Saturday, August 22, 2009

DirectQ and Security

I've just spent some time closing several hundred potential buffer overrun cases in DirectQ; most of these were inherited from the original GLQuake code, but a few I had introduced myself. I pretty much took the opinion that any such case, even if it did not result in the ability to inject arbitrary code into an executable memory location, was worthy of closing, as it's possible that a stray pointer could cause a jump to an area where it would pose a threat. There are still some left as of now, and it's likely that there will be some forever, but at least things are a lot more solid than they were.

All memory allocated by DirectQ (with the possible exception of Zone memory - I must check that one up) is explicitly marked "non-executable" also, so that's another plus.

I always laugh when I hear people arguing the case that Free Software is more secure because vulnerabilities will get patched faster. This is not necessarily a fair and accurate description; what's actually happening is that Free Software assists in creating a scenario where the response time to a known vulnerability can be potentially decreased. That's a whole lotta maybes, before you even factor in the fact that those who are potentially decreasing that response time don't have to depend on doing so for food and shelter. Security is a serious matter and one should not play games of political oneupmanship with it, but unfortunately most Free Software proponents seem hell-bent on doing just exactly that.

The whole area of security and Linux is full of similar misleading info. The simple truth, and genuine cause of the whole security scare, is that the number of Windows users is several orders of magnitude larger. If I was a worthless piece of dirt writing a virus that let me get at people's personal stuff, of course I'm going to pick on the larger target. If in 20 years time the Free Software revolution happens and most people are growing their own vegetables, weaving their own beards, wearing sandals and using Linux, then the opposite would be the case. Linux would be riddled with viruses and Windows would be seen as the secure alternative.

Anyway, I don't have a problem with the concept of Free Software in general or Linux in particular - DirectQ itself is Free Software, after all. My main problem in OS-land is with Unix; and this also applies to HP-UX, Solaris, AIX and other non-Free software. And yes, it's based on practical real-world hands-on experience, not what I read on SlashDot or have been led to believe by others.

1 comments:

Anonymous said...

"If in 20 years time the Free Software revolution happens and most people are growing their own vegetables, weaving their own beards,wearing sandals and using Linux, then the opposite would be the case. Linux would be riddled with viruses and Windows would be seen as the secure alternative."
I agree to all until that point, that is another falacy that should be erradicated. The weakness is the uniformity across the systems, the situation would reverse in case Ubuntu or some big distribution is stabilished as the only linux flavor.