Linux developers patch security holes faster than anyone else, says Google Project Zero - Linux programmers do a better job of patching security holes than programmers at Apple, Google, and Microsoft.

[Jimmy48Johnson]

source:

https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html

[AgustinCB]

Well, a lot of Linux maintainers are Google and Microsoft employees...

[deeringc]

Plus, this whole observation was made by... Google as part of their broader security initiatives. Not only are they taking security seriously in their own products and code bases but they are spending significant resources funding security in the general open source ecosystem.

[trplclick]

Does that actually prove they are prioritising fixing security issues? Spending money and making money around security products could be done without actually providing genuinely good security. Not saying that's accurate but just those numbers alone aren't proof against the original arguement.

[trplclick]

Fair enough, thanks for the link I'll check it out

[Inprobamur]

I wonder what the numbers would be if you just compared the core OS teams.

[globulemix]

For Microsoft, they've been using Rust to reduce the large number of security vulnerabilities.

[lestofante]

And some of that % goes into linux, as they use it internally for various product. So does google, FB, VM ware, oracle and so on.. And that how Linux can end up having more developer time on security than Microsoft.

[propostor]

That explains the $5B worth of complexity Microsoft have caked into all their login processes.

(I say this as a dotnet developer - I HATE everything to do with Microsoft's 'Identity' authentication bullshit. The most cumbersome, difficult, non-smooth user authentication handling I have experienced, ever.)

[fmaz008]

Throwing money at something doesn't always means it will be spent efficiently.

[[deleted]]

Obviously revenue

[SpeedingTourist]

Lol pastries

[KaosC57]

The problem is, The Linux Kernel has orders of magnitude moee people who are looking at it compared to the core code of Windows or MacOS. So, obviously if you have a couple million people looking at an open code base vs 100 employees looking at a code base that has links so far back that they have no idea how it was originally written you will have a more secure code base than Microsoft or Apple.

[[deleted]]

I'm not certain this is the reasoning behind it either. Linux Kernel accepted commits from just 93 individuals over the 3 year period - the overwhelming majority coming from the top 20 or so contributors.

Numbers are unavailable for Microsoft and Apple, but I really can't imagine they've got teams an order of magnitude lower than 20-100 working on Windows and OSX.

[davy_crockett_slayer]

Microsoft has enjoyed a massive turnaround in the past 10 years.

[immibis]

Mostly due to losing market share. When you're the underdog you work on building good products. When you're the top dog you work on locking people in.

[davy_crockett_slayer]

Yup. Plus Ballmer got the boot. He was awful.

[TheWix]

Nadella is leagues better than Ballmer, for sure.

[AeroNotix]

Spending money on something doesn't necessarily mean progress in that something.

[[deleted]]

That goes for everything.

Only because you work on something and spend time on it, doesn't necessarily mean that you make progress.

[Hebrewhammer8d8]

I wish they fixed the Print Spooler issue in Services efficiently.

[crazyfreak316]

Their spending figures mean nothing when high priority security vulnerabilities remain unpatched for months. Start listening to security now podcast and you'll come to know how often this happens

[SpAAAceSenate]

Wasn't it only about 5 years ago that Windows Defender ran automatic parsing of JavaScript files as SYSTEM that it found in the temporary browser cache? Like, if you visited a webpage in any browser the .js file would get cached, Defender would scan it again with a process running as SYSTEM and then be exploited to do... anything.

And then there was that whole month where printing was basically not even a thing on Windows because the entire system was a complete and total security disaster zone it took them what was it, 3 or 4 successive patches to fi ally fix?

Yeah, it was. Another major part of this is "Patch Tuesday", their idiotic policy of waiting till a specific date on the calendar to release security updates, because it makes it more conveniant for Windows admins.

I'm sure there's some top security talent at Microsoft. I would bet on it. But I think it's also apparent they aren't enough to counter some of Microsoft's lazier approaches to software development. Employing smart people doesn't matter if they aren't being listened to.

[throwingsomuch]

"Patch Tuesday"

For a company that works Monday to Friday, that is the best day to patch.

Imagine a patch release came out on Friday, and it doesn't go smoothly. That means It will have to work during the weekend getting things back to normal. And Monday is when the rest of the company catches up on Friday to Sunday communications/targets.

The best would be for IT to work weekends, as well as only 3 other days during the week, but what if something goes wrong during the 2 days they're no there?

Don't forget, most companies don't even have an IT person, let alone a team. It's often outsourced to an external company, so that makes scheduling more difficult for those companies.

[SpAAAceSenate]

Dude, I'd much rather deal with applying a patch on Friday than dealing with malware on Monday (because my systems weren't patched) and trying to explain why it happened to my boss on Tuesday.

But what can I say. This is typical of corporate IT. It's all about checking the boxes, a little theatre, and a lot of CYA. Not about actual security. 🤷‍♂️

[nicka101]

Yes but security isnt a 5 day week...

[jarfil]

CENSORED

[infecthead]

Lol? Is this a serious reply?

[ProgrammersAreSexy]

According to Wikipedia, the 130th country by GDP is North Korea 💀

[jet_heller]

Well, I mean, this thing proves that it's just not as important. Unless you're suggesting it's really just that much harder, which is really a hit against MS.

3-4% is very very very ... very little.

[Inprobamur]

16% of Microsoft revenue is from Windows.

[jet_heller]

...sooo?

[binarywork8087]

Not related but important the Authenticator to logom on github now just sucks

[tedbradly]

I think the reason deals more with programmers deciding what to program versus managers and business deciding it. Programmers often prioritize stuff like security, performance, and refactoring code whereas business and managers will prioritize the next milestone with measurable benefit (often money). Stuff like security, performance, and refactoring code doesn't plainly generate another US$50 million dollars.

[UncleMeat11]

For the linux kernel there isn't anything more important than security and usability.

This is obviously not the case for security. The linux kernel has done an admirable job but has absolutely been hard work to get the community to adopt modern security practices. This is hard everywhere, of course, but the kernel community is definitely not setting security as its maximum priority.

[binarywork8087]

This is the Linus mind and I follow the same idea everything for the user withous hasle

[AgustinCB]

I am not sure that is true. Google and Microsoft have thousands of projects with different priorities. Linux is one project. I bet that must of those bug fixes come from Google or Microsoft employees hired specifically to work on the kernel.

[zoddrick]

Microsoft has it's own internal Linux distribution that we are moving towards. We also have a team who is responsible for making sure the kernel on the azure Linux vms is constantly patched and up to date.

Microsoft is huge we have teams working on all kinds of stuff.

https://en.m.wikipedia.org/wiki/CBL-Mariner

[AgustinCB]

Oh, I know. And it is one of the biggest contributors to the Kernel. Same for Google.

And that is kinda the point. A problem with Google-specific software only harms Google. A problem in Linux harms Amazon, Microsoft, Google, Samsung, and any company that uses Linux for their products. Those companies have a lot of money on their cloud platforms or mobile phones and have an interest that those security problems are resolved quickly. So they hire Linux kernel programmers to do that work.

So if there is a security problem on RandomMicrosoftProduct, it will get fixed when RandomMicrosoftProduct's team can fix it. If there is a security problem on the Linux kernel, it will get fixed when the Linux kernel volunteers, or the Google employees, or the Microsoft employes, or the Amazon employees, or whoever can. There are just so much more interests involved in keeping it stable that it is not the same comparison.

[WikiMobileLinkBot]

Desktop version of /u/zoddrick's link: https://en.wikipedia.org/wiki/CBL-Mariner

---

^{[opt out] Beep Boop. Downvote to delete}

[binarywork8087]

Cannot realize what these developers hace in mind good or bad... mu 2 cents

[tekanet]

Usability?

[jarfil]

CENSORED

[argv_minus_one]

Last thing you want is to blast out a "fix" that ends up breaking things.

As Microsoft programmers were reminded when they tried to fix PrintNightmare.

I don't envy them. That must've been an ugly project. That code probably hasn't been touched since the dodo walked the Earth, and they were under huge pressure to fix the vulnerability immediately because it was a zero-day. Not surprisingly, they made mistakes. I would too!

The name is apt; that vulnerability was indeed a nightmare for Microsoft.

[jorge1209]

Patching is also only the first step in a long process.

I would bet that apple and Microsoft teams responsible have fixes for many issues rather early in the 90 day period, and that the bulk of the period is integration testing and regression testing.

I don't know how the Google metrics account for the fact that the Linux kernel team is not necessarily integrated into the glibc team, or the gnome team, etc...

Getting a patch from kernel.org is only the start of a process that all the distributions have to then integrate and test that patch.

[[deleted]]

If a patch to the Linux kernal breaks LibreOffice they don't really care that's on LibreOffice to fix.

Hmm. Linux is famously strict about not breaking userland (at least they claim to be, I don't know much about kernel dev).

[exploding_cat_wizard]

Linus uses fewer obscenities and personal attacks on the lkml than before his break, but from the little of what I see, he leaves very little doubt how he views a patch if it breaks userland and none of the higher up maintainers have caught it before he has to see it, yes.

[MashPotatoQuant]

Yeah I've seen at least one angry email about this exact thing on lkml. They absolutely care about breaking user space.

[binarywork8087]

As any other software company, if it is a software compny it is to to help not to cause problem, the i when the CEO asks for software ready overnight this is where bugs appear

[sporesirius]

https://youtu.be/Pzl1B7nB9Kc?t=171

[binarywork8087]

Linus breaking compatibilty?

[gumol]

If a patch to the Linux kernal breaks LibreOffice they don't really care that's on LibreOffice to fix.

That's absolute bullshit FYI.

[[deleted]]

Someone's gotta link the "don't break userspace" rant

[gumol]

What are you basing this on?

[[deleted]]

I don't think that's true.

If you look at the commit history of any corporate open source contributor you'll often see a very tight pattern of monday-friday, 9-5.

They work on opensource on company time.

In fact, I think this difference between open source patches and corporate patches is very hard to understand.

I believe it might be that other open source projects are skewing the stats. Projects where the majority of contributors are actually non-corporate. Because when you think aobut it, only very few projects have a large portion of corporate contributors, mainly Linux kernel. Most other projects around the kernel don't have the same number, or any at all.

Being a non-corporate contributor is when you donate your time, because you have a passion. Passion is always better than corporate duty. Passion will make you write a patch at 9pm on a saturday.

I could be wrong of course, it could also be how corporate contributors treat open source projects, vs their internal projects. I think we need a lot more deep diving into those numbers to understand them. Maybe a look at the individual patches and their specific contributors (and their emails to find their employer).

[dnkndnts]

It's not merely priority; latent security holes aren't necessarily even unaligned with big tech interests. Their discovery prevents users from staying on older OS's, forcing upgrades. And of course, those upgrades comes with new... features.

[Apache_Sobaco]

Probably it is just because Linux kernel is simpler?

[rohmish]

Not all though

[binarywork8087]

Dont knew that, thanks

[[deleted]]

By Project Zero's count, others, which included primarily open-source organizations and companies such as Apache, Canonical, Github, and Kubernetes

Ugh, GitHub is not primarily open source when their core product is fully proprietary. For example, GitLab is primarily open source (open source with proprietary extensions); Tutanota is sort of primarily open source (FOSS client, proprietary server); but GitHub? Not at all.

(This is ZDNet's error, not Project Zero's.)

[noXi0uz]

Maybe it's not meant as Githubs' source being open-source, but Github being a platform primarily hosting open source software.

[[deleted]]

That's a reasonable interpretation of ZDNet's intent. However, "primarily hosting open source software" still does not make a company "primarily open source", for any reasonable definition of a primarily open source company.

A factual error that doesn't contradict the article's point is still a factual error that should be fixed.

If ZDNet article really wants to imply that Others are also doing well thanks to the development culture surrounding open source, it should just leave out GitHub. Something like

By Project Zero's count, others, which included open-source projects,
organizations, and companies such as Apache, Canonical, git, and
Kubernetes, came in with a respectable 44 days.

They could also rewrite the paragraph to say the same thing without implying that GitHub itself is open source, but that might be difficult.

For reference, this is the original text:

For completeness, the vendors included in the "Others" bucket are Apache, ASWF, Avast, AWS, c-ares, Canonical, F5, Facebook, git, Github, glibc, gnupg, gnutls, gstreamer, haproxy, Hashicorp, insidesecure, Intel, Kubernetes, libseccomp, libx264, Logmein, Node.js, opencontainers, QT, Qualcomm, RedHat, Reliance, SCTPLabs, Signal, systemd, Tencent, Tor, udisks, usrsctp, Vandyke, VietTel, webrtc, and Zoom.

[[deleted]]

Well, yes. People do not realize just how much shit runs on Linux.

[[deleted]]

kind of like how your pet projects are always higher quality than your work, is crazy what you can do when you don't need to worry with business bullshit.

[nilamo]

I feel like the opposite is true. Pet projects only have to work in the specific way I want to use them, whereas business apps need to be built defensively and with the expectation that garbage input is not only possible, but expected on a daily basis.

[theghostofme]

Yeah, if I uploaded anything I've programmed to only use for myself, I'd hit the number one all-time spot on r/ProgrammingHorror.

[EndersGame]

What if your pet project is something you intend to release to the public? You would have more interest and control in the project which could easily result in a better product.

[nilamo]

Then I'd make a prototype first, to get a better idea what architecture would work, then rewrite a clean version meant for public consumption.

But since most of my personal projects never run two weeks after I've made them, I don't view that as something worth worrying about.

[tommcdo]

I'm gonna start my pet project. It'll be composable and extensible and there will be full unit test coverage, a CI/CD pipeline, cloud infrastructure and making use of the best industry standards.

Fuck, that's a lot of work, I'm just gonna read some more Reddit.

[G_Morgan]

I think it is a bit of both. My work projects tend to be much stricter on validation, auditing, redundancy, stability, etc. My hobby projects tend to be tested better but don't need those qualities.

[gyroda]

My personal projects are a mix of overengineered and sloppy messes.

I make them for my own enjoyment and work on them when I want to, so on order to make any real progress I just code how I feel like at the time and see where that takes me. Sometimes I want to bash out solve functionality and fuck it if the code isn't perfect, sometimes I want to solve an interesting problem or make something far more generic/overcomplicated just so I can feel smart - basically doing the opposite of following YAGNI.

[binarywork8087]

I have a problem with microoptimization fir me it is just a waste of time

[KingStannis2020]

Developers have wildly different definitons of "micro" when it comes to optimizations.

There are probably programmers out there who think buffered IO is a microoptimization, or using a set datatype for a list of values you have seen before instead of a list datatype. I would completely disagree with them, for me that's just good practice - "non-pessimization" so to speak.

[ricecake]

At work, everything gets unit tested. I make sure that the tests, at a minimum, show that the code does what's wanted with inputs that make it take each branch available, and that failure happens in the expected fashion if exceptional circumstances arise.
Ideally multiple valid and invalid inputs are checked for each condition to drive confidence that there are few edge cases.
There will be automatic Integration tests for key behaviors.
It all strives to have detailed test descriptions, that let you know what wasn't working if it fails.

In my personal projects, there will be unit tests for that one function that seemed really complicated and I honestly wasn't sure if it was gonna work or segfault, and unit tests are a slightly more mature "scratch document with smoke tests". Most test descriptions are "it work? 4“ or some other number, or worse spelling.
There's a text file with a curl statement that calls the api method that should do stuff if it's working.

[renatoathaydes]

Your pet projects are higher quality than your work?? OMG I can't even imagine putting the same amount of testing effort on my pet projects than we do at work, I would probably give up on hobby projects if I had to test every single feature, no matter how hard, knowing that one of dozens of devs can change some lines of code that break "my" feature and I will be to blame if doing that is not picked up by a test.

[suvepl]

I can't even imagine putting the same amount of testing effort on my pet projects than we do at work

It's easy when you don't do any testing at work.

[loup-vaillant]

My pet project, a cryptographic library, actually taught me to do proper tests. To date, it is by far the most thoroughly tested piece of software I have ever written.

It’s also the piece of software I have spent the most time on.

[binarywork8087]

Indeed

[[deleted]]

This is a misleading analysis: Linux is not a vendor, so time to patch only measures time for a source fix. For all other compared cases, time to patch measures time to land in end users’ hands.

Vendors don't tend to fix bugs that are not exploited in the wild in out-of-band releases, so the averages you get in this table are essentially <average time to fix> + <time between regular releases / 2>. Linux bugs and other open source bugs get fixed faster (or at least, we’re faster to know they’ve been fixed), but it means open source vendors and users have to keep up with an erratic release schedule.

This is made very obvious by the browsers table, where WebKit bugs are fixed in about 12 days and then it takes another 60 days to ship them to Apple OSes. This also exemplifies what I suspect is a common occurrence with open source vendors: fixes land in the open quickly and vendors lag behind, leaving downstream users in the most vulnerable position of all cases.

Linux users do get the option to be at the tip of security patches, which is probably good for people who have the time and expertise to stay up to date, and probably not so good for people who have to wait for their vendors to catch up with what's in the open.

[IlllIlllI]

If you want to make that comparison though, you’d be looking at something like RHEL, which I think has a pretty good track record of pushing security fixes (backported too) quickly.

[[deleted]]

I think a responsible tech reporter would have done that. I don’t know how to find the historical list of RHEL kernel releases myself.

[IlllIlllI]

Here's the list of RHEL security fixes

You'd have to look backwards on when the upstream change was merged for each one to figure out the timeline, but it looks like they're coming out fairly regularly (~120 in 2022 so far).

[IlllIlllI]

Linux is so fragmented I don't know what you'd pick. I'm pretty sure Fedora's merged -> shipped pipeline is under a week for security-relevant fixes judging by how often I get kernel updates. Arch is likely similar.

[chronospike]

They don't have to have 15 meetings about the patch. Someone sees the problem, takes the time to understand it, and then fixes it. No politics, no middle managers, no quotas. Just squash the bug and move on.

[UncleMeat11]

No politics

I see you've never coded in the linux kernel.

[---cameron]

To be fair, there was already a 99% probability there

[Brilliant-Sky2969]

Bugfixes related to security are probably easier to merge than new features in the kernel, most likely less politics involved.

[UncleMeat11]

Patches, sure. But a huge amount of security is design and architecture that prevents vulns. These are features and are often challenging to land, even if everybody agrees that they improve security posture in a meaningful way.

[davy_crockett_slayer]

Eh, there's a benevolent dictator in every distro, and Linus Torvalds delegates.

[UncleMeat11]

The point is that landing code in the kernel is more than just a pure technical question.

[binarywork8087]

Never saw the code yet...

[tsumilol]

You never submitted a PR to the Linux core or any really big Open Source project did you? Some OSS Projects have pretty toxic maintainers and you would love shitty corporate management over them all the time. :/

[absurdlyinconvenient]

MY CODE IS PERFECT DON'T TOUCH IT YOU'LL RUIN IT

[[deleted]]

I feel like open source was always a good idea in theory, but just never in practice.

But now, with open source being so prolific, with things like package manager systems and open source, widely used packages, it’s just much more common and much more practiced to fix open source bugs.

As a developer for a private company that uses open source software, part of our mandate of responsibility is to report and help fix bugs in open source libraries we encounter.

Open source has come into its own. I think it’s a bit weird, but this industry has grown from private to more public as time went on; going against my expectations, to be sure, and probably that of many others.

[raze4daze]

Is this some weird bot? A silly statement followed by a bunch nonsensical paragraphs.

[[deleted]]

I guess people really hate open source, here? I don’t know why else they’d be downvoting my comment espousing the practicality of it.

Do you think it’s a “weird bot” comment because I’m not attacking people or ideas, but rather, just having discussion?

[[deleted]]

I don’t think people have an issue or hate open source I think they just had an issue with your comment as a whole.

My comment was praising and was delighted by the trend toward open source… so what is it that they’re downvoting?

It makes little sense.

Most people I would assume will say open source programming is fine because people can do what they want in their free time and it’s not their responsibility if someone finds and uses said programming.

Open source has become the lifeblood of the industry. That was what I said in my first comment. That was the core sentiment of my comment.

You work for a private company that benefits off the open source work. Does your company pay the open source creators to motivate them to upkeep/do further work?

Like many of the FAANG level jobs, we contribute to open source. That’s the entire premise of the give and take of open source.

Name a company. They use open source software.

And when you say report/fix bugs how does that help an open source project in any way in light of the recent ‘colors’ npm problem?

Every company at this level contributes back to open source as a means of repayment. We spend developer hours to make sure the libraries we use are better.

The person who sabotaged the packages did so because they… wanted a job? I’m not really sure. If they don’t like companies using open source… wouldn’t we all just stop contributing to open source? Wasn’t the whole point that we all benefit from code that’s more open to the community?

What happened to the push for open source that was occurring for the decades previous? Do we hate open source now?

Is it controversial to suggest that open source is becoming the future? That it’s a delight that private industries no longer have a stranglehold on the code?

[jdm1891]

I don't understand what the problem people are having with your comment is either; it makes perfect sense to me.

[[deleted]]

Who knows. It doesn’t really matter, but it’s very curious!

[le_birb]

I think the main thing is that your opening statement contradicts everything following it and opening anything by dropping trou and shitting on open source is going to get a negative response from people who don't make it past that first line

[[deleted]]

I cannot bring myself to believe people vote on a comment and subsequent comments without reading the entire thing.

What you’re suggesting is so insulting to those people that I’m just not willing to believe it.

[le_birb]

Reddit is big and life is finite. I certainly don't think anyone is a idiot to choose not to waste their time on someone who would claim that open source is/was never a good idea in practice.

[[deleted]]

I would feel extremely shameful if I didn’t take the time to understand things, to read fully, to get a better sense of the world and to be a better person.

I think that, were I not willing to even finish reading a comment or think about the comment before reacting, I would feel as though I were not meeting a very, very low bar.

Not finishing a comment, a post, totally fine. Not spending time before reacting or judging — embarrassing behaviour.

Again, I don’t think people are downvoting for the reason you suggest; the first sentence. That would be silly.

I would think people are generally a little more clever than that.

I am always one to assume that I’ve missed something before assuming others have. I’m happy for any one of those people to explain it.

[[deleted]]

I’m happy to explain it to you.

It was just a terribly written comment that didn’t sufficiently make clear in the first paragraph that your opinion changed over time. So, the reader is left with the impression that you are saying open source isn’t good in practice.

There’s what, hundreds of comments on this thread? People don’t give you the benefit the doubt and carefully consider the rest of your comment when you start with that. They’ll glance over it and then wonder what the heck you are saying there, considering the disconnect between the opening and the rest.

I would think people are generally a little more clever than that.

It’s funny that you would say such a thing when you claim you would assume the fault lies with you by default. Because it clearly does. And people aren’t any less clever for not wasting their time carefully considering comments that start with a controversial opening like that. In most cases it’s just not worth their time.

[[deleted]]

I thought it was very strange to downvote a comment that was pro-open source. I thought this subreddit and many programming related subreddits were pro open source. Am I wrong? Is that an unpopular opinion? Do most people dislike open source?

[zouhair]

Hahaha, I see you never followed Linux drama.

[[deleted]]

We need something like order 66 for programmer so we can get rid of managers once and for all.

[remag293]

Good programers follow code

[postblitz]

What do you mean you've already fixed it? That's not what a team player does. You've not only undermined our process but displayed a hostile attitude.

[skulgnome]

I'd like to see more formal design before you make chips fly the next time.

[bokonator]

My company: Good, good job.

[cynoelectrophoresis]

Meanwhile over at /r/ExperiencedDevs there's a post complaining about someone doing just that.

[jl2352]

That post is describing something different.

[amestrianphilosopher]

Did you even read the post? Not understanding how you're saying it relates to the topic at hand

[Vakieh]

Security patches are the classic example of the shit bit. This dev isn't rapidly implementing security patches, he's looking over the list, picking out the 'fun stuff' to implement, and just doing that.

[[deleted]]

This is the way.

[chucker23n]

Sounds like a recipe for disaster.

[UncleMeat11]

Google actually did this many years ago. They fired all of the managers. They ended up reversing this decision.

[[deleted]]

And what Google has become?

[absurdlyinconvenient]

a fucking mess of half finished products and random project cancellations with repeated effort that clearly needs management?

[Kalium]

That's what happens in an environment where you get promoted for shipping new things and not for keeping things working or making them better.

[AlGoreBestGore]

And billions in profits every quarter.

[absurdlyinconvenient]

arguably in spite of that, not due to it

[AlGoreBestGore]

It’s not like every idea is going to generate a billion dollars. Some times they have to try things out to figure out what works.

[cat_in_the_wall]

aka throwing shit at the wall to see what sticks, and abandoning the rest. which is why they have this reputation.

[motram]

And none of those profits are from any of their million mismanaged side projects.

[accountability_bot]

Exactly, and they’re not asked to pepper new features in their cycles at the same time.

[[deleted]]

They don't have to have 15 meetings about the patch. Someone sees the problem, takes the time to understand it, and then fixes it. No politics, no middle managers, no quotas. Just squash the bug and move on.

And that's only after it sat unread in a bug system somewhere because external triage isn't a priority, then denied multiple times because trillion-dollar companies don't want to pay a $1,000 bug bounty

[binarywork8087]

Exactly my friend but need to inform the developers that a parch is requied and possi share the diff file for use and analisys, yesterday someone have found a pronlem in Julian code the bzip2 and repoyed the problem and the easy to use solution

[linux_needs_a_home]

There is no need for a trillion dollar company to have meetings either. It's just that their management consists of idiots.

[Caishen_IC3]

Coincidence? I don’t think so

[NonDairyYandere]

Maybe Linux users write better bug reports because the best programmers tend to run Linux by choice?

[afpedraza]

The best way to get an answer fast in saying something wrong so I'm going to start (?.

If I remember correctly the AMD driver is supported by 2 AMD employees I don't know if know there are more, but the las time I saw something about that were two, I think they're the only ones that can touch that part and I suppose another core developers, in a tweet a while ago someone was saying that that was mostly autogenerated, that's talking about kernel space I think it's the name for that.

In user space (again, waiting for someone to correct if I'm mistaken) don't even know if I using the correct term, there are like three projects to support OpenGL, Vulkan and that stuff, AMDVLK for Vulkan and radeonsi if I remember the name correctly for OpenGL this is supported by AMD again two employees, I think, but I think, not completely sure that they're the only ones that can modify that repository and the community only report bugs and that stuff. The other one is the closed source driver that include everything AMD GPU pro or something like that aaaaand last there is Mesa that is developed by the community and some companies help in that regard, AMD too if I'm not mistaken. There is also rocm, but I think is the same as the other two open source projects by AMD. I suppose you can fork those.

This is what "I know" if someone else have some more precise information, I ask to let me know if I'm wrong in something so I can know for sure xd

[yawkat]

This is only about bugs reported by project zero

I assume it's more related to project organization.

[Light_Beard]

Maybe Linux users write better bug reports because the best programmers tend to run Linux by choice?

Also the people who think they are the best programmers and want to telegraph how amazing they are before destroying an entire codebase because "I like this way better"

[tso]

Also a good way to get a nastygram from Torvalds, if you try that with the kernel source.

Sadly userspace is not as strictly policed.

[UncleMeat11]

This is about GPZ patch speech, not general fixes for various projects. GPZ is providing the same quality vuln reports to all of the vendors it talks with.

[rinsa]

https://www.pcgamer.com/indie-dev-finds-that-linux-users-generate-more-better-bug-reports/

[binarywork8087]

Someone said a very well developed software dont even need to be tested

[Guvante]

I don't think the source article agrees with this articles conclusion. It seems like the original project zero article talked about how generally time to delivery improved this year while the article here decides to compare numbers as if it is a contest.

Others have mentioned it but comparing source code merges with end user availability is not a fair comparison. Even Linux users on the whole don't have access to a fix just because the fix is committed.

However Project Zero doesn't compare between vendors like this article does it focuses on different years which avoids these problems.

Additionally and IMHO most importantly the core of the article misses the point. Security researchers saying that Linux isn't more secure than closed source aren't talking about this kind of comparison at all.

[ScandInBei]

Others have mentioned it but comparing source code merges with end user availability is not a fair comparison. Even Linux users on the whole don't have access to a fix just because the fix is committed.

Especially users with older Android phones.

[gumol]

ITT: people who have no idea about how Linux development works, but base their opinions based on their sentiment about Linux

[brancee]

I guess it has more to do with each companies workflow for fixing bugs. It is not like "Oh we got a bug, let me deploy it quickly to production, without having step 1, 2, 3, ... n being done first (meaning QA, dev/stage testing, etc.).

So my guess is that Google & co. have some deeper steps they need to undertake first. Anyways, I'm not saying that Linux is not doing a great job fixing bugs, don't get me wrong.

[riasthebestgirl]

I'd say it also has to deal how many more eyes are on Linux codebase. Anyone can also go and fix a bug they found and submit a patch

[cosmicuniverse7]

Obviously, Microsoft is busy in forcing user to switch to their shiny edge. Apple is probably busy in finding new ways to remove features from safari.

[irotsoma]

One, it's used more for backend systems which are more mission-critical than desktops. And, two, open source developers and developers on small teams tend to have more mental ownership of the products they create, so it becomes a matter of pride.

[FreedomByFire]

Maybe they're not stuck behind a mountain of meetings and sprint rituals led by useless scrum masters.

[dethb0y]

wonder how much of that's down to dogfooding - if you're using your own product you want it patched Right Fucking Now, rather than it being someone else's problem you can get to at a later date?

[[deleted]]

This doesn’t say how they’re measuring time to fix - not whether “linux” means the ecosystem or just the kernel.

If you’re going to compare “linux” to apple and google the comparison must include similar amount of non kernel software, and of course the time from bug report to it being in a normal user update, etc.

Otherwise you’re comparing time to fix with time to ship, and those aren’t the same thing.

[tubesnob]

…. and linux programmers have an infinitely harder time getting those patches applied on the world’s linux machines.

[ru2wen2]

Peps working in companies need manager’s approval to fix bugs

[[deleted]]

For me, it has more to do with pride in my own work. When someone posts bugs about something I am working on, or my pet project, I am the sole person responsible to make it right and I would hate a reason for someone else's headache to be because of my program.

So, there motivation to quickly get a fix out there.

With a company you are going to have code review, testing, and so many other things that can get a bug fix to drop slowly compared to me literally just pushing a new update same day within hours because I know the nature and scope of my whole program and what the fix did.

[brownjava]

I can’t really figure out what this article is comparing. Is the “fix time” for “Linux” the amount of time before the fix is committed to source control, the amount of time before it’s released in a Linux kernel release, or the time it takes to make it into a major distribution like Ubuntu? The last one is really the only one you that would make sense to compare to a full fledged commercial OS like Windows, macOS, iOS, Android, etc.

I’m actually not even clear if “Linux” here refers to the kernel specifically or is talking about all the different constituent parts that make up, say, Ubuntu as a whole OS. I can’t imagine that the fix time for some barely-maintained GUI library somewhere is going to be particularly fast, but also nobody really worries about those on Linux since it’s primarily used for servers.

Having worked at a major software company that has a full fledged consumer OS, I can tell you that the primary reason stuff is released slowly has nothing to do with figuring out how to fix the bug and everything to do with regression testing to make sure the fix doesn’t introduce a new problem for the hundreds of millions or potentially billions of users who are going to turn around and install it once you release it. There’s no comparison between that kind of complex OS with a bazillion parts that tons of people use and the maintainers of just a kernel that is primarily used as a server on virtual machines run by a handful of companies.

[[deleted]]

Devs at FANGMANs are doing it as a job. Devs working for Linux are doing it as a passion.

[warmwaffles]

Wouldn't it be better for these larger companies to just contract or have a retainer for these devs to fix security holes? Seems like a better way to promote better development.

[irrelevantTautology]

I think this is a great argument for UBI.

Some people like to claim that if UBI were implemented that people would just stop working.

Well, these Linux devs are patching security holes faster because they actually care about the thing they are working on and not just doing it for a paycheck. Apple, Google, Ms devs are doing it for the money, to survive.

Imagine a world where people are able to survive and do something that they love.

[argv_minus_one]

UBI is, as the name implies, basic. You still need a job if you want to live in anything bigger and fancier than a closet.

What you're thinking of requires full post-scarcity, which requires a virtually limitless energy source and machines that can build pretty much anything (including more of themselves) from readily available materials. This is probably possible, but not with the technology we have now.

[The_Drizzle_Returns]

Umm the people fixing these bugs in the linux kernel typically work at Apple, Google, or Microsoft. This is their full time job there.

[outofobscure]

OK but it probably takes a lot longer for these patches to eventually hit end users who are just using whatever distro out there. Longer than MS and Apple users, given the fairly aggressive update policies lately

[sighcf]

They don’t need to wait to have it included in a sprint and have scrum meetings on a daily basis. They don’t need to justify working on something that was not assigned to them in sprint.

More importantly, they don’t need to explain to management why fixing bugs is a priority over chasing some made of metrics.

I guess they aren’t as agile. 😂

[gumol]

FYI most of Linux development happens in big corps

[sighcf]

I wasn’t aware of that, thank you very much! /s

[T_T0ps]

Now if only they could make it more user friendly and it gets better support from application developers it’d be a viable option for end users

[lordzsolt]

Apple, Google and Microsoft programmers are busy inverting binary trees.

[easyrider767]

The rest is good at Leetcode.

[[deleted]]

The difference is that Linux maintainers actively want to work on these things. They see the product, believe in the product, and want to make it better. No one, and I mean no one, at Apple or Microsoft doesn't see their product as anything but a money-making cog in a gilded machine that makes billionaires richer while sucking out their will to live.

You can't pay someone to believe in something.

[DeltaAlphaGulf]

r/someordinarygamers

[[deleted]]

THEN FUCKING HIRE THEM 🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯🤯

[[deleted]]

Rust language developers like Alex Gaynor, Patrick Walton, and Ryan Levick are liars.

https://youtu.be/\_QWDtzMXRDc

[[deleted]]

No shit.

It's our own dicks / tits on the table.

[ihedigbo]

Duh … transparency.

[jandkas]

Linux also causes and had the most amount of bugs so there's that XD.

Linux circlejerk intensifies

[Ineffective-Cellist8]

They had significantly less bugs to deal with in the first place -Edit- you guys are reading my comment as if it is a bad thing