Slashdot Mirror
Solar Designer on Openwall
Demonfly writes to tell us that Solar Designer, who some would argue is one of the more respected security experts on the net, took the time to answer a few questions about the future of Openwall, the security enhanced GNU/Linux distro. From the interview: "There's real demand specifically for security-enhanced Linux systems. Linux is widespread, it has good hardware support, there's a lot of software available for it (including some commercial packages), and there are system administrators with specific Linux skills. Of course, OpenBSD and other *BSDs have their user bases, too - and people are working on the security of those systems. No, Linux (the kernel) is not a better choice than *BSDs security-wise. But it is not substantially worse either."
I think that SELinux has the potential to be a more secure kernel than many of the *BSDs.
The more you know, the less you understand.
"No, Linux (the kernel) is not a better choice than *BSDs security-wise. But it is not substantially worse either.""
Damming with faint praise, are we?
The title of this news item had me thinking it was some kind of cool new transparent solar cell for houses or something. That'd be pretty cool. Too bad it's just about Linux...
Hexy - a strategy game for iPhone/iPod Touch
The real question is: When are you going to release a set of patches for Linux 2.6?
/tmp /proc
The openwall patches for 2.4 do the following three really useful things. Hardware compatibility is pushing me to 2.6 but I'd sure like to have the patches:
Non-executable stack (defeats most buffer-overflow attacks)
Restricted links and fifos in
Restricted
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
I seem to recall reading that SDF -had- Linux, in a past life,
but - after an intrusion - -now- use NetBSD or the like.
They'd surely have something useful to say about Linux v BSD
security.
Does anybody know any of their admin's of the times to ask?
FYI: sdf.lonestar.org is a long-time "free" Shell provider
(I have NO pecuniary interest in their organisation)
I seem to recall reading that SDF -had- Linux, in a past life, but - after an intrusion - -now- use NetBSD or the like.
Talk about convoluted punctuation. Try to write more with words rather than symbols:
I seem to recall reading that SDF used Linux in a past life, but now uses NetBSD (or the like) after an intrusion.
Not that your post (or that sentence) is flawless beyond that, it's just over-punctuating seems to be spreading among poor writers; dashes in particular are popular. I'm just fighting the good fight to stop it.
It is because of this that other projects were allowed to flourish, namely the grsec jumbo patch. I think most people for the last several years have pretty much abandoned using (or even thinking of using) the openwall set of patches when other more feature-rich, updated patches exist and have existed for many years now.
I seem to recall reading that SDF -had- Linux, in a past life,
but - after an intrusion - -now- use NetBSD or the like.
Correct. After numerous break-ins while running Linux, SDF switched to NetBSD and hasn't had their site compromised since. But that really doesn't prove much. It is obviously just anecdotal evidence and shouldn't be viewed as anything more. NetBSD worked better for SDF, OSX works better for some and believe it or not, Windows works better for others. So what.
He has something to sell. He can't sell it if he admits that Linux security is perfect.
The non-executable stack is in 2.6.xx already. It's activated for normal executables that have been compiled with a recent compiler.
/tmp, you can now use the unshare() system call with CLONE_NEWNS to give every user their own private /tmp. You can also just restrict /tmp via an LSM (Linux Security Module, like SE Linux or RSBAC)
/proc with an LSM too.
Rather than restricting
You can restrict
Perhaps you need to brush up on your reading skills. See, the netziens have adopted several different ways to show tonal emphesis via a text-only medium, usually by surrounding a given word or phrase with asterisks, underscores, or in some cases, dashes.
Combine that with the fact that the dash is perfectly acceptable punctuation - it is used in a similar manner as a comma, except that it provides more emphesis - and it is perfectly clear what the GP meant.
It's your servers, stupid.
FTP, HTTP, NTP... these are where intruders are going to come at you. The BEST security measure is really, really good code. Stuff like electricfence, W^X, and SSP (aka ProPolice) can only compliment poorly written code.
"I had a lot of breakins on OpenBSD so I switched to Windows instead."
While such an example might indeed be true, it is entirely non-representative of fact. I.e the root password was "god" and after switching to Windows, the machine was moved onto an isolated LAN segment.
While in general it is true that OpenBSD is normally found to be rather secure out of the box and the opposite is true for Windows, it is largely decided by the skills of the person(s) managing the server.
"I had a lot of breakins on Linux, so I switched to Linux."
Hmm, that would be because I simply omitted the distro brand. I have found very secure Linux machines and daily-compromised NetBSD machines.
Blind arrogance is dissatisfying.