Hacker News new | ask | show | jobs
by CryoLogic 2688 days ago
It's also OSS and it is much easier to surface security bugs for Linux than for Windows.

In my own research, I have attempted to send Microsoft security bugs only to be told they would be backlogged and reviewed later (which never happened to my knowledge).
1 comments
21 2688 days ago
> It's also OSS and it is much easier to surface security bugs for Linux than for Windows.

Shouldn't then the number of bugs decrease much faster, since they are easier to find? Unless they are introduced at even a greater rate than the ones in Windows.

link
Dahoon 2688 days ago
No, because linux OS's includes a lot of software in their repositories and new packages are added all the time. Look closer at the list. "40 Debian CVEs in 2019" breaks down to this:

* Google Chrome: 36

* Artifex Ghostscript: 1

* ZeroMQ: 1

* macOS CUPS: 2

* Debian: 0

link
sanxiyn 2688 days ago
You are right. One current estimate is that Linux is introducing security bugs at a rate faster than they are fixed.
link
Dahoon 2687 days ago
New and better tools are finding bugs in old code, so it isn't really that more and more bugs get into new code:

"But, your editor wondered, could we be doing more than we are? The response your editor got was, in essence, that the bulk of the holes being disclosed were ancient vulnerabilities which were being discovered by new static analysis tools. In other words, we are fixing security problems faster than we are creating them. "

https://lwn.net/Articles/410606/

link