full-disclosure - [inbox] Re: RE: Linux (in)security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: peter at adamantix.org (Peter Busser)
Subject: [inbox] Re: RE: Linux (in)security

Hi!

> In 2003 there have been 43 security advisories for SUSE Linux according to 
> SUSE's website:
> http://www.suse.com/de/security/announcements/index.html
> 
> RedHat has had 53 during the same time period:
> https://rhn.redhat.com/errata/rh9-errata-security.html
> 
> Debian has had 176 during the same time period:
> http://www.debian.org/security/2003/
> 
> (Makes me wonder if the other vendors are really being honest.  Is Debian 
> that bad?  Or just much more thorough, forthright and conscientious than 
> the others?)

Debian is not that bad. There are 3 Debian distributions at the moment. The
old Potato, the current Woody and the future Sarge. AFAIK there have been
advisories that were specifically for versions that can be found in Potato. I'm
not sure if there are already advisories for Sarge, but if not you can expect
them to start appearing before the official release.

Then there is the size of Debian. apt-cache stats will tell you the total
number of potentially installable packages. On my Woody machine it is more than
8800 packages. And on my Debian unstable machine it says more than 17000. Or
put in different words, the Red Hat taroon beta I downloaded was 4 CDs. Debian
Woody alone is 6 CDs. Sarge will be bigger. It is almost true that if you
cannot find it in Debian, it does not exist.

With a code base that large, it is not surprising that there are more
advisories for Debian than for other, much smaller distributions.

Groetjes,
Peter Busser
-- 
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world
http://www.adamantix.org/