Re: [gentoo-hardened] Updates: a way too simplified security question I am asking anyway

["Javier Martínez" <tazok.id0@gmail.com>]

Well, first bugs are always there, maybe the unique difference between
this two OS is that OpenBSD have found more of them (maybe), this does
not means that OpenBSD is free of bugs, it stills having them be sure
of this, if this statement is not true why they are still making
auditories to their code if there are not bugs?.

This is not an ideal world, software is written by humans so since
humans are not perfect, software is not perfect too, bugs will exist
forever, the only thing developers can do is searching for them,
nothing more.

Do you want something to be safe?, first make your system a B1 one
(orange book), configure rsbac/Selinux to do so, configure PaX, make
an trusted path execution to avoid execution of untrusted software
(exploits) and then control the execution of perl an python (between
others) scripts (in the way of perl blablabla.pl, which does not need
execution rights). You under this two frameworks you can do it. Can
you do this under OpenBSD ;).

2008/8/20, Jan Klod <janklodvan@gmail.com>:
> Hello,
> some people in gentoo forum made me ask this one: it is supposed, that
> regular
> updates of system is a wise thing to do, but, excuse me, ... those bugs and
> holes are there before someone say "update them" -- so do you agree, nowdays
> Linux is never safe?
> OpenBSD has its own slogan about only very few remote holes in long time --
> so
> it makes an impression, I can install an OpenBSD machine and let it do it's
> job.
> Can anyone crash my impression about OpenBSD (and is it still alive enough,
> by
> the way?)?
> How about hardened gentoo in this regard (create system for few, specific
> purposes and leave it for years without damn update hustle)?
>
> I realize, this is "in general", but the question is about software writing
> style (think when write it or wait for someone to find what is wrong) and
> ways to protect from bugs (like overflows etc) in software.
>
> In ideal world, updates are necessary only to get software, that has new
> functions -- do we seam to approach it?
>
> Jan
>
>