| |||||||||||
|
| |||||||||||
Counting vulnerabilitiesCounting vulnerabilitiesPosted Jun 22, 2007 21:37 UTC (Fri) by smoogen (subscriber, #97)Parent article: Counting vulnerabilities
Another big issue that seems to be lost is that outside researchers can not see the Vista code in large enough numbers to really evaluate the code. A lot of the same bugs could be there but may only be known internally or by the usual BlackMarket crack organization.
It would be interesting to make a Vista comparible OS. Just equivalent packages what MS ships in XP and Vista... and then have everything as 'extra-packs'
It would also be interesting to make a comparison of 180,360,720, and 1440 days.
(Log in to post comments)
Counting vulnerabilities Posted Jun 22, 2007 22:30 UTC (Fri) by pr1268 (subscriber, #24648) [Link] > It would also be interesting to make a comparison of 180,360,720, and 1440 days. Or even easier, compare Windows XP to RHEL 4 in the above time frames.
Counting vulnerabilities Posted Jun 25, 2007 11:55 UTC (Mon) by Randakar (guest, #27808) [Link] Heh. That's not even the whole story; A few days ago I saw a site reporting that Microsoft is SILENTLY FIXING security vulnerabilities; As in, not reporting them at all - just fixing them without telling anyone.*
So any study based on "official vulnerabilities" falls down right there. If the vendor isn't even honest about it there is no way in hell the numbers will tell us anything about the actual security provided when you run their OS.
*) I don't remember where I saw it though - If somebody could post the link that'd be kind.
Counting vulnerabilities Posted Jun 25, 2007 14:14 UTC (Mon) by nix (subscriber, #2304) [Link] But everyone does that.
To be specific: everyone quietly fixes bugs which *might potentially* be considered security vulnerabilities, if just because they don't realise that they're vulnerabilities at the time they fix them.
You don't need to be nefarious to do that.
(Equally, known vulnerabilities in unreleased or released-as-development versions of free software are often fixed without formal vulnerability announcements, on the basis that anyone who was bitable by this bug is going to be upgrading often anyway, or why else would they be running a development release?)
Counting vulnerabilities Posted Jun 28, 2007 16:45 UTC (Thu) by amikins (subscriber, #451) [Link] I think the allegation here is more to the effect of patching installed versions without any notification that there is an issue or that the system is updating itself.I haven't seen anything to that effect, but then I avoid learning anything about Vista when I can.. It just infuriates me.
|
|||||||||||