3 ms·
Looking at the charts provided, out of 34 fixed bugs of "high importance" only 8 have been introduced in the last 5 years (i.e. after v3.0). So 75% of security
by e1g 10y ago
Looking at the charts provided, out of 34 fixed bugs of "high importance" only 8 have been introduced in the last 5 years (i.e. after v3.0). So 75% of security fixes are for "legacy" bugs that have been introduced forever ago. The same ratio seems to hold true for the charts of "mid" and "low" importance (bit hard to tell with that resolution).
Over the same period, the kernel codebase grew from 8M LOC to 22M LOC. I'm not sure how to interpret this gap in security issues between the old "small" code vs the new massive code. Either kernel developers are a great deal more careful and the new code has a great deal fewer bugs, or we are about to get hit with a massive backlog of disclosures that bad guys are quietly piling up.
- pixl97 10y ago>the kernel codebase grew from 8M LOC to 22M LOC. I believe most of that growth has been in the /drivers section of the kernel. While a driver can still root your kernel, the chance of one affecting you is much lower, unless it is one of the generic/common ones.
- e1g 10y agoI ran some stats[1], and turns out you're absolutely right: /drivers accounts for 55% of growth in the codebase. Didn't know it was that fat! [1] http://imgur.com/a/pdvFP http://imgur.com/a/pdvFP
- deleted 10y ago[deleted]
- woliveirajr 10y agoAnd arch takes a big slice too. Perhaps new supported functionalities for specific processors ?
- hibbelig 10y agoLet's say for simplicity's sake that _every_ bug needs exactly five years until it is found. This means that you will see zero bugs introduced in the last five years -- they haven't been found yet!