Single quotes or double quotes? I left single as single, and double as double, but "fixed" (or is that 'fixed'?) them both.
Is there any interest in bring the "New Technologies" section up to date? It seems like lots of additional good stuff has been done. When I point our new guys to this page (in particular) it would be nice for them to see a reference to PIE and/or ASLR, etc. (see previous security.html diff I sent 29 August) For your consideration. Regards, Rob RCS file: /cvs/www/security.html,v retrieving revision 1.422 diff -u -p -r1.422 security.html --- security.html 2 Jul 2015 05:49:04 -0000 1.422 +++ security.html 4 Sep 2015 22:38:52 -0000 @@ -112,10 +112,10 @@ skills.<p> Some members of our security auditing team worked for Secure Networks, the company that made the industry's premier network security scanning software package Ballista (Secure Networks got purchased by Network -Associates, Ballista got renamed to Cybercop Scanner, and well...) +Associates, Ballista got renamed to Cybercop Scanner, and well...). That company did a lot of security research, and thus fit in well with the OpenBSD stance. OpenBSD passed Ballista's tests with flying -colours since day 1.<p> +colours since day one.<p> Another facet of our security auditing process is its proactiveness. In most cases we have found that the determination of exploitability @@ -126,7 +126,7 @@ have fixed many simple and obvious carel and only months later discovered that the problems were in fact exploitable. (Or, more likely someone on <a href="http://online.securityfocus.com/archive/1";>BUGTRAQ</a> -would report that other operating systems were vulnerable to a `newly +would report that other operating systems were vulnerable to a 'newly discovered problem', and then it would be discovered that OpenBSD had been fixed in a previous release). In other cases we have been saved from full exploitability of complex step-by-step attacks because we @@ -165,7 +165,7 @@ written somewhere, but perhaps not taken <li><h3><font color="#e00000">The Reward</font></h3><p> Our proactive auditing process has really paid off. Statements like -``This problem was fixed in OpenBSD about 6 months ago'' have become +"This problem was fixed in OpenBSD about six months ago" have become commonplace in security forums like <a href="http://online.securityfocus.com/archive/1";>BUGTRAQ</a>.<p> @@ -229,7 +229,7 @@ finding and fixing new security problems get widely reported because (as stated earlier) many of them are not confirmed to be exploitable; many simple bugs we fix do turn out to have security consequences we could not predict. We do not have the -time resources to make these changes available in the above format.<p> +time or resources to make these changes available in the above format.<p> Thus there are usually minor security fixes in the current source code beyond the previous major OpenBSD release. We make a limited @@ -269,8 +269,8 @@ things:<p> <li><h3><font color="#e00000">Reporting problems</font></h3><p> <p> If you find a new security problem, you can mail it to -<a href="mailto:[email protected]";>[email protected]</a>. -<br> +<a href="mailto:[email protected]";>[email protected]</a>.<p> + If you wish to PGP encode it (but please only do so if privacy is very urgent, since it is inconvenient) use this <a href="advisories/pgpkey.txt">pgp key</a>.
