It’s really frustrating to see spin making “news”. David Sykes, the Symantec Australia Managing Director stated in an article in the Australian IT that “the time from the announcement of a vulnerability to its subsequent patching had ‘blown out’ to 54 days … ”
I love spin. The title of the article (”OSS Means Slower Patches”) makes me think “gee, all open source must have a slower patch cycle.” Okay, so, where is the evidence? When one says “blown out”, they usually have a point of reference … blown out from what?! The answer to this one is pretty simple and they clear it up in the article: “Symantec had not published previously statistics on the average time required to produce patches, but Mr Sykes said data showed the lag had previously been about 30 days.” Ahh, well, we’ll just take your word for it Mr. Sykes … you simply have no motivation in the matter.
The next quote just cracks me up: “Mr Sykes said the increasing popularity of open source software, such as the Mozilla Foundation’s Firefox browser, could be part of the reason for the increase in the gap between vulnerability and patch, with the open source development model itself part of the problem.” Ahh, right. This also makes complete sense. Afterall, we all know those lazy lots over at Mozilla don’t do a thing when a vulnerability is announced. “We’ll get it with the next service pack” I often hear them say. Not. C’mon, really? Is this Sykes guy for real?! Or is his head in the sand? The Mozilla Foundation is the most vigilant at responding to security vulnerabilities; far better than their rivals in the matter.
The one bit … the tiniest shred of truth in this article (and thus the horrendous spin on it) comes from one simple sentence: “In practice, large companies with around 10,000 employees were now looking at 50 days between vulnerability and the installation of patches across systems” Sykes said. Bingo. Now there is a statistic that I can reckon with. I’ll be the first to admit that managing Mozilla’s applications on an Enterprise scale is a bit difficult but not impossible. It is the same problem that organizations have with rolling out and updating any application that isn’t tied to the Enterprise update schedules and mechanisms. The fact is, Enterprise is still trying to figure out how to roll out Firefox and OpenOffice and keep it managed across their environments.
All that being said, we can see the spin. Firefox gains popularity. People start installing it across the Enterprise. People don’t pay attention to the nagging little red icon in the upper right-hand corner. People don’t upgrade. Yep, that sucks. So spin it. “OSS Blows Chunks” or “OSS Users are Doomed” or even “The End Cometh”. Yeah, that makes sense.
Through all the nonsense and spin there is the truth. The update mechanisms in open source software are maturing at a phenomenal pace. Windows Update is nice but what about all of your Linux or Mac users? The anser isn’t “sucks to be them”.
The spin merchants will peddle their wares and the open source community will continue to work diligently towards a better software stack that doesn’t suck.
