4 ms·

This won't be popular, but: Linus' attitude is part of why Linux sucks at security. Go to e.g. osvdb.org, search for 'Linux kernel': 878 results. Search for 'S

This won't be popular, but: Linus' attitude is part of why Linux sucks at security. Go to e.g. osvdb.org, search for 'Linux kernel': 878 results. Search for 'Solaris', which includes many non-kernel vulnerabilities: 595 results; search for 'freebsd': 171, including e.g. ftpd issues; search for 'OpenBSD': 93, again including stuff like an XSS in OpenBGPD's bgplg (very much not part of the kernel!) This is not merely historical; Full-Disclosure readers get a "vulnerabilities in Linux kernel: 20 issues fixed" every month or so. Yes, Linux has some really nifty stuff, lots of people are looking at it, and things like GrSecurity can be useful. But it also has a lot of (local) kernel-level vulnerabilities compared to similar pieces of software.

ema 16y ago
Just because more linux security bugs are found dosn't mean that linux has more security bugs. I think there are far more linux boxen connected to the internet than solaris and *BSD, so the incentive to search for vulnerabilities should also be greater.
- iuguy 16y ago
  Linux has more security bugs because it's a tangled mess of spaghetti code, large sections of which aren't particularly well maintained. Seriously, try looking for dangling pointer bugs, there's tons, you can just pluck them from the trees. Here's a comment I posted a while back that might be of interest: http://news.ycombinator.com/item?id=2301830 http://news.ycombinator.com/item?id=2301830
  - KonradKlause 16y ago
    Then please start fixing all these bugs and submit patches!
  - tptacek 16y ago
    Spent much time crawling through BSD driver code, have you?
    - iuguy 16y ago
      Haha, I spent a bit looking at Net and FreeBSD, but I stopped because no-one really uses it, so what's the point? To be fair, this stuff happens in BSD land too, but nowhere near as much as on Linux. To be fair again, the Linux codebase is a very different beast and has grown in a very different way.
KonradKlause 16y ago
My home brew operating system has zero bugs. Thus, it's the most secure os in the world. Or it is because no body cares or looks at it? ;-)
- InnocentB 16y ago
  "Zero bugs" and "zero known bugs" are two different matters entirely :)
  - KonradKlause 16y ago
    True. Please tell this also the kids who think sites like osvdb.org tells them how secure a OS is...
KonradKlause 16y ago
BTW: I'm switching over to NetWare now. osvdb.org shows only one kernel vulnerability!
tptacek 16y ago
It won't be popular for a variety of reasons, the foremost two being: 1. It's a very dumb metric, for reasons stated well downthread and for many others (the bewildering number of off-by-default hardware and kernel features many of those vulns appear in being another). 2. The fairly obvious rebuttal that things Linus says on message boards actually have little to do with the security of Linux, and that the particular thing Linus said this time has practically nothing to do with the security of Linux. With the possible exception of OpenBSD†, nobody clueful picks server platforms other than Linux with the expectation that it is going to be easier to keep them secure on the Internet. † Reasonable people can disagree about the extent to which OBSD is a win; in 2011, I'd rather have Spengler on my side than Theo.
- JoachimSchipper 16y ago
  It is not a very good proxy for how likely you are to get 0wned. It is available, though, and I'm not convinced that it's so bad that a 5x (Linux kernel/FreeBSD) or 9.4x (Linux kernel/OpenBSD) difference still doesn't say anything. Linus' words don't affect code quality; but wanting to move quickly does, and Linux does move quickly. I agree that Spengler is pretty awesome, though.
- iuguy 16y ago
  > Reasonable people can disagree about the extent to which OBSD is a win; in 2011, I'd rather have Spengler on my side than Theo. To quote the wisdom of the dude: "Well, yeah. That's like, your opinion, man."

ema 16y ago

Just because more linux security bugs are found dosn't mean that linux has more security bugs. I think there are far more linux boxen connected to the internet than solaris and *BSD, so the incentive to search for vulnerabilities should also be greater.

iuguy 16y ago
Linux has more security bugs because it's a tangled mess of spaghetti code, large sections of which aren't particularly well maintained. Seriously, try looking for dangling pointer bugs, there's tons, you can just pluck them from the trees. Here's a comment I posted a while back that might be of interest: http://news.ycombinator.com/item?id=2301830 http://news.ycombinator.com/item?id=2301830
- KonradKlause 16y ago
  Then please start fixing all these bugs and submit patches!
- tptacek 16y ago
  Spent much time crawling through BSD driver code, have you?
  - iuguy 16y ago
    Haha, I spent a bit looking at Net and FreeBSD, but I stopped because no-one really uses it, so what's the point? To be fair, this stuff happens in BSD land too, but nowhere near as much as on Linux. To be fair again, the Linux codebase is a very different beast and has grown in a very different way.

KonradKlause 16y ago

My home brew operating system has zero bugs. Thus, it's the most secure os in the world. Or it is because no body cares or looks at it? ;-)

InnocentB 16y ago
"Zero bugs" and "zero known bugs" are two different matters entirely :)
- KonradKlause 16y ago
  True. Please tell this also the kids who think sites like osvdb.org tells them how secure a OS is...

KonradKlause 16y ago

BTW: I'm switching over to NetWare now. osvdb.org shows only one kernel vulnerability!

tptacek 16y ago

It won't be popular for a variety of reasons, the foremost two being: 1. It's a very dumb metric, for reasons stated well downthread and for many others (the bewildering number of off-by-default hardware and kernel features many of those vulns appear in being another). 2. The fairly obvious rebuttal that things Linus says on message boards actually have little to do with the security of Linux, and that the particular thing Linus said this time has practically nothing to do with the security of Linux. With the possible exception of OpenBSD†, nobody clueful picks server platforms other than Linux with the expectation that it is going to be easier to keep them secure on the Internet. † Reasonable people can disagree about the extent to which OBSD is a win; in 2011, I'd rather have Spengler on my side than Theo.

JoachimSchipper 16y ago
It is not a very good proxy for how likely you are to get 0wned. It is available, though, and I'm not convinced that it's so bad that a 5x (Linux kernel/FreeBSD) or 9.4x (Linux kernel/OpenBSD) difference still doesn't say anything. Linus' words don't affect code quality; but wanting to move quickly does, and Linux does move quickly. I agree that Spengler is pretty awesome, though.
iuguy 16y ago
> Reasonable people can disagree about the extent to which OBSD is a win; in 2011, I'd rather have Spengler on my side than Theo. To quote the wisdom of the dude: "Well, yeah. That's like, your opinion, man."