Bill Gates: Windows Patched Faster than Linux

petard writes "In a very interesting interview published by the Register, Bill Gates made several interesting claims about Longhorn. Many of them have been extensively covered recently, including plans to force users to patch automatically. Surprisingly, everyone seems to have overlooked his statement that Microsoft fixes bugs faster than Linux developers do. 'We've gone from little over 40 hours on average to 24 hours. With Linux, that would be a couple of weeks on average.' Either he's lying or woefully misinformed; their recent performance seems to be more on the order of 3+ months, or over 2000 hours."

Comments

Who Solves Security Problems Faster?

[Crispin Cowan]

My favorite study on this question was "Linux vs. Microsoft: Who Solves Security Problems Faster?" by Jim Reavis. The data is from 1999 and 2000, but it is nicely systematic. At least back in 2000, Linux was much faster than Microsoft, averaging 11 days vs. 16 days.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, Immunix Inc.
Immunix: Security Hardened Linux Distribution

Re:Patching Faster vs. Patching Easier

[AstroDrabb]

I am not saying that the Linux patching process is cumbersome, but we gotta admit that the average users (not sysadmins) just can't begin to understand how to patch their Linux boxes.

What? Have you ever used Red Hat's up2date tool? It is easier then windows update. It is just a GUI app that you click Next in about 3 times, wait for the new packages to download and your done. What in the world could be hard about that? Red Hat even has a little icon that sits in the notification area and turns a bright red with an exclamation point when there are updates available. Clicking on that brings up the uber-newbie friendly GUI to download them. No terminal (command line) involved. No rebooting involved (unless you upgrade the kernel). You can install ALL the updates at once with NO reboot between them, unlike many MS updates, especially service packs that require a reboot. Please don't mention chain loader, no average Joe is going to be able to use that.

Marketing

[ralphus]

Tricks. It's all tricks.

I recently was in a Microsoft webinar regarding patch management. If you are interested, or a glutton for punishment, this was it. At one point they showed a histogram on the screen that was intended to show vulnerabilities in operating systems and how MS was beating everyone on the planet. Major Microsoft products were all broken down by release, e.g. Windows 20003, Windows XP, Windows 2000, Windows NT, etc.. Linux and BSD were categorized by distribution only, e.g. Redhat, Debian, BSD etc...

Windows 2003 appeared at the far left with only a few vulnerabilities. Windows 2003 was actually the "winner". It even "beat" BSD! Now think about that histogram for a minute. It created false divisions that did an apples to oranges comparison. The sum total of Debian vulnerabilites likely refer to all released versions of a Debian distribution with all possible packages installed while Win2003 likely refers to only a Win2003 retail box installed with the bare minimum options.

Marketing is a black art. I have some personal experience, but NDAs to bind me. It's an art of trying to create and/or shape ideas in the mind of your customers, critics and competitors. The most successful marketing is that which makes them believe they came to the ideas you wish them to hold of their own volition.