“For most open source projects, news of an overlooked
security hole is simply part of the debugging process. But for the
developers of OpenBSD, an operating system whose design motto is
“secure by default,” it’s nothing short of an affront.“
“Back in June, when a “malicious character string” vulnerability
was discovered in an open source IRC (Internet Relay Chat) client,
OpenBSD developers opted for the blitzkrieg approach and were
already performing a full, pre-emptive source tree audit before
crackers had time to figure out ways to exploit the
vulnerability.”
“We fixed dozens if not over a hundred of format string
vulnerabilities,” says Aaron Campbell, an OpenBSD developer. “At
the time, no exploits for format string problems were available. It
was easy to crash programs, but methods for gaining elevated
privileges were not publicly known and at the time it was largely
theoretical.”