>
> This argument is similar to several others that have popped around
> security circles since the beginning of time.
>
> "Firewalls give administrators a false sense of security."
>
> "Shadow passwords arent the solution, secure passwords are."
>
> Both of these statements are true in general. And if people these as
> their only lines of defense, they will most likely be broken into.
> When used by an administrator armed with a security policy, subscriptions
> to all relevent security mailing lists, and experience, these all become
> useful tools.
>
> Who knows how many cookie cutter stack overwrites might already exist that
> haven't been released to the public yet. This patch will provide
> protection for people who arent on security mailing lists, and offers them
> some protection against bugs that aren't common knowledge. While we are
> at it, the symlink patch is also a good idea from a security perspective.
Think of it as an early-warning system rather than a cure. If some
previously-stable daemon starts dumping because execution is passing into
the stack, you may reasonably suspect that a previously unknown weakness
is being probed by the bad guys. Sure, this won't catch every security
hole, but *nothing* will do that and it's better to have some warnings
than none.
Mark H. Wood, Lead System Programmer MWOOD@INDYVAX.IUPUI.EDU
Those who will not learn from history are doomed to reimplement it.