it seems we are on the same page as I said I agreed with the premise of your post. I mostly just liked the story.
As for BSD, there is no such thing as something being too slow to prevent hacking. One can exploit a known vulnerability without an ounce of system resources used.
[/QUOTE] yep. If they’ve got em anyway. To find one though you’ve got to see if that particular system has a given vulnerability and to do that you have to test it. Which takes clock cycles.
Also true. It takes time though. This was a walk in hackathon. Time was limited. Probably to a single day, though I didn’t ask. I could if you think it sufficiently important. I don’t want to bug the guy. He’s old and it’s late.
As luck would have it I ran into the originator of this story in the interim and got it told to me again.
It did happen, though later in the development of computing than I had remembered.
It was BSDi specifically. The fairly short lived commercial variant of BSD. It had unusually efficient code when it was out. To match equivalent
throughput it didn’t need the speed other systems did, and it’s specialty was high security. As a result it was fine running on x386 systems where other OSes of the period simply couldn’t. There was commentary at the time that the windows version of the period might be able to match its code speed if it removed several of its more basic critical security features.[/QUOTE]
________________________________________________
Not to drag this topic out, but you cannot make assumptions that all vulnerabilities are unknown to those who wish to exploit them, and therefore they constantly testing looking for a hole. A vulnerability becomes a
threat when it is known. The Equifax breach was
through a known vulnerability – those involved knew exactly what to do and how to execute it efficiently. It took mere seconds and little if any resources to gain access to Equifax systems.
Part of my profession is vulnerability management. There are professional organizations that test for vulnerabilities under lab environments and post their findings to the vendors of said applications. This information can be easily obtained by anyone, including those who wish to exploit. BSDi is not void of vulnerabilities regardless of what clock speed the software is able to run at. Takes only a few minutes to find dozens upon dozens of critical vulnerabilities that exploit everything from DoS attacks to remote root access. Clock speed is irrelevant!
Edit: The quotes are getting messed up which makes it difficult to read!