OSS Patches Slower

Jericho takes Symantec to task on their statistics and the news article in particular for not providing enough details. In reality the article should be named something to do with Mozilla and IE vulnerabilities not OSS in general. However, they don't seem to compare the browsers on the same level, they only discuss Microsoft's vendor confirmed vulnerabilities (13) whereas the actual number of patched vulnerabilities was 19.

In addition they claim the time from vulnerability to patch has increased from 30 to 54 days. This seems to be paten rubbish. It was never at 30 days. Have a look at the Mozilla vulnerabilities page, the first critical vulnerability took 2 months to be resolved, the second took 1 month. We know that it is going to take Microsoft a minimum of 30 days to write and test a patch, but this list currently gives all vendors (including Microsoft) 60 days to patch and currently Microsoft is topping the list several times with the longest vulnerability being 116 days overdue from the 60 day window (that's 176 days).

I haven't done a particularly deep investigation, but given the lack of explanation in the article, this seems enough to counter the claims that 'OSS is general patches slower' or 'Mozilla patches their browser slower than IE'. It is true however that Mozilla has had more vulnerabilities than IE this year, six more to be precise. This is probably due to the rapid rise of Firefox, making it a more interesting target. They do however, seem to have consistently dealt with them in a timely manner.