Microsoft had 982 recess days on 61 advisories, averaging 16.10 days from bug to patch. Sun proved itself to be very slow, although having only 8 advisories it accumulated 716 recess days, a whopping three months to fix each bug on average. The results turned out well enough, this time, but given that patches for most open source security problems come out almost simultaneous to initial announcements, or within only a few days, it is unfortunate that an average of 11 days occurred before Red Hat updates followed. If the same tests were done on all Linux distributors, some might fare slightly better, but most would fare worse. The time is coming where more attention needs to be paid to getting security updates out in a timely manner for all Linux distributions.
Responses flow in to new cryptographic rules .
For good news, check out the Cracking DES book from the EFF, which has been put back online. Young's seemingly innocuous act might violate new US government regulations that restrict placing privacy-protecting crypto programs on the Web. Therein lies the uncertainty. The rules are much less onerous than the previous version, but they still apply. And they're so labyrinthine and convoluted that even lawyers who specialize in the area declined to guess whether or not Young has run afoul of President Clinton's executive order and Commerce Department regulations.