OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Bernstein's License
From: haywardslothmud.org
Date: Mon Jul 24 2000 - 09:45:24 CDT

>Note that StackGuarding something which has no buffer overflows is not
>really necessary; does your product StackGuard everything, including
>thoroughly audited code?

I have looked at the qmail website many times and I haven't found any
guarantees that it has no overflows or security issues. Though I did see
him discuss confidence in the design - and the thought that if a problem
is found, it is very unlikely to be exploitable.

I think stackguard's goal is to prevent "unknown" buffer overflows. I
know I don't have the time to personally audit every piece of software I
have, but I probably do have the time to recompile it.

I personally don't like his license either. More than anything, it just
lets him keep control of everything related to the project. Including the
ability to stop distribution and make it commercial, thus killing
open source development on the project because it can't be feasibly
maintained anymore.

I won't go into reasons why, it is well documented here:
http://www.opensource.org/osd.html 

--
Brian