On Tue, 25 Apr 2006 17:14:20 CDT, Paul Schmehl said:
I also have a policy that I avoid software that has a poor security
track record. So, I don't use Internet Explorer - on any platform - and
I don't use sendmail - on any platform. The first thing I do, when I
set up a FreeBSD box is uninstall sendmail and install Postfix. It's
not that I like Postfix more. It's that Postfix has had very few
vulnerabilities in it, and sendmail has them routinely. It tells me
that the programmers writing the former understand security better than
the programmers writing the latter. It's nothing personal. They both
do a job that needs to be done. One makes me worry less.
There's another very important factor to consider - the black hats will
want to invest for the best cost/benefit ratio. There's a very real
possibility that Sendmail has programmers that are *just* as interested
in security as the Postfix crew, but more bugs are found in Sendmail because
finding a Sendmail bug can get you 80% of the Unixoid boxes out there, and
Postfix will only snag you 5% or so (or whatever the exact ratio is).
Real life example:
For a long time, IE was being routinely exploited, and there were almost no
holes found in Mozilla/Firefox. Now that enough people run Firefox to make it
worth trying to exploit, holes are being found. Is this saying that the
Firefox crew used to be interested in security, and have given up, or is it
saying that they've always had the same level of concern, but holes are present
in *any* large package, and they're being found more because more people are
looking?
pgpxk0Z2Hyw09.pgp
Description: PGP signature
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
