LWN: Comments on "The Apache vulnerability, full disclosure, and monocultures"

it's not a problem of the monoculture at all

DeletedUser2254 — 2002-06-25T19:06:24+00:00

What if you do have e.g. 5 open source implementations of web servers
that all take about 20% of the server installations?

in terms of the LWN argue it would be safer to drive like this,
but they are on error. when you do have 5 web servers then you
have 5 mostly different codebases, 5 times the places where
vulnerabilities might waiting to compromise the community.

its simply a problem of having enough developers, code reviewers
and lab tests plus the usual out in the wild "tests" with hackers.
when your software lacks inspection due to its magnitued then it
can only get worser when you have 5 of that magnitude.

tell the world that open standards are a good thing
and that open source standard software is just the better choice.

but a different aspect - what if there were 5 webservers out there?
would you expect them to have all the same features?
would you expect at least on of them to provide you
all the features you need for your business?

compare to the desktop browser war on open source desktops -
which of them does Java, SSL and a few more features?
why do we need all those wanne be browsers
whilst only a few fullfill the practical needs
but an unknown amount of them is most likely having security
vulnerabilities? same for the crowds of MP3 audio/video players...

and for a last argue, there must be measures to make standard
open source software more secure. think of the SEL package
for the Linux kernel and its userland counterpart.
did you ever notice that there is no BeOS, no BSD (net, free, open)
and no hurd version of the SEL package around? Thats where choice
does developers drive mad. good development is done only once.

I want to remeber the cleanup of the multiple instances of the
zip algorithm in the linux kernel some half year ago. And i want
to remember the Amiga OS that had really only a single implementation
of "printf" in the whole system, regardless of application, system
or kernel caller - they all used the same prooven codebase. If there
would ever pop up a bug, then the fixing would be a single operation.

Dont complain that a single bug can have such a magnitude of affected
systems due to "monoculture" (in fact Apache does have only some 50%
share if i remember correctly). Only a widespread system can ensure
that open source community has the man power to maintain it. If we
had multiple of such software then the number of bugs that a certain
system with a particular software will suffer wont get better. It only
will take longer time to get fixes and updates carried out due since
the number of developers (and developer time) per software package
will significantly shrink.

A healty open source community must have a strong look onto its own
effectiveness (like using bitkeeper), else it will spent a good deal
of its working hours with useless tasks. Thats not true in all cases,
e.g. where there are different promising approaches to follow and
different requirements to fullfill, but its true in general for the
whole community. Re-inventing the wheel over and over again wont
benefit anyone, despite the one that feels great about.

Regards, Alex.

Not so simple as "Apache is a monoculture"

bjn — 2002-06-20T17:50:42+00:00

This vulnerability, like many others, is a stack overflow. Such vulnerabilities are very sensitive to the hardware architecture, operating system, and compiler. Unlike IIS (which runs on only one OS, and only one hardware architecture), Apache runs on many OSes, and many hardware architectures, and is compiled with many compilers. I wouldn't call that a monoculture (w.r.t security), since it is much harder to write an exploit that will work on all of them.

I would expect the more popular variations (Red Hat Linux on Intel, for example) to be widely attacked; but I doubt any attack tool is going to reach a majority of the Apache servers worldwide.

Exploit posted to Bugtraq this morning (not just unix64/win32)

yem — 2002-06-20T05:50:23+00:00

http://online.securityfocus.com/archive/1/277830/2002-06-17/2002-06-23/0

To avoid monoculture nurture alternative servers (e.g. Caudium)

ber — 2002-06-19T13:08:22+00:00

Monoculture can grow to be a problem for the Free Software community
as this incident clearly shows. So having several high quality solutions
and some diversity is good even for webservers. The Free Software is out there, we just have to foster diversity. I'm a long time user of
the Caudium (www.caudium.info) webserver (a people's fork of Roxen formerly known Spinner, aka Spider) and it is good to have a choice.

Apache 1.3.26 available

dananderson — 2002-06-18T22:21:12+00:00

Apache 1.3.26 is available which is supposed to fix the buffer overflow problem.

For mirrors: http://www.apache.org/dyn/closer.cgi/httpd/
For direct download: http://www.apache.org/dist/httpd/

The Apache vulnerability: why disclosure of this problem so early?

DeletedUser2129 — 2002-06-18T17:27:04+00:00

I think it is important to mention the vulnerability was
detected during a test, there was no indication of anyone
using this to compromise any server.
Especially in cases like this, there is time to consult
the makers of the software and to find a fix, before
seeking publicity.