Which is "worse?" I actually think these are about the same--either way, someone can take over your PC. But some Linux partisans will insist that the Microsoft bug is somehow "worse." I disagree, but don't take my word for it: Read the descriptions of some bugs from the XP list and some from the Red Hat list, and make up your own mind.

Does all this mean Linux is terrible? Not at all! Complex software will always have bugs and security problems, and I consider Linux's bugs to be in the fully normal range and not worth getting agitated over. What's more, it's great to see such active bug-fixing as the Red Hat pages indicate: There always will be bugs in any software, and the rational thing to do is to fix them, rather than try to convince others that the bugs aren't real or somehow don't count.

Does all this mean XP is inherently wonderful? Nope. XP's bugs are fewer than Red Hat Linux 7.2, but also within the normal range, and likewise merit neither ecstasy nor apoplexy. And, as I said before, there's other Microsoft software--some of it bundled with XP--that has much worse records.

So here's what it does mean: Linux is a normal operating system; so is XP. Both have bugs, some major, some minor. Anyone who tells you that Linux is "inherently more secure" or "much less buggy" than XP simply isn't working from current facts. The reality is that bugs happen, even in Linux: Get over it.

Speed Of Fixes
The second most-cited argument in reader mail was along the lines of: "Open Source bugs aren't that big a deal because they can be fixed far faster than Windows bugs."

Yes, under the very best and limited circumstances, this can be true: A raw, initial fix can be posted online sometimes within hours of a bug coming to light, and that's wonderful, when it happens. But that initial posting is often in source code, or in a form that requires that parts of the operating system or software be rebuilt or recompiled by the user. And it's usually posted in special developer-only portions of open-source Web sites. In other words, the patch may be useful to a handful of expert users. That's great for them, but what about everyone else?

Most patches take much longer to appear, and longer still to become generally available to all affected users, in finished, tested, easily installable form--even if, technically speaking, the initial instance of the bug was stomped out very quickly. Given the growing fragmentation of the open source community and the increasingly quasi-proprietary distributions of Linux, how could it be otherwise? It has to take time to get patches out.

Consider just two cases in point: The Open Source Mozilla project ran three years late in development, and that was just a browser, not an entire operating system. Linux itself took about 7 years before it was even remotely ready for prime time. In the face of software gestations this lengthy, I think it's hard to argue that open source's supposed "fast fixes" actually mean much in real world benefits.

This is a big chunk of Microsoft's problem, of course--it takes time to release a finished, auto-installing patch for all versions and builds of all affected in-use Microsoft software. This often makes Microsoft patches appear weeks or months after a bug comes to light. But as Linux and other open-source software face the same kinds of market problems, their pace is slowing, too. It's inevitable. The more complex and fragmented a software market is, the longer it will take for fixes to diffuse out to all builds and versions. Complex software takes time to write and debug: Get over it.