On 10/25/11 5:11 PM, Rich Freeman wrote: > And "Debian is doing it" or whatever isn't actually a bad reason to > consider this. When Debian does something by default, it means that > upstream packages will take notice.
Right, I was thinking about the change for a long time, but if Debian, which advertises itself as stable and well-tested, thinks it's time to do it, then why should we stay behind? My primary motivation is doing the right thing, and linking to Debian's plans is one of my points to show that it makes sense. I think that generally just trying to patch detected vulnerabilities as soon as possible is not sufficient to stay reasonably secure. Mitigation techniques like SSP and ASLR are really important, because they give you more time to fix vulnerabilities (by making it harder to exploit them). And again, I don't suggest enabling anything by default that would degrade performance in an unacceptable way or create compatibility problems that can't be solved. And I'm also looking for a way that will provide a seamless upgrade path for existing users (i.e. one that doesn't break them).
signature.asc
Description: OpenPGP digital signature
