4 ms·

I know why they use RHEL - support is apparently good and not every corpo wants to keep some linux experts on payroll to fix the rare issues that need a bit mor

by ilyt 3y ago

I know why they use RHEL - support is apparently good and not every corpo wants to keep some linux experts on payroll to fix the rare issues that need a bit more expertise. And they keep old versiond of Red Hat updated for longer so you old crusty enterprise garbage can stay garbage few years longer and claim "but OS is updated" in audit. I have no idea who in their right mind would use derivative, it has zero benefits and is just build worse than vanilla Debian.

cyberpunk 3y ago
Funny; our RHEL systems were a nightmare for compliance actually. Most of the tools the auditor/pentester type people use only search for, (completely fake example) libfoo 1.x.2 having a security hole, and redhat's libfoo 1.x.2-wibble13 even though it has a backported fix, is flagged as vulnerable. For each one of these packages, it's a crazy process to prove that the CVE they reported isn't actually there, and it delays our accreditation to the point where it was easier for us to change distro than go thorough hundreds of these..
- NovemberWhiskey 3y ago
  t.b.h. all this tells me is that your pentesters are bad.
  - cyberpunk 3y ago
    Bingo. We don't get to choose them, though, and they hold the strings on the certifications that our business needs. Sometimes it's easier to bend.
    - attentive 3y ago
      If they make a claim that some package has CVE and you can demonstrate that to be false as per official distro changelogs etc they can go hike.
      - _ea1k 3y ago
        The problem is that if they don't fix the tool, you'll get to tell them that every week (or however often they scan). Dealing with bad security audits isn't fun.
    - bonzini 3y ago
      You used to pay Red Hat, did you try passing them the hot potato?
  - mshook 3y ago
    Pretty much but that's my experience as well, I made the same comment above...
- jabl 3y ago
  Perhaps auditing tools should do something better than just comparing version numbers as released by upstream? Maybe Ubuntu LTS does less security backports than RHEL, but that doesn't make it better per se (saying this as an Ubuntu user).

by ilyt 3y ago

cyberpunk 3y ago

Funny; our RHEL systems were a nightmare for compliance actually. Most of the tools the auditor/pentester type people use only search for, (completely fake example) libfoo 1.x.2 having a security hole, and redhat's libfoo 1.x.2-wibble13 even though it has a backported fix, is flagged as vulnerable. For each one of these packages, it's a crazy process to prove that the CVE they reported isn't actually there, and it delays our accreditation to the point where it was easier for us to change distro than go thorough hundreds of these..

NovemberWhiskey 3y ago
t.b.h. all this tells me is that your pentesters are bad.
- cyberpunk 3y ago
  Bingo. We don't get to choose them, though, and they hold the strings on the certifications that our business needs. Sometimes it's easier to bend.
  - attentive 3y ago
    If they make a claim that some package has CVE and you can demonstrate that to be false as per official distro changelogs etc they can go hike.
    - _ea1k 3y ago
      The problem is that if they don't fix the tool, you'll get to tell them that every week (or however often they scan). Dealing with bad security audits isn't fun.
  - bonzini 3y ago
    You used to pay Red Hat, did you try passing them the hot potato?
- mshook 3y ago
  Pretty much but that's my experience as well, I made the same comment above...
jabl 3y ago
Perhaps auditing tools should do something better than just comparing version numbers as released by upstream? Maybe Ubuntu LTS does less security backports than RHEL, but that doesn't make it better per se (saying this as an Ubuntu user).