3

For a non-commercial user, is there any difference between major distributions regarding the time needed for security patches to be available? Does the "enough eyeballs effect" takes places in this context?

I wonder if there is some objective data available like track records for instance allowing to compare the security patches delivery speed from several distributions:

  • For example, good distribution would have most fixes available as updates within hours.
  • Another aspect would be that bad ones would make applying critical patches unnecessarily hard (and no way to make them automatic).
2
  • The title of your question is ok, but the body is opinion-seeking. Please have a look at LWN, NIST NVD etc. for a glimpse at how distributions release patches. – Deer Hunter Oct 31 '15 at 13:42
  • There is currently a discussion about this post on Meta, following which I will try to improve this post and my own answer (I do not touch it right now to avoid successive partial edits). Feel free to participate if you like ! – WhiteWinterWolf Nov 3 '15 at 12:56
6

Your question is a good one as it is used by some marketing department to praise their own Linux distribution.

Most often Linux distributions are not the patches authors: as their name states they are just distributing otherwise already existing content.

  1. A security vulnerability is discovered and notified privately to the software development team,
  2. The software team develop a fix and forward it to the main distributions (this may take a variable delay depending on the correction complexity, hopefully at this step the issue is known only by the software development team and the vulnerability discoverer),
  3. The main distributions produce an security update, and sometimes all of them including the software author coordinate themselves to release the fix at the same time, thus maximizing the number of people getting the fix before any exploits gets developed by analyzing the fix content,
  4. After a variable delay (most often a few days but it can be longer depending on the software development team transparency policy) the vulnerability is publicly documented so administrators can now compare the behavior of vulnerable and fixed environments and ensure all of their environment is properly fixed.

Security updates are therefore most often upstream updates that the distribution team must:

  • Apply, which include recompiling all required software for all supported platforms,
  • Test to ensure it doesn't break anything on the distribution,
  • Customize if the patch cannot be applied as-is, and then go again on the previous "test" step,
  • Release to the distribution users when the patch has been properly qualified.

The issue then with the Linux distribution regarding security updates release is not really the "enough eyeballs effect" you mention, but the number of developers available for these steps, even more since upstream security updates cannot be planned in advance and that most developers act on a voluntary basis.

Large well-known distributions will have generally no issue with this: there will always be enough people available somewhere on the planet to work and coordinate themselves in order to release the update quickly (however even then the whole process will most likely take a few days instead of the few hours you seem to expect). However for smaller distributions (or somewhat confidential derivatives from larger distributions) this may be a real issue.

So, to answer your question, any large and well-known distribution will be approximately equivalent (and very good) into their response time into releasing security updates.

However, in all cases, you should read the distribution update policy and procedures upfront:

  • As you mention, different distributions may have different update procedures adapted to different needs. As it appears in your question, you deem binary update to be more secure because quicker to apply, while other consider source code diffs more secure because it can be inspected.

  • Different distributions may also adopt different life-cycles. Some may need a full system upgrade every 6 or 12 months, no update being provided for previous versions. Some will provide updates for a longer period, covering several years, and possibly cover both the current and a one or more previous releases. Some distributions rely on a Long-Term-Support (LTS) basis: some releases are flagged LTS meaning they will get updates during a longer period than releases which are not. At last a few distributions rely on a rolling-update principle: there is a single release which evolves over time, all installed products being always at the most recent version but updates may require manual configuration changes.

This distinction is important because while a stable security update should not require any manual configuration changes after the patch has been applied, the amount of changes needed after a full system upgrade can be quite substantial to say the least. Therefore some people will prefer to keep the same version a longer time, even if they do not benefit from the latest features, while other people prefer to upgrade to the most recent release in order to benefit from the latest features, even if this require more work (this will be the case mostly only for individual users, corporate users will usually go to the longer support period).

However, if you need serious guaranties (like an insurance for your business), then you should choose a commercially supported Linux distribution where:

  • Update delivery will not rely on benevolent work any more but on paid employees,
  • Your Linux distribution provider will be accountable to you in case of issues,
  • You will benefit from professional support to assist you for the update application (it is good to have a security update available, but what if it breaks your environment?).
2
  • Worth noting that in some serious cases, distributions can get contacted and can coordinate to ensure everyone has a patch ready before a vulnerability is publicised. I believe this happened for either of Shellshock or Heartbleed. – Steve Dodier-Lazaro Nov 4 '15 at 17:02
  • @SteveDL: Thanks for suggestion, I edited my post accordingly! – WhiteWinterWolf Nov 4 '15 at 17:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.