* Andrew Sullivan:
> (For instance, a DNS company runs completely different name server code on
> completely different hardware and OS platforms in order to make sure not to
> be vulnerable to day-0 exploits. That kind of thing.)
This only helps against crasher bugs. For code injection, it's
devastating if the attacker can compromise one node, and by
diversifying, he or she can choose which code base to attack. I guess
that in the database case, it's mostly the same, with crash bugs on
the one side (where diversification helps), and creeping data
corruption bugs on the other (where it might increase risk). If you
use multiple systems with a comparator, things are different, of
course.
--
Florian Weimer <fweimer@bfk.de>
BFK edv-consulting GmbH http://www.bfk.de/
Kriegsstraße 100 tel: +49-721-96201-1
D-76133 Karlsruhe fax: +49-721-96201-99
