On Friday 18 November 2005 21:54, Les Mikesell wrote:
> The black hat activities can only
> exploit existing bugs and adding new code that no one understands may
> not be the way to reduce bugs.
No, it may not be a reduction in the net number of bugs. I'll not argue that
point. I will say that I do think the base premise of one superuser is a
Wrong Thing, and I think properly implemented roles and mandatory access
controls are the right direction for adding yet another layer.
If I have a flat tire, and have five patches to fix the tire, but each patch
has a hole in it, the likelihood is that if I apply all five patches the
holes won't line up and I can make it home on the tire. Yes, it is possible
that all five holes will line up; but it is less likely than with one patch
on the tire. And all the patches have holes; there is always one more bug in
every program, regardless of age and experience.
> If you are starting from scratch building a new service you can do
> that. If you've inherited 30 years worth of existing stuff that
> relies on permissions being what the filesystem says they are, then
> you are going to be spending an enormous amount of time trying to
> fix something that wasn't broken.
And this is the sort of thing the Fedora and Red Hat developers are doing now.
This is why RHEL has a targeted and not a blanket enforcing policy. No, it
is not perfect. Neither are the other security features in recent Red Hat
releases, some of which interacted badly with some programs I use daily
(CrossOver Office, for one, didn't like execshield, but it was Wine that was
broken, not execshield).
> It's no fun arguing with someone who is being reasonable...
Judging from some others' replies, not all share your opinion; that's ok. I
try to be reasonable, but I also tend to expect others to be reasonable, and
tend to get nervy with those who are unreasonable. And I am not always
successful at being reasonable (just ask my kids). :-)
> But compare
> this to a few years back when distributions added ssh because of its
> security advantages over telnet - and in doing so introduced the means
> that many systems, including some of mine, were exploited using bugs
> in the new code. Following someone else's advice about best practices
> doesn't always make your system more secure, even when the theory
> sounds right.
In theory, there is no difference between theory and practice. In practice,
there is.
I wasn't impacted by the ssh holes, since I had two more layers above that
preventing any ssh sessions from untrusted IP's. Of course, I patched when
the patches came out, because I know that no firewall is perfect. But the
holes don't usually line up.
Layers, layers, layers. Winter is coming upon us, and the advice is always to
dress in layers. Sound advice, both for clothing and for security. The
Internet Blizzard of malware is upon us; weather the storm with layers.
Yeah, that woolen union suit might itch, but it sure is warm.
--
Lamar Owen
Director of Information Technology
Pisgah Astronomical Research Institute
1 PARI Drive
Rosman, NC 28772
(828)862-5554
www.pari.edu
