Hacker News Reader

Comment by ilyt | Hacker News Reader

I know why they use RHEL - support is apparently good and not every corpo wants to keep some linux experts on payroll to fix the rare issues that need a bit more expertise. And they keep old versiond of Red Hat updated for longer so you old crusty enterprise garbage can stay garbage few years longer and claim "but OS is updated" in audit.

I have no idea who in their right mind would use derivative, it has zero benefits and is just build worse than vanilla Debian.

View on HN

Funny; our RHEL systems were a nightmare for compliance actually. Most of the tools the auditor/pentester type people use only search for, (completely fake example) libfoo 1.x.2 having a security hole, and redhat's libfoo 1.x.2-wibble13 even though it has a backported fix, is flagged as vulnerable.

For each one of these packages, it's a crazy process to prove that the CVE they reported isn't actually there, and it delays our accreditation to the point where it was easier for us to change distro than go thorough hundreds of these..

t.b.h. all this tells me is that your pentesters are bad.

Bingo. We don't get to choose them, though, and they hold the strings on the certifications that our business needs. Sometimes it's easier to bend.

If they make a claim that some package has CVE and you can demonstrate that to be false as per official distro changelogs etc they can go hike.

The problem is that if they don't fix the tool, you'll get to tell them that every week (or however often they scan).

Dealing with bad security audits isn't fun.

You used to pay Red Hat, did you try passing them the hot potato?

Pretty much but that's my experience as well, I made the same comment above...

Perhaps auditing tools should do something better than just comparing version numbers as released by upstream?

Maybe Ubuntu LTS does less security backports than RHEL, but that doesn't make it better per se (saying this as an Ubuntu user).

Reply on news.ycombinator.com