3 ms·
Not really. A FreeBSD 4.x system with a (modestly) stripped down kernel and running sshd was not only rock solid in 2003, but would probably be rock solid toda
by rsync 11y ago
Not really.
A FreeBSD 4.x system with a (modestly) stripped down kernel and running sshd was not only rock solid in 2003, but would probably be rock solid today.
Just to pick one random example.
- hueving 11y agoDoesn't sound like a random example to me. It sounds like one of the most secure examples you could think of.
- 9935c101ab17a66 11y agoHahaha, glad someone else noticed.
- tptacek 11y agoNo, FreeBSD 4.x from 2003 would not be "rock solid" today; it had kernel RCEs. Not to mention the ones in OpenSSH. Nothing was secure in 2003.
- rsync 11y agoHmm... I would have to look to be sure, but having lived through it all, I seem to remember that all of the 2-3 OpenSSH security advisories that came out for FreeBSD in the last 10-12 years were either: a) incredibly far fetched theoretical attacks that didn't work in almost 99% of live deployments b) local privilege escalation that required a real unix login on the system to exploit I think if you had left a FreeBSD 4.x system running on the public Internet all of these years you would have been untouched.
- tptacek 11y agoI've been doing FreeBSD security in particular since 1996, when I got the commit bit for discovering the crt0 environment overflow flaw, and all I can say is that this just isn't true. You don't even have to be a security specialist to know that there's something wrong with your argument, because you're talking about exactly the time period where OpenBSD --- which is more secure than FreeBSD --- comically started having to change its tagline from "no remote vulnerabilities in the default install" to "just one vulnerability in the default install" to "only two remote vulnerabilities in the default install for a heck of a long time". Even OpenBSD concedes it wasn't secure in 2003!