Re: pf configuration

[Michael H Buselli <cosine_(_at_)_computer_(_dot_)_org>]

On Wed, 04 Sep 2002 15:36:00 +1000, Darren Reed wrote:

> It will take time for OpenSSH to build up the level of confidence in its
> security that it had at the start of the year and that is as it should be,
> a natural raction to the more recent events.  You cannot find fault in
> people for this.

I think it's not very smart of people to not pay enough attention to
OpenSSH to not know that privilege separation can save their ass, and
has already saved the asses of those using it in the past.

I understand that it takes time for people to build up confidence in
previously compromised network daemons, but to ignore the steps taken by
the developers to prevent future compromises will only result in them
using other software by vendors with less reputable secure programming
skills.  If those people haven't been hit by the school of hard knocks
yet, they will be.  Not a good move.

Most software vendors just get compromised again and again like the
great Energizer Bunny keeps going and going, but with regards to OpenBSD
and OpenSSH, 1) I've never heard of any other software vendor using
privilege separation before, and 2) the OpenBSD team has a better
reputation for security mindedness than anywhere else, and to me that
still far out weighs the recent vulnerabilities in just one of their
more complicated products which they had forked from another vendor's
code a while back, bringing whatever baggage that created with it.

Is there any other software out there that does privilege separation
where it makes sense?  Any of the big four MTAs?  BIND?  Apache?  They
all partake of pretty complicated encryption and authentication
activities these days, so why don't they separate their code on
platforms where it's possible and practical?  If any of them are doing
anything similar, I haven't heard of it.  If they are using privilege
separation, they should be bragging about it to the world right now
before the next IE/IIS vulnerability gives us all a good chuckle.

T\_/T\_/T
Michael H Buselli      http://www.cosine.org/      <cosine_(_at_)_computer_(_dot_)_org>
"Unix is very simple, but it takes a genius to understand the
 simplicity."                                           --Dennis Ritchie