While the graphs are nice, and provide a visual representation of the time it takes to releasing a patch with regards to a security advisory - what real information do they tell us?

Other than, some groups of 'volunteers' take longer to react to, and deliver patches than others? While I understand your point of view, there is absolutely nothing that stops the admins of servers from rolling their own patches, updating their own RPMS, from their own repository, and doing their own testing.

Or, you can wait, and be grateful that someone else is doing the hard work, that actually, as a linux system admin - "WE" (and that we includes all the installers of all the linux based distributions), should be doing ourselves. That is the nature of the beast.

I could understand and appreciate issue if all the projects in question where commercially backed entities with proprietary code - but we're all "standing on the shoulders of giants" each time we boot up our CentOS/SL/RHEL/Oracle Linux, (uurrghh!) - I'm just happy that I don't have to do the work myself.

I do appreciate the work and effort that you put in, but i think the bottom line is - If you really want security, either pay for it - or do it yourself! :) Otherwise, you'll have to wait for your distro of choice to get the work done for you.

Just my 2pence

On 20 Aug 2012, at 13:02, Janne Snabb <[log in to unmask]> wrote:

> Hello,
> 
> I made some statistics and comparisons about security advisories
> published by three popular RHEL 6 clones: CentOS 6, Oracle Linux 6 and
> Scientific Linux 6.
> 
> The article is available at the following URL:
> 
> http://bitrate.epipe.com/rhel-vs-centos-scientific-oracle-linux-6_187
> 
> I hope you find it interesting.
> 
> Feedback is welcome, but please post it at the bottom of the article or
> to myself in private. Do *not* send it to this mailing list unless your
> message is specifically about Scientific Linux. Please do not start a
> flame war on this mailing list.
> 
> In case the graphs are not visible in your browser, you should start
> using a browser which supports current technologies (specifically: SVG
> graphics).
> 
> Best Regards,
> -- 
> Janne Snabb / EPIPE Communications
> [log in to unmask] - http://epipe.com/