https://www.zdnet.com/article/google-project-zero-finds-linux-developers-patch-security-holes-faster-than-anyone-else/ * + + Trending o Presidents Day deals o Top tablets: iPad isn't your only option o Best Tax Software o Best iPhone deals o Best home battery backup o Great 3D printers for under $500 o Best VPN Services o Windows 11 o Best Web Hosting o Cloud o Innovation o Working from Home o ZDNet Recommends o ZDNet Academy + Technology o See all Technology o Hardware o Laptops o Tablets o Storage o Processors o Software & Services o Operating Systems o Business Management Software o Mobility o 5G o Smartphones o Innovation o Cloud o Artificial Intelligence o Big Data o AR & VR o Robotics + Security o See all Security o Cyber Threats o VPN o Password Manager + Business o See all Business o Tech Industry o Tech & Work o Developer o Data Management o Legal o Companies o Amazon o Google o Apple o Microsoft o Samsung o E-Commerce o Enterprise Software o SMBs o Executive Guides o Events + Finance o See all Finance o Credit Cards o Banking o Taxes o Blockchain + Education o See all Education o Business & Management o Computers & Tech o Bootcamps o MBA + Home & Office o See all Home & Office o Networking o Broadband o Mobile Carries o Home Networking o Smart Office o Office Furniture o Office Hardware & Appliances o Smart Home o Home Security o Home Entertainment o Speakers o Kitchen & Household + More o See all Topics o International o China o EU o United Kingdom o New Zealand o India o Singapore o Korea o Australia o Japan o Government o Government: US o Government: UK o Government: AU o Government: Asia o Deals o Newsletters o Galleries o Videos o Reviews o Blogs * * Trending + Presidents Day deals + Top tablets: iPad isn't your only option + Best Tax Software + Best iPhone deals + Best home battery backup + Great 3D printers for under $500 + Best VPN Services + Windows 11 + Best Web Hosting + Cloud + Innovation + Working from Home + ZDNet Recommends + ZDNet Academy * Technology + Hardware + Laptops + Tablets + Storage + Processors + Software & Services + Operating Systems + Business Management Software + Mobility + 5G + Smartphones + Innovation + Cloud + Artificial Intelligence + Big Data + AR & VR + Robotics See all Technology * Security + Cyber Threats + VPN + Password Manager See all Security * Business + Tech Industry + Tech & Work + Developer + Data Management + Legal + Companies + Amazon + Google + Apple + Microsoft + Samsung + E-Commerce + Enterprise Software + SMBs + Executive Guides + Events See all Business * Finance + Credit Cards + Banking + Taxes + Blockchain See all Finance * Education + Business & Management + Computers & Tech + Bootcamps + MBA See all Education * Home & Office + Networking + Broadband + Mobile Carries + Home Networking + Smart Office + Office Furniture + Office Hardware & Appliances + Smart Home + Home Security + Home Entertainment + Speakers + Kitchen & Household See all Home & Office * More + International + China + EU + United Kingdom + New Zealand + India + + Singapore + Korea + Australia + Japan + Government + Government: US + Government: UK + Government: AU + Government: Asia + Deals + Newsletters + Galleries + Videos + Reviews + Blogs See all Topics * * + Asia + Australia + Europe + India + United Kingdom + United States + ZDNet France + ZDNet Germany + ZDNet Korea + ZDNet Japan * What are you looking for? [ ] Go * Join / Log In * Account + Preferences + Community + Newsletters + Log Out Linux developers patch security holes faster than anyone else, says Google Project Zero Linux programmers do a better job of patching security holes than programmers at Apple, Google, and Microsoft. * * * * * * * Steven Vaughan-Nichols Written by Steven Vaughan-Nichols, Senior Contributing Editor Steven Vaughan-Nichols Steven Vaughan-Nichols Senior Contributing Editor Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system; 300bps was a fast Internet connection; WordStar was the state of the art word processor; and we liked it. Full Bio Posted in Linux and Open Source on February 18, 2022 | Topic: Security There's a lot of FUD about how Linux is being shown recently to be less secure than proprietary systems. That's nonsense. But, now there are hard facts from Google's Project Zero, Google's security research team, showing Linux's developers do a faster job of fixing security bugs than anyone else, including Google. ZDNet Recommends The best Linux Foundation classes The best Linux Foundation classes Want a good tech job? Then you need to know Linux and open-source software. One of the best ways to learn is via a Linux Foundation course. Read More Project Zero looked at fixed bugs that had been reported between January 2019 and December 2021. The researchers found that open-source programmers fixed Linux issues in an average of only 25 days. In addition, Linux's developers have been improving their speed in patching security holes from 32 days in 2019 to just 15 in 2021. Its competition didn't do nearly as well. For instance, Apple, 69 days; Google, 44 days; and Mozilla, 46 days. Coming in at the bottom was Microsoft, 83 days, and Oracle, albeit with only a handful of security problems, with 109 days. By Project Zero's count, others, which included primarily open-source organizations and companies such as Apache, Canonical, Github, and Kubernetes, came in with a respectable 44 days. Generally, everyone's getting faster at fixing security bugs. In 2021, vendors took an average of 52 days to fix reported security vulnerabilities. Only three years ago the average was 80 days. In particular, the Project Zero crew noted that Microsoft, Apple, and Linux all significantly reduced their time to fix over the last two years. As for mobile operating systems, Apple iOS with an average of 70 days is a nose better than Android with its 72 days. On the other hand, iOS had far more bugs, 72, than Android with its 10 problems. Browsers problems are also being fixed at a faster pace. Chrome fixed its 40 problems with an average of just under 30 days. Mozilla Firefox, with a mere 8 security holes, patched them in an average of 37.8 days. Webkit, Apple's web browser engine, which is primarily used by Safari, has a much poorer track record. Webkit's programmers take an average of over 72 days to fix bugs. Project Zero gives developers 90-days to fix security problems. Besides the average now being well below the 90-day deadline, the team has also seen a dropoff in vendors missing the deadline or the additional 14-day grace period. Last year, only a single bug, a Google Android security problem, exceeded its fix deadline, though 14% of bugs required the extra two weeks. Still, everyone's doing a much better job of fixing security bugs than they've been doing in years past. Why? The Project Zero crew suspects it's because "responsible disclosure policies have become the de-facto standard in the industry, and vendors are more equipped to react rapidly to reports with differing deadlines." Companies have also been learning best practices from each other with the increase in transparency. I credit much of this to the growth of open-source development methods. People are realizing that it's to everyone's advantage to fix bugs together. Related Stories: * In 2022, security will be priority number one for Linux and open-source developers * It's time to improve Linux's security * Enough with the Linux security FUD Linux | Security TV | Data Management | CXO | Data Centers Show Comments LOG IN TO COMMENT * My Profile * Log Out | Community Guidelines Join Discussion for: Linux developers patch security holes faster... Add Your Comment Add Your Comment Related * * * * * * Google: Vendors took an average of 52 days to fix reported security vulnerabilities * Best browser for privacy 2022: Secure web browsing * Best Linux distros for beginners 2022: You can do this! * Security: Google to pay up to $91,337 for exploits of new Linux and Kubernetes bugs * Get updating: Apple releases iOS 15.3.1 patch for 'actively exploited' security flaw * Best video chat app 2022: Top virtual meeting software * Google Cloud's Python logging library just got a 'major' update * Google reveals plans for targeted ad, privacy policy changes coming to Android * Best snow blower 2022: It's time to ditch the shovel Please review our terms of service to complete your newsletter subscription. [ ] You agree to receive updates, promotions, and alerts from ZDNet.com. You may unsubscribe at any time. By joining ZDNet, you agree to our Terms of Use and Privacy Policy. [ ] You agree to receive updates, promotions, and alerts from ZDNet.com. You may unsubscribe at any time. By signing up, you agree to receive the selected newsletter(s) which you may unsubscribe from at any time. You also agree to the Terms of Use and acknowledge the data collection and usage practices outlined in our Privacy Policy. Continue Newsletters See All See All ZDNet Connect with us (c) 2022 ZDNET, A RED VENTURES COMPANY. ALL RIGHTS RESERVED. Privacy Policy | Cookie Settings | Advertise | Terms of Use * Topics * Galleries * Videos * Sponsored Narratives * Do Not Sell My Information * About ZDNet * Meet The Team * All Authors * RSS Feeds * Site Map * Reprint Policy * Manage | Log Out * Join | Log In * Membership * Newsletters * Site Assistance * ZDNet Academy