"For most open source projects, news of an overlooked
security hole is simply part of the debugging process. But for the
developers of OpenBSD, an operating system whose design motto is
"secure by default," it's nothing short of an affront."
"Back in June, when a "malicious character string" vulnerability
was discovered in an open source IRC (Internet Relay Chat) client,
OpenBSD developers opted for the blitzkrieg approach and were
already performing a full, pre-emptive source tree audit before
crackers had time to figure out ways to exploit the
"We fixed dozens if not over a hundred of format string
vulnerabilities," says Aaron Campbell, an OpenBSD developer. "At
the time, no exploits for format string problems were available. It
was easy to crash programs, but methods for gaining elevated
privileges were not publicly known and at the time it was largely
Some of the products that appear on this site are from companies from which QuinStreet receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. QuinStreet does not include all companies or all types of products available in the marketplace.