MWR Labs: Assessing the Tux Strength

It is only fair if the compared distros have the same release cycle. So comparing Ubuntu with Fedora is just fine, they release every 6 month. Other wise the time of the experiement is just arbitrary and will effectively disfavor distributions with longer release cycles that don't shipp newer linux-2.6.

They for example didn't test Red Hat or CentOS.

> evaluating the latest stable for each distro seems fair to me.

At the same time we should keep in mind that they have been released in different times and with different processes. Otherwise such comparison may be misleading.

Debian puts a lot of efforts into releasing a distribution that contains only mature software, "old by design" so to speak, where many vulnerabilities have already been found and patched.

The main reasons to do that are security and reliability.

Other distributions (including Ubuntu) are releasing much newer software, mainly to provide a better desktop experience, so they can ship new security features.

OTOH, all the cutting-edge software included inevitably contains many new vulnerabilities.

In terms of trade-offs, given that the memory protection tools mitigate a specific set of vulnerabilities only, having mature software gives much more security in my opinion.