2 ms·

You realize there are several fortune 500 companies whose products are based on FreeBSD, right? The same cannot be said for netbsd or dragonfly. To call FreeBS

by tw04 9y ago

You realize there are several fortune 500 companies whose products are based on FreeBSD, right? The same cannot be said for netbsd or dragonfly. To call FreeBSD a "hobbyist OS" shows a distinct ignorance of the market.

kbenson 9y ago
Are you contending that those products often run unvetted code? There's a world of difference between the likelihood of these problems being exploited on a servers that aren't shared, routers, small internet devices, and IoT devices compared to shared hosting environments, end user systems (whether they be mobile or desktop) and cloud/virtual server services. Of the latter, I'm o ly aware of FreeBSD being used in any frequency for shared hosting, and even that is relatively rare. FreeBSD just doesn't have the same exploit exposure as the others. But Google compute cloud, AWS, windows, MacOS, and Linux (including Android) definitely are ripe for exploitation.
- tw04 9y ago
  What do you mean "run unvetted code" - when you've got network facing service, there WILL be remote exploits available. This bug can then be used for privilege escalation. Your understanding of the FreeBSD user base and it being "relatively rare" is so far off base I'm not sure what to tell you. For starters I'd be willing to bet the number of Juniper switches and routers in the wild number in the tens of thousands and they all run FreeBSD. EMC has several storage products. There are multiple firewall vendors. NetApp has several storage products. Etc. etc. etc. Almost all of which are exposed to multiple users, and while some may be behind a firewall, that's little comfort for targeted attacks...
  - kbenson 9y ago
    This isn't about FreeBSD not getting a fix, it's about not getting advance notice. If to be exploited you require a remote unprivileged exploit first, I think you are at least an order of magnitude, if not multiple, less likely to be exploited than a cloud vps provider or desktop user that is downloading and running programs from non upstream sources. I mean, should OpenBSD have received advance notice? What about QNX? What about all those embedded POS system providers? FreeBSD accounts for a very small percentage of high risk systems, and I think that explains this.

by tw04 9y ago

kbenson 9y ago

Are you contending that those products often run unvetted code? There's a world of difference between the likelihood of these problems being exploited on a servers that aren't shared, routers, small internet devices, and IoT devices compared to shared hosting environments, end user systems (whether they be mobile or desktop) and cloud/virtual server services. Of the latter, I'm o ly aware of FreeBSD being used in any frequency for shared hosting, and even that is relatively rare. FreeBSD just doesn't have the same exploit exposure as the others. But Google compute cloud, AWS, windows, MacOS, and Linux (including Android) definitely are ripe for exploitation.

tw04 9y ago
What do you mean "run unvetted code" - when you've got network facing service, there WILL be remote exploits available. This bug can then be used for privilege escalation. Your understanding of the FreeBSD user base and it being "relatively rare" is so far off base I'm not sure what to tell you. For starters I'd be willing to bet the number of Juniper switches and routers in the wild number in the tens of thousands and they all run FreeBSD. EMC has several storage products. There are multiple firewall vendors. NetApp has several storage products. Etc. etc. etc. Almost all of which are exposed to multiple users, and while some may be behind a firewall, that's little comfort for targeted attacks...
- kbenson 9y ago
  This isn't about FreeBSD not getting a fix, it's about not getting advance notice. If to be exploited you require a remote unprivileged exploit first, I think you are at least an order of magnitude, if not multiple, less likely to be exploited than a cloud vps provider or desktop user that is downloading and running programs from non upstream sources. I mean, should OpenBSD have received advance notice? What about QNX? What about all those embedded POS system providers? FreeBSD accounts for a very small percentage of high risk systems, and I think that explains this.