{"id":6,"date":"2006-08-07T19:50:50","date_gmt":"2006-08-07T19:42:44","guid":{"rendered":""},"modified":"2017-03-07T16:21:43","modified_gmt":"2017-03-07T16:21:43","slug":"while_we_re_at_it_security_and_speed","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/frilled\/2006\/08\/07\/while_we_re_at_it_security_and_speed\/","title":{"rendered":"While we’re at it … security and speed"},"content":{"rendered":"

Since SearchSecurity’s ranking<\/a> is dragging some attention, I’d like to share my opionion. Though being part of the security team I can only present my personal point of view (as always in this blog .-).<\/p>\n

You can doubt or disagree with the ranking in any form you like, and there may be some strange points in there. But that, frankly, is not important.<\/p>\n

What is<\/em> important is to ask how good we do<\/em> compared to how good we can do<\/em> . And then make changes accordingly<\/p>\n

First of all, note that we will not be able to deal with vulnerabilities like Ubuntu. Or other companies that pay their employees for doing that stuff. We’re community-based. People spend their time digging into vulnerabilities, getting new ebuilds ready and testing them in their free time.<\/p>\n

Second, we do have a lot more architectures than other distros to care about. Not all are supported security-wise, but still, it’s a nice list if you want to make an impression.<\/p>\n

Third, fixes are often available way ahead of any GLSA. That is not true for every arch, it is not true for any case, and it is not generally true .-) Still, users who update often are indeed not so seldomly protected even if no GLSA has been issued yet. The GLSA is only the last step in the whole process.<\/p>\n

That being said, it should be clear we are not aiming to be #1 on that list.<\/p>\n

But there’s things we could make better.<\/p>\n