Date: Tue, 23 Apr 2002 11:56:46 -0700 From: Terry Lambert <tlambert2@mindspring.com> To: Robert Watson <rwatson@FreeBSD.org> Cc: Greg 'groggy' Lehey <grog@FreeBSD.org>, Jordan Hubbard <jkh@winston.freebsd.org>, Oscar Bonilla <obonilla@galileo.edu>, Anthony Schneider <aschneid@mail.slc.edu>, Mike Meyer <mwm-dated-1019955884.8b118e@mired.org>, hackers@FreeBSD.org Subject: Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?) Message-ID: <3CC5AE6E.9622AF93@mindspring.com> References: <Pine.NEB.3.96L.1020423141144.64976l-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Robert Watson wrote: > "System programming is hard, let's go shopping". This is exactly the phrase that comes to mind every time someone yanks the plug on a service they are afraid might one day have an exploit found for it. > Someone who's unaware or unwilling to address security issues will *still* > be safer if we provide a safer system. If they are going maliciously out > of their way, sure, there will be problems, but if they don't need telnet, > and we disable telnet by default, we have actually produced a safer system > for them. And if they do need telnet, it's easy to turn on. "Securing telnet is hard; let's turn it off and go shopping". 8-). > I think you've correctly identified an area where a lot of future security > work is needed. However, that doesn't negate the need for security work > in the base system, because without a secure base system, you're building > everything else on sand. If you have the time and resources to spend > helping to kick KDE and its related dependencies into shape, I welcome > your doing that. It's something I haven't had time to work with yet, but > have definite future plans to do. No one has *that* much time. Auditing that code base would be on the order of the difficulty of auditing Windows, and we have the source code the KDE. I agree that the base system needs to be secure, but I think you either trust your security model, or you don't: X11 *does* have a security model, even if it doesn't encrypt all the traffic over all its connections by default. If the security model is flawed, then it needs to be fixed, not turned off. I think it's a lot worse to leave a vulnerable telnetd turned off by default but available to be turned on, than to have one that's non-vulnerable turned on by default. The fear that someone is going to find a vulnerability should be balanced by the idea that someone is going to fix it, not balanced by the idea that that you can hide the vulnerability by not running the vulnerable code, "mostly". I guess this is a basica philosophical difference: IMO, exposure equals the probability of a fix. Turning things off belongs in the firewall code. FWIW: I wouldn't object to a firewall rule that disallowed remote TCP connections to the X server by default, if the firewall is enabled. I think we already have this... -- Terry To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3CC5AE6E.9622AF93>