Linux Has Fewer Bugs Than Rivals 626
sushant_bhatia_progr writes "Wired has an article stating that according to a four-year analysis of the 5.7 million lines of Linux source code conducted by five Stanford University computer science researchers, the Linux kernel programming code is better and more secure than the programming code of most proprietary software. The report, set to be released on Tuesday, states that the 2.6 Linux production kernel, shipped with software from Red Hat, Novell and other major Linux software vendors, contains 985 bugs in 5.7 million lines of code, well below the industry average for commercial enterprise software. Windows XP, by comparison, contains about 40 million lines of code, with new bugs found on a frequent basis. Commercial software typically has 20 to 30 bugs for every 1,000 lines of code, according to Carnegie Mellon University's CyLab Sustainable Computing Consortium. This would be equivalent to 114,000 to 171,000 bugs in 5.7 million lines of code."
Apple != Orange (Score:5, Interesting)
The Windows XP code base includes all of the extraneous crap that gets bundled with and on top of the kernel.
The "Linux" code base just includes the kernel.
Re:Congratulations... (Score:1, Interesting)
They did report a lot, if not all, of the bugs to the linux kernel developers
Not completely scientific (Score:5, Interesting)
"[Linux has] 985 bugs in 5.7 million lines of code, well below the industry average for commercial enterprise software. Windows XP, by comparison, contains about 40 million lines of code, with new bugs found on a frequent basis."
So Linux has 985 bugs. Windows has bugs that appear frequently. Ok that doesn't really tell me anything. I tried to dig a bit deeper [zdnet.co.uk] and came up with: "Coverity has not analysed the source code to Microsoft Windows because the company does not have access to the source code, Hallem said. Apple Computer's Mac OS X has a great deal of proprietary programming, but the core of the operating system is based on BSD, an open-source operating system similar to Linux."
So everything is based on estimates. Now, you know and I know that the Linux kernel has less bugs... but this is a tentative (at best, shoddy at worst) way of presenting that idea.
Re:sigh... (Score:3, Interesting)
Retarded report (Score:0, Interesting)
It's a comparison between oranges and apples. Windows has a GUI and a huge userland with complex applications. Linux is just a silly kernel (yes, silly if compared with the other OSS alternatives -- and definitely buggier than the others). But since it goes into slashdot's agenda, let's give it all the latitude.
Interesting, but the comparisons are flawed.. (Score:2, Interesting)
Also "Windows XP, by comparison, contains about 40 million lines of code, with new bugs found on a frequent basis" isn't exactly very scientific either. How frequent? How severe? XP has been released for roughly 3 years. According to the poster, it's roughly 8 times the size of the code these guys analysed, in which they found 985 errors. So to be at the same level, that would allow for around 7880 bugs, or about 8-10 bugs being found per day since its release. Is that the frequency that's implied here?
It sounds like a good bit of initial research, but probably only just to Bachelors degree level. They need to apply this research correctly in fair comparisons to other operating systems before the results they came up with are meaningful.
Re:Kernel is not the problem (Score:2, Interesting)
Even on Windows machines, Apple software just works. iTunes shares music across the network with a single checkbox and everything else just works. I plug my iPod in and it just synchronises, and comes up with a playlist based on what I listen to and what I like.
Doing something similar with a combination of vendors? Not a chance. Doing something similar on Linux based systems? Possible certainly, but I don't want to have to write it.
Linux Kernel is solid. Sadly, once you put useful applications on it (like the ones that make WXP 40 million lines long) it will fall apart.
Re:How can one be sure (Score:1, Interesting)
Re:Mistake (Score:2, Interesting)
Where do they get these numbers??? (Score:3, Interesting)
I'm going to call bullshit on this. Maybe this number is based on some rule that every variable must be asserted, everything exception checked, etc. (even if these conditions rarely or never happen).
If they're counting bugs like I count bugs - i.e., in a normal operating environment the software loses data, produces incorrect results or limits operability then there is no way that a commericially viable product can have this number of bugs.
20 to 30 bugs for every 1,000 (Score:2, Interesting)
Bug This! (Score:3, Interesting)
The report, set to be released on Tuesday, states that the 2.6 Linux production kernel, shipped with software from Red Hat, Novell and other major Linux software vendors, contains 985 bugs in 5.7 million lines of code, well below the industry average for commercial enterprise software.
Commercial software (at this point in time) has its priority on releasing new versions often. Because each release is a salable item. Linux on the other hand gets forked or changes version whenever "Linus feels its ready". BIG DIFFERENCE. Here's why.
Commercial software decide how much value is on each bug, if the bugs are cheap (not show stoppers), but minor things they can't forsee as causing them to lose money... They will ship it. Acceptable known bugs. Project management decision.
Open source has time on their hands. They can look over the code carefully, waste time on bugs that commercial outfits wouldn't even bother... But the problem (like with software project management) is that you can't tell which bugs will be the nasties when you choose to ignore them. Less bugs == more secure software, less nasties.
If commerical software decided to play the careful release, minimize bug game... They would make less money initially, but in the end it would work out. Microsoft and ilk can certainly compete with linux, but they made a choice long ago not to. They made a choice to RELEASE FAST and MAKE MONEY FAST! (hey, that sounds like spam).
m
Re:They counted bugs per lines of code (Score:3, Interesting)
Re:20-30 bugs per 1000 lines??? (Score:5, Interesting)
Keep in mind that you need to know the definition of a bug. It's not necessarially what you think it might be, but what the researchers defined. By their definition a condition that could never occur could be considered to be a bug. For example:
int foo ()
{
if (0)
return;
do_something();
return (0);
}
This overly-simple example could be considered to be a bug. If the condition is ever true the function will return an undefined value, but the condition will never be true so you couldn't possibly return an undefined value. It's not at all uncommon to find code with similar logic scattered throughout - improperly defined loops, conditionals, etc. could result in theoretical bugs that no path of execution can actually get to.
Then there are the kinds of bugs that only occur in extremly specific situations. About 13 years ago I had to track down a bug that caused a report package to crash. It took me a while to figure it out but eventually I did. The program would crash only on specific days. It'd only crash on Wednesdays. It'd only crash on certian Wednesdays - Wednesdays in September. Even more specifically, usually only the 3rd or 4th Wednesday in September.
The bug was that whoever wrote the code that printed a header on the reports was extremely anal about memory usage. He calculated exactly how many characters it would take for a buffer to hold the full date. The problem was he miscalculated by 1 character. With "Wednesday" being the longest day spelled out and "September" being the longest month, a 2 digit date (eg. Wednesday September 23) meant that the full date string would overflow the buffer by 1 character. This kind of bug wouldn't show up very often - only a few times a year - but it was a pretty nasty one when it did.
Linux Has Fewer Bugs Than *One* Rival (Score:3, Interesting)
How about comparing it with MacOS/X, FreeBSD and others?