4 ms·

Are you sure it has no remote vulns since it's been discontinued or did I just prove Poe's law?

by qb45 9y ago

wahern 9y ago
I think that's called security by obsolescence. Not sure how well that actually works. Root kits don't just disappear and FreeBSD 4.1 isn't as obscure as, say, VMS. But as long as there are no remote vulnerabilities it's probably no worse than a typical Linux install, in the sense that both would be trivially rootable once you get your foot in the door.
- 5ilv3r 9y ago
  Usually with BSD you can apply new patches to old systems without any trouble. No need to upgrade everything.
  - wahern 9y ago
    Maybe FreeBSD is different, but I've run OpenBSD for 17 years and this is definitely not the case for all BSDs. Because OpenBSD is a cohesive system they're not afraid to do aggressive refactors. Which means subsystems can change drastically within just a few release cycles, meaning you can quickly lose the benefit of further fixes. For example, just today Theo announced that he's staging the removal of TIOCSTI, the perilous ioctl that allows injecting data into a process group TTY. It's a huge break with historical BSD. That means if there's a TIOCSTI exploit found next year (say, in the NetBSD or FreeBSD code) that effects OpenBSD 6.0, there won't be an OpenBSD fix to backport; you'll have to craft one yourself and maintain it going forward. NetBSD imported Lua 5.1 (IIRC, or maybe Lua 5.2) into their base, then in later releases upgraded it to Lua 5.3. the difference between Lua 5.1 and Lua 5.3 is like the difference between Python 2 and 3. Plus, Lua 5.1 is completely unmaintained at this point. If you're on an unsupported NetBSD release don't expect any fixes coming down the pipe for Lua 5.1. But I admit that FreeBSD is definitely not OpenBSD, for better and worse, in terms of the pace of major refactoring work.

4 ms·

Are you sure it has no remote vulns since it's been discontinued or did I just prove Poe's law?

by qb45 9y ago

Are you sure it has no remote vulns since it's been discontinued or did I just prove Poe's law?

wahern 9y ago
I think that's called security by obsolescence. Not sure how well that actually works. Root kits don't just disappear and FreeBSD 4.1 isn't as obscure as, say, VMS. But as long as there are no remote vulnerabilities it's probably no worse than a typical Linux install, in the sense that both would be trivially rootable once you get your foot in the door.
- 5ilv3r 9y ago
  Usually with BSD you can apply new patches to old systems without any trouble. No need to upgrade everything.
  - wahern 9y ago
    Maybe FreeBSD is different, but I've run OpenBSD for 17 years and this is definitely not the case for all BSDs. Because OpenBSD is a cohesive system they're not afraid to do aggressive refactors. Which means subsystems can change drastically within just a few release cycles, meaning you can quickly lose the benefit of further fixes. For example, just today Theo announced that he's staging the removal of TIOCSTI, the perilous ioctl that allows injecting data into a process group TTY. It's a huge break with historical BSD. That means if there's a TIOCSTI exploit found next year (say, in the NetBSD or FreeBSD code) that effects OpenBSD 6.0, there won't be an OpenBSD fix to backport; you'll have to craft one yourself and maintain it going forward. NetBSD imported Lua 5.1 (IIRC, or maybe Lua 5.2) into their base, then in later releases upgraded it to Lua 5.3. the difference between Lua 5.1 and Lua 5.3 is like the difference between Python 2 and 3. Plus, Lua 5.1 is completely unmaintained at this point. If you're on an unsupported NetBSD release don't expect any fixes coming down the pipe for Lua 5.1. But I admit that FreeBSD is definitely not OpenBSD, for better and worse, in terms of the pace of major refactoring work.