Subject: Re: Preventative security features?
To: None <firstname.lastname@example.org>
From: Dmitri Nikulin <email@example.com>
Date: 11/14/2004 10:42:39
Tim Kelly wrote:
>On Sat, 13 Nov 2004 20:29:12 +1100
>Dmitri Nikulin <firstname.lastname@example.org> wrote:
>These are mutually exclusive ideologies; it's a shame few people grasp
>this (I know you were being facetious).
But don't they both believe in God? That's kinda the point of the
phrase, to get a whole scope of monotheists. Or something.
Anyway that doesn't really matter :)
> Yes, it is fed into the system entropy pool.
Good, I was hoping NetBSD did it Right. Linux and (when you get the
out-of-tree-driver) FreeBSD just have it as a character device and a
userland daemon has to feed the pool from that. Terrible
misunderstanding of the point of the device.
> NetBSD's method was given high praise.
Weird, maybe nmap's algorithms just aren't right for this kind of thing.
I'm much more willing to believe nmap is broken than NetBSD. I mean,
nmap has flags to output everything in 13375p33k, it's hard to take that
seriously. I just happen to use it as an example so often since I don't
know any decent alternative.
Okay, features that still make sense after all discussion:
-Blackholing (even if only to save packet filtering efforts)
-User/pid walling (so is this actually PR'd by someone else already?)
> While security is always important, I admire (and learn greatly from)
NetBSD's clarity of code so I'd object to any attempts to reconcile
OpenBSD coding practices with NetBSD's at the expense of that clarity.
Who said anything about adopting coding practices? Some features are
good, but adopting code isn't the way. Absolutely right, NetBSD is
regarded as the single cleanest (code-wise and use-wise) free operating
system available, from which a lot can be learnt. Why exactly
universities insist on explaining Linux code is baffling.