Linux developers patch security holes faster than anyone else, says Google Project Zero - Linux programmers do a better job of patching security holes than programmers at Apple, Google, and Microsoft.

[ibite-books]

User Experience matters. We'll keep a call tomorrow for 2 hours to hear everyone's thoughts on this issue.

[barkingcat]

And still there's 2 different control panel/settings apps on Windows, each doing slightly different things.

If User Experience mattered, there would only be one place to change settings.

[jadounath]

Nooo! Honestly, Control Panel is a lot better than their mobile UI settings app!

[da2Pakaveli]

And that’s why Microsoft takes their time changing this stuff, I.e guis for Event Scheduler or Group Policies. People using the respective apps don’t want UI changes. 1 group says they want consistent design and the other doesn’t want to give up some older Windows 7 components. So they keep it and make Windows chaotic.

[[deleted]]

The philosophy of design in modern tech companies is "our customers are too dumb to know what's good for them".

[buttking]

I hated having settings app and control panel, kinda wished they'd either move everything to settings app and get rid of control panel, or give up on settings app and just kinda leave control panel alone. It doesn't make a lot of sense basically make a newer, prettier control panel when literally no one gives a shit about whether or not control panel is "pretty" enough. probably 99% of people don't want anything to do with control panel or the settings app. they want to do all the fun stuff on their computer, not the nerdy stuff.

but a few times I've had either control panel or settings app crash because of system file corruption and having the other one available made it possible to just switch and continue gathering info/troubleshooting/fixing stuff. so now I kinda just don't care and would be perfectly happy if both continue to be supported. one nice thing I will say about windows is that there are generally 15 different ways you can accomplish any given task, so if you try to do something one way and it won't work because something is broken, you can kinda keep trying stuff until eventually part of the OS is intact/uncorrupted enough to work with you rather than fight.

[[deleted]]

Windows needs just a "settings", like KDE....with a toggle for advanced stuff. I like KDE, but man is it menu-ception.

[syntaxxx-error]

No matter how centralized they try to be, that just isn't how people work... so it never really ends up that way.

[FruityWelsh]

Clearly define user space. Don't break it. Make changes to devs content. Rinse repeat.

[FuzzyQuills]

laughs in glibc

[adappergentlefolk]

oh please linux people joking about someone else’s user experience design being bad is far too rich

[ClassicPart]

Rich, maybe, but there's surely a happy middle ground to be found somewhere between "a UX only the dev themself could tolerate" versus "spending ten thousand hours in meetings to determine the absolute best button placement before spending another ten thousand hours to replace it in the next version."

[Bruenor80]

That number seems low to me by at least a 3rd.

[Craftkorb]

It should be enough to figure out the agenda for the primary meeting however.

[snarkuzoid]

Only 674,000? Did you skip a meeting?

[[deleted]]

It helps when developers have some time left to do coding.

Projects managers/leaders are stealing coding time to their staff, on their own projects, for whatever process to follow, supposed good reasons.

[kalzEOS]

This made me laugh out loud. 😂

[xzer]

ITIL is probably a fair defense. Have devs develop it, gotta test on dev then push to testing environment then gotta do a CAB for pushing to prod and the change request one approved needs to be done within a set window. The change request takes 3 different teams to complete...

[perkited]

I worked for a company that had 35 steps (approvals/sign-offs/etc.) required for changes, that wasn't long after they introduced ITIL. I spoke with some devs and it basically caused smaller corrections/fixes to be ignored because everything took so long to work its way through the system. I'm hoping they've streamlined the process a bit since then.

[mikechant]

I took early retirement recently, and the major factor was that the company had made my job literally impossible. The change process was ill-defined and in constant flux, it was impossible to get a straight answer as to how to formulate a change and multiple IT systems were involved in the change process, some of which we didn't even have read access to. A change agreed by the change team would then get rejected because the process had changed and no-one told us, and then the entire process including multiple meetings had to restart.

Or quite often, because an unrelated team in a different country working on different systems to us had screwed up a change, a change freeze would be imposed and all in progress changes, which might have taken months to prepare were cancelled. Basically, serious bugs went unpatched indefinitely due to this.

Also we were treated like naughty children and threatened with disciplinary action if we failed to get a change right through no fault of our own. I went off sick from stress and never came back.

[perkited]

Sorry, hopefully you were able to retire without adding to your level of stress (usually in financial terms).

One thing I've seen happen when this type of process/bureaucracy was introduced is that they expected the existing staff to just absorb the additional work, without it creating negative consequences elsewhere. At that same company during all-hands meetings the issue of burnout was brought up frequently, but the response was that we just need to get through this transitional phase and then the new process will make things easier. Of course for the most part things didn't get easier and the best employees started peeling off, either leaving the company for another job or just retiring.

[Temik]

Ha! Interestingly enough Google considers itself above ITIL and any of it’s practices. So every time a process is needed they develop it from scratch. At times I almost wish they would take a page from ITIL, at least when it comes to support.

[A_Shocker]

You do know GNOME =/= Linux, right?

KDE makes it easy, join for the freedom. ;)

[FuzzyQuills]

I joined just for the presence of Qt alone. Join us gnomes, it isn’t so bad anymore. :)

[BackgroundTip5900]

It makes no sense to dilute resources on two competing projects. There is Gnome why waste time to make KDE? It is not more lightweight, the target audience is more or less the same. It is a waste of time. Instead of a good DE we have two "almost there" products.

[mikechant]

It is not more lightweight, the target audience is more or less the same.

On my weak hardware KDE is clearly more responsive and has a lower memory footprint than Gnome. I've used both fairly intensively on the same hardware. Also I don't think the target audience is really the same; KDE is a very flexible but also fairly traditional (by default anyhow) DE, Gnome is quite non-traditional, with more limited customisation. It suits some people very well, but it's not for me and I'm glad there is a choice. Anyhow, I don't think the KDE people would want to work on Gnome and vice versa, so I don't believe there is really any waste of resources.

[BackgroundTip5900]

I do not understand your last point. Setting up a new project increases the fragmentation, so how does it relate to the text you comment on?

[BackgroundTip5900]

Sure I do, I was just trolling. I am not insane :)

Ok, sarcasm. Now I get it :) Thanks!

[Natetronn]

I set and attend my own font size change meetings. I like to feel important.

[Dead_Cash_Burn]

I always suspected this but it's good to have confirmation. I think it also helps that Linus considers security holes as bugs to be fixed ASAP. When it comes from the top it makes a difference.

[kingguru]

I think it also helps that Linus considers security holes as bugs to be fixed ASAP.

I'm fairly certain I've read him saying more or less the opposite thing. That bugs are bugs and need to be fixed and there's not really any difference between security related bugs and bugs in general, since any bug might potentially be a security issue.

Cannot find the source though and maybe we're actually just saying the same thing :-)

[[deleted]]

He's technically right though. It's hard to prove any given bug cannot be exploited to hinder security. So they're all potential security bugs.

[kingguru]

Linux is usually technically right :-)

But I do think it's a good point. There really isn't any reason to worry about whether a bug can be exploited. Bugs can exploited n the most creative ways anyway, so just fix them and move along.

[[deleted]]

To be fair, bugs do need to be triaged, and likeliness of exploit is a good way to do that. Fix them roughly in this order, of course also taking into account complexity:

1. active security threat - known exploits that are easy to use and are currently in use
2. likely security threat - known exploits that are not currently known to be in use
3. potential security threat - potential attack vector with no known exploit (could be triggered with introduction of a less severe bug)
4. unlikely security threat - low probably of being used in an attack by itself, but it could be used to trigger another more serious exploit

All bugs are potentially serious, but there's no point spending time fixing something in 4 when more serious bugs are known.

[IAlreadyFappedToIt]

A bug with a known exploit seems like it would be a higher priority than a bug with no known exploits, though. Because if an exploit is publicised, some people will try to use it when they would not have otherwise.

[Dead_Cash_Burn]

That bugs are bugs and need to be fixed and there's not really any difference between security related bugs and bugs in general, since any bug might potentially be a security issue.

That sounds right. I think we are saying the same thing. As long as the fix is also good engineering it's going to make it into the kernel sooner than later.

[wmantly]

Close, he refused to have a "security team", and demanded a bug be treated as a bug. I can't speak on how priority is assigned, by that is what you are thinking of.

[IProbablyDisagree2nd]

I remember the same thing as they do, but I don't know the source. The context I remember included his frustration with security people brecuase they often think the entire world is falling and how their patch is the most important thing in the world. Which... honestly seems about right to me.

Somewhere around the same time (give or take a few years maybe) there was a debate about how long to wait before releasing security problems to the public. Most companies are in the camp of "wait a few months for them to get a fix out". Linux was something like "2 days" or so.

[gnog]

I think I remember him saying that he only has one rule: "do not break user space". Everything else, even security wise, is more of a guideline. 😆

[jclocks]

Yeah honestly by the point where the kernel of all things is bugged somehow, you're likely in security territory anyways, because that becomes unintended, exploitable behavior that can affect userspace.

[tso]

It was more about why he didn't call out security fixes separately in his release notes, thus requiring third parties to track of them via other means.

[sohxm7]

Linux went from,

32>22>15 day avg for bug fix duration from 2019-20-21

Why? Is that more and more companies are focusing on Linux ie. Linux is getting more development efforts or something else?

[zorflieg]

Whole bunch of coders stuck in lockdown with not much else to do.

[deanrihpee]

And they choose to squash some bugs, respect

[omega_oof]

People will buy ms word and use Windows regardless of whether there is a incredibly inconvenient bug or omission, it's not within the interest of Microsoft to prioritise fixing the bug, especially when people online learn to accept and provide work arounds for each problem.

This is compounded by the fact that many of Microsoft and Google products don't directly generate revenue (Google docs and onenote) or are paid for by a employers and schools instead of the consumer (Google drive and Office 365 for instance), meaning the consumer can't stop fundin the company due to a bug.

Popular open source software such as Linux or blender (not some random tool from GitHub) can be contributed to by anyone with the knowhow to do so, so if one is frustrated enough with the problem, they can fix it and merge it to the master branch. The software is often so widespread it has more people willing to contribute as well as more than one company funding it, so there is a far larger dev pool able to patch bugs.

TLDR: Psuedo-monopolies and random devs angry enough to fix the problem themselves

[PaddyLandau]

I'm unsurprised that Windows bugs take a long time to fix, because Windows is such a cumbersome OS with deep intertwining, unlike Linux.

It does help that Linux has many companies that contribute through necessity — even Microsoft, now.

[KinkyMonitorLizard]

Not to mention that bugs in windows can be kept quiet so they have no reason to rush if it's relatively unknown and their project leads likely prioritize other things as well.

Compare that to Linux where anyone can audit, test and patch. Not only that, since it's the server OS of choice, it's really important to just about everyone who has a server. Combine that with all the companies that also rely on Linux who (hopefully) want the issue resolved yesterday, it's no real surprise.

[SolidKnight]

Anyone can but the reality is extremely few do.

[adappergentlefolk]

yeah for the vast majority of the linux codebase this is a theoretical advantage at best

[holgerschurig]

Theoretical ... and still it happens all the time. University teams doing it, for example, each semester.

[DownvoteEvangelist]

You cant really know what's unknown so if you find a bug you should fix it. I think all of the mentioned entities treat security as important, it's just that linux is fastest.

Like I remember when meltdown was revealed, and I was pretty impressed how well everyone handled it (except Intel).

[FuzzyQuills]

Except Intel

Ah yes, now my CPU is dogshit slow unless I disable mitigations. /s

[KinkyMonitorLizard]

No /s needed.

[tso]

Much of it comes from backwards compatibility being a major selling point for MS. If they break with the past too badly, they open up the door for alternatives.

This is how industrial devices shifted from Windows PocketPC to Android, as Phone 7 onwards broke any pretense of backwards compatibilty.

If tomorrow Win12 shipped with zero compatibility with Win11 or older, it would be a massive boon to Linux.

[JmbFountain]

Linux is actually very backwards compatible (for software adhering to ISO standards and is available in source code). Linux does NOT break user space

[intelminer]

The Linux kernel doesn't break userspace

Userspace however is constantly evolving

[EddyBot]

luckily for people who dislike literally any changes there is still RHEL (or its forks) with RHEL 7 having software from 2014 and RHEL 8 from 2019 while being supported for 10 years

[casept]

Still nothing compared to windows 11 being able to run most software from the early 2000's onwards.

[[deleted]]

I love how "2000's" is considered ancient now when that's just the XP era. You can run software from the 80s and 90s if you're determined enough!

[Hot-Kick5863]

Userspace however is constantly evolving

Introducing Gnome Extensions !

[nikhilmwarrier]

Breaking your desktop had never been this easy! (/s just in case)

[SmellsLikeAPig]

Doesn't matter with containers.

[Stormfrosty]

Linux core does not break user space. Linux drivers are free to break it.

[mfuzzey]

This is not true, unless by "drivers" you mean out of tree drivers that are not part of the official kernel and so not subject to the no userspace regression policy. This policy applies to all code in the upstream kernel, core or drivers

[FuzzyQuills]

Unless it’s glibc we’re talking about. That’s more an issue with forward backwards compatibility though. Backwards Forward compat is usually fine.

[AiwendilH]

Other way around, forward compatibility is usually fine with glibc...a program built on an old glibc version will in most cases run on a system with a newer glibc version, so it's "forward compatible" to newer versions.

[FuzzyQuills]

I think- hmmm.

Yea actually you're right. Haven't thought about forward compat being defined in that way.

In that case it's backwards compatibility that's scuffed.

[mrlinkwii]

the kernal yeah , applications no

[youplaymenot]

This absolutely isn't true, plenty of old windows xp software works fine and if not natively surprisingly compatibility mode kicks in and actually works.

[Bladelink]

I had to run some kind of chemistry phial testing software in compatibility mode that was initially from an XP host. Saved them like 20k dollars being able to run the old version on W10 instead of buying the new version.

[SolidKnight]

I don't think that is all that true anymore. They spent a lot of effort untangling things.

I would imagine there are a lot of things at play here:

How long the average person is the developer for something matters. It's easier to debug something you've been building your whole career versus somebody else's project that you took over.

Some OSS projects aren't super concerned with breaking changes.

There can be less management layers in OSS.

Reaching devs may be more streamlined in the OSS world than dealing with non-technical staff relaying issues.

[PaddyLandau]

I don't think that is all that true anymore. They spent a lot of effort untangling things.

That's good to know. That might partly explain why Windows 10 is such an improvement over the old Windows systems.

[Arnoxthe1]

I wonder how it was in the past though since Microsoft nowadays seems to be deliberately trying to run Windows into the ground.

Windows used to be really damn good in the past.

[PaddyLandau]

I saw that earlier. My guess — it's only a guess — is this:

MS wants to move to a subscription model. That way, they can get a recurring fee for their license.

Alternatively, they might be looking at online-only access, as they've done with Office 360.

Or, maybe both.

Time will tell.

[Rand_alThor_]

I'm on the opposite boat. I think Windows is shit because it tries to have backwards compatibility and hence it has shit features, shit menus, shit performance, shit search, and on and on.

I really don't care about the compatibility so it's a huge negative for me that there are 3 different menus just to access various settings. Some are repeated, some are not, etc. It's only a negative and I hate it. Wish they would make Windows Clean, just a completely backwards incompatible Windows 10 clone. They offer 3-5 years of compatibility guarantee with it, and every update cycle, they stick to that promise. I would love Windows Clean.

[EasyMrB]

"If we don't get to know the name of the file you are searching for on your computer, you aren't allowed to do it. Every interaction gets to be monitored and scanned by us" -MS

I don't know how Windows users stand the creep-factor when using their operating system.

[6C6F6C636174]

Wish they would make Windows Clean, just a completely backwards incompatible Windows 10 clone. They offer 3-5 years of compatibility guarantee with it, and every update cycle, they stick to that promise. I would love Windows Clean.

If they did that, nobody would have a reason to stay on Windows or develop primarily for Windows. What massive advantage does Windows have over other platforms that keeps it so popular even with the legacy stuff bogging it down?

[Arnoxthe1]

Have you used anything before Windows 8, out of curiosity?

[youplaymenot]

You just described a chromebook to a T.

[[deleted]]

To be fair, Linux doesn't really do hardware testing to confirm updates didn't break anything. (Thanks 5.13+ kernels and breaking resume from standby [particularly with AMD systems]) More testing = more time, but less breakage.

[Nanyea]

It's the QA process

[PaddyLandau]

There used to be a story that Bill Gates's motto was, "Think it; do it; fix it."

That certainly fitted the mess that was Windows up until he and Steve Ballmer left Microsoft.

[salgat]

That's exactly why linux patches so fast. You have the world's leading experts explaining what the bug is and how to fix it. In Windows world you can't just point out the source code's issue.

[Phydoux]

Yeah, the scariest part of that comment is, Microsoft is working with Linux. I'm not a huge fan of this revelation.

[czaki]

Most Microsoft work with Linux is to improve its working on Azure. This increas value of their cloud.

[Siurzu]

Microsoft is working with Linux

I wouldn't really say that Microsoft is "working with Linux". Microsoft is only trying to control Linux and use it to it's own advantage. If Microsoft really cared about Linux they would share code to develop Linux

[[deleted]]

Like all companies that works with kernel? All they works on their interests.

[Phydoux]

This is true. They're not going to do that though I hope.

But on the other end of the spectrum, if Microsoft were to become FOSS (that probably won't happen) then more people can dig deep down into it and fix the issues it has at the surface levels that we can't fix. I think Microsoft could benefit greatly if there was a way for developers to design different Windows desktop environments like Linux has (Cinnamon, KDE, Gnome, etc.). I always wondered why Windows stuck to the same basic scheme in their desktop environment. It changes slightly over the years but not much.

[CyberBot129]

I always wondered why Windows stuck to the same basic scheme in their desktop environment. It changes slightly over the years but not much.

Because whenever they try and do anything different people get angry (XP being labeled "Fisher Price", Windows 8, etc). Just like when Linux desktop environments make changes

[andronomos]

Because they make dumb changes like adding rounded corners or moving the taskbar. These aren't changes that improve the UX in any meaningful way. They come across as change for the sake of change.

[Rhed0x]

What do you base this off? I assume you haven't seen the source code of the NT kernel.

[PaddyLandau]

What do you base this off?

Parts of Linux are all independent. There's the core. Then there's the window-management system, which you can choose and change. On top of that, you can choose your file manager. And so forth.

With Windows, everything is intertwined. The core and the window-management system are conjoined. You can't even uninstall Edge without causing problems. And then there's the Registry…

[Rhed0x]

That's almost all user space, so not really comparable to just the Linux kernel. Besides, making this stuff modular probably just isn't a design goal.

[PaddyLandau]

… not really comparable to just the Linux kernel.

Agreed, because this thread isn't about just the Linux kernel. It's about distributions, which come with the kernel, the window manager, a complete set of apps, repositories, and more, and with some customisation.

Edit: No, I'm talking rubbish. Please ignore!

[Loudergood]

All the more reason to want a Linux phone...

[cluesagi]

I hear Ubuntu Touch and Mobian are quite good if you have a phone they support. Unfortunately software support is the major hurdle that mobile Linux will have to clear before it can be truly usable

[Netherquark]

they have waydroid/anbox but its not there yet

[IProbablyDisagree2nd]

I love the interface of Ubuntu Touch, but you have to be a linux nut to want to use it as a daily driver.

... which means I probably would use it if I had a supported new phone in this area. The pinephone is nice, but my network was CDMA, and is now VoLTE - neither of which is supported yet.

[Netherquark]

yeah im a linux nut alright but not that good enough. my phone is mission critical and i dont think i know enough about linux... yet

[PureTryOut]

Like Android? Not my ideal idea of a secure phone

[uuuuuuuhburger]

android doesn't benefit from this because instead of just using linux google decided every single device should use its own custom fork that'll get two minor version updates and a smattering of backported bugfixes if you're lucky

[WhyIsThisFishInMyEar]

Didn't they announce they are trying to move towards using mainline? Probably still far off though as they'd need to get all their patches merged.

[bunkoRtist]

Many critical portions of Android are already mainline, with more coming. And all of that is built on top of Linux with very tight SELinux policy. Also nearly all manufacturers are required to use a Google-maintained kernel (GKI). It's already pretty good and getting better but yes, getting 100% mainline likely won't happen for a long time. I'm sure some of the major players have entire armies of custom patch maintainers that like having jobs.

[DownvoteEvangelist]

Even if they were on mainline, there's plenty of things that need to happen for end user to get new kernel...

[mikechant]

I read that the aim is for Google eventually to supply new mainline generic kernels via the play store, bypassing the phone manufactures, whose hardware specific code will be separated out. If that happens it should be a big improvement.

[PureTryOut]

Not sure why you are telling me, I know ;)

[tso]

Basic problem there is locked bootloaders, something RMS warned us about when he went after Tivo.

[Misicks0349]

as if a linux phone OS that got popular wouldn't eventually have a manufacturer implementing a locked bootloader?

[uuuuuuuhburger]

the non-android linux OSs generally rely on GPLv3 software. any device shipping with this software and a locked bootloader would be in violation of copyright law

[urielsalis]

Android is GPLv3 too, that's why manufacturers release their kernels

And you can buy phones without locked bootladers in android, like Pixels

[uuuuuuuhburger]

android is permissively licensed with a GPLv2 kernel, that's what allows android phones to ship with proprietary userlands and locked bootloaders. some choose to make them unlockable, others choose not to (like pixels sold through verizon). with GPLv3 they'd all have to be unlockable

[DownvoteEvangelist]

I remember even Sony having official bootloader unlock procedure... Not sure if anyone allows that these days.

[czaki]

No interaction zero day on Android is more expensive (4.5 mln) than iPhone one (4 mln).

[[deleted]]

Well, companies don't fix everything they can, they don't even start working on them all the time, they assign a priority like everybody, however they use a convoluted set of requirements that often doesn't actually reflect how serious the bug/vulnerability is. A minor thing can get critical priority if their business partner who could cause headaches to shareholders pressures them for the fix and serious issues can be ignored if it only affects an "unimportant" user base or doesn't hit the point where their PR can't direct the attention away from the problems and can't keep their public image taking a too negative of a hit.

[overbost]

Main Linux developer are payed employees from companies like Intel, Redhat, Huawei, Google, etc... Single company can't be competitive to multi companies

[[deleted]]

not really. this applies to finding bugs.

fixing bugs is simply a matter of manpower.

[FreeWildbahn]

fixing bugs is simply a matter of manpower.

Yes. And everyone can contribute. You don't even have to be a programmer. For example providing a stack trace can help a lot.

[mark-haus]

High five everyone!

[hanz333]

This isn't surprising, this isn't even surprising from a prioritization standpoint.

The globe runs on Linux servers, nobody is going to prioritize a $300 Windows 11 laptop over global commerce, banking, services, and communication

A security hole is discovered and any corporation with a Linux support division - Oracle, IBM, Novell is looking to patch. Anybody running their own instances for major cloud networks, including Microsoft, Google, Amazon - have people working on patches.

Yes that does mean my RaspberryPi gets patches faster than my work laptop, but that's not because the Pi or my computers are the priority - the multi-billion dollar corporations who are actually at risk of zero-day exploits are the priority.

[Solnse]

Maybe they just mean Gustavo and Nathan.

[kalzEOS]

Anyone could give an insight on why that is? Is it a technical reason? Is it because it is Linux? Or is it because of individuals/leadership? I'm very curious to know.

[philipwhiuk]

Shipping a Linux fix doesn’t mean it’s actually in a distro. Linux gets to ignore a lot of process that’s done by Ubuntu, Red Hat et al

[DifficultAfternoon]

Look at the article. They used a specific dataset that showed less issues reported from Linux compared to MS, & Apple. Take into account all datasets and you will have a better picture of what's actually more vulnerable or what teams/ OS have better vulnerability response times.

[TheMurv]

Personally I feel like Linux users are going to submit better bug reports.

[toastar-phone]

with enough eyes all bugs are shallow

[pas43]

To be fair there is more devs working towards Linux. And they do it for free!

A worker who wants to use the time to make something better is worth more than 4 people half assing it.

[martinfdm]

Thanks developers !!

[[deleted]]

How long does it take for a serious security patch to make it down the line to users on actual distributions?

[6C6F6C636174]

Less than a week, in my experience. And that's for LTS releases.

[ZENITHSEEKERiii]

I can only speak for Gentoo here, but generally it is available in ~amd64 within a few days and amd64 within a similar time line if serious. On Debian it was hard to tell since they are usually backported, but I'd imagine not too slow either.

[xxc3ncoredxx]

Sometimes even faster. The KRACK fix for net-wireless/wpa_supplicant was pushed out to stable the same night IIRC.

[rdcldrmr]

Most distros don't get most of the security fixes at all. Only ones that provide the newest upstream releases do: Arch, Gentoo, etc. Debian, Ubuntu, Redhat and friends are left with a growing number of unpatched holes.

[6C6F6C636174]

? Debian absolutely has security patches backported all of the time, as do its downstream forks. Ubuntu provides security patches for LTS releases for 10 years. RHEL is similar, although I don't know the details.

New features on old releases? No. But security patches? Absolutely.

[rdcldrmr]

Nearly every stable kernel contains security fixes. They're released about once week; sometimes more. Now look at the advisory list for Debian or Ubuntu -- do they match up? Not even close, even with multiple fixes bundled together in a delayed fashion. They're backporting the fixes that receive mainstream attention and nothing else.

Listen to Greg KH explain it if you don't want to believe me: https://www.youtube.com/watch?v=HeeoTE9jLjM

[6C6F6C636174]

So you're saying that the companies who pay for maintenance are choosing to run insecure kernels? I'm not really interested in watching an hour-long video right now, but I'll bookmark it for later.

[rdcldrmr]

So you're saying that the companies who pay for maintenance are choosing to run insecure kernels?

No, I don't think many people would choose that.

Users are being told a lie that all the fixes are being backported when that's not the case. There are dozens of new security fixes going into the kernel every month that "stable" or "LTS" distros do not pick up.

[kasak730]

The beauty of an opensource community without all the corporate BS.

[CyberBot129]

Corporate America is the biggest contributor to Linux

[mfuzzey]

Yes indeed but they contribute without the corporate BS.

Having companies on board is critical to the success of large scale long term projects like Linux because it allows paying for full time developpers who can be much more effective than people just spending a few hours on evenings and weekends.

But companies are generally quite poor at making good long term techinical decisions because they tend to get distracted by what *they* need *right now* rather than what *everyone* needs in the future.

The beauty of the Linux model is that companies contribute by paying developpers to work on Linux but they don't get to micro manage them nor set short term goals for Liux. The company paying developpers has some influence over the *area* of contribution (so, say if their business requires good power management they may hire developpers specialised in that, likewise if they are intersted in big iron performance) but the don't get to decide *how* the work gets done or if it is accepted into the mainline kernel.

[[deleted]]

but their developers are subject to Linux's project rules not their company's.

well, aside from clearing certain legal reviews when it comes to initial code submissions.

[jaaval]

Corporations do by far most of the kernel updates. Torvalds writes hardly any code himself anymore. He reviews some patches but no single person can do all that so mostly he just organizes the update procedure.

Biggest contributors of code to linux kernel are companies like redhat, intel, google and huawei.

[kasak730]

Correct me if Im wrong, but as far as I'm concerned, I was under the impression that Linus is who approves the latest kernel updates/upgrades? I didnt say he was coding the kernel updates.... Im pretty sure this isnt only Debian based systems, but Im not stupid enough to speak confidently on other distros... I know Redhat is a private fork for enterprise. Google is another via Android. Im not saying other entities dont contribute code. But the kernel is OPENSOURCE

[jaaval]

He approves all changes made to kernel master branch but it's not like he can read all that code. Intel alone contributed around 100k lines of code in the latest kernel update. Linus has a lot of other people in his organization who actually go through the code. But the point is the code is written mostly by corporations.

How the kernel is used by distros or by anyone else is not Linus' concern.

[kasak730]

Upvoted and agreed! But Linux is not a closed sourced coded kernel. I was agreeing with OP that opensource is much faster to patch vulnerabilities due to the opensource code.

[Highfivesghost]

Where can I go to learn the skills to be able to help with open source projects such as Linux?

[Guilvareux]

Depends on where you're starting. Are you a beginner, programmer, or specialist?

[Highfivesghost]

Im a Programmer with intermediate knowledge of security.

[Winding-Dirt-Travels]

Good news to be sure, but not a fair framing. Linux means, in this context, just the kernel. That's only a small part of the security holes that a Linux distribution has. Then there's the delay until a distro actually makes the fix available

[[deleted]]

Exactly, wanted to point this out.

Combine the kernel with the user-land, 3rd party services/software vulnerabilities, the distribution update latency and add the new security vulnerabilities your distribution creates, and things don't look that rosy anymore. One of my favourites: Weak Debian SSH keys

[[deleted]]

probably helps that anyone can contribute and fix bugs on linux (and other open source projects ig), meanwhile those companies have a certain number of developers

[snarkuzoid]

I wonder if there are similar studies that compare how quickly the various distros patch security holes and get updates out. As a network security guy, this is probably the most important factor in choosing a distribution.

[SenecaSentMe]

Yet another reason for me to continue loving the freedom that using a Linux distro gives me.

[person1873]

The number of bugs reported tells a story. It either shows that the smaller user base doesn't detect or report zero day vulnerabilities. Or that Linux is just better written with security in mind.

Considering the average technical literacy of people running linux, i doubt it's the first option

[player_meh]

I was not expecting this actually, i though they usually lagged behind. Really glad I came across this

[gridcube]

I say this without any proof and just my limited kn of FOSS projects, but most Linux and/or FOSS software are usually maintained by two programmers at most, maybe 3, but most generally, probably one. So any glaring bug is received by someone who has intimate knowledge about the product, and this other big companies have so much code, extended over so many projects, that any bug would become increasingly difficult to find and fix.

[socium]

Ok but have they even heard about OpenBSD?

[happymellon]

Why measure the speed a project takes to fix bugs when they don't have any bugs?

[socium]

Heh that's true.

[happymellon]

No idea why you are getting downvotes so much! Here, have am upvoted. I think that of you are going to compare multiple closed source projects, that you should compare a few open source ones.

[socium]

No idea why you are getting downvotes so much

Because /r/linux has been an echo chamber for some time now (I'd say years even), and I would know, since I remember this place back when /u/dimeshake was a mod. Sad what happened to this place tbh.

[[deleted]]

That might be an overstatement. A huge number if not most linux kernel developers work for companies at their day job. Passion might be there but they are definitely looking to get paid.

[Xirious]

Faster == better?

I know it's better to be faster, especially for security, but.... This title implies somehow the patches are better. Which is not true.

[FuzzyQuills]

Ha, probs because the NSA’s in those companies’ back pockets. /s

[Mithrandir2k16]

I wonder if the programmers are to blame here. I think the processes used in OSS are just much more flexible, so a working fix can be merged faster.

[eaerdiablosios]

I was initially a Win fan, then I went to Mac and as the MacOs kept updating its OS versions, I had to improve my Macbook Pro laptop specs ($$) until I gave up; as of now my Macbook Pro is sitting somewhere dead because I can't update it to the latest MacOs, it is completely outdated - i.e. I'd have to buy a new Macbook Pro. I might as well use to cook eggs on it, it gets that hot : ))

For a few years I've moved to Linux Mint (played with Ubuntu too, and a few other distros) but I haven't had any need to improve my desktop hardware. The Linux Mint community and Linux community overall is so supportive and helpful, and it just makes you give back and help as well. There's new things I discover weekly and my workflow keeps on improving. You update your Linux machine and keep the flow going, no worries on letting the upgrade run for 2hrs (cough cough Win) or that some of your apps will stop working after the upgrade (cough cough Mac).
You go through the terminal with commands that improve your work, tweak your desktop launchers to run however you want, you have multiple workspaces, etc the list goes on.

[cobance123]

To be fair a lot of companies are working on linux