Re: [9fans] So What is P9 good for.....

[Geoff Collyer <geoff@collyer.net>]

> CERT still receives security problem reports for bind, sendmail, etc.,

As I commented to friends recently,

> I've just been looking at the security bugs fixed in the pre-release
> of freebsd 5.0 and it's dozens (maybe hundreds) of nasty bugs.  Worse,
> it's the usual suspects: buffer overflows, bugs in BIND and the DNS
> resolver, bugs in sendmail (inconceivable!).

It's twenty years on, and lunix distributions still include sendmail
and BIND, despite their size, slowness, complexity, buginess, painful
configuration files and long history of security bugs, usually due to
buffer overruns.  There are certainly plausible alternatives to
sendmail available.  I'm not sure about BIND, but I'd rather port dns
and whatever machinery it needs to Unix than deal with BIND again.
The stupidity of permitting (nay, encouraging) forward and reverse
maps to differ is bad enough, but it nibbles at you, with
manually-maintained zone serial numbers and trailings dots and just
endless crap.  (Of course, the DNS itself won't win any beauty
contests, but that's a harder problem.)

The first security measures I take when installing lunix are:

	- find any sendmail processes and kill them all.
	- find all sendmail binaries, set permissions to 0 and then remove them.
	- find any sendmail queue directories or configuration files and remove them.

What's wrong with these lunix people, are they stupid or something? ☺