On Sun, Oct 17, 1999 at 11:13:53PM -0400, Jerry Alexandratos wrote:
> Hi, I'm currently using another BSD (it's the one that touts itself as
> the Ultra-Secure one).  Anyway, I'm looking to switch becuase I'm not
> quite happy with some of the attitudes around there.
> 
> I've used NetBSD in the past, and it looks like it's come a long way
> since then, so I'm hoping it'll be the alternative I'm looking for.
> 
> I'm hoping that some kind soul could take a few minutes to answer the
> following questions and write back to me (I'm not on these lists
> (yet?)).
> 
> 1. Has NetBSD done a security code review at some point in recent
>    history?  Yes, I know that they don't have anywhere as many reports
>    on Bugtraq as NT, but the security weenies at work are gonna try and
>    nail me on this one.

We've done a security code review that I'd argue is at least as extensive
as the one "another BSD" did -- Matt Green personally read just about all
of the userland code after I did a grep-through for buffer overrun type
problems.  AFAICT, "another BSD" likes to rant and rave about how they
periodically review code, but they often just use 'grep'.  Matt's very
modest so he probably will not go into this much detail.

It is worth note that in their haste to integrate "cool security 
features!!!" "another BSD" has a history of *introducing* serious new
security holes.  Oops...!

I would further suggest that our approach to operating system 
development -- driven by strong architectural concerns, with a
substantial distaste for halfway solutions to hard problems, with
a decided preference for compact, elegant solutions over flashy
new features we can brag about -- is inherently more likely to
provide you with a secure base you can build secure systems from.

I am in the network security business.  Unless the client has a
very strong preference otherwise (and sometimes even then, because
sometimes the client's needs end up _requiring_ NetBSD) my systems
run NetBSD.

> 2. Will the recently imported KAME stuff provide IPSEC for IPv4?

I have not poersonally tried this but from an inspection of the code 
and documentation it certainly looks like it should work.

> 3. I noticed that there's a project to incorporate userland PPP.  How's
>    that going?  Anyone want a willing tester?

Why do you want this?  It's inherently far less efficient than 
in-kernel PPP, which AFAICT works just fine.

Making the FreeBSD userland PPP work on NetBSD takes about half an 
hour, if you really feel the need to use it.

> 4. Soft Updates?  I know that there was some work to integrate it.  Did
>    it ever get integrated?

There's a CVS branch for this but I don't see anyone working on it at
the moment.  One reason may be that we have a working version of LFS
in our tree, which provides the same benefits as "soft updates" and
many more as well.  This works nicely in -current -- some ports can
even boot from it -- due to some excellent work by Konrad Schroeder.

> 5. Is the Xircom CreditCard 10/100 CE-10/100 multilink card supported?

Don't know, sorry!  Support for CardBus was just committed (though it
looks like it may need a week or two to stabilize) so there's certainly
more choice out there for 100baseT network cards for your laptop than
there used to be!