Existing studies on problem reports in open source projects focus primarily on the analysis of the general category of problem reports, or limit their attention to observations on the number of security problem reports. To evaluate the security of a project, it is necessary to know not only how many security problem reports are logged but also how many are reported and how promptly they are corrected etc. In this paper, we study publicly disclosed security problem reports from eight releases of Fedora, nine releases of Ubuntu, four releases of RedHat Enterprise Linux (RHEL) and two releases of Suse Linux distributions, analyse and discuss which type of problem reports and how frequently they are reported, and how promptly they are corrected. Overall, Fedora and Suse show good results with high and medium severity security problem reports resolved without a backlog. On the other hand, RHEL and Ubuntu show less positive results with presence of backlogs.
[1]
Rahul Telang,et al.
Does information security attack frequency increase with vulnerability disclosure? An empirical analysis
,
2006,
Inf. Syst. Frontiers.
[2]
Yuanyuan Zhou,et al.
Have things changed now?: an empirical study of bug characteristics in modern open source software
,
2006,
ASID '06.
[3]
Mladen A. Vouk,et al.
On Reliability Analysis of Open Source Software - FEDORA
,
2008,
2008 19th International Symposium on Software Reliability Engineering (ISSRE).
[4]
John D. Musa,et al.
Software reliability - measurement, prediction, application
,
1987,
McGraw-Hill series in software engineering and technology.
[5]
J. Herbsleb,et al.
Two case studies of open source software development: Apache and Mozilla
,
2002,
TSEM.