How secure is your Linux distro

[Wally Balljacker]

http://searchsecurity.techtarget.com/or ... 17,00.html

This test basically takes a look at how fast security patches are issued for each distribution. I was very surprised to see OpenBSD, and Slackware among the lowest scores.

[Gomer_X]

This test basically takes a look at how fast security patches are issued for each distribution. I was very surprised to see OpenBSD, and Slackware among the lowest scores.

I wasn't so surprised to see Slack and the BSDs behind the curve because they're pretty slow moving.

I was more surprised to see Gentoo so far down the list. I guess rapid development doesn't mean security focused development.

[Patrick]

Wow, Slackware and Suse are near the bottom. That's pretty shocking.

[Judland]

So, what are these results telling me about Mandriva?

They are in the middle of the curve, which means to me that they are not so quick to release an update without proper testing (in other words, patching a system yet breaking it), but don't let the issue go for too long without fixing it.

It's a good balance, in my opinion.

[Tsuroerusu]

Naturally, it's unwise to put too much stock in the absolute numbers themselves; it's better to think about what is causing these results. For example, both Ubuntu and Fedora are free, but are sponsored by commercial vendors (Canonical Ltd. and Red Hat Inc., respectively). This could indicate that having corporate resources to support free efforts is important.

Also notice that retail distributions aren't necessarily better than free distributions in this regard. While Red Hat earned a respectable 63, Novell's SUSE received a 32. Some retail distributors may have a more lengthy process to develop and test fixes, because they must support more enterprise-level customers. A similar consideration may help explain Trustix Secure Linux's low score of 32: this distribution is oriented toward security, so perhaps its security experts take longer to verify vulnerability fixes.

The fact that other freely available versions like Debian score so well may reflect the distributed nature of such projects. With participating developers all over the world, they may be able to pounce on problems faster than organizations limited to a single country or site.

Any distribution release fixes faster than Microsoft does.

[Tsuroerusu]

So, what are these results telling me about Mandriva?

They are in the middle of the curve, which means to me that they are not so quick to release an update without proper testing (in other words, patching a system yet breaking it), but don't let the issue go for too long without fixing it.

It's a good balance, in my opinion.

I agree, I think of the same thing when I look at SUSE's results. I like to keep a close eye on what happens at SUSE, so I subscribe to the commit mailinglist, and it's been very close to 24 hours since I got notified about Firefox 1.5.0.5 going into the whole development system, plus I'm paranoid about security so I subscribe to the SUSE Security mailinglist, and it's been about 1½ hours since they issued a security bulletin for Firefox and Thunderbird. What this all tells me is that they test the fixes a lot before releasing them, and I actually know that they do this from watching a presentation by Marcus Meissner, leader of SUSE's security team, at FOSDEM back in February.

[jsusanka]

to me this is not that important - but what is important is the trouble I have when the fixes are issued. with any distro of linux I have had very very minimal trouble with patches and never had to roll any patch back - I was able to fix stuff by editing config files.

I know some windows admins at my company that are still struggling to get up to date because shit just breaks when they touch their windows servers.


now the real test for me at least is out of box quality

I would like to see a test of windows server out of box versus a linux out box server

no patches or anything and leave them out on the internet and see what happens.

I know where my money would be.

[Patrick]

I would like to see a test of windows server out of box versus a linux out box server

no patches or anything and leave them out on the internet and see what happens.

I know where my money would be.

Of course we know the answer to this.

[Judland]

I would like to see a test of windows server out of box versus a linux out box server

no patches or anything and leave them out on the internet and see what happens.

I know where my money would be.

Of course we know the answer to this.

Yea... a score of 0.4

[Gomer_X]

Wow, Slackware and Suse are near the bottom. That's pretty shocking.

When I look at the fact that Red Hat is behind Fedora and Debian is behind Ubuntu, it brings me to a conclusion.

Distros with more up to date software release patches more often because they're more likely to need them. More "stable" distros don't patch as often because people who use them don't want to update often, and older software doesn't have as many bugs.

I know if I were running a 2.4 kernel, Apache 1.3 and MySQL 4.x, I'd probably have fewer security vulnerabilities than with the latest versions. My FC4 box gets fewer updates than my FC5 boxes.

This explains Slackware, but not Suse.

[Chess]

One important point this article does not take into account is how long patches are provided for old versions of a distro.

[Tsuroerusu]

Wow, Slackware and Suse are near the bottom. That's pretty shocking.

When I look at the fact that Red Hat is behind Fedora and Debian is behind Ubuntu, it brings me to a conclusion.

Distros with more up to date software release patches more often because they're more likely to need them. More "stable" distros don't patch as often because people who use them don't want to update often, and older software doesn't have as many bugs.

I know if I were running a 2.4 kernel, Apache 1.3 and MySQL 4.x, I'd probably have fewer security vulnerabilities than with the latest versions. My FC4 box gets fewer updates than my FC5 boxes.

This explains Slackware, but not Suse.

Especially with the latest enterprise releases, but overall, SUSE has for a long time used quite a common codebase all the way from their highend enterprise server products to their "consumer product" as a lot of the German guys put it, which I applaud them for. So I'll bet it's because they do this extra testing of the patches, Microsoft does the same kinda thing, they're just a million times more ineffective. That's what I think.

For example, they have yet to release a Firefox 1.5.0.5 update, and the sources have gone into their build/patch system, so I think it's because they do some internal testing, of course I don't really know this, but it's just a guess.

One important point this article does not take into account is how long patches are provided for old versions of a distro.

Good point, for SUSE I know it's two years for every consumer/community release (9.1 security support just ended last month) and like seven years for the enterprise server releases, I don't yet know how long SLED 10 will be supported with security fixes.