News for hackers. Stuff that matters.

A comment on Linux developers patch security holes faster than anyone else, says Google. Parent comment

Re:Linux developers patch security holes faster than anyone ... by jka on Sunday February 20, 2022 @12:48PM (#30407517)
You make a good point here -- the time-to-deployment is significant as well as the time-to-resolve.

It's also true that once a fix is available in any Linux source tree, advanced users can begin to use it from that moment onwards.

Arguably some users could develop their own workaround or solution even before one is available upstream, should they want to (because the code and tools to compile it are all available to them).

(similarly it'd be valuable to analyze how long it takes for the majority of end-users to upgrade across common operating systems. something like this chart[1] of Firefox version traffic history, but for security fix rollout)

[1] - https://web.archive.org/web/20201220010043/https://paulcalva...

[ Parent | on HN ]
Re:Linux developers patch security holes faster than anyone ... by tpmx on Sunday February 20, 2022 @01:32PM (#30408032)
Sure - there is definitely a real benefit for advanced users of the Linux kernel.

Epecially if your organization has someone on the Linux kernel security team, I guess.

[ Parent | on HN ]
Re:Linux developers patch security holes faster than anyone ... by bombcar on Sunday February 20, 2022 @01:56PM (#30408254)
This can also be a downside where the fix reveals the vulnerability and it begins to be exploited before distros get fixes out.

Iirc there recently was a big one where the fix was snuck into a large Linus patch and not revealed until all distros had a chance to release updated kernels.

[ Parent | on HN ]