The brk() vulnerability

The brk() vulnerability

Posted Dec 4, 2003 5:52 UTC (Thu) by brouhaha (subscriber, #1698)
In reply to: The brk() vulnerability by JoeBuck
Parent article: The brk() vulnerability

The problem with doing kernel maintainance in public is that the bad guys are watching.

The problem with doing kernel maintenance secretly (e.g., proprietary kernels such as that of Windows) is that it's a little harder for the bad guys to find exploits, but it's a lot harder (effectively impossbile) for the good guys to audit the code to discover and fix weaknesses before they are used for attacks.

Like any engineering decision, it is a tradeoff. Most people that don't have a vested interest in promoting proprietary software believe that the open development model results in better security. The studies Microsoft has funded that claim Linux security is worse reach that conclusion based purely on the number of advisories issued, ignoring the fact that the number of advisories is not a measure or even a good predictor of the number of remaining vulnerabilities in the software.

---

(Log in to post comments)