| |||||||||||||
|
| |||||||||||||
Kernel security, year to dateKernel security, year to datePosted Sep 9, 2008 22:47 UTC (Tue) by nix (subscriber, #2304)In reply to: Kernel security, year to date by bfields Parent article: Kernel security, year to date
A development model in which nothing ever changed would introduce no new
bugs. The current development model has a high change rate.
The remainder follows by induction.
(Not that it's very *useful*, but when was the last time you heard of a
(Log in to post comments)
Development model Posted Sep 10, 2008 21:28 UTC (Wed) by man_ls (subscriber, #15091) [Link] So true. And with the current rate of changes, any statistics are less than useful: the last development cycle may have produced some 170k new lines and maybe 20 vulnerabilities. That is one CVE per 8k lines of code, i.e. a needle in a haystack.A really useful study on vulnerabilities would have to contemplate (as our editor suggests) the rate of changes, the rate of introduction and the rate of removal; and compare with other development models. Anything else is just anecdotal evidence.
|
|
||||||||||||