OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: ftpd bug in FreeBSD through at least 3.4
From: Nate Williams (nateyogotech.com)
Date: Mon Oct 02 2000 - 23:36:10 CDT

> Operating Systems like FreeBSD, lacking much in the way of backwards
> compatibility, must be babied through frequent upgrades with lots of
> skilled systems administration.

Huh? I've got FreeBSD 1.1 binaries running on boxes that are 6-7 years
old. I don't understand the issues about 'lacking backwards
compatability'. Just recently my 5 year old uemacs binary failed on
freefall because they (finally) deleted the shared libraries it used. I
could make it work by bringing in the libraries, but it was *easier*
just to upgrade to a newer binary.

> Commercial Unix vendors like Sun, on the other hand, only need to be
> upgraded every few years thanks to their extensive patch support.

*Yeah* Suffice it to say I disagree, since Sun boxes used on the
Internet *must* be upgraded to the latest/greatest version of SunOS if
you intend on being truly secure.

And, you end up having to roll your own versions of the software,
because too often the software on them is so out-dated and buggy that
it's easier to do it yourself than rely on Sun.

> Backwards compatibility is often maintained across several major
> revisions saving hundreds of hours of maintenance in some cases.

See above.

> We're still using some Sun binaries compiled 10 and 11 years ago!

If FreeBSD were that old, I could say the same thing. Give me a couple
of years. :)

> Think of how many times you've had to recompiled FreeBSD binaries in
> just the last couple of years.

If you're recompiling the binaries because you *had* to, then you're
misinformed. You get to recompile them, but you certainly dont' have
to.

Nate

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message