3 ms·
Hmm... I would have to look to be sure, but having lived through it all, I seem to remember that all of the 2-3 OpenSSH security advisories that came out for Fr
by rsync 11y ago
Hmm... I would have to look to be sure, but having lived through it all, I seem to remember that all of the 2-3 OpenSSH security advisories that came out for FreeBSD in the last 10-12 years were either:
a) incredibly far fetched theoretical attacks that didn't work in almost 99% of live deployments
b) local privilege escalation that required a real unix login on the system to exploit
I think if you had left a FreeBSD 4.x system running on the public Internet all of these years you would have been untouched.
- tptacek 11y agoI've been doing FreeBSD security in particular since 1996, when I got the commit bit for discovering the crt0 environment overflow flaw, and all I can say is that this just isn't true. You don't even have to be a security specialist to know that there's something wrong with your argument, because you're talking about exactly the time period where OpenBSD --- which is more secure than FreeBSD --- comically started having to change its tagline from "no remote vulnerabilities in the default install" to "just one vulnerability in the default install" to "only two remote vulnerabilities in the default install for a heck of a long time". Even OpenBSD concedes it wasn't secure in 2003!