Re: [inbox] Re: RE: Linux (in)security

[Peter Busser <peter () adamantix org>]

Hi!

> In 2003 there have been 43 security advisories for SUSE Linux according to 
> SUSE's website:
> http://www.suse.com/de/security/announcements/index.html
>
> RedHat has had 53 during the same time period:
> https://rhn.redhat.com/errata/rh9-errata-security.html
>
> Debian has had 176 during the same time period:
> http://www.debian.org/security/2003/
>
> (Makes me wonder if the other vendors are really being honest.  Is Debian 
> that bad?  Or just much more thorough, forthright and conscientious than 
> the others?)

Debian is not that bad. There are 3 Debian distributions at the moment. The
old Potato, the current Woody and the future Sarge. AFAIK there have been
advisories that were specifically for versions that can be found in Potato. I'm
not sure if there are already advisories for Sarge, but if not you can expect
them to start appearing before the official release.

Then there is the size of Debian. apt-cache stats will tell you the total
number of potentially installable packages. On my Woody machine it is more than
8800 packages. And on my Debian unstable machine it says more than 17000. Or
put in different words, the Red Hat taroon beta I downloaded was 4 CDs. Debian
Woody alone is 6 CDs. Sarge will be bigger. It is almost true that if you
cannot find it in Debian, it does not exist.

With a code base that large, it is not surprising that there are more
advisories for Debian than for other, much smaller distributions.

Groetjes,
Peter Busser
-- 
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world
http://www.adamantix.org/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html