Hacker News new | ask | show | jobs
by 21 2685 days ago
> It's also OSS and it is much easier to surface security bugs for Linux than for Windows.

Shouldn't then the number of bugs decrease much faster, since they are easier to find? Unless they are introduced at even a greater rate than the ones in Windows.
2 comments
Dahoon 2685 days ago
No, because linux OS's includes a lot of software in their repositories and new packages are added all the time. Look closer at the list. "40 Debian CVEs in 2019" breaks down to this:

* Google Chrome: 36

* Artifex Ghostscript: 1

* ZeroMQ: 1

* macOS CUPS: 2

* Debian: 0

link
sanxiyn 2685 days ago
You are right. One current estimate is that Linux is introducing security bugs at a rate faster than they are fixed.
link
Dahoon 2684 days ago
New and better tools are finding bugs in old code, so it isn't really that more and more bugs get into new code:

"But, your editor wondered, could we be doing more than we are? The response your editor got was, in essence, that the bulk of the holes being disclosed were ancient vulnerabilities which were being discovered by new static analysis tools. In other words, we are fixing security problems faster than we are creating them. "

https://lwn.net/Articles/410606/

link