On Wed, 19 Dec 2012, Jeffrey Walton wrote:
Surely it is better to leave this to OS distribution maintainers who
establish common rules for OS packages and ensure that options are applied
in a uniform and consistent manner.
I think your arguments make a lot of sense and I would like to agree with you.
Unfortunately, the folks at Red Hat provided a "proof by counter
example" with the recent MySQL 0-days
(http://www.h-online.com/security/news/item/MariaDB-fixes-zero-day-vulnerability-in-MySQL-1761451.html).
I would have expected Red Hat security folks to be on top of it,
especially with a high risk application such as a database that
accepts input from the network (some hand waiving since PHP is likely
in front of it).
I don't know anything about this vulnerability but your conclusion
does not quite make sense. Software is evaluated for vulnerability at
the source code level without consideration for the fortifications
which were suggested.
I am suggesting that OS distributions know how to best fortify their
systems and that fortification methods may vary with each OS release.
This does not mean that application bugs should not be corrected.
Most of the the -z,blahblah options could be eliminated if the OS and
toolchain were to arrange to do useful security things by default.
They could do useful security things by default and flags could
disable safeguards for rare code which needs to intentionally do the
things guarded against.
Bob
--
Bob Friesenhahn
bfrie...@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
_______________________________________________
Autoconf mailing list
Autoconf@gnu.org
https://lists.gnu.org/mailman/listinfo/autoconf
