lkml.org 
[lkml]   [1999]   [Dec]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable Stack / Buffer Overflow Exploits...
On Thu, 30 Dec 1999, Horst von Brand wrote:

> But the problem would stay exactly the same with an outdated (or just not
> updated) Linux distribution.

That applies for every OS, if there isn't any maintenance done and bugs
keep being discovered, it will become insecure.
Just because in a few years the patch may not be so useful as it is now,
is no reason to include it.
Why bother porting to IA64 if we know the architecture will be obsolete in
10 years or so?

It's useful NOW, so let's include it NOW.

> I didn't say it doesn't. Just that I prefer to get a bind that is immune to
> this kind of attacks than cores all over the place and a bind that doesn't
> work because it is being probed from all over the planet.

This kernelpatch will not repair bind.
However, it will, when properly configured, give you warnings about
certain possible security issues in ANY userspace code run.
This is not a solution, but a tool to help control the results that may
occur due to a programming booboo.
Like I said before, try it out, see if you can outsmart it and then give
proper comments, don't start comparing things that don't relate to this
patch.

> Linus stated it _won't_ go into the kernel, because it just papers over
> bugs in userland code, and buys very little (if any) extra security, and
> moreover breaks legitimate programs.

I have a tremendous respect for Linus, but, he 's not the only person that
codes for linux.
He is human ( at least so I 've heard ;) he made a judgement based on his
personal interpretation of linux, the patch, the userbase opinion and
state of technologie at that moment.
If the world was a static place, his decision then shouldn't be
questioned, but it's not.
I have my owm mind and can think of my own, just because someone else has
an opinion I don't have to share it.
This is a discussion that should be based on current facts and emotions,
hiding behind someone elses decision without facts to back that decision
up isn't a valuable contribution in my opinion.

Regards,

---------------------------draw-conclusion-here------------------------
Homme R. Bitter *NIX admin, BOFH, MCSE, parttime divine entity.

(S) This signature is swingware, I let you use mine if you let me use
yours.....


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.065 / U:0.632 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site