Linux is a joke

[Gogol]

OK, then just continue throwing blanket statements then bro. No skin of my nose either.

Of course on the internet everyone is a billionaire playboy and worlds strongest street fighting god with a degree in quantum physics. Of course there mere demanour will tell you this. They don’t have to prove anything when they come marching in on their high horse ¯\_(ツ)_/¯

Man, no disrespect but you are talking about the most successful opensource project ever, having over 20k contributors. It’s a mammoth of a project.

I love macs for what they are. I wouldn’t necessarily use linux for dev work either. But there are lots of other use cases where linux absolutely rules.

Also, no one is telling you to not contribute to linux. If for nothing, you could write some documentation for the project and feel proud about it. If linux wasn’t there, you would be paying a lot more money for softwares.

Also, it is opensource unlike macos and windows. So, everyone can read the source code and find vulnerabilities/issues. On a closed source system, you have to work backwards to produce a bug. That’s why you don’t see so many reports for closed source oses.


I would request you to read more, before complaining.

 

[Juhku]

OK, then just continue throwing blanket statements then bro. No skin of my nose either.

Of course on the internet everyone is a billionaire playboy and worlds strongest street fighting god with a degree in quantum physics. Of course there mere demanour will tell you this. They don’t have to prove anything when they come marching in on their high horse ¯\_(ツ)_/¯

Yeah, whatever.

I really could care less about giving super lengthy explanations on why you are wrong, but if you understand it, this single page should be enough.
https://www.cisa.gov/known-exploite...t_by=field_date_added&items_per_page=All&url=

 

[AccKing]

I'd like to understand more to comment, but people are just attacking OP saying he's retarded or insinuating his ignorance without adding nothing productive, just attacks...vague thread with vague answers and personal attacks created by fan boys of a OS, hard to learn something useful from this kind of discussion

 

[Lukmat]

I don't know how we can compare
Android - what is not Linux any more, it have some linux architecture but it's not linux any more
Windows - what is operating system for desktop
Linux - what is not operating system, but kernel and people want to use it as operating system using some fancy GUIs

 

[SirLouen]

This is the biggest issue for an opensource project. The number of CVE is gonna be ridiculously high compared to alternatives, because you can find the flaws straight in the code, no need to reverse engineer the thing.

But now see how much time it takes to solve them compared to closed systems. You will find a different picture.

Android - what is not Linux any more, it have some linux architecture but it's not linux any more

It Linux 100%, what are you talking about?
This is not linux?

 

[umbreno]

I'd like to understand more to comment, but people are just attacking OP saying he's retarded or insinuating his ignorance without adding nothing productive, just attacks...vague thread with vague answers and personal attacks created by fan boys of a OS, hard to learn something useful from this kind of discussion

Apparently there is nothing left to discuss in any serious or mature manner. Everyone has things figured out apparently, and anything less is stupid.

What I have learned from the thread though:

- that any parts of a so called system, either collectively or individually, having a greater number of CVE entries than their next best alternatives combined, year after year, and throughout history doesn't suggest that there might be a systemic problem with the controls of the code base that I briefly touched on... it just means you are an idiot that obviously doesn't know CVEs in themselves being published and bugs sooner or later being patched is a good thing, hardly the point being made, but no never mind here I guess

- Labelling anything open source automatically means something is good because you can inspect and audit the code yourself. And if you can't because you don't have the first clue how to inspect millions of lines of code properly which presumably is more often the case than not, then you can always at least count on the good will of other people to put your mind at ease because then it's someone else's headache to remedy and they'll sort it... even if take topping CVE charts year after year first to get there LMAO.
Just tell anyone that gives examples of critical security issues in open source software having taken a decade to be fixed that they're an idiot for suggesting open source doesn't always mean best

- Linux is the most successful project because it is technical masterpiece and not because any promising next best alternatives had severe licensing constraints in the 90s at time when a competitor to Windows was in dire need and anything, anything at all that was viable enough to get the ball rolling in any serious way would do. In Linux's case that was its utility and ability to allow companies to test and quickly implement cutting-edge tech features.
It's not 1998 anymore though. It's 2024 and this competitor has not only for the most part been hijacked by and become a playground for big tech companies, but in addition to this what remains of the incredibly whacky gnuisms has just rather anti-climatically culminated in to a bazaar of half-assed system components obscurely glued together to the kernel. Hardly the gold standard of FOSS operating systems it set out to be LOL

Also learned people browsing the lounge are too busy to have a serious discussion but have the time to post half-assed put downs if you yourself don't post what will take nothing short of a thousand paged thesis on a systems security architecture and services configuration to prove your point whenever a suggestion ruffles their feathers and address your thought on any popular status quo, no matter how questionable it is. Eat your heart Galileo lol

 

[Juhku]

Apparently there is nothing left to discuss in any serious or mature manner. Everyone has things figured out apparently, and anything less is stupid.

Because you refuse to learn or understand that the number of CVE reports has absolutely zero correlation to the security of a given software.

This is the biggest issue for an opensource project. The number of CVE is gonna be ridiculously high compared to alternatives, because you can find the flaws straight in the code, no need to reverse engineer the thing.

But now see how much time it takes to solve them compared to closed systems. You will find a different picture.

As @SirLouen replied, of course, open-source systems will get a huge number of CVE reports just due to the nature of open-source projects. The code there is audited by tens of thousands of contributors, so pretty much all severe bugs that are found will be reported since the CVE reports for Linux are controlled by their own developer team.

The bugs get reported as CVEs by the Linux developing team because even if the bug doesn't directly contribute to a security flaw, it could possibly be used as an attack vendor in a different configuration.

A severe bug is found in the Linux kernel that can NOT be used as an attack vendor in 99% of Linux distributions?
It will still get reported as a CVE because it could theoretically be used in some obscure distribution under very specific configurations.

Also, we have not spoken about the severity of these CVEs yet.
The barrier to report a bug as a CVE in open-source projects (e.g. in Linux) is very low.
A lot of the CVEs reported in Linux aren't even considered harmful EVEN if they could be used as AVs under the very specific configurations.

Yeah, sure, Linux-based projects have a lot more reported CVEs.
But, they are mostly not to be feared since they are not classified as severe threats and require very specific conditions to be used. Also, they are and will be patched mostly within a week.

Yes, you will be unsafe if you use outdated software under very specific configurations, and you also manage to be targeted by a malicious actor.
How probable is that? Not very.

Windows, on the other hand, is proprietary.
They do not report CVEs with such a low barrier, they take ages to distribute any patches, and because the internal security of their OS is complete shit (and the fact that the amount of possible different configurations is much lower when compared to Linux-based systems), the severity of their bugs are much, much higher.

Since you don't really know about how CVEs work, I don't expect you to know about CVSS either, because we wouldn't even be having this conversation if you did.

CVSS is a scoring system for security bugs.

Here's a comparison of the CVSS scoring by CVE reports in Linux and Microsoft products.

 

[GLimaDev]

Linux has more reported CVEs partly because it's open-source. Anyone can dig into the code and spot issues, which means more eyes catching bugs. Plus, there's a culture of sharing these finds openly, so they all get logged. It's not necessarily that Linux is buggier, just that its problems are out in the open.

 

[Deleted member 731332]

No what is that? Sounds like a word narcissists throw around at people when they’re trying smell their own farts better

You can use Google and learn about it yourself. The condition certainly wasn’t created by “narcissists.” Seems like you struggle with it, since now you also appear to consider yourself a psychoanalyst as well. Just trying to help a fellow human out.

 

[umbreno]

You can use Google and learn about it yourself. The condition certainly wasn’t created by “narcissists.”

I know what it is. I was being facetious on the grounds you’re telling me i’ve got this shaky half made up thing whilst contributing nothing to the dicussion to suggest why you think so beyond a smug attitude and hot air

Seems like you struggle with it, since now you also appear to consider yourself a psychoanalyst as well. Just trying to help a fellow human out.

LOL so basically what you’re telling me is you’re allowed to pathologise and label people telling them they’re suffering from dunning-kruger for no apparent reason, but if anyone does the same they’re attempting to be a ‘psychoanalyst as well’. Another narcissistic tendency.

/ ‘psychoanalysis’

 

[umbreno]

Because you refuse to learn or understand that the number of CVE reports has absolutely zero correlation to the security of a given software.



As @SirLouen replied, of course, open-source systems will get a huge number of CVE reports just due to the nature of open-source projects. The code there is audited by tens of thousands of contributors, so pretty much all severe bugs that are found will be reported since the CVE reports for Linux are controlled by their own developer team.

The bugs get reported as CVEs by the Linux developing team because even if the bug doesn't directly contribute to a security flaw, it could possibly be used as an attack vendor in a different configuration.

A severe bug is found in the Linux kernel that can NOT be used as an attack vendor in 99% of Linux distributions?
It will still get reported as a CVE because it could theoretically be used in some obscure distribution under very specific configurations.

Also, we have not spoken about the severity of these CVEs yet.
The barrier to report a bug as a CVE in open-source projects (e.g. in Linux) is very low.
A lot of the CVEs reported in Linux aren't even considered harmful EVEN if they could be used as AVs under the very specific configurations.

Yeah, sure, Linux-based projects have a lot more reported CVEs.
But, they are mostly not to be feared since they are not classified as severe threats and require very specific conditions to be used. Also, they are and will be patched mostly within a week.

Yes, you will be unsafe if you use outdated software under very specific configurations, and you also manage to be targeted by a malicious actor.
How probable is that? Not very.

Windows, on the other hand, is proprietary.
They do not report CVEs with such a low barrier, they take ages to distribute any patches, and because the internal security of their OS is complete shit (and the fact that the amount of possible different configurations is much lower when compared to Linux-based systems), the severity of their bugs are much, much higher.

Since you don't really know about how CVEs work, I don't expect you to know about CVSS either, because we wouldn't even be having this conversation if you did.

CVSS is a scoring system for security bugs.

Here's a comparison of the CVSS scoring by CVE reports in Linux and Microsoft products.
View attachment 369900
View attachment 369901

That is a decent briefing. Is interesting and useful for members that didn’t actually know of any of it.

 

[homenet]

Peronsally I think what’s retarded is the continous yet impossible attempt of major distros to try to get every third party packages to confrom to their specific configuration management tools and patches seem. Especially when even some of your core OS elements themselves don’t even conform to them either. And good luck with the kitchen sink approach to fixing things when they inevitably break as you keep trying to fit a square peg in a round hole.

And yet the vast majority of Linux users (myself included) are happily using their OS everyday for work and leisure purposes without any problems at all.

 

[umbreno]

And yet the vast majority of Linux users (myself included) are happily using their OS everyday for work and leisure purposes without any problems at all.

And how does that make my opening post ‘retarded’?

 

[SirLouen]

Also, they are and will be patched mostly within a week.

Typically, the CVE is submitted with a PR, so many are patched almost back to back specially critical ones.

Something impossible within a closed system. A CVE might only be reported without any clues on how to sort it until their engineering team find it out, test it and solve it, which could mean days or even weeks
Plus, exactly as you said, depending on the severity, you could have your system configured to accept updates almost immediately (for example Ubuntu's Livepatch)

 

[thedorf]

Oh no Linux is dead!

 

[umbreno]

Oh no Linux is dead!

It’s not dead. It’s just shit. Probably only notable exception to some extent were the immediate RHEL downstreams, and yet RHEL’s dire restrictions is just case in point about how big tech companies have come to exercise so much control over the ecosystem and development

 

[onlyzagor]

This is a pretty thorough breakdown of the challenges Linux faces. While I agree that the fragmented nature of Linux development can lead to issues, I think it's also what allows for innovation and customization that you just don't see with Windows or macOS. Sure, it's not perfect, but for those who want control over their system, Linux offers something unique. It's definitely not for everyone, though.

 

[Vadim639]

How long have you been using this operating system?

 

[homenet]

And how does that make my opening post ‘retarded’?

Oh I dunno, perhaps the thread title "linux is a joke" would be a good start.

 

[vyqiqefe]

Linux is open source so that is a good thing. Also many apps don't work on linux so you can't get many viruses lol