CeDeROM <cede...@tlen.pl> writes: > You have this idea to remove local denial of service advisories.
No. With very few (imho unfortunate) exceptions, we have *never* issued advisories for local DoS exploits. So we're not taking anything away from you. > My idea is to move them into benchmarks/recommendations such as CIS, The CIS benchmarks are not lists of vulnerabilities. They are lists of best practices for configuring a machine, and shell scripts that tell you whether a machine is configured correctly according to the benchmark. The only way to prevent local denial of service attacks is to not have any users. A four-byte shell script will send the load through the roof. A seven- or ten-byte script will render the machine unusable, and you won't even be able to log in to kill it. These are not bugs, they're fundamental features of the operating system, and you can't plug them without making the system useless for its intended purpose. DES -- Dag-Erling Smørgrav - d...@des.no _______________________________________________ freebsd-security@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
