Hacker News Reader

Comment by JoachimSchipper | Hacker News Reader

This won't be popular, but: Linus' attitude is part of why Linux sucks at security.

Go to e.g. osvdb.org, search for 'Linux kernel': 878 results. Search for 'Solaris', which includes many non-kernel vulnerabilities: 595 results; search for 'freebsd': 171, including e.g. ftpd issues; search for 'OpenBSD': 93, again including stuff like an XSS in OpenBGPD's bgplg (very much not part of the kernel!) This is not merely historical; Full-Disclosure readers get a "vulnerabilities in Linux kernel: 20 issues fixed" every month or so.

Yes, Linux has some really nifty stuff, lots of people are looking at it, and things like GrSecurity can be useful. But it also has a lot of (local) kernel-level vulnerabilities compared to similar pieces of software.

View on HN

Just because more linux security bugs are found dosn't mean that linux has more security bugs. I think there are far more linux boxen connected to the internet than solaris and *BSD, so the incentive to search for vulnerabilities should also be greater.

Linux has more security bugs because it's a tangled mess of spaghetti code, large sections of which aren't particularly well maintained.

Seriously, try looking for dangling pointer bugs, there's tons, you can just pluck them from the trees.

Here's a comment I posted a while back that might be of interest: http://news.ycombinator.com/item?id=2301830

Then please start fixing all these bugs and submit patches!

Spent much time crawling through BSD driver code, have you?

Haha, I spent a bit looking at Net and FreeBSD, but I stopped because no-one really uses it, so what's the point?

To be fair, this stuff happens in BSD land too, but nowhere near as much as on Linux. To be fair again, the Linux codebase is a very different beast and has grown in a very different way.

It won't be popular for a variety of reasons, the foremost two being:

1. It's a very dumb metric, for reasons stated well downthread and for many others (the bewildering number of off-by-default hardware and kernel features many of those vulns appear in being another).

2. The fairly obvious rebuttal that things Linus says on message boards actually have little to do with the security of Linux, and that the particular thing Linus said this time has practically nothing to do with the security of Linux.

With the possible exception of OpenBSD†, nobody clueful picks server platforms other than Linux with the expectation that it is going to be easier to keep them secure on the Internet.

† Reasonable people can disagree about the extent to which OBSD is a win; in 2011, I'd rather have Spengler on my side than Theo.

It is not a very good proxy for how likely you are to get 0wned. It is available, though, and I'm not convinced that it's so bad that a 5x (Linux kernel/FreeBSD) or 9.4x (Linux kernel/OpenBSD) difference still doesn't say anything.

Linus' words don't affect code quality; but wanting to move quickly does, and Linux does move quickly. I agree that Spengler is pretty awesome, though.

> Reasonable people can disagree about the extent to which OBSD is a win; in 2011, I'd rather have Spengler on my side than Theo.

To quote the wisdom of the dude:

"Well, yeah. That's like, your opinion, man."

My home brew operating system has zero bugs. Thus, it's the most secure os in the world.

Or it is because no body cares or looks at it? ;-)

"Zero bugs" and "zero known bugs" are two different matters entirely :)

True. Please tell this also the kids who think sites like osvdb.org tells them how secure a OS is...

BTW: I'm switching over to NetWare now. osvdb.org shows only one kernel vulnerability!

Reply on news.ycombinator.com