Counting vulnerabilities

Counting vulnerabilities

Posted Jun 29, 2007 20:25 UTC (Fri) by giraffedata (subscriber, #1954)
In reply to: Counting vulnerabilities by jimparis
Parent article: Counting vulnerabilities

The study compares products, so Wireshark on Windows doesn't count because it's not part of the Windows Vista product.

The article says the study doesn't count bugs in "packages" that are on RHEL but not Vista, which I assume means capabilities. And it doesn't say that the Wireshark bugs were counted against RHEL. (Though I could imagine they were if Vista comes with a similar tracing facility).

I believe a much more interesting figure would be number of bugs that were exploited during the period. That would discount bugs in unused code and bugs with no realistic way to exploit. It would be more applicable to the question, "should I do this job with Windows or with Linux"?

---

(Log in to post comments)