> > Enabling a world-wide auto-update feature does indeed seem much of a
> > security risk to me.
> >
> More of a risk than up2date for RedHat or emerge -u system for Gentoo? Or
> cvsup for *BSD?
Yes. These systems are voluntary. The structure of UNIX systems, and updates
makes it much easier to test and update and less likely to kill a system
even if it is flawed. Updating user space applications in Red Hat, other
then SSH causes me essentially no nervousness. If Apache bombs out I can
trivially roll it back to an older version, or if it's totally screwed up
remove, and replace (and not lose my config files either since most RPM
packages are designed to protect old/original config files). I cannot
selectively install say 90% of Service Pack 4 in Windows 2000, it's pretty
much all or nothing. In Red Hat (and Linux/BSD in general) there are no
roll up security fixes (exceptions being appliance vendors, but those are
much more tightly bound environments and less likely to suffer update
related problems).
To put it bluntly:
Compare the number of times MS has had to re-release patches/updates or
additional fixes because it kills/breaks something vs.s. the number of times
Red Hat or SuSE does.
P.S. even if MS does solve most of these issues they still have painted
themselves into a corner due to their rather insane file locking which
requires a reboot in virtually every circumstance you want to replace
important files.
> Paul Schmehl (pauls (at) utdallas (dot) edu [email concealed])
Kurt Seifried, kurt (at) seifried (dot) org [email concealed]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/
> > security risk to me.
> >
> More of a risk than up2date for RedHat or emerge -u system for Gentoo? Or
> cvsup for *BSD?
Yes. These systems are voluntary. The structure of UNIX systems, and updates
makes it much easier to test and update and less likely to kill a system
even if it is flawed. Updating user space applications in Red Hat, other
then SSH causes me essentially no nervousness. If Apache bombs out I can
trivially roll it back to an older version, or if it's totally screwed up
remove, and replace (and not lose my config files either since most RPM
packages are designed to protect old/original config files). I cannot
selectively install say 90% of Service Pack 4 in Windows 2000, it's pretty
much all or nothing. In Red Hat (and Linux/BSD in general) there are no
roll up security fixes (exceptions being appliance vendors, but those are
much more tightly bound environments and less likely to suffer update
related problems).
To put it bluntly:
Compare the number of times MS has had to re-release patches/updates or
additional fixes because it kills/breaks something vs.s. the number of times
Red Hat or SuSE does.
P.S. even if MS does solve most of these issues they still have painted
themselves into a corner due to their rather insane file locking which
requires a reboot in virtually every circumstance you want to replace
important files.
> Paul Schmehl (pauls (at) utdallas (dot) edu [email concealed])
Kurt Seifried, kurt (at) seifried (dot) org [email concealed]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/
[ reply ]