Win Users Need to Patch Once Every 4.8 Days on Average.

i think that what that means is that if its connected to the internet, the software will stop working until its downloaded the relevant "needed" services, in a completely offline machine, how does windows know when an update is needed?

fseal said:

Ugh, does anyone use Linux around here?

A STOCK install, nothing extra other than the live CD will have an update atleast once a day, sometimes multiple times.

A stock install of FC12 installed then updated will have something like 300 MB of updates an it's only 2-3 months old!

Windows has FAR fewer updates than Linux does. And far fewer breakages because of it. It's rather remarkable actually.

Yes, Linux user here. We use tons of Linux servers at work and I have usually kept a few Linux workstations at home.

While there are tons of updates available for many Linux distros, there are a few key things to keep in mind
#1). Most people obtain nearly all of the software they run from the distro vendor. Thus, these patches not only patch the OS, but almost every since piece of software installed on the computer

#2). Many of the updates which are released and installed are not of a critical security nature. Many are simply updated functionality, additional documentation or the completion of features which were not ready previously.

#3). Linux (in and of itself) is a constant work in progress. New versions are often released every 6 months or so and the updates are simply the collection of changes on the way to the new version. This is a very different philosophy from Microsoft who often goes 3-5 years between full major releases.

fseal said:

Yeah it's sort of the opposite, it stops working if you do

1 very important point to remember is that with a distribution like Fedora....that is a testing bed that is (by design) a bleeding edge distro to test and solidify changes for the Red Hat Enterprise product. They take chances with that version and those who are using that distro need to keep that in mind.

We use CentOS at work (a re-build of Red Hat Enteprise Linux) and it has far fewer updates and those updates "rarely" break anything as the key to this distro is an enterprise class OS providing the ultimate in security and stability. So, it doesn't have the absolutely latest versions of the sofware...but rather the older, proven, well tested versions of these components.

I use Ubuntu at home on my dekstops, and I have rarely had a problem with updates bringing down the box.


The beauty here of Linux is that "you", the end-user gets to choose what type of OS they want (bleeding edge or stable) and you can find tons of options in between. With Windows 7..you get Home Premium, Professional and Ultimate....which are very much the same thing at the end of the day. Linux isn't perfect and it isn't for everybody, but it sure is darn cool having so many options available that are freely available to use. Having more frequent updates is just the nature of the system.


And on the Windows 7 front, and the Vista Front...I don't find that I have to patch my box every 5 days to keep it running and secure. Tons of people barely stay current on their Windows 7 updates....nevermind all of the 3rd party apps that they install and forget to maintain. I don't think most people are tending to these maintenance tasks more than 1 time per week.

madtownidiot said:

And if you know what you're doing, Linux never breaks anything.

I wouldn't necessarily feel comfortable making this statement. I've certainly had some bumps along the way over the years..and some caused by updates. However, it's been no more significant than the bumps along the way for Microsoft and 3rd party patches for my Windows servers.

fseal said:

Well I was referring to a base install if linux which is analogous to a base install of Windows. VERY basic tools and a default browser, nothing else.

Even basic installations of Linux include quite a number of apps in addition to what Windows provides. Usually components of Apache web server are there, components for Sendmail are there, there are music rippers, graphics apps like TheGimp, office applications, bit torrent clients, PDF readers, instant messengers, etc.

fseal said:

Even the slower release cycle distros still have a lot more updates than Windows does, including ones that break existing executables, drivers especially

Again, there are more updates.... I won't disagree with that. But it's also most likely updating every single piece of software on your computer as well. For example, it patches your OS, your browsers, your PDF readers, your office application, your graphics applications, your SQL servers, your multimedia applications, etc. The breadth of updates includes far more than you have with a Windows update.

The only real driver issues that I have had after an update are
1). for graphics cards. And that's usually just on machines with eye-candy stuff enabled. Most often, you also need to recompile the video driver against the currently running kernel.

2). For any other piece of hardware that I compiled a driver for. With these, you have to compile again against the newly running kernel (that's usually 2 commands, make and make install)

Note: for both of the above issues, on my production servers, I often exclude kernel updates from yum and rather evaluate the kernel releases to only get the ones that fix a major security problem or performance issue that we are experiencing.

fseal said:

The only way to keep a machine stable I've found is to simply never update it till you completely rebuild a new one. Course that leaves you open to attack vectors if you are running public servers so that's not a good option there.

I update my servers, running CentOS which are command line only quite frequently without issue. As noted above, I am more selective on kernel updates. Also, with proper firewalling techniques and so forth, and having very few ports open to the outside, you can effectively mitigate a lot of the security concerns anyway to the point where they aren't really an issue. For work, scanning with tools like Qualsys to see what security vulnerabilities exist based on how you are running can shed quite a bit of light on what you are vulnerable to and what you really need to secure yourself against.

I usually update my Ubuntu desktops at home every month or so and experience minimal problems when I update.

fseal said:

Linux breaks itself with updates CONSTANTLY. As a software engineer, even though I have the ability to fix it, it's a complete PITA to /have/ to constantly fix it instead of getting my real work done. The actual reality is, because you CAN fix/config linux, you pretty much HAVE to, noone else does.

I guess people just have lots of different experiences. I've got nearly 130 different Linux machines running in all of our data centers, test labs and such and we are a software development shop writing mainly webapps which run on Tomcat or Solr and we don't experience anything remotely close to constant breaking of our Linux boxes because of patching. And I have been supporting Linux servers for over 8 years professionally for multiple software companies. So, it's not like I haven't been around enough or set up anything complex enough to see issues.