Gentoo - Secunia

Have a look here:
http://secunia.com/product/339/

That list is massive.

The Debian list is pretty large too:
http://secunia.com/product/143/

I am not a hardcore nix user, but I'm wondering why that list is so long compared to other OS's. Nearly all of the advisories are for software that Gentoo doesn't develop, but I am wondering why we don't see a massive list of advisories for other *nix OS's that (I'm guessing here) have the same software:

http://secunia.com/product/4368/
http://secunia.com/product/4258/


Any Thoughts? :D

/me gets chipotle

If you subscribe to BugTraq you will notice that there is a Gentoo issue nearly every day but they seem to be more in the third party products than the core OS itself.

Debian seems to get a lot of the same.....

Gentoo and every other Linux distro generally use customized packages for their own distro. SUSE for example comes with a different style of any given package than what entoo has. SUSE customizes almost everything including the Kernel, so if Gentoo has a security flaw, which is daily, SUSE most likely doesn't.

Gentoo is terrible at this. SUSE and RedHat both use custom, and Slackware generally has a different package too. Gentoo for some reasno, and Debian, both get spanked with this. I'm not sure why because I've never looked at how those two distros do things, mainly because I don't like them.

Take the Kernel, SUSE has a custom Kernel, so if there is a flaw in Gentoo, generally it won't be for SUSE because even though it's the Linux Kernel, SUSE is custom and pretty much more secured by the SUSE security team.

Ok, so different distros differ more than I thought.

So why are the changes that Debian and Gentoo make so drastic that they open up security vulnerabilities? Are they merely customizing software to work for the OS, or are they also making an attempt to improve the software itself?

It would probably take someone who is hardcore Debian or Gentoo to answer that one. ;)


Merry FESTIVUS everybody

Yeah well, everything is relative ...

Sure i can't look aside the figures, i can say it may be a misplaced figure ...

As well as Debian as Gentoo make great difference in stable - unstable packages.

For example, gentoo has a system where you can specify if you want tested or untested (latest released) packages through the for.ex. "ACCEPT_KEYWORDS=~x86" function, whereas you can specify in Debian the selection between stable - unstable - testing is , if i remember correctly, through the apt-get config. Most bugs apply at unstable, not fully released, packages.

So what i'm trying to say, if you are sticking to stable (as me) and you upgrade regularly, these presented figures don't apply actually.
I do have to admit there are people who still believe the latest versions are the best, which definetly isn't. These people would match alot of those advisories.

As they say often, a box is as good as the person who controls it ...

Anyway thats my point of view,

And also from me a Mewwy Kwistmas :p

Cheers,

I'm willing to call this a bias. Most security testers are going to use a OS that they feel is more...well hardcore. Along with this comes the whole OS groupie thing. So the more people that use an OS, the more your are going to hear from it. When was the last time you got any security announcements for college linux?

I think the important thing here is the number of unpatched advisories rather than the number in total.

Steve

I agree with steve.milner on this one. My opinion is that due to the testing that all the packages undergo before they get flagged as stable in the Portage tree [as described by Shrekkie above] a lot of issues show up. Yes there are many GLSAs every week, either third-party or base system-related.

It should be made clear that Gentoo gives a choice of many, many kernels.

Code:

---


ac-sources/          gentoo-sources/        ksymoops/          pegasos-dev-sources/  sparc-sources/
alpha-sources/        grsec-sources/        linux-headers/      pegasos-sources/      uclinux-sources/
ck-sources/          hardened-dev-sources/  linux26-headers/    ppc-dev-sources/      usermode-sources/
config-kernel/        hardened-sources/      mips-headers/      ppc-sources/          vanilla-sources/
development-sources/  hppa-dev-sources/      mips-sources/      ppc64-headers/        win4lin-sources/
genkernel/            hppa-headers/          mm-sources/        rsbac-dev-sources/    wolk-sources/
gentoo-dev-sources/  hppa-sources/          openmosix-sources/  rsbac-sources/        xbox-sources/

---

So there's quite a few things to choose from, but not all of them are patched by the Gentoo dev team [like the vanilla sources].

Maybe SUSE doesn't disclose as much, or maybe they can't find things in as many apps as Gentoo can. It doesn't matter. These are all open source systems and if one is so concerned to have everything top-of-the-line they should study the original webiste for each application and study the new patches and use that instead.

I myself use only stable packages on my Gentoo laptop [except for Sun's Java Compiler, v1.5] and never ran into any kind of problem. Sure I'm not a big target for the hackers of the world but my system has been standing its ground so far.

It's not that SUSE can't find things, it's simply that they have an entire team who does nothing but security, and does security audits on code like Open BSD does, so before it's released, it's already been tested, that's that.

gentoo ... isn't cutting edge ... it's bleeding edge... so you should expect certain inconsistencies.

after installation i had many problems w/ dependencies and broken paths

(of course, i'm not a linux expert)...

but Debian is considered defacto a model linux distro.... ibm has actually chosen it to be their linux standard

Actually IBM sides with SUSE. They helped get SUSE certified and to this date no Linux has been tested and shown more secure than SUSE. SUSE got the highest award in security to date of any distro.

before you start flaming me ... i just want to get a chance to clarify my statement... let me look up the issue of Linux Magazine in which I read it ...

be right back

ehehe

how about gentoo chooses the documented distributed approuch of fixing the bugs in the way linux came what it became today, by publishing everything to the world, while suse relies on a few die hard code munchers first... besides that there are several awards for security, suse won one off and with that it didn't poop one ALL distro's, just the tested ones wich where probably the certified (dunno which cert certed) ones

you can twist the story all you want in the favour of yer own distro... "I like cygwin because it got no advisories AT ALL http://secunia.com/product/2924/"

Quote:

---

Originally posted here by unhappy
before you start flaming me ... i just want to get a chance to clarify my statement... let me look up the issue of Linux Magazine in which I read it ...

be right back

---

That's not a flame idiot, and it's been almost 3 hours, still reading?

don't call me an idiot... it's absurd

No, I don't think so. You read something in a Magazine, posted it as fact, and then when you got called on it you say "Oh I'll re-read what it said" because I posted with what IBM actually DOES do, which is support SUSE.

Quote:

---

after installation i had many problems w/ dependencies and broken paths

---

You prolly didn't sort out well your USE-Flags in the /etc/make.conf.

Besides,

gore, when are you going to interprete something what another user said for real, instead of always making your own story out of what someone replied ? You seem to have that female touch where they always tend to twist what a male says, into something they wanna hear. And don't flame people... it's childish.

How did I twist around what he said? He did read something, and then he did post it as fact, and I called him on it and he did say "oops, I'll read it again, I played with the facts, oh baby baby".....

And when are you going to pull your head out of your ass and quit going after everything I say ? You sit there like you're some type of voice of ****ing reason or something and tell me to grow up, that I'm stupid, that I don't know anything, how about I call you out? Bitch.

i'm sorry ... i wanted to look up the article ... and yes i was wrong, i wasn't ibm... i was HP

i wan't trying to bullshit you guys i just remembered wrong

here's the link to what i was getting at...

""""" What I was looking for," remembers Geary, "was a unifying distribution that HP could rally around, develop on, and we'd have one place where we could get together on Linux across the company." Geary, a 14-year veteran at HP, says that in the final evaluation, the decision to go with Debian was made because of one thing: standards. With the other distributions, "it wasn't clear who was committed to the standard, and how much they were committed," says Geary."""""

http://www.linux-mag.com/2002-03/debian_01.html


PS: Debian's c o o l ...

"Perhaps this is part of Debian's appeal. A 100 percent hackers-only organization with none of the businesslike trappings of a commercial distribution, Debian is basically a suit-free zone. The distribution itself is composed of almost 4,000 software packages, each of which is maintained by one of the 700-odd Debian developers."


Thanx for sticking up for me shrekkie even though i ****ed up w/ exact company... i'll definitely try to install gentoo again...

Quote:

---

Originally posted here by unhappy
i'm sorry ... i wanted to look up the article ... and yes i was wrong, i wasn't ibm... i was HP

i wan't trying to bullshit you guys i just remembered wrong

here's the link to what i was getting at...

""""" What I was looking for," remembers Geary, "was a unifying distribution that HP could rally around, develop on, and we'd have one place where we could get together on Linux across the company." Geary, a 14-year veteran at HP, says that in the final evaluation, the decision to go with Debian was made because of one thing: standards. With the other distributions, "it wasn't clear who was committed to the standard, and how much they were committed," says Geary."""""

http://www.linux-mag.com/2002-03/debian_01.html


PS: Debian's c o o l ...

"Perhaps this is part of Debian's appeal. A 100 percent hackers-only organization with none of the businesslike trappings of a commercial distribution, Debian is basically a suit-free zone. The distribution itself is composed of almost 4,000 software packages, each of which is maintained by one of the 700-odd Debian developers."


Thanx for sticking up for me shrekkie even though i ****ed up w/ exact company... i'll definitely try to install gentoo again...

---

See a miss reading is one thing, I knew IBM was standing with SUSE a while back. They like SUSE. Even Dell is now offering SUSE as a standard option instead of just RedHat. They used to charge mroe for SUSE because ti was custom for their servers but now they don't, they made it a standard option. As for Debian, I'd rather use Slackware, you can use apt-get on SUSE and Slackware so really there isn't a reason for me to use it.

HP stands behind Linux as well, which you've pointed out. HP did stand up for SUSE a few times too against SCO.

Quote:

---

Originally posted here by .: Shrekkie :.
gore, when are you going to interprete something what another user said for real, instead of always making your own story out of what someone replied ?

---

Heh, if he did that things would be sooooo boring around here. :)

Quote:

---

And don't flame people... it's childish.

---

Not if it's done properly. ;)

As to the original topic of the thread, Gentoo does get a lot of security advisories (I use it, I should know, but I've never had any problems security-wise with it. Most of the bugs are, as has already been mentioned, in third-party apps, although I don't know why there seem to be more for Gentoo than any other distro - perhaps it's to do with some of the patches they add on.

Awwwwww, I have a fan!

More flames from the seniors I see...

May as well join in.

suse is a rubbish distro.

Sleep with one eye open ****er.

Bah, you've no chance SuSe LuSer

You'll spend all your energy dealing with your crap distro you'll never get round to doing anything even close to me...

Get a real OS - OS/2!

Steve

Gore mentioned apt-get for suse and slackware and that brings me to a minor slightly off topic question. When you use that wonderfull little program on other OS's besides debian based does it go to suse and slackware repositories or does it go to the same debian repositories that my libranet goes to? If it goes to the same repositories then why pimp that you can use it on your uber SuSE to install the same insecure packages? I mean if its 3rd party apps that have the most bugs/flaws and you are getting them from the same source as all theese "evil" debian and gentoo usersarent your packages just as flawed?

Quote:

---

Originally posted here by steve.milner
Bah, you've no chance SuSe LuSer

You'll spend all your energy dealing with your crap distro you'll never get round to doing anything even close to me...

Get a real OS - OS/2!

Steve

---

You know how to make OS/2 Slow, Crash prone, buggy, shitty, and hell to use? READ THE ****ING INSTALL MANUAL.

And as for spending energy on a crap distro.... this box is my FTP, SSH server, and workstation, generally has uptimes of 3 months, and doesn't crash. YAST2 is the absolute best admin tool ever made, and I can have as many people as you want tell you the same. anyone who has ever used it knows.

But you're right about one thing, I won't ever do anything even close to you, I don't need to reboot.


Dave, you tell it where to get updates from. You'd have to ask Horse though because he uses it more than I do.

Quote:

---

Originally posted here by gore
And as for spending energy on a crap distro.... this box is my FTP, SSH server, and workstation, generally has uptimes of 3 months, and doesn't crash.

---

Hah, until you plug the network cable in!

Reboot City is thataway ======>

HTH

Steve (Did I mention I lived under a bridge ?)

Dave can speak for me the cable is in, he downloads off me. And has an SSH account.

Quote:

---

Originally posted here by ZomBieMann77
Gore mentioned apt-get for suse and slackware and that brings me to a minor slightly off topic question.

---

AFAIK atp-get is for Debian... which makes me wonder, how come it's okay for SUSE to use Debian 'technology' while Gentoo - using ports and whatnot - is all evil and lame?

gore, we all get it: you're too stuck into your distros to get your head out of the arse and understand that what distro we use isn't got **** to do with what we are or what we could do with the computer. Hell I could install text-only BSD on my dad's computer so he can show off with it... what good?

Quote:

---

Originally posted here by hypronix
AFAIK atp-get is for Debian... which makes me wonder, how come it's okay for SUSE to use Debian 'technology' while Gentoo - using ports and whatnot - is all evil and lame?

---

It was ported to SUSE, SUSE didn't do it or release it. But you would know that had you bothered to read into it instead of seeing a chance to make me look hypocritical and running with it. It's not distributed by SUSE, it doesn't come on the CDs, it's merely an option, nothing more.

Besides, SUSE didn't take Debian and put a different Kernel in and call it theirs. Gentoo took Free BSD, a Linux Kernel, and a SUSE splash screen, and called it Gentoo. And above that SUSE has been around longer than ANY other Linux company still in business. SUSE came in in 1992, that's outdating any distro still around.

You'll also note I said I didn't use it much and he would have to Ask the Horse who does. It would appear you didn't read up on any of this.

At least I had the common courtesy to try Gentoo out before I ran my mouth. After 5 times I still didn't like it and realised I had a Free BSD machine already and had no use for the same thing with a different Kernel.

Quote:

---

gore, we all get it: you're too stuck into your distros to get your head out of the arse and understand that what distro we use isn't got **** to do with what we are or what we could do with the computer.

---

If I pull my head out, it might un-plug my ass and I'd say things like that which make no sense. I don't seem to recall ever saying someone was stupid because they used Gentoo, I said Gentoo was stupid.

Quote:

---

Hell I could install text-only BSD on my dad's computer so he can show off with it... what good?

---

If you had to install it for him it's doubtful he could use it in the first place.

Quote:

---

Originally posted here by gore
If you had to install it for him it's doubtful he could use it in the first place.

---

Yeah that was the point.

I think that having Gentoo be stupid implies that those who use it are too. Now I've tried a fare share of OSes and distros [not nearly as many as you anyway :)] and decided to stick to this. Next week I'm getting another box that's going to be dedicated for toying and playing with different OSes and different things on different OSes. So I'll manage to give SUSE 9.1 Pro a try, Solaris 9, BSD [in more detail] etc.

It's funny but, the first distro I ever installed was a SuSE 6.1. And I was supposed to install 9.1 but Novell delayed shipping, Solaris wouldn't detect anything on my computer and I got to Gentoo. So it's a matter of chance that I run this, and I love it. I don't care what they got from where, but they do mention they use a ports-like system and a bunch of other things... what they found nice in other distros.

I admit to not having followed the discussion very, very closely. I didn't mean to insult gore or anybody else, simply point out that I think most people here have got a good clue you are SUSE/Slackware biased. And it's getting old sometimes...

Your attitude sure did change fast in a matter of two posts. Fact is a good LART.

If my "SUSE/Slackware" Elitism gets old don't read what I say.

No my attitude didn't change at all in a matter of two posts. Maybe you took it too hard in the first post, or too lightly in the second one. Matter of fact is, I stand before what I said, and if you choose to understand different things from the two posts, it's up to you.

LART-ing aside, that is.

Man you could have said elfknv;kldnfvl;jkdfv;ndfvn;df;lnkdfl;vn and I wouldn't have taken it differently, it's almost 3 PM and I haven't been to bed yet. DAMN do I want to though.