5 ms·

And it has MORE reported CVEs than Windows:https://www.cvedetails.com/top-50-products.php?year=2018 https://www.cvedetails.com/top-50-products.php?year=2018

by 21 8y ago

CryoLogic 8y ago
It's also OSS and it is much easier to surface security bugs for Linux than for Windows. In my own research, I have attempted to send Microsoft security bugs only to be told they would be backlogged and reviewed later (which never happened to my knowledge).
- 21 8y ago
  > It's also OSS and it is much easier to surface security bugs for Linux than for Windows. Shouldn't then the number of bugs decrease much faster, since they are easier to find? Unless they are introduced at even a greater rate than the ones in Windows.
  - Dahoon 8y ago
    No, because linux OS's includes a lot of software in their repositories and new packages are added all the time. Look closer at the list. "40 Debian CVEs in 2019" breaks down to this: * Google Chrome: 36 * Artifex Ghostscript: 1 * ZeroMQ: 1 * macOS CUPS: 2 * Debian: 0
  - sanxiyn 8y ago
    You are right. One current estimate is that Linux is introducing security bugs at a rate faster than they are fixed.
    - Dahoon 8y ago
      New and better tools are finding bugs in old code, so it isn't really that more and more bugs get into new code: "But, your editor wondered, could we be doing more than we are? The response your editor got was, in essence, that the bulk of the holes being disclosed were ancient vulnerabilities which were being discovered by new static analysis tools. In other words, we are fixing security problems faster than we are creating them. " https://lwn.net/Articles/410606/ https://lwn.net/Articles/410606/
imtringued 8y ago
Maybe because more people can report them? With Windows you'll be lucky if Microsoft doesn't outright deny their existence.
- Dahoon 8y ago
  That and saying Debian isn't like saying Windows. Debian is like 50.000 packages. Pretty much all CVES in this year so far listed as Debian CVES has been in Google Chrome browser...
TheForumTroll 8y ago
When the list says "Debian" or "Ubuntu" it includes all software in Debian and Ubuntu. That includes software like Google Chrome, Firefox, Python, Ruby, etc. For example out of the 40 listed in 2019 in Debian 36(!) are Google Chrome bugs, not Debian bugs. Do go ahead and count CVEs in Windows and Windows software (games, office, databases, browsers, etc.) and come back with your results for an apples to apples comparison or go back to Reddit and troll.
Dahoon 8y ago
When the list says Debian or Ubuntu it includes all software in Debian and Ubuntu. That includes software like Google Chrome, Firefox, Python, Ruby, etc. For example out of the 40 listed in 2019 in Debian 36(!) are Chrome bugs, not Debian bugs. Sort by Vendor: https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php

And it has MORE reported CVEs than Windows:https://www.cvedetails.com/top-50-products.php?year=2018 https://www.cvedetails.com/top-50-products.php?year=2018

by 21 8y ago

And it has MORE reported CVEs than Windows:https://www.cvedetails.com/top-50-products.php?year=2018 https://www.cvedetails.com/top-50-products.php?year=2018

CryoLogic 8y ago

It's also OSS and it is much easier to surface security bugs for Linux than for Windows. In my own research, I have attempted to send Microsoft security bugs only to be told they would be backlogged and reviewed later (which never happened to my knowledge).

21 8y ago
> It's also OSS and it is much easier to surface security bugs for Linux than for Windows. Shouldn't then the number of bugs decrease much faster, since they are easier to find? Unless they are introduced at even a greater rate than the ones in Windows.
- Dahoon 8y ago
  No, because linux OS's includes a lot of software in their repositories and new packages are added all the time. Look closer at the list. "40 Debian CVEs in 2019" breaks down to this: * Google Chrome: 36 * Artifex Ghostscript: 1 * ZeroMQ: 1 * macOS CUPS: 2 * Debian: 0
- sanxiyn 8y ago
  You are right. One current estimate is that Linux is introducing security bugs at a rate faster than they are fixed.
  - Dahoon 8y ago
    New and better tools are finding bugs in old code, so it isn't really that more and more bugs get into new code: "But, your editor wondered, could we be doing more than we are? The response your editor got was, in essence, that the bulk of the holes being disclosed were ancient vulnerabilities which were being discovered by new static analysis tools. In other words, we are fixing security problems faster than we are creating them. " https://lwn.net/Articles/410606/ https://lwn.net/Articles/410606/

imtringued 8y ago

Maybe because more people can report them? With Windows you'll be lucky if Microsoft doesn't outright deny their existence.

Dahoon 8y ago
That and saying Debian isn't like saying Windows. Debian is like 50.000 packages. Pretty much all CVES in this year so far listed as Debian CVES has been in Google Chrome browser...

TheForumTroll 8y ago

When the list says "Debian" or "Ubuntu" it includes all software in Debian and Ubuntu. That includes software like Google Chrome, Firefox, Python, Ruby, etc. For example out of the 40 listed in 2019 in Debian 36(!) are Google Chrome bugs, not Debian bugs. Do go ahead and count CVEs in Windows and Windows software (games, office, databases, browsers, etc.) and come back with your results for an apples to apples comparison or go back to Reddit and troll.

Dahoon 8y ago

When the list says Debian or Ubuntu it includes all software in Debian and Ubuntu. That includes software like Google Chrome, Firefox, Python, Ruby, etc. For example out of the 40 listed in 2019 in Debian 36(!) are Chrome bugs, not Debian bugs. Sort by Vendor: https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php