Langa Letter: Linux Has Bugs: Get Over It (TechWeb)

He identified two bugs pulled from the CERT list as comparable, a ptrace bug in RH's kernel, and the WM_TIMER bug in the w32 API. It is true that they are of comparable severity. However, the ptrace bug was fixed immediately, but the WM_TIMER bug not only hasn't been, but (according to reports) can't be, and (according to MS) won't be.

But that's hard to do.

WinXP "itself" only has 22. RedHat has 150-some. But RedHat includes a lot more software that just "plain" WinXP does. When you factor in IE, Outlook Express, MSN Messenger, NetMeeting, IIS, MSDAC, Office XP, Windows Media Player, SQL Server 2000, the .NET Framework, etc -- well, then the # of bugs in a typical install of WinXP jumps (to roughly 64, by my count).

But the problems don't just end there. To get a count of the toal # of bugs that have affected WinXP you need to do more.

MS releases new versions of Windows "components" (IE, Outlook, WMP) while WinXP itself it out. So you also have to factor in all the bugs from both WMP 8 (which shipped with WinXP when it was first released) and WMP 9 (which was just released a few weeks ago). That will also elevate the # of bugs.

So, it's really hard to say how many bugs have affected your typical WinXP install.

He also ignores that RedHat has many installation profiles: desktop, db server, web server, etc. Dependingon your profile, different software gets installed.

So it's really hard to say how many bugs a RedHat user will see vs a WinXP user.

And he didn't really try, either.

I think this statement is essentially true, even if his arguments and the numbers he states are ill-chosen (151 RedHat patches vs. 24 for XP seems suggest that RedHat is 6 times more buggy, which is of course nonsense).

I think we Linux advocates are ill-advised to fight against statements like this. The 2.4 series of the kernel had major maturity problems as we all know. The ever-increasing size of user space libraries and the growing number of drivers offer far more corners for bugs to hide than Linux in the good old days. At the same time, Microsoft products have improved a lot in terms of stability - the "bluescreen every day" times are over.

We must face these facts, and focus on Linux' real advantages. Most importantly: it's free.

A Linux admin, faced with a security hole, can wait until his vendor issues a patch - or fetch the source, apply the patch, rebuild and reinstall himself. Hiw Windows counterpart can do nothing but wait until Microsoft delivers a patch.

Most patches take much longer to appear, and longer still to become generally available to all affected users, in finished, tested, easily installable form--even if, technically speaking, the initial instance of the bug was stomped out very quickly. Given the growing fragmentation of the open source community and the increasingly quasi-proprietary distributions of Linux, how could it be otherwise? It has to take time to get patches out.

Balderdash. The Debian security team gets patches out within hours to days, Microsoft's weeks or months are inconcievable. And Debian does this for the current stable (3.0, "woody") and old stable as well (2.2, "potato") which is still supported two and a half years after release [no better than Microsoft here, but contrast to RedHat's recent announcement]; for six different processor architectures in potato and eleven in woody!

As for "finished, tested, easily installable form", how's:

apt-get update && apt-get dist-upgrade

dselect -> u <enter> -> i <enter>

aptitude -> u -> g

Of course, other distros have followed Debian's lead, so it's similarly easy to upgrade other systems. [Though AFAIK, nobody else has the debconf system which preserves package-by-package configuration options through upgrades.] And other distros have made other innovations, which spread around the community.

So Mr. Langa, show me the multiple Windows distributors who rush to get out the fastest and most thorough patch solutions -- with the longest maintenance periods! Show me the competing distributions of Windows which have innovated system management tools at anywhere near the rate of the Linux distros! The ability of multiple vendors to compete highlights an advantage of freedom with direct benefits for aggregate security -- and should illustrate the more "capitalist" (or more properly, "libertarian") nature of F/OSS cf. the Redmond Bolsheviks who preach "the one true solution".

Speaking of competition, show me the alternative processor architectures Windows runs on which are immune to IA-32 exploits run by all the script kiddies! Not only are F/OSS users free to choose CPUs according to merit and not "which one runs Windows", but our diversity improves our security, e.g. my group's alpha and PowerPC boxes are inherently less vulnerable to overflow-type attack than the Wintel monoculture; adding a (Debian?) *BSD firewall would improve things even further. And of course, others have mentioned the multitude of mail transport agents, name servers and web servers (Debian stable has nine packages providing httpd, vs. one from Microsoft).

No, I'm afraid there is no comparison, F/OSS is more secure: Get over it.

While he seems to have chosen to present this in a deliberately inflammatory form (not surprising—it's his job to promote discussion, and one of the best ways to do that is criticism), the essential core of his argument is something quite worth paying attention to.

Linux is not, by any real-world definition "inherrantly" more secure or stable than Windows; much as I despise admitting it, Windows 2000 and XP have progressed to the point where random crashes are not the routine thing that they once were. This isn't to say that Windows no longer demonstrates any problems, but they are now, generally more to do with usability issues rather than stability.

Linux, in my experience, has been consistently stable so long as the environment it runs in is configured correctly. An error in configuration can cause significant heartache, as I recently experienced with my GNOME2 desktop; while it didn't affect the stability of the system (I never experienced any system-wide crashes), it did render my desktop less usable as major components simply failed to work. It turned out that it was a simple name resolution error (my machines hostname was getting mapped to an incorrect IP address, causing ORBit2 to fail; since much of the GNOME2 infrastructure relies on ORBit2 in one way or another, this caused large portions of my desktop to fail). And this whole thing was due simply to the fact that I am using a domain that is administered by a remote host (yes, it is my domain; it's being hosted by another company, though). That and the fact that I use DHCP to allocate my IP address…

It took me almost a month (mostly because of insufficient time) of fiddling around before I finally figured this out (since everything had been working properly before then, I had been assuming it was the fault of an incorrectly built package that I had installed, since nothing had been changed that I was aware of; it wasn't until I, finally, sat down and methodically tracked down the problem that I figured it out). And I consider myself an experienced user who has no fear of using the command line or editing configuration files.

Imagine somebody who was Linux-illiterate trying to figure this one out…

It is also quite true that script-kiddies have not been targeting Linux before now simply because it was a low-profile system; I think we can expect the number of exploits for Linux to grow from now on—although I fully expect that these exploits will be fixed nearly as quickly as they are discovered, if not quicker.

The Linux / BSD world seems to manage this diversity fairly well. Most programs run fairly well on most platforms. In fact, I have run into many more compatibility problems between Windows versions than between Linux versions. The worries about lock-in and incompatibilities as with commercial Unix doesn't seem to come true in the Linux world.

If security is your main concern--by all means, select OpenBSD. They have had ONE remote hole in the default install, in more than 7 years! There are also more security oriented Linux distributions, like NSA Security Enhanced Linux or Trustix. You can make a choice between features and stability. Between bleeding edge and conservative choices.

A capable customer can harden the operating system, or a security-oriented vendor can pick up a Linux distro and secure it for its customers to an extent that would be impossible with Windows.

With Windows you are always at the mercy of Microsoft. It surprises me that so many people in business are satisfied with that. I guess most risk concious companies make risk assessments, and if you are very much dependent on a single vendor in some area, or on a single customer, this is always a risk, something that one should try to avoid. For OS's I don't see any other way than Linux/BSD/Unix today, if we take this seriously.