full-disclosure - windows linux final study

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Mar 30 00:59:13 2005
From: joe_k at web.de (Joerg Kurz)
Subject: windows linux final study

>
>
>(...)
>Look beyond that and think out loud about the second part of the original 
>paragraph quoted:
>
>  per vulnerability for the Windows solution, 69.6 days of risk per 
>  vulnerability for the minimal Linux solution and 71.4 days of risk for 
>  the default Linux solution.
>
>So now there is a difference in patch cycle between "minimal linux" and 
>"default linux"? Can anyone cite a source for any linux vendor that makes 
>this distinction between install types AND releases patches on a different 
>cycle for them? How far do you have to take word mincing to make this 
>statement true?
>
>
>jericho
>(...)
>  
>
>  
>

Although agreeing with you in most of the other points, I have to add that the 
difference in the days of risk results most probably from the averaging:

Example:
patch 1: 50 days
patch 2: 60 days
patch 3: 70 days
full installation contains: all patches = 60 days / patch
minimal installation contains: patch 1 & 2  = 55 days /patch

-jk