Lunduke
News • Science & Tech
Which Operating System has the Most Vulnerabilities?
Windows? iOS? Ubuntu? Do you know... for sure?
April 02, 2024
post photo preview

The recent, high profile software vulnerabilities have raised a number of questions about the security of our software.

Three questions which have been on my mind:

  1. Is software less secure now... than it used to be?
  2. Which has more vulnerabilities... Open Source Software or Closed Source Software?
  3. Which Operating System has the most vulnerabilities... and which has the least?

These seem like fair questions to ask.  And, considering the massive amount of data available, we should be able to arrive at some definitive answers.  Yet, when we see discussions around exactly these topics, most of the statements seem to be based on feelings and preferences... rather than hard facts.

Let's fix that.

First we need to grab details on all publicly known CVEs (aka "Common Vulnerabilities and Exposures") -- the standard way of publishing details around exploits and vulnerabilities -- and drill down into that data.  Luckily CVEdetails.com makes obtaining this data incredibly simple (the data below is obtained from there).

Is software less secure now... than it used to be?

The easiest way to begin answering this question is to track the number of CVEs reported per year... and put that data into a pretty graph.

At the current rate, 2024 will have more CVEs than any previous year.

And the results are... not exactly difficult to read.  It goes up pretty much every year -- accelerating, significantly, over the last few years.

  • 2022: 25,083
  • 2023: 29,065

That's a roughly 16% increase in the total reported CVEs... in just one year.

And, at the current rate (January through March of this year), 2024 is on track to hit 35,484 by the end of the year.  Which would be a 22% increase, year on year.

There are two likely possibilities which could explain this:

  1. We are getting much better at finding the vulnerabilities in software.
  2. We are adding more vulnerabilities to software.

And, in fact, both could absolutely be true.

Considering the ever-increasing complexity of our software systems (both in terms of total Lines of Code and number of interdependent systems), it seems reasonable that at least some portion of this dramatic increase in CVEs is thanks to us simply having more vulnerabilities in software.

This is about as close to a definitive answer as we are going to get: Based on the available data, yes.  Software is less secure now than it used to be.

Which Operating System has the most vulnerabilities... and which has the least?

Now let's pull data on all known CVEs... and sort them by Operating System (again, using data gathered from CVEdetails.com).

Behold.

Hello, Debian!

Your eyes do not deceive you.  Debian Linux has had the highest number of reported vulnerabilities, clocking in at a whopping 8,751.

  • Android is in second place, with 7,008 CVEs.
  • And Ubuntu Linux was trailing in third place, with 4,058.

Windows, iOS, and macOS all had significantly lower total numbers of reported vulnerabilities.

Note: I left a variety of BSD and UNIX systems off this list as their number of total CVEs was lower than the lowest entry on the chart.  FreeBSD: 488, OpenBSD: 188, NetBSD: 167, Solaris: 532.

But... that chart above only provides part of the picture, as it includes all CVEs ever reported.

Therefore, while it is a fascinating glimpse into past (and overall) vulnerability, it does not give us a good indicator of the current security of each given OS.

To solve that, let's look at a singular recent major version of each OS.  While the versions below are not all of the same age, each was chosen as: 1) a recent release, 2) publicly available for enough time to be somewhat well tested, and 3) with sufficient data available to be worth evaluating.

Yikes, Android!

The results clearly show Android as the Operating System with the largest number of known vulnerabilities (currently).

  • iOS (for iPhone) has roughly 10% of the reported CVEs as Android.  Or, to put another way, "1,000% more secure".
  • Both Windows and macOS clock in as measurably more secure than Ubuntu (in terms of total number of vulnerabilities found).

The old narrative that "Linux is more secure" appears to be... mostly untrue.

That said, it's entirely possible that the Open Source nature of Linux (and the software ecosystem around it) has enabled a higher percentage of vulnerabilities to be found, compared to Closed Source systems.  But that is purely speculative, and we need to go on what data we have available.

No matter which way you slice it -- modern versions of major Linux Distributions have significantly more known vulnerabilities than modern versions of Windows or macOS.

The Findings

We can safely declare, based on available data, the following:

Q: Is software less secure now... than it used to be?

A: Yes.  Demonstrably so.  And it's getting worse, year on year.

Q: Which Operating System has the most vulnerabilities... and which has the least?

A: Linux based systems contain the most reported vulnerabilities, with Android (Linux-based) leading the pack by a large margin.  Windows, macOS, iOS (and most BSD / UNIX systems) all have significantly fewer known vulnerabilities.

Q: Which has more vulnerabilities... Open Source Software or Closed Source Software?

A: This is a mixed bag.  Open Source BSD systems have significantly less known vulnerabilities (both in total, and per version) than the Closed Source Microsoft Windows.  At the same time, Open Source Linux (and Android) led the pack in vulnerabilities.  One thing we can say for sure: The most vulnerable systems are Open Source (to one degree or another).

I don't like these numbers any more than you do.  Don't shoot the messenger.

community logo
Join the Lunduke Community
To read more articles like this, sign up and join my community today
33
What else you may like…
Videos
Podcasts
Posts
Articles
The Stallman Report - A Hit Piece on the Free Software Founder

An anonymous author. Strong political bias. Dubious motivation. Canceling an old man with cancer because he makes controversial statements.

00:49:07
October 14, 2024
Debian Linux Doesn't Want Straight White Men

Want to be a paid intern for Debian? Everyone is welcome! (Except Straight White Men. And Asians. Debian really doesn't want Asians.)

00:19:56
October 14, 2024
The Road to Skynet: Nuclear Powered, CAPTCHA Solving AI

Teach Al systems to beat CAPTCHAs and pretend to be people, then give them nuclear reactors. What could go wrong!?

00:12:02
November 22, 2023
The futility of Ad-Blockers

Ads are filling the entirety of the Web -- websites, podcasts, YouTube videos, etc. -- at an increasing rate. Prices for those ad placements are plummeting. Consumers are desperate to use ad-blockers to make the web palatable. Google (and others) are desperate to break and block ad-blockers. All of which results in... more ads and lower pay for creators.

It's a fascinatingly annoying cycle. And there's only one viable way out of it.

Looking for the Podcast RSS feed or other links? Check here:
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

The futility of Ad-Blockers
November 21, 2023
openSUSE says "No Lunduke allowed!"

Those in power with openSUSE make it clear they will not allow me anywhere near anything related to the openSUSE project. Ever. For any reason.

Well, that settles that, then! Guess I won't be contributing to openSUSE! 🤣

Looking for the Podcast RSS feed or other links?
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

openSUSE says "No Lunduke allowed!"
September 13, 2023
"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

This episode is free for all to enjoy and share.

Be sure to subscribe here at Lunduke.Locals.com to get all shows & articles (including interviews with other amazing nerds).

"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

I know The Register attacked Lunduke, but they have an interesting article about switching customers from Linux to BSD. https://www.theregister.com/2024/10/08/switching_from_linux_to_bsd/

6 hours ago

On this week in privacy, let's explore web apps and convenience.

Web apps are cool

Web apps are applications that run inside web browsers. As you probably already know, web apps have been around for years, most notably with in the form of electron apps, and have had varying levels of success. Whole frameworks like React and Vue are designed specifically to turn an ordinary web page into an interactive app that runs offline.

There are advantages and disadvantages of web apps. On the plus side, unless you allow notifications, they turn off when the browser is closed. There's no secret spying. They're also compatible with every operating system with a decent browser. On the negative size, native apps can be more feature rich, and better handle touch controls.

We can install web apps from the Brave menu. This creates a link on the app screen. Alternatively, we can just bookmark the site. Either works.

Logging in every time sucks

One of the biggest advantages of web apps in a secure browser is ...

PSA for the morning: I'm still getting this Ubuntu system set up and went to install Joplin which is an AppImage. Turns out 24.10 (maybe it's a thing in older version too, but I don't know) is missing a dependency for AppImages to work. In case anyone was going to move to Ubuntu 24.10 and run AppImages, install fuse2 first.

apt install libfuse2t64

October 14, 2024
post photo preview
Last week at The Lunduke Journal (Oct 6 - Oct 12, 2024)
GNOME Layoffs! Woke Software Alternatives! Internet Archive Hacks! Facebook Censorship Portal!

Whew!  Last week was another crazy one!

GNOME Foundation layoffs, Google breakup by the government, Facebook's custom developed web portal to help Biden censor Americans... oh, and that crazy Internet Archive hack (which is still going on!).  Wild times.

But, if you're going to watch just one show from last week, I would make it the one about LEGO parts on laptops.  Because that one made me smile.

The Shows

The Articles

Read full Article
October 13, 2024
post photo preview
Funny Programming Pictures Part LIX
Buckle up, Buttercup.

One of these is my favorite.  Youn know which one it is.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Read full Article
October 11, 2024
Today is the last day new Lifetime Subscriptions are available!

Whew!  It's the end of an era!

Today is the final day that new Lifetime Subscriptions to The Lunduke Journal can be picked up.

No rain checks.  No extensions.  These really and truly are the last few hours they will be available.

If you've ever wanted one, now is literally your last chance.

  • Lifetime Lunduke Journal Subscriptions are only available until Friday, October 11th, 2024.  That's... today!

  • Lifetime Subscriptions are discounted to $200 for these final hours.

  • Today is also the last day any subscription can be obtained via Bitcoin.

  • Obviously, all existing Lifetime Subscriptions (including those picked up in the final moments) will be honored.  For life.

You can find all of the details in this article (or this video) -- including the reasons why no new Lifetime Subscriptions will be offered after today, and details on the new Lunduke Journal Affiliate Program.

If you have picked up a Lifetime Sub in the last few hours and days, you will be receiving an email shortly (if you haven't already) with confirmation.  If you have questions, feel free to email me (bryan at lunduke.com).

How To Get a Lifetime Subscription

All the benefits of a Standard Monthly subscription... but pay once and never need to pay again.  $200.

  • Go to Lunduke.Locals.com/support.

  • Select "Give Once".

  • Enter "200" into the amount field.

  • After checking out, Lunduke will toss you an email once your account is set to full lifetime status.

How To Get a Lifetime Subscription (with Bitcoin)

You can also obtain a Lifetime Subscription via Bitcoin.

  • Make sure you have a Lunduke.Locals.com account (a free account works just fine).

  • Send $200 worth of Bitcoin (or more) to the following address:

bc1qyjakve8fywm8pz2v99v57yhjj0vzr2vjze6fcq

  • Email "bryan at lunduke.com" with the following information: What time you made the transaction, how much was sent (in Bitcoin), and the email address you use (or plan to use) on Locals.com.

Here's a handy-dandy QR code you can scan that also has a Bitcoin Wallet Address for The Lunduke Journal:

102127_2uuarwwiqcds5s2.jpeg
 

 

 

 

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals