3 ms·
The Linux kernel developers don't release security fixes directly to end users, unlike e.g. Apple and Microsoft. Perhaps the Linux numbers should also include
by tpmx 5y ago
The Linux kernel developers don't release security fixes directly to end users, unlike e.g. Apple and Microsoft.
Perhaps the Linux numbers should also include the integration/QA lead time of the distros if it's meant to be a competition.
- jka 5y agoYou make a good point here -- the time-to-deployment is significant as well as the time-to-resolve. It's also true that once a fix is available in any Linux source tree, advanced users can begin to use it from that moment onwards. Arguably some users could develop their own workaround or solution even before one is available upstream, should they want to (because the code and tools to compile it are all available to them). (similarly it'd be valuable to analyze how long it takes for the majority of end-users to upgrade across common operating systems. something like this chart[1] of Firefox version traffic history, but for security fix rollout) [1] - https://web.archive.org/web/20201220010043/https://paulcalvano.com/assets/wp-content/uploads/2017/11/FirefoxBrowserVersionTrafficHistory_20171126.jpg https://web.archive.org/web/20201220010043/https://paulcalva...
- tpmx 5y agoSure - there is definitely a real benefit for advanced users of the Linux kernel. Epecially if your organization has someone on the Linux kernel security team, I guess.
- bombcar 5y agoThis can also be a downside where the fix reveals the vulnerability and it begins to be exploited before distros get fixes out. Iirc there recently was a big one where the fix was snuck into a large Linus patch and not revealed until all distros had a chance to release updated kernels.