Genesi selects IBM PowerPC for Performance-intensive Pegasos Release

[dammy]

Poster: gary_c Date: 2003/12/4 21:29:53

The Pegasos Guardian will be running ShopIP Crunchbox on OpenBSD.

And that will do what compared to Linux/FW1-NG?  How about PEg/SHopIPCrunchBox vs VPN-1 Edge?  Note the prices on the latter.

Dammy

[Rodney]

You're absolutely right, you must not forget strong software auditing procedures even when the architecture is not x86.

Yer but thats why their using OpenBSD!

[Rodney]

@ dammy

I think what the press release was try to say is that the buffer overflows that break x86 boxes wont work on a PPC box. This is not the same thing as saying, PPC doesnt have buffer overflows, just that, you have to do it a lot differently.

Much of the office and network IT infrastructure in use today is x86-based,” explained Buck. “The Guardian runs on a different processor platform and is not as susceptible to the common buffer overflows that are the main entry point for security breaches.”

"x86-based" exploids wont work on PPCs. This is commensence but for some reason they wanted to spell it out. I guess everyone doesnt know the differences between the two platforms. But the point is, in an x86 world people are going to assume that you'r box is x86 and if they try to exploit it, they're not going to succseed. They only way they will is if they know the box is PPC and they change the way they exploit the box. Thats how i read it anyway!

[gary_c]

Dammy wrote:

And that will do what compared to Linux/FW1-NG? How about PEg/SHopIPCrunchBox vs VPN-1 Edge? Note the prices on the latter.

Those prices seem to be just the application software; the Peg/Crunchbox prices are for a complete system. Otherwise, I don't know much of anything about the pro net security market. On the plus side, it's good Genesi is getting some real-life products out, and the partnerships are real. As for the relative merits of the product, I guess that's for the market to decide. You're right -- it has to be competitive; the Guardian seems to have some positive points and presumeably a competitive price will be charged.

[dammy]

Poster: gary_c Date: 2003/12/5 2:03:17

Those prices seem to be just the application software; the Peg/Crunchbox prices are for a complete system. Otherwise, I don't know much of anything about the pro net security market.

No, that's including hardware, see here.

You're right -- it has to be competitive; the Guardian seems to have some positive points and presumeably a competitive price will be charged.

Checkpoint is the clear leader, there is nothing better then those guy's products.   If Genesi with their partner are going to get in that same market, they have to have a better product and a MUCH cheaper level then what Checkpoint is offering.  Edge1 appliances are something new from Checkpoint and it's going to be damn hard to compete with those pricing levels. :-o

Dammy

[gary_c]

I checked their site again, and see what you mean. Well, I assume the Genesi and ShopIP guys are aware of their competitors here and are lining up their product advantage ideas. Guess we'll see what happens, eh?

-- gary_c

[downix]

@dammy

I looked at Checkpoint, they do not offer the same performance level nor even close to the same features.  Please compare like with like, don't grab a machine that can do only 1.5Mbps and compare with one going Gbps+ and wonder why the price is higher on the latter.

[dammy]

Poster: downix Date: 2003/12/5 10:07:50

I looked at Checkpoint, they do not offer the same performance level nor even close to the same features. Please compare like with like, don't grab a machine that can do only 1.5Mbps and compare with one going Gbps+ and wonder why the price is higher on the latter.

True, these are the embedded devices which CheckPoint has recently (I had no idea that they had released these yet and shocked to see the low pricing) released for the small business needs that do not require FW1-NG.  For most small to medium, those embedded VPN-1 Edge devices is overkill.  For $300, the S8 delivers Firewall/VPN throughput of 22/3 Mbps, allows 8 total users to traverse the gateway, and provides 1 remote access tunnel at one time.  If your looking at the upperend, the XU delivers Firewall/VPN throughput of 150/30 Mbps, allows an unlimited number users to traverse the gateway (no license limitations), and provides 25 remote access tunnels at one time.

Now, if your looking at enterprise level, CheckPoint's bells and whistles are alot highier then $15K for server/management software.  Then again, out of Fortune's 100 list, 97 are CheckPoint customers.  For a list of what enterprise level apps and supported hardware, check here.

Dammy

[IonDeluxe]

@Gary_C

even if you include the pagaos II, you are maybe hitting the 1000 mark of machines produced, but that hardly meets "trialled and tested"
In any case he is talking Pagasos, not Pegasos II or Pegasos line and/or product group.
At best it is exaggeration and inaccurate statements at worst it is blatant lies.I dont care if it is not a "deposition" or not, it IS advertising, a public statement and as such must be accurate and concise.

Quite frankly this continuing misleading conduct by BBRV/Genesi should not be tolerated! As a small business breaking into the market one would expect them to ensure there is absolutely no room for doubt and that thier integrity is beyond reproach.If it by design or mistake it basicly boils down to lies, and I am astounded why people put up with it.

[gary_c]

even if you include the pagaos II, you are maybe hitting the 1000 mark of machines produced, but that hardly meets "trialled and tested"

That's your interpretation. Keep in mind that these boards were sent to people who are mainly developers, who are using them actively with the intended OSs.

it basicly boils down to lies, and I am astounded why people put up with it.

No, I don't think it boils down to lies.  At the worst it comes down to how you want to interpret what is meant by "Pegasos" (note the spelling, BTW) -- i.e., does it include both the original run and the Pegasos II? Things like that. I don't think this PR is any less truthful than other companies'.  

-- gary_c

[ikir]

I bet Genesi will name it the MicroPegasos

LOL :lol:  funny :-D

Anyway, nice idea (strategy). Good luck.

[IonDeluxe]

OMFG somebody dared to make a spelling mistake! Quick alert the world defense forces to this serious threat! Sheesh, get a life.

I did not "interpret" anything.
By your own words they MAY have sold 1000 boards.
Yet BBRV says that over 1000 have been trialled and tested.You say they have gone mainly to developers, BBRV say they have been supporting the hobbyist community.
Something said, something stated which is not true is a lie, be it intentional or otherwise.Hence such statements in the before mentioned press release are lies.Furthurmore either you or bbrv are lying as well as your statements are in conflict.
Considering you have never intentionally spoke mis truth and also considering the track record of bbrv i will assume bbrv is lying some more making that entire section of the press statement little more than wishful fabrication.

[Kronos]

And where is that conflict between those statements ?

"hobbyis community" and "developers" aren't mutal exclusive, and I'm
sure I can do a lot of trialing and testing  :-P

[System]

@Ion

You say they have gone mainly to developers, BBRV say they have been supporting the hobbyist community.

To be quite blunt, most of the hobbyist community ARE developers.   While VERY talented, the Amiga community doesn't have any developers left which would not be classified as hobbyists.  After all, none of the developers, including Nova Design is able to make a real living off of Amiga software.  

Remember very clearly however that the community that we are discussing isn't necessarily just the Amiga community.  I can state unequivocably that there have been over a thousand sold, most are in the hands of real users which happen to be developers as well.  

In regards to the community support issue, we have spent a GREAT deal of time, sweat, and money over the last year or so supporting this community (and others).  See the events calendar at http://pegasosppc.com/community.php if you care to doubt that fact.  

In fact, the amount of attention and support that Genesi is giving this community (and others) by FAR outweighs any other prospects at the moment, so in my mind, your argument regarding community support is a bit of denial.

Wayne Hunt
Web Presence Manager
Genesi USA

[Hammer]

I think what the press release was try to say is that the buffer overflows that break x86 boxes wont work on a PPC box. This is not the same thing as saying, PPC doesnt have buffer overflows, just that, you have to do it a lot differently.

Buffer overflows is programming structure issue. For example, the deployment of PowerPC doesn’t rescue the flaws of Samba. It doesn’t solve the issue IF people just copy the source code and port it on their preferred ecosystem.

x86-based" exploids wont work on PPCs. This is commensence but for some reason they wanted to spell it out. I guess everyone doesnt know the differences between the two platforms. But the point is, in an x86 world people are going to assume that you'r box is x86 and if they try to exploit it, they're not going to succseed. They only way they will is if they know the box is PPC and they change the way they exploit the box. Thats how i read it anyway!

No quite common sense IF one looks into an open source ecosystem.  

In most cases, buffer overflows has nothing to do with HW i.e. refer to
http://www.itworld.com/nl/lnx_sec/12182001/
http://www.secunia.com/advisories/8533/

Note the inclusion of MacOS X i.e. a PowerPC box.
It’s an issue with sloppy programming...

Also refer to
http://www.ciac.org/ciac/bulletins/l-104.shtml

-104: SuSE Linux, xinetd Buffer Overflow
July 3, 2001 23:00 GMT
--------------------------------------------------------------------------------

PROBLEM: SuSE Linux, xinetd has a buffer overflow vulnerability
PLATFORM: i386 Intel Platform: SuSE-6.3,6.4,7.0, 7.1, 7.2 Sparc Platform: SuSE-7.1 AXP Alpha Platform: SuSE-6.3,6.4,7.0, 7.1 PPC Power PC Platform: SuSE-6.4,7.0, 7.1
DAMAGE: The buffer overflow vulnerability allows a remote attacker to execute arbitrary code at all privleges.
SOLUTION: Apply patches supplied by SuSE

--------------------------------------------------------------------------------

VULNERABILITY
ASSESSMENT: The risk is HIGH. The vulnerability results in a root compromise, it is remotely exploitable, and is widely publicized

[Hammer]

Assuming that it is this Chris Shephard that you mean, and after having read the three articles I can't really see that there is that much to it. Offcourse there are improvements over plain x86, but nothing that will stop a competent attacker. So IMHO using PowerPC over x86 is just security through obscurity, and nothing more.

PPC was not a guarantee to shield from Samba buffer overflow issue i.e. refer to
http://www.secunia.com/advisories/8533/
MacOS X was also hit by Samba's buffer overflows.

Related References

Buffer Overflow Attacks and Their Countermeasures
http://www.home.linuxjournal.com/article.php?sid=6701

gcc bounds checking patch
http://web.inter.nl.net/hcc/Haj.Ten.Brugge/

Stackshield
http://www.angelfire.com/sk/stackshield/index.html

StackGuard
http://www.immunix.org/stackguard.html