4 ms·

Just switch to Linux if you are already switching.

by shmerl 5y ago

consumer451 5y ago
Win 10 open CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32238/Microsoft-Windows-10.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... Linux kernal open CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html https://www.cvedetails.com/vulnerability-list/vendor_id-33/p... Please don't shoot the messenger.
- atoav 5y ago
  So what you wanna say is that Linux people find more CVEs?
  - consumer451 5y ago
    Sure, ok.. and they are public knowledge and they are not fixed.
    - Jon_Lowtek 5y ago
      your links do not filter for "not fixed"
      - consumer451 5y ago
        My sincere apologies. I don't have a horse in this race. https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/top-50-products.php I would like to add that in my muggle opinion, a CVE being closed does not mean that every desktop has been patched.
        Jon_Lowtek 5y ago
        There is no such thing as an open or closed CVE. Conflating "description is public" with "has been patched" would be wrong, but claiming that all existing CVEs ever are "open vulnerabilities" is nonsensical.
        consumer451 5y ago
        OK, thank you. However, the downside of publicly reporting vulnerabilities is that everyone has this knowledge and does not need a team of pen testers to find these vuln's, correct? Is there any public info on linux/macos/win desktop patch rates? I have personally been screwed by Ubuntu patching. I am not a total idiot and I assume I can't be the only one. https://news.ycombinator.com/item?id=28957314 https://news.ycombinator.com/item?id=28957314 edit: I realize that I have foot in mouth syndrome in this thread, but does anyone have real world patch rates on desktop OSes? Also, am I way off in the thought that publicly posting CVEs allows less technical adversaries to attack you? I believe in the benefits of OSS, but everything has positives and negatives. If desktop linux has lower patch rates, as is my experience, then maybe we shouldn't be recommending desktop linux to everyone? These are honest questions in the hope of learning.
        Volundr 5y ago
        It's generally accepted that open published CVEs push vendors to actually patch their software, instead of covering up and ignoring bugs. It also gives you a heads up that the software your running has an issue and you need to update. It's tempting to think that making this knowledge publicly available gives the bad guys a roadmap, but in security you really can't just assume that because a vulnerability isn't public knowledge the bad guys won't know about it. Frankly with the proliferation of the vulnerability black market, lack of public disclosure of CVEs would mean that only the black hats know it.
    - IntelMiner 5y ago
      You know what they say about "security through obscurity" right?
      - consumer451 5y ago
        I feel that this used to be a large advantage of using less popular OSes.
  - Zababa 5y ago
    A recent example of that: https://news.ycombinator.com/item?id=28978086 https://news.ycombinator.com/item?id=28978086
    - consumer451 5y ago
      Honest question.. any stats on linux/win/macos desktop user patch rates? As in, who is actually updating the most?
- e2le 5y ago
  1) The CVE list for Linux begins at 1996 while for Windows 10 it begins at 2015. 2) Linux users appear to be more adept/willing to find and report bugs. A bug that's out of sight and out of mind doesn't mean that it doesn't exist. https://old.reddit.com/r/gamedev/comments/qeqn3b/despite_having_just_58_sales_over_38_of_bug/ https://old.reddit.com/r/gamedev/comments/qeqn3b/despite_hav... 3) I suspect the openness of Linux facilitates individuals willing to find and report bugs.
- saagarjha 5y ago
  Number of CVEs and CVSS scores is a terrible way to judge relative security.
  - consumer451 5y ago
    OK, so that combined with patch rates would be a better way? Any data on that? Disclaimer: I am not religious about operating systems. I am trying to learn here.
    - hdjjhhvvhga 5y ago
      Practically speaking, it's impossible to compare these metrics between open and closed systems for various reasons. In open systems, bug reporting is a part of the culture. Moreover, as you are closer to the vendor, you can actually count on it being fixed, in trivial cases overnight. You have public bug tracking systems where the bug is almost like your baby: you talk to others about it, you argue in favor if it being fixed. Moreover, a good number of users actually fixes the bugs. Sometimes it's enough a bug report is published that you patch your own system without asking anyone. As source code is available, for some people it's a kind of a hobby to go through and find bugs. Some do it for sport, some for learning/as a part of their curriculum, some as a part of their product development or audits. With closed systems, many of these points above are not true. Users are not accustomed to reporting bugs, and even if they report a bug sometimes, they become put off as they don't know what happens with it later. They don't actively analyze the source code to find bugs. If a bug is found, they pray the patch is released soon. It is very rare someone has enough low-level skills to manually patch a binary based on a CVE description. Given these differences, I think the only viable metric is the response time, i.e. the time between the bug being disclosed and fixed.
      - consumer451 5y ago
        Thank you very much for taking the time to respond.
    - saagarjha 5y ago
      Unfortunately not. Judging security is actually really hard! But CVSS is essentially a useless number in every sense, and number of CVEs is not directly useful because different OSes get different amounts of attention. My hobby OS is not infinitely more secure than Linux just because it has no CVEs, for example. On might thing that "mitigations" or "vendor approachability" could be used, but they are only part of the story and have their own problems: some software (not saying which…) is known to just glom on "mitigations" without abandon that don't actually help. And, while rarer, there are vendors who respond appropriately to bug reports but fail to ever actually meaningfully improve security. Really, the best way to judge security is to ask security researchers: they break the software, they're at the forefront of what it takes to do this and what kinds of things the software is doing to keep them out. They'll tell you which things work and which don't, and how "serious" a vulnerability is (assuming it's not one they found, because they're not immune to bragging :P). In general, across the modern OSes, there is no "one" OS that is more security on every front. Windows has its own issues in subsystem X, Linux is broken in responding to Y, etc.

Just switch to Linux if you are already switching.

by shmerl 5y ago

Just switch to Linux if you are already switching.

Win 10 open CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32238/Microsoft-Windows-10.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... Linux kernal open CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html https://www.cvedetails.com/vulnerability-list/vendor_id-33/p... Please don't shoot the messenger.

atoav 5y ago
So what you wanna say is that Linux people find more CVEs?
- consumer451 5y ago
  Sure, ok.. and they are public knowledge and they are not fixed.
  - Jon_Lowtek 5y ago
    your links do not filter for "not fixed"
    - consumer451 5y ago
      My sincere apologies. I don't have a horse in this race. https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/top-50-products.php I would like to add that in my muggle opinion, a CVE being closed does not mean that every desktop has been patched.
      - Jon_Lowtek 5y ago
        There is no such thing as an open or closed CVE. Conflating "description is public" with "has been patched" would be wrong, but claiming that all existing CVEs ever are "open vulnerabilities" is nonsensical.
        consumer451 5y ago
        OK, thank you. However, the downside of publicly reporting vulnerabilities is that everyone has this knowledge and does not need a team of pen testers to find these vuln's, correct? Is there any public info on linux/macos/win desktop patch rates? I have personally been screwed by Ubuntu patching. I am not a total idiot and I assume I can't be the only one. https://news.ycombinator.com/item?id=28957314 https://news.ycombinator.com/item?id=28957314 edit: I realize that I have foot in mouth syndrome in this thread, but does anyone have real world patch rates on desktop OSes? Also, am I way off in the thought that publicly posting CVEs allows less technical adversaries to attack you? I believe in the benefits of OSS, but everything has positives and negatives. If desktop linux has lower patch rates, as is my experience, then maybe we shouldn't be recommending desktop linux to everyone? These are honest questions in the hope of learning.
        Volundr 5y ago
        It's generally accepted that open published CVEs push vendors to actually patch their software, instead of covering up and ignoring bugs. It also gives you a heads up that the software your running has an issue and you need to update. It's tempting to think that making this knowledge publicly available gives the bad guys a roadmap, but in security you really can't just assume that because a vulnerability isn't public knowledge the bad guys won't know about it. Frankly with the proliferation of the vulnerability black market, lack of public disclosure of CVEs would mean that only the black hats know it.
  - IntelMiner 5y ago
    You know what they say about "security through obscurity" right?
    - consumer451 5y ago
      I feel that this used to be a large advantage of using less popular OSes.
- Zababa 5y ago
  A recent example of that: https://news.ycombinator.com/item?id=28978086 https://news.ycombinator.com/item?id=28978086
  - consumer451 5y ago
    Honest question.. any stats on linux/win/macos desktop user patch rates? As in, who is actually updating the most?
e2le 5y ago
1) The CVE list for Linux begins at 1996 while for Windows 10 it begins at 2015. 2) Linux users appear to be more adept/willing to find and report bugs. A bug that's out of sight and out of mind doesn't mean that it doesn't exist. https://old.reddit.com/r/gamedev/comments/qeqn3b/despite_having_just_58_sales_over_38_of_bug/ https://old.reddit.com/r/gamedev/comments/qeqn3b/despite_hav... 3) I suspect the openness of Linux facilitates individuals willing to find and report bugs.
saagarjha 5y ago
Number of CVEs and CVSS scores is a terrible way to judge relative security.
- consumer451 5y ago
  OK, so that combined with patch rates would be a better way? Any data on that? Disclaimer: I am not religious about operating systems. I am trying to learn here.
  - hdjjhhvvhga 5y ago
    Practically speaking, it's impossible to compare these metrics between open and closed systems for various reasons. In open systems, bug reporting is a part of the culture. Moreover, as you are closer to the vendor, you can actually count on it being fixed, in trivial cases overnight. You have public bug tracking systems where the bug is almost like your baby: you talk to others about it, you argue in favor if it being fixed. Moreover, a good number of users actually fixes the bugs. Sometimes it's enough a bug report is published that you patch your own system without asking anyone. As source code is available, for some people it's a kind of a hobby to go through and find bugs. Some do it for sport, some for learning/as a part of their curriculum, some as a part of their product development or audits. With closed systems, many of these points above are not true. Users are not accustomed to reporting bugs, and even if they report a bug sometimes, they become put off as they don't know what happens with it later. They don't actively analyze the source code to find bugs. If a bug is found, they pray the patch is released soon. It is very rare someone has enough low-level skills to manually patch a binary based on a CVE description. Given these differences, I think the only viable metric is the response time, i.e. the time between the bug being disclosed and fixed.
    - consumer451 5y ago
      Thank you very much for taking the time to respond.
  - saagarjha 5y ago
    Unfortunately not. Judging security is actually really hard! But CVSS is essentially a useless number in every sense, and number of CVEs is not directly useful because different OSes get different amounts of attention. My hobby OS is not infinitely more secure than Linux just because it has no CVEs, for example. On might thing that "mitigations" or "vendor approachability" could be used, but they are only part of the story and have their own problems: some software (not saying which…) is known to just glom on "mitigations" without abandon that don't actually help. And, while rarer, there are vendors who respond appropriately to bug reports but fail to ever actually meaningfully improve security. Really, the best way to judge security is to ask security researchers: they break the software, they're at the forefront of what it takes to do this and what kinds of things the software is doing to keep them out. They'll tell you which things work and which don't, and how "serious" a vulnerability is (assuming it's not one they found, because they're not immune to bragging :P). In general, across the modern OSes, there is no "one" OS that is more security on every front. Windows has its own issues in subsystem X, Linux is broken in responding to Y, etc.