Slashdot Mirror

a) it doesn't take account of the window of vulnerability between discovery (or, at the very least, public disclosure) and a working patch being made available. This study does. Google finds more details for those that want 'em.

b) All Linux distros ship far more software than Microsoft does with Windows, and rarely will all of it be installed and running on a given system. If a vulnerable package isn't installed on a given system, then that system isn't vulnerable. To compare like with like, you'd need to take Windows' stats and add them to IIS, Exchange, Mozilla, Office/OpenOffice.org, Cygwin/SFU, SQL server, a bunch of free and shareware IRC clients and so on.

If folks are going to play these silly pissing contests, then the only fair way to do it is to take account of the period of vulnerability and base comparisons on "role profiles" (e.g. PHP web server, anti-spam MTA, static web server, graphical desktop).

--

The data is from 1999

True, but its the data we have, unless you know of a more recent study.

Linux data is from Red Hat only

True. But talking about response time for patches to the Linux kernel is pretty meaningless, so you end up talking about distro vendors. Red Hat seems like a pretty reasonable vendor to look at.

You neglected to mention Sun

The original article also did not mention Sun, so I considered it irrelevant to comment on Sun. That Reavis studied Sun is a bonus. Enjoy :)

Only three operating systems were included

So what's your point? I'm just refuting Gates' claims that MS patches faster than "Linux".

Evaluation criteria were not explicitly stated

I don't get your point. The evaluation criteria was "how many days does the vendor leave you exposed to a published vulnerability?"

Raw data are not available

Raw data for Microsoft, Red Hat, and Sun.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, Immunix Inc.
Immunix: Security Hardened Linux Distribution

The data is from 1999

True, but its the data we have, unless you know of a more recent study.

Linux data is from Red Hat only

True. But talking about response time for patches to the Linux kernel is pretty meaningless, so you end up talking about distro vendors. Red Hat seems like a pretty reasonable vendor to look at.

You neglected to mention Sun

The original article also did not mention Sun, so I considered it irrelevant to comment on Sun. That Reavis studied Sun is a bonus. Enjoy :)

Only three operating systems were included

So what's your point? I'm just refuting Gates' claims that MS patches faster than "Linux".

Evaluation criteria were not explicitly stated

I don't get your point. The evaluation criteria was "how many days does the vendor leave you exposed to a published vulnerability?"

Raw data are not available

Raw data for Microsoft, Red Hat, and Sun.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, Immunix Inc.
Immunix: Security Hardened Linux Distribution

The data is from 1999

True, but its the data we have, unless you know of a more recent study.

Linux data is from Red Hat only

True. But talking about response time for patches to the Linux kernel is pretty meaningless, so you end up talking about distro vendors. Red Hat seems like a pretty reasonable vendor to look at.

You neglected to mention Sun

The original article also did not mention Sun, so I considered it irrelevant to comment on Sun. That Reavis studied Sun is a bonus. Enjoy :)

Only three operating systems were included

So what's your point? I'm just refuting Gates' claims that MS patches faster than "Linux".

Evaluation criteria were not explicitly stated

I don't get your point. The evaluation criteria was "how many days does the vendor leave you exposed to a published vulnerability?"

Raw data are not available

Raw data for Microsoft, Red Hat, and Sun.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, Immunix Inc.
Immunix: Security Hardened Linux Distribution

My favorite study on this question was "Linux vs. Microsoft: Who Solves Security Problems Faster?" by Jim Reavis. The data is from 1999 and 2000, but it is nicely systematic. At least back in 2000, Linux was much faster than Microsoft, averaging 11 days vs. 16 days.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, Immunix Inc.
Immunix: Security Hardened Linux Distribution

My favorite study on this question was "Linux vs. Microsoft: Who Solves Security Problems Faster?" by Jim Reavis. The data is from 1999 and 2000, but it is nicely systematic. At least back in 2000, Linux was much faster than Microsoft, averaging 11 days vs. 16 days.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, Immunix Inc.
Immunix: Security Hardened Linux Distribution