Re: libsafe and Debian installation
I assume you means it's the wrong way to increase security. I disagree
with you. libsafe and good code are 100% orthogonal issues. good code
is the security blanket, libsafe is the safety net. One should never
say "libsafe will catch it" as libsafe isn't perfect, but it provided a
safety net to those who either get hit before they can patch, or
actually get hit by the actual new attack.
Lets say one is an administrator of his own machine on a cable modem.
Lets say that person is in the middle of finals, or ends up in the
hospital and is unable to update his machine. Something like libsafe can
provide a real boost in security.
How many machines are hacked on a daily basis that libsafe could have
protected against (and in fact warn the administrator of the machine
that they have an insecure application). Any system administrator who
relies on libsafe alone to provide him protection, is a not so
intelligent system administrator, but any system administrator who
doesn't consider the pros (as well as the cons) of using libsafe is also
not doing his job. If the cons are too great for someone, i can accept
that they wont use it. But to say that there's a security reason not to
use it, to me seems like a very weak argument.
shaya
On Mon, 2002-04-22 at 17:20, Jeroen Dekkers wrote:
> On Mon, Apr 22, 2002 at 02:03:00PM -0400, Shaya Potter wrote:
> > why are you so anti libsafe?
>
> Because it's the wrong to increase security. You should increase
> security by learning how to code, not by using a library to provide
> workarounds for your mistakes. If you provide such a library,
> people get lazy and just think "libsafe will catch it". We should fix
> buffer overflows, not provide workarounds for it.
>
> Jeroen Dekkers
> --
> Jabber supporter - http://www.jabber.org Jabber ID: jdekkers@jabber.org
> Debian GNU supporter - http://www.debian.org http://www.gnu.org
> IRC: jeroen@openprojects
--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: