SANS Top 20 Internet Vulnerabilities

services should be correct to the function they are to serve. excessive services, such as many default installs have, would then not be a correct implementation.

if you don't need portmap, why run it? if you don't need ntp why run it? if you don't need chargen why run it? if you don't need daytime or inetd, why run it?

running necessary and correctly configurated servers may be what the net is about, but there is no reason for excessive portage dude.

That's just double-speak.

Read it this way:

"Considering how screwed our customers have been recently ...and I mean we -really- fucked up big time if someone can hose us with BASIC scripts attached in e-mail for christsakes... we -need- to start plugging holes as fast as we can before we start losing money, otherwise we aren't going to be top dog and we'll to lose customers and market share faster than you can say "0wn3d j0", therefore, we need to play major fucking catchup before the stock price drops."

Before bashing microsoft too much, consider this: they are strongly pushing C#. C# provides bounds checking on arrays and strings. There goes a huge percent of buffer overflows. I bet C# has a more sane printf/scanf input/output system, so there goes format bugs.

By making a transition to a language that solves most of their problems for them, Microsoft stands a chance of becoming one of the more secure vendors -- once they re-write everything in C#.

They are looking at drastically cleaning up their code through a new language. Most people wait for their buffer overruns to show up on bugtraq. OpenBSD at least looks for problems proactively -- but not proactively enough to rewrite all tools in a language that does the work for them.

Just keep this in mind next time you hear someone bash microsoft about security. They might not be real secure today, or tomorrow, but in a few years time, they stand a good chance of being far ahead of other people still using C for everything.

Cheers! :)