3 ms·

Out of curiosity, does OpenBSD have anywhere near this many security issues?

by asdf21 7y ago

CameronNemo 7y ago
There is no definitive way of knowing how many security issues are present in a piece of software or a collection of software. You can only look at history and attitudes for a project (and perhaps other factors such as language used) and extrapolate from there.
- thrwaway6318 7y ago
  >and perhaps other factors such as language used) and extrapolate from there. I'm curious about this statement. Which languages do you think indicate greater security, which ones tend to indicate the opposite?
  - CameronNemo 7y ago
    Languages with a garbage collector will be able to avoid some of the worst memory errors.
    - asveikau 7y ago
      Usually people say it's bounds checking and preventing use after free rather than GC. It's possible to have both without GC.
- tracker1 7y ago
  Maybe security issues is overly broad... but poor configuration choices related to security is obviously the context here.
anfilt 7y ago
The short answer is no, and generally will be no. OpenBSD seems to take security more seriously than freeBSD. However, knowing what bugs exist or other issues that effect security is hard. Let alone comparing.
- todd8 7y ago
  > knowing what bugs exist or other issues that effect security is hard I agree. For example, according to [1]: "In the autumn of 2004, [Dan] Bernstein taught a [University of Chicago graduate level] course about computer software security, titled "UNIX Security Holes". The sixteen members of the class discovered 91 new UNIX security holes. Bernstein, long a promoter of the idea that full disclosure is the best method to promote software security and founder of the securesoftware mailing list, publicly announced 44 of them with sample exploit code." This was 15 years ago, but it does reveal just how hard it is to know how many vulnerabilities are out there. [1] https://upclosed.com/people/daniel-j-bernstein/ https://upclosed.com/people/daniel-j-bernstein/

Out of curiosity, does OpenBSD have anywhere near this many security issues?

by asdf21 7y ago

Out of curiosity, does OpenBSD have anywhere near this many security issues?

There is no definitive way of knowing how many security issues are present in a piece of software or a collection of software. You can only look at history and attitudes for a project (and perhaps other factors such as language used) and extrapolate from there.

thrwaway6318 7y ago
>and perhaps other factors such as language used) and extrapolate from there. I'm curious about this statement. Which languages do you think indicate greater security, which ones tend to indicate the opposite?
- CameronNemo 7y ago
  Languages with a garbage collector will be able to avoid some of the worst memory errors.
  - asveikau 7y ago
    Usually people say it's bounds checking and preventing use after free rather than GC. It's possible to have both without GC.
tracker1 7y ago
Maybe security issues is overly broad... but poor configuration choices related to security is obviously the context here.

anfilt 7y ago

The short answer is no, and generally will be no. OpenBSD seems to take security more seriously than freeBSD. However, knowing what bugs exist or other issues that effect security is hard. Let alone comparing.

todd8 7y ago
> knowing what bugs exist or other issues that effect security is hard I agree. For example, according to [1]: "In the autumn of 2004, [Dan] Bernstein taught a [University of Chicago graduate level] course about computer software security, titled "UNIX Security Holes". The sixteen members of the class discovered 91 new UNIX security holes. Bernstein, long a promoter of the idea that full disclosure is the best method to promote software security and founder of the securesoftware mailing list, publicly announced 44 of them with sample exploit code." This was 15 years ago, but it does reveal just how hard it is to know how many vulnerabilities are out there. [1] https://upclosed.com/people/daniel-j-bernstein/ https://upclosed.com/people/daniel-j-bernstein/