View from the Trenches: Hitchhiker's Guide to a Bug Fix

 in
A plea not to panic the next time a bug fix or security alert hits the newsgroups.
______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Re: View from the Trenches: Hitchhiker's Guide to a Bug Fix

Anonymous's picture

Exactly. Anyone who uses Linux for any length of time learns the importance of a high quality package management system. Debian provides dpkg and apt. Life is good. Once that functionality is in place, patching is no worse than any other update and dependancy management.

My pet peave is spinmeisters who point at security advisories and turn logic on its head by saying that a high patch rate is a BadThing(tm). When I first got into IT someone told me there are two promises that a salesman can make with confidence, "Software has bugs, and hardware breaks". Well, seeing as how bugs are inevitable, then what really counts is the timeliness of discovery, and speed with which a patch comes out. After that, it's just business (package management) as usual.

Not True

Anonymous's picture

Once Linux get's BSD like randome position independent compiled code (RedHat is doing this I think) then 99% of all exploits will be gone.

And if the distros would just run all their code through Valgrind they'd save themselves a lot of bug fixes later as well.

If those two things happened we'd see OpenBSD level security in Linux.

i sort of disagree

florin's picture

99% of all exploits will be gone
I wish i could agree. Yes, the remote root exploits will be made much more difficult. But it will be a statistical thing: the correct entry points in certain code segments will be randomized. That doesn't mean it will be impossible to exploit a code and get remote root. It just means it will be a lot harder (orders of magnitude).

This will not prevent classic DoS, i mean remotely crashing the service. The remote root will not work, but the attacker may still be able to crash that particular service.

But anyway, i'm not saying it's worthless. It's still a valuable protection, it's just not panacea.

P.S.: Yes, Red Hat appears to be the first distro to deliver this thing. Their next release (scheduled for launch this month) will include this kind of protection. I can barely sit still while waiting for it... :-)

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState