Fans should 'weep' over Linux bugs

Following the furore earlier this week over which operating system, Linux or Windows, suffered more security vulnerabilities throughout 2001, Linux site LWN.net set about comparing the vulnerabilities suffered by different Linux distros in 2001.

Needless to say, the results were quite interesting, even prompting the Linux site to warn: "Anybody who is proud of Linux's security should have a good look and weep - it is a very long list."

The big picture is somewhat vague, because although all Linux distributions have the same kernel, each distro contains thousands of different packages and extra applications.

LWN said: "There is no end of caveats that apply to this table: it is hard to make a one-for-one comparison of security updates across distributions. Undoubtedly some updates have been joined that should not be, and others have been kept separate when they should be together."

Also, the results do not distinguish between versions, so an update for Red Hat 6.2 would be lumped in with Red Hat in general.

The resulting table identifies 290 updates for 145 unique vulnerabilities across the main Linux distributions - Suse, Debian, Mandrake, Red Hat and TurboLinux.

"It would seem that the vnunet.com article actually underestimated the problem," said LWN.

However, in light of the results, the site was quick to point out that "we are not yet at a point where we can make meaningful comparisons even between Linux distributions. Trying to compare Linux with Windows seems like a waste of time."

The fact that each distribution of Linux comes with a wide assortment of packages makes it more than just an operating system for comparison purposes. And the scope of difference between each distro is so wide that patches released for a package in one distro may not be at all applicable to another.

"In the end, there is only so much to be learned about the security of an operating system by counting its published vulnerabilities," said LWN.

"One has to look at the seriousness of each, how it was discovered (internal audit or external exploit), how long users had to wait for a fix, and how many users were actually compromised as a result of the problem. We need better ways of understanding and comparing security response; simply counting vulnerabilities is not sufficient."

Below is the table identifying all Linux security updates throughout 2001 for the major distros.

Source: LWN.net