Re: [gentoo-hardened] Updates: a way too simplified security question I am asking anyway

[Jan Klod <janklodvan@gmail.com>]

On Wednesday 20 August 2008 22:31:30 RB wrote:
> On Wed, Aug 20, 2008 at 12:14 PM, Jan Klod <janklodvan@gmail.com> wrote:
> <snip rambling flame>
No problem, we can cut it. 

> I'm not going to address each of the fallacies I see in your
> statements, but you have an exceedingly idealistic view of software
> development and particular OS' perceived security.  [Insert project
> here] may have a slogan, but the developers are still human and thus
> still make mistakes and are inherently lazy.  Short of being powered
> by unicorn farts, there is no way any reasonably complex system can
> approach that ideal.
[sorry, as you see, writing what I don't know much about]
In this light I was assuming, that file server is much less complex than it 
is. Give you my word to remember this when I write my next code :)

>
> In regard to your philosophy of updates, do you build a wall and not
> defend it?  Do you plant a garden and not water it?  In the same
> light, no system can be "permanently" secured.  Safes are rated by the
> amount of time it would take a dedicated, skilled cracker to open it;
> none are ever deemed uncrackable.  If you want more time, you purchase
> [or build] one that better matches your needs.  System security is no
> different.
Complexity matter again... Theoretically.. is it possible to enumerate all the 
possible scenarios for a file server? (or, I might have wrote - all of its 
states) Oh, sure, it has finite amount of memory :)
Human problem. 
Is easy to say "security", hard to give an action for all the possibilities 
(right action by our judgement)...

I started this as a "flame", but the rest might go out of scope of this list 
and send me to theoretical computer science.

Javier Martínez: 
"control the execution of perl an python (between
others) scripts (in the way of perl blablabla.pl, which does not need
execution rights). You under this two frameworks you can do it. Can
you do this under OpenBSD ;)"

Thanks, just you put me on my way, if I really need a reliable system, that I 
can get NOW AND HERE :)