are not in that market, there are plenty of others available.

Re:Too many packages?

[cperciva]

Is FreeBSD having the same problems, or are they handling the situation, or are they just ignoring it?

The FreeBSD base system is supported quite well, although we have had occasional manpower problems (e.g., when one member of the security team is travelling around Japan on work, one member is writing his doctoral thesis, another member is job-hunting, et cetera).

The FreeBSD ports tree is supported on a "best effort" basis -- we make no guarantees, but we do our best.

Re:Too many packages?

[babbage]

Or is it when the Debian people say "stable", they mean a stable feature set and not necessarily stable security-wise?

I think that's precisely it.

I just left a job where all the Linux machines were running Debian Stable [Woody], unless there was a specific requirement for something else (e.g. a commercial application that wouldn't run reliably on anything but RHEL).

Everything was buggy as hell, but the admins were okay with this, because it was "stable". Desktop applications had thorougly well documented bugs or feature omissions that had been corrected upstream years ago, but if it wasn't available in stable (or maybe in backports.org, then an upgrade was strictly out of the question.

Therefore, I was constantly explaining to new people why CUPS crashed all the time, or why getting Gaim to connect to the Jabber server was such a convoluted process, or why we couldn't run Thunderbird or Firefox because the standard builds required a newer version of libc than what was locally available. Etc. Ad nauseam.

The logic for Debian stable comes really close to making sense, without ever quite working. You should be able to install the current Debian stable on a system, deploy it, and aside from occasional security patches, it'll always maintain the same state it was in the day you deployed it.... warts and all. And that's the catch -- there's lots of grimy old warts in a lot of the packages that had upstream fixes months or even years ago, but none of this is available to you unless you're willing to [a] build your own packages (and forego the wonder that is apt-get), or [b] upgrade to Testing or Unstable (and abandon the promise of stability & consistency, which isn't without merit).

Debian Stable is a great idea. It's disappointing that the reality of living with Debian doesn't live up to the naive promise of that idea. I can see where it's just the thing for a server that you want to set up and then ignore for a nice, long, mostly reliable decade, but for anything that you plan to put on your desk and have to cope with from day to day, it's just painful to live with.

Re:Too many packages?

[arivanov]

Nope.

It is outrageously silly.

Ever tried to write shellcode for Alpha? It was even thought to be impossible for more then 5 years until someone published a way to do some limited borderline cases in 2000.

Ever tried to write shellcode for 680xx? Same as above, even harder due to the protection model vagaries.

Basically these arches use a different protection model and instruction encoding from x86. Both of these make writing shellcode nearly impossible.

So on, so fourth.

hobbyist OS?

[OffTheLip]

Not to start a flamewar (well maybe a little) - OSS will need to meet the challenge of managing all of the little details of a widely acceted OS. Red Hat is grapling with that problem now with some suceess. Having what you believe to be a better widget is not enough.

Bits of News

[Masq666]

I originally posted this on http://bitsofnews.com/ but decided to post it on Slashdot also. It's a bit sad though that Debian is struggling with it's security updates, Debian used to be a nice distro but i've changed to Suse myself due to the lack og updates.

Current issues

[cortana]

http://newraff.debian.org/~joeyh/stable-security.h tml is an incomplete list of issues currently affecting stable. It's not 100% correct; in addition to the provisos at the top of the page, it doesn't seem to know about recent updates such as this morning's Gaim update.

Re:The most secure option

[Metteyya]

Actually, being American on Sahara (and whole muslim-dominated north Africa) makes you pretty prone to physical attacks :).

Re:Let it go Louie

[Ingolfke]

Ah yes, it sounds like Debian has followed Gentoo and BSD down the bath to oblivion.

Security support is ill-suited to open source

[cperciva]

Woah! Wait a moment before you start flaming me on the basis of my subject line...

The problem of providing security support is ill-suited to being solved by the traditional "mob of volunteers" approach which describes most open source development. When you're doing development, it doesn't matter if you have five people coding one week and nobody doing any coding the next week; but when it comes to dealing with a constant stream of security issues which are being reported (in particular, from upstream vendors), it is important to guarantee that there will be someone around to deal with them. When the entire security team consists of people who have other full-time jobs, it's impossible to make sure that someone will be around when they are needed.

The job of "security officer" is really one which should be a job, not a role-played-by-a-volunteer. Go out and raise some money to pay for your security officer, so that he is able to always be available when he is needed, because if he needs to get some other job to support himself, he won't be around when you need him.

Re:Debian alternatives?

[Just Some Guy]

I'm also in the moved-to-Gentoo camp, although I also use FreeBSD in a lot of places (including several desktops). I guess I like the extra configurability of source-based systems over binary Linux distros.

For example, Debian currently lets me choose between "openssh-client" version 4.1p1-4, or "ssh-krb5" version 3.8.1p1-8; I have to pick between a recent version or Kerberos support.

I still like Debian and its derivatives, but I decided that it imposed constraints that I was not personally willing to work under.

Don't even get me started on the unavailability of X.org and KDE 3.4. Although there's nothing about source-based system that makes them inherently more up-to-date, it seems like the big names (FreeBSD and Gentoo) seem to do a better job of it than the binary distros have been able to manage. Perhaps there's something to be said for supporting a relatively small number of hardware platforms. Gentoo even supports platform-specific versioning, so x86 users can play with the latest and greatest apps, even if they don't build on m68k.

To each his own, of course. Those are the reasons I made my decision, but I'm sure they're far from universal.

*BSD.

[MrDomino]

All of the BSDs currently have excellent package-management systems that can elegantly handle both binary and source packages. pkgsrc in particular is a really nice system---further, it has the advantage of not being tied to one OS. Although it is developed primarily for NetBSD, it can be used from any of the other BSDs, Linux, several Unices, and even Windows (with Internix, i.e. Windows Services for Unix).

In fact, it's definitely worth checking NetBSD out; the 2.x line has been really interesting, and development is continuing to move forward at a rapid pace. If you're on a single-processor system, it's arguably one of the best-performing OSes available at the moment, and it in general will work. Add that to the fact that you could probably port it to your toaster if you were dedicated enough, and it's worth giving serious consideration to as an alternative to Debian, or indeed anything else.

Re:Is unstable possibly better?

[kaarlov]

I don't know about recent issues, but for last year or even two years of Woody being stable version, there were many security problems in Woody which were resolved very slowly or not at all, while the unstable was usually fixed in reasonable time.

Of course, unstable is what it says. You get new features, different behavior and even broken software all the time. Not very good thing in production enviroment. And right now there's some major changes going on in the unstable (C++ ABI and Xorg transition) and I would be extremely cautios using it. But if the release of Etch takes as long as Sarge, the unstable will be the way to go again in 2007 at the latest.

Re:Close: Switch to OS X

[cwalker]

I thought that this sub-thread was so stupid that it was not worthy of a response but this list of incredible flaws in Linux that are supposedly fixed in OS X or Windows is so ridiculous, I just had to respond.
1. More secure? Not true. All Operating Systems have problems, closed sources Operating Systems have more problems than others becuase there are fewer people viewing and fixing the bugs and other problems. An Operating System's security depends greatly on the configuration and administration not that is is created or modified by a certain company.
2. Not true either. Speed depends on configuration and administration. Mac's are tuned for certain things where Linux can be tuned in any cofiguration you so desire.
3. More advanced or aged only because it is running a version of FreeBSD which is so close to linux how can you call it anything but *NIX?
4. Built for idiots that rather the computer maintain control. I, on the otherhand, like to control my computer.
5. Linux is backed by many successful companies such as IBM, Novell, Redhat, etc., etc as well as a world of seasoned programmers.
6. See above. Open source programming does not mean amateurs. Most of the open source programmers are seasoned vets that work full time for large companies.
7. Most of OS X is open source because it is Free BSD. Note the "Free" part of that. (see http://www.freebsd.org/copyright/copyright.html)
7. (you probably meant 8 right?) See above statements. OS X is mostly FreeBSD which means they do not own the code. The GUI, they own, but so what. The kernel is still UNIX!

If the list goes on I would like to see it because this preliminary list is bogus.

Re:Let it go Louie

[say]

Bullshit. All the technically sweet linux distributions out there which use apt are more or less resting on debian's shoulders. If you watch the security changelogs - or the regular changelogs - of ubuntu packages, you'll see that nine out of ten get made by debian, adapted to ubuntu and thrown to the ubuntu servers. Some are just renamed to "-ubuntu" and passed on. And a very few are actually maintained by ubuntu themselves.

We can't move on. Much of the linux community depends on a well-functioning debian organization. They are lacking man-power to keep their security updates as fast as the multi-employee-distributions. That doesn't mean they're technically behind, and that we have something better to move to. Although the commercial distros would love that.

your not only a coward, but an..

[Halvy]

asshat as well.

if linux users got what they paid for, they'd get nothing, you.. you..you bill hates follower.

I'd rather pay nothing, take that money and either put it towards a hardware router for security (just plug it in).. or save that money for something else fun..and set up a linux software firewall/router (easy, just point&click).

If people didn't have windoz forced on them when they buy in major oulets, they would get used to linux quicker.

at least with linux, when you put the effort into fixing it the way you want (note: linux at least has that option!), then we have a functional & hardened box.

I hope I didn't use tooo many big words there, mr coward :)

Re:Let it go Louie

[WryCoder]

To say nothing of the fact that Ubuntu raided many key developers from Debian, which is now left scraping for help. Ubuntu is slightly repackaging the work of the real packagers, the Debian people, and calling it a new distro. It's basically a hostile fork, and we are the worse for it.

A lot of assumptions for a page and a half article

[atokata]

The article didn't go quite as in depth as I would have liked. Specifically, the Debian apt repositories have literally, and you may quote me, zillions* of packages. I'm fairly certain they have quite a few more than, say, Red Hat has binary packages in their repositories.

Therefore, it would follow that if 4% of Debian packages had security vulnerabilities that would equate to a substantially greater number of packages than would the same 4% of Red Hat packages.

The other important thing to keep in mind is that it's unlikely many users would install all zillion packages at one time.

Finally, the article implies Debian and Red Hat are in competition. However, as literate geeks will know, Debian is the OS of "Software in the Public Interest" http://www.spi-inc.org/about which is a non-profit entity. Therefore, while one could argue that Red Hat (a for-profit enterprise) and Debian are in competition for userbase, by no means are they in direct competition for 'business'.



*Debian website says "over 15490." Which begs the question, how many more than 15490? 15491?

Re:Debian alternatives?

[Halvy]

i notice noone responded to your question *yet* so i'll give me .02 worth.

nothing *compares*, but you have to compare apples with apples.

and since debian is well, only debian, i can only add that Synaptic (graphical front end) for apt-get is alot easier to use when you want to install or change alot of programs.

I also notice quite a few of the *other* distros are implementing apt-get/synaptic with their releases, in addition to whatever else they would normaly have as default (ie urpmi, Kpackage, etc). :)

Re:Close: Switch to OS X

[CyberDave]

OS X is mostly FreeBSD which means they do not own the code. The GUI, they own, but so what. The kernel is still UNIX!

No, not really. The kernel is Apple's own creation (Xnu, I think they call it, but I'm not positive on that). As I recall, it's a Mach-derived kernel. The user-space is all FreeBSD-based, but the core microkernel is not.

And Apple owns more than just the GUI. They own the APIs, too. You know, CoreFoundation, Cocoa, Carbon, all those fancy things that allow Mac developers to quickly and easily make all those wonderful programs.

Mac OS X is far, far more than simply FreeBSD with a proprietary window server...

parent Flamebait

[Britz]

Parent post is a flamebait and I wonder what moderators are smoking today.
Debian is much more than a distribution. And there is unfortunately nothing better than Debian (as in the distro) to move on to. There is a reason why many distributions are build on Debian.
Please point me to a distro that can manage version upgrades even half as gracefully as Debian.
There was a discussion about Ubuntu on Slashdot and it was argued that if Ubuntu continues to be diverge further from sid and stay incompatible it will eventually dissolve, because the team will never be able to support the huge package base.

I am a desktop Linux user that started out with Debian 2.1 Slink and I also have the feeling that Debian has had some major issues lately.

About the security issue:
Heise security published it first 10 days ago:
http://www.heise.de/newsticker/meldung/61076

As a result of this a discussion on the Debian security mailing list ensued:
http://lists.debian.org/debian-security/2005/06/ms g00142.html

Heise Online then reported on that as a result of that discussion:
http://www.heise.de/newsticker/meldung/61125

For those that can't read German the article says that of the five members that should make up the security team four are not active at the moment if they ever were. The only remain one is Martin Schulze aka Joey. He has been pretty busy with the organisation of the Linuxtag. So he was cut off from the action. Debian people are working on the problem.

Everyone that is not satiesfied with the current state of affairs should get their hand dirty helping instead of complaining. After all Debian forms the bases of "plenty of well-managed, technically sweet linux distributions out there".

Like Knoppis, Ubuntu or Xandros. Full list here:
http://www.debian.org/misc/children-distros

Here's why your wrong

[bogie]

"When the entire security team consists of people who have other full-time jobs, it's impossible to make sure that someone will be around when they are needed."

Your wrongly basing your entire arguement on the idea that OSS programmer(s)=loner(s) with other "real" jobs. That is simply not the case for many OSS projects. Commercial OSS companies like Red Hat, Suse/Novell, et al are and have been the driving force in OSS for some time now. Look at any big distro, any major software project etc and at this point chances are they are being bankrolled and supported by commercial copanies that are paying people to work on them and deal with things like security issues. And if a popular project has a security flaw that an author won't address, and distros won't fix because its not part of their distro...well you know the deal, use the source luke.

I see what your trying to say but again your arguement is flawed as "traditional" OSS development no longer means unpaid and non-commercial. I don't think that the people buying Red Hat linux and getting security support for years and years would share the same viewpoint. And I also don't think that commercial companies put more into security than OSS programmers do. History just doesn't show that.

For version .002 for widget X that isn't widely used and gets abandoned for lack of interest and now has a security issue, how is that different than in the commercial world? At least with OSS someone/anyone can fix the problem. With commercial software you literally have to stop using the software because no fix will ever come.

OSS is particulary well suited to dealing with security issues IMHO and the problems it has with security are more or less the same problems that commercial software makers face. Your floating down a well known river in Egypt if you think that in the commercial world all projects have people who are paid to soley to work on security.

Re:Close: Switch to OS X

[westlake]

1 ...closed sources Operating Systems have more problems than others becuase there are fewer people viewing and fixing the bugs and other problems...

The lead post is titled "Debian Struggling With Security," in part because the Debian team is short-handed.
There are 200 or so Linux distros. But Open Source doesn't magically endow you with the organization, money and manpower needed to maintain any one of them.

4. Built for idiots that rather the computer maintain control. I, on the otherhand, like to control my computer.

George Eastman had a slogan: "You click the button, we do the rest." Once a technology becomes accessible to the masses, the hobbyist and his obsessions are driven to the margins. Calling your opponents idiots doesn't change a damn thing.

Re:Is unstable possibly better?

[poopdeville]

Yes, there are times when Unstable gets fixed faster than Stable. The way the whole Stable/Testing/Unstable thing works is that a package maintainer submits a package to Debian. It is placed in unstable. If it survives two weeks there, it is moved to testing. Eventually, there is a freeze and all of testing becomes stable. Now, if a bug is found in a testing package, a new package is submitted to Debian to replace it. So it ends up in Unstable for two weeks. Packages can be fast tracked from Unstable to Testing if the issue is severe.

Regarding whether Unstable got a fix at the same time as Gentoo, that depends on whether or not the package maintainer is following the source as closely as Gentoo. In theory, there should be no difference.

Re:Close: Switch to OS X

[cwalker]

This has been fun. I have frequented the forums for a while now and have never really posted anything other than brief comments here and there but this one I thought I would go at it full board. Thanks for replies and you are all right. My response has been short and to the point with many technicalities left out because it was a spur of the moment post. That's what makes this fun and able to enjoy everyone elses take on matters.
As far as OS X being FreeBSD is absurd and I should have stated that more correctly in that it is derived from FreeBSD. It is as close to FreeBSD as Linux is to UNIX as well as OS X is UNIX.
Stating that open source is just plain more secure is an obvious over-simplification. But the fact is that open source applications, especially the Linux kernel has a better chance of being more secure with more eyes on the code world-wide.
For somone to call Windows and Mac users my opponents is funny as well. I dont have opponents in the computer world. I support all of them. I have built fairly complex web server environments on both Linux and Windows. I have had to support Mac users in a graphics environment and have enjoyed it all. I like to express opinions as well as listen to them. And when I said "idiots" it meant that an entirely graphical Operating System to me and to most SysAdmins is a limitation more than a benefit. If you are a user of the operating system it is better through and through. In other words, at times, GUI OSes are "idiot proof" not that only idiots use them. In fact, I want to buy a Mac for my own personal use but I cant afford one for one.
In the end, my statements were just as short and rash as the original statement.
I am sure you have already read this but check this out as well http://www.apple.com/macosx/features/unix/

Also, take a look at this especially under the heading "BSD": http://www.kernelthread.com/mac/osx/arch_xnu.html

Thanks.

Zdnet: do some fact checking next time

[joey]

I think it's indicative of the quality of this zdnet article that it attributes a page I maintain to Martin Schulze. More details in my blog entry, here:

http://kitenet.net/~joey/blog/entry/secfud-2005-07 -06-11-28.html