Which is which

Well, yes, of course, but most attacks on higher-level stuff don't bother
trying to exploit a kernel bug in order to get at, say, Firefox. They
buffer-overrun some image library instead (FF does things like ship its
own copy of that known security-wobbly library libpng, always, because
some patch of theirs was rejected from the upstream tree, sigh). I'm not
sure I've ever heard of userspace network-facing software such as web
browsers being successfully attacked by way of a kernel hole. I suppose it
*could* happen, and perhaps it has, but is it common enough to make the
kernel a more worthwhile thing to fix than the higher-level stuff? It
seems more likely they'd stick to attacking the higher layer, and thus get
an exploit that works no matter what version of the kernel you're running.

(Damn good interview, btw.)