[31425] in bugtraq
Re: Windows Update: A single point of failure for the world's economy?
daemon@ATHENA.MIT.EDU (Jeremy C. Reed)
Thu Sep 4 14:34:25 2003
Date: Wed, 3 Sep 2003 15:11:50 -0700 (PDT)
From: "Jeremy C. Reed" <reed@reedmedia.net>
To: Paul Schmehl <pauls@utdallas.edu>
Cc: Stefano Zanero <stefano.zanero@ieee.org>,
BugTraq <BUGTRAQ@securityfocus.com>
In-Reply-To: <2705798112.1062604589@utd49554.utdallas.edu>
Message-ID: <Pine.LNX.4.43.0309031501480.13485-100000@pilchuck.reedmedia.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Wed, 3 Sep 2003, Paul Schmehl wrote:
> > Enabling a world-wide auto-update feature does indeed seem much of a
> > security risk to me.
> >
> More of a risk than up2date for RedHat or emerge -u system for Gentoo? Or
> cvsup for *BSD?
cvsup (or cvs) to update to new operating system or ports/pkgsrc sources
is different because:
- you don't get the final product; the binaries are not built
automatically nor installed.
- it is used to build from source; and the source code changes can
be compared and reviewed by anyone.
Jeremy C. Reed
http://bsd.reedmedia.net/
p.s. If you are a pkgsrc user, be sure to install and use
security/audit-packages.
p.p.s. I help run a BSD security update service; I don't think any of our
customers automatically upgrade with security updates although it is
possible.
