News for hackers. Stuff that matters.

A comment on Security by obscurity is underrated. Parent comment

Re:Security by obscurity is underrated by Quiark on Friday September 11, 2020 @08:01PM (#24448629)
A tangent: are VPNs other than WireGuard less likely to have vulns compared to SSH? Seems the same to me (or worse for OpenVPN a few years ago)
[ Parent | on HN ]
Re:Security by obscurity is underrated by tptacek on Friday September 11, 2020 @09:02PM (#24448942)
You're asking for my opinion, and that's all I can relate, but here's my ranked ordering of things likely to have RCE vulnerabilities, from least to most secure:

* A Java, Python, or Ruby app server

* OpenVPN

* Stock nginx

    ----- starts to get really unlikely right here ----
* OpenSSH

* The Linux IP stack

* WireGuard

[ Parent | on HN ]
Re:Security by obscurity is underrated by wglb on Friday September 11, 2020 @08:15PM (#24448700)
One crude first-order comparison is to look at the relative size of the code. More code is more likely to have more vulnerabilities, to a first-order BOEC metric.
[ Parent | on HN ]