Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Kees Cook :tux: (kees@fosstodon.org)'s status on Sunday, 18-Feb-2024 15:47:44 JST Kees Cook :tux:

   Last time I did a Linux kernel security flaw lifetime analysis was back in 2021. It showed the average time between flaw introduction and fix was 5.5 years for 108 "high priority" CVEs:
   https://outflux.net/slides/2021/lss/kspp.pdf

   I refreshed my dataset today and was surprised to see that now with 103 more CVEs, it's still holding at 5.5 years. This actually means Linux is getting faster at finding issues, but the (diminishing) technical debt of the past is still dragging down the average.