3 ms·

Pretty much any other Unix-like operating system. FreeBSD for example

• rewmie 3y ago
  So far in 2023 all CVEs reported on Linux had at most a CVE score of 0-1, which is also the score of all CVEs reported for FreeBSD. https://www.cvedetails.com/cvss-score-charts.php?product_id=47&fromform=1 https://www.cvedetails.com/cvss-score-charts.php?product_id=... What exactly is your definition of security track record? Do you have any, or are you parroting cliches?
  • Veserv 3y ago
    Almost every vulnerability listed on that site since mid-July 2022 has what is effectively a NULL score which is the starting time of your query. The first Linux CVE I clicked at random has CVSS 0.0: https://www.cvedetails.com/cve/CVE-2022-4095/ https://www.cvedetails.com/cve/CVE-2022-4095/ The same CVE on the official NVD has CVSS 7.8: https://nvd.nist.gov/vuln/detail/CVE-2022-4095 https://nvd.nist.gov/vuln/detail/CVE-2022-4095
  • medler 3y ago
    Ok but if you look over the past 5 years or so, Linux has had 10x as many CVEs per year, including far more with high CVE scores.
    • hollerith 3y ago
      I don't doubt it. I also heard that when a Linux dev find a bug that might be a vulnerability, they often don't bother adding it to the CVE database (and say as much in discussions with the other kernel devs) which casts doubt on the usefulness of counting CVEs as a way to estimate how secure Linux is.