Persecutee features isn't all that matters when considering the security of an operating system.
We care about what is our actual risk in the real world.
So one way to consider real risk is to look at the amounts and severity of security bugs and vulnerabilities
that operating systems have a history of to do that we are going to look at c v e details dot com which
is a security vulnerability database containing most of the known security vulnerabilities for applications
and operating systems.
Have a look at CV details yourself now and see what the latest data is.
If we look at the top 50 list here we can see the top 50 worst vendors which is what we're on now.
And as of recording we can see Microsoft is at the top with its 12 products.
These will mostly be operating systems.
We've got Apple.
We've got Linux and we've got Linux distributions here all in the top 10 and this is for all time.
If we look at the 2018 we can see we've got Microsoft Debian which is a Linux operating system.
Apple is still here for 2018.
If you look at the top 50 worst vendors with c v s scores now the higher the score the higher the CBS
number the more severe the vulnerability happens to be.
So for Microsoft here we can see 2042 critical security vulnerabilities.
So we can say we've got Microsoft Apple Linux and Linux distributions here or in the top of this list
of critical security vulnerabilities.
By the way would be something like a remote code execution bug where you can remotely take over a device
by sending a specially crafted packet or data.
So it's a Pants on Fire tight bug.
If we look at the top 50 worst products we can see we've got Linux here on the OS Mac or Android for
the mobile platform.
I was on the mobile platform and the Linux distribution here and a Windows operating system all in the
top 10 for products top 50 worst products.
And if we look at the c v s scores we can see of course again Linux kernel Markov's Android iOS Debian
Windows Server all the top 10 for products and all with critical security vulnerabilities.
So what can we take from this data first all operating systems have security vulnerabilities and all
operating systems have serious critical security vulnerabilities.
So if someone is trying to tell you to move to Linux or Mac because that will solve all of your security
problems.
That's just a myth.
Just look at the data.
Other than that it's hard to take much more from this data.
Why.
Because there are many biases in how this data is collected.
So for example researchers spend more time analyzing Windows simply because it's the most popular operating
system.
Mac and Linux will be less researched so there should be a bias to finding Windows security books more
obscure versions of Linux will have much less research.
So we should expect to see less security bugs.
That does not mean there are less bugs in the operating system.
It just means less have been found.
Also security researches can get paid for finding security books called Book bounties which incentivizes
security researchers to look at specific products and particularly they're not going to be looking at
open source products because they tend to not have bounties offering money.
Another issue a security bug could be recorded as a single vulnerability in one vulnerability database.
And there's several vulnerabilities in another simply based on how it's classified.
A bug in Windows could apply to many of Microsoft's operating systems which means as a vendor they might
get 6 or so vendor vulnerabilities when it's really one bug for a single product or operating system.
Also Microsoft and Apple do their own security testing so find their own vulnerabilities.
So in this case it's good to have those vulnerabilities discovered fixed and listed on here and other
databases.
There are lots of potential biases in how this data is created.
So from this data the main message we can take from it is all operating systems have serious security
vulnerabilities.
It's just a question of time before more issues are found.
This is a trend that won't end anytime soon.
We will keep finding vulnerabilities security vulnerabilities in all our operating systems.
Another metric to consider when thinking about security bugs is how fast fixes come out.
These security vulnerabilities when they are disclosed.
Microsoft and Apple do a good job of responding to vulnerability report and produce patches to fix these
issues pretty quick more obscure Linux versions can take longer to fix issues which is obviously a problem.
For more information on bugs and vulnerability reports read this here buying into the bias why vulnerability
statistics soc.