MESSAGE
| DATE | 2005-06-07 |
| FROM | Ruben Safir
|
| SUBJECT | Re: [NYLXS - HANGOUT] Device Drivers Filled With Flaws, Threaten
|
On Mon, 2005-06-06 at 17:03, Inker, Evan wrote:
> OK, Please can someone explain why Novell's Director of Software Engineering
> make the following statement publicly:
Because he opposes the move into the GNU/Linux sphere. It seems pretty
obvious. MS drivers secure? Please. Linux drivers not secure and poor
quality, please don't make me sick. The pool of programmers in both
cases largely suck, but I'd rather trust Donald Beckers Eth0 drivers to
the paid minions of 3Comm land any day.
And you know what, how do you audit code that is closed like the moronic
patent protected NVideo systems.
Maybe Billy can shed light on this.
Ruben
> " The Linux kernel has been consistently audited for security, but the
> kernel source tree contains huge numbers of outdated device drivers, says
> Novell software engineering director Crispin Cowan."
>
> "Device Drivers Filled With Flaws, Threaten Security"
> Security Focus (05/26/05); Lemos, Robert
>
> Although operating system code has improved in recent years, device drivers
> still have numerous flaws that threaten operating system security. The
> responsibility of securing device driver code lies primarily with the
> third-party hardware vendors that create the drivers, but also with
> Microsoft and the Linux development community.
>
> Automated code-checking firm Coverity said an audit of the Linux 2.6.9
> kernel code revealed that over 50 percent of the discovered flaws existed in
> device drivers. Though those flaws may not have been exploitable, they do
> reflect on the overall quality of code, says Coverity CEO Seth Hallem.
> Microsoft's Windows software development process includes provisions for
> checking third-party code shipped with the operating system and the company
> has an initiative to improve device driver development. The Linux kernel has
> been consistently audited for security, but the kernel source tree contains
> huge numbers of outdated device drivers, says Novell software engineering
> director Crispin Cowan.
>
> Of particular concern are drivers with direct memory access such as USB
> drivers, graphics drivers, and sound drivers, since code launched from those
> can overwrite system memory. Networking, wireless, and Bluetooth drivers are
> the only ones that are vulnerable to remote access, however. Open Source
> Development Labs Linux evangelist Bill Weinberg says driver exploits are
> also limited by the fact that many of them will simply crash the system.
>
>
> ****************************************************************************
> This message contains confidential information and is intended only
> for the individual or entity named. If you are not the named addressee
> you should not disseminate, distribute or copy this e-mail.
> Please notify the sender immediately by e-mail if you have received
> this e-mail by mistake and delete this e-mail from your system.
> E-mail transmission cannot be guaranteed to be secure or error-free
> as information could be intercepted, corrupted, lost, destroyed, arrive
> late or incomplete, or contain viruses. The sender therefore does not
> accept liability for any errors or omissions in the contents of this
> message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.
> This message is provided for informational purposes and should not
> be construed as an invitation or offer to buy or sell any securities or
> related financial instruments.
> GAM operates in many jurisdictions and is
> regulated or licensed in those jurisdictions as required.
> ****************************************************************************
|
|
