RE: Re: FreeBSD Security Survey



   As an administrator, time is always an issue.  FreeBSD has proven
   itself time and again.  Having said that, one "wish" would be to have
   a default/built-in security update mechanism.
   Since time is always and issue, if the system could by default
   (without an admin having to write scripts and/or apps, or manually
   update) update itself for both system and installed ports/packages, it
   likely would reduce security issues exponentially.
   This of course would be a massive project/challenge. Varying system
   and kernel configurations alone would make this a huge challenge, not
   to mention the potential security implications.
   The survey is a great idea.  I suggest adding a section for
   administrators to add comments and/or "wishes".
   Sejo
   Brent Casavant wrote:
> On Sun, 21 May 20
 06, Colin Percival wrote:
> 
> 
>>In order to better understand
>>which FreeBSD versions are in use, how people are (or aren愒) keeping
>>them updated, and why it seems so many systems are not being updated, I
>>have put together a short survey of 12 questions.
> 
> 
> I applaud this survey, however question 9 missed an important point,
> at least to me.  I was torn between answering "less than once a month"
> and "I never update".
> 
> While I find ports to be the single most useful feature of the FreeBSD
> experience, and can愒 thank contributors enough for the efforts, I on
> the other hand find updating my installed ports collection (for security
> reasons or otherwise) to be quite painful.  I typically use portupgrade
> to perform this task.  On several occasions I got "bit" by doing a
> portupgrade which wasn愒 able to completely upgrade all dependencies
> (particularly when 
 X, GUI愀, and desktops are in the mix -- though I
> always follow the special Gnome upgrade methods when appropriate).
> 
> I can愒 rule out some form of pilot error, but the end result was pain.
> 
> After several instances of unsatisfactory portupgrades (mostly in the
> 5.2 through early 5.4 timeframe), I adopted the practice of either not
> upgrading ports at all for the life of a particular installation on a
> machine (typically about one year), or when necessary by removing *all*
> ports from the machine, cvsup惺ng, and reinstalling.  This has served
> me quite well, particularly considering the minimal threat profile these
> particularly systems face.
> 
> So, in short, that愀 why *I* rarely update ports for security reasons.
> 
> There are steps that could be taken at the port maintenance level that
> would work well for my particular case, however that愀 beyond the scope
> of the sur
 vey.  Thanks for taking the time put the survey together, I
> certainly hope it proves useful.
> 
> Thank you,
> Brent Casavant
I share this frustration with you.  I was once told that the pain in
upgrading is due largely to a somewhat invisible difference between
installing a pre-compiled package, and building+installing a port.  In
theory, if you stick to one method or the other, things will stay mostly
consistent.  But if you mix them, and particularly if you update the
ports tree in the process, the end result is a bit more undefined.  One
thing that I wish for is that the ports tree would branch for releases,
and that those branches would get security updates.  I know that this
would involve an exponentially larger amount of effort from the ports
team, and I don愒 fault them for not doing it.  Still, it would be nice
to have.
Scott
_____________________________________
 __________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"