The future of vendor-sec [LWN.net]

The future of vendor-sec

Posted Mar 10, 2011 1:47 UTC (Thu) by cyd (guest, #4153)
Parent article: The future of vendor-sec

> In 2008, 69 issues were found first on vendor-sec, but by 2010 that had dropped to 29. According to Cox, 29 represents just 4% of the total number of vulnerabilities fixed.

Where do the rest come from?

(Log in to post comments)

The future of vendor-sec

Posted Mar 10, 2011 8:50 UTC (Thu) by mjcox@redhat.com (guest, #31775) [Link]

For calendar year 2010, mixing public and embargoed:

235 (32%) from some public mailing list or internet site
177 (24%) from relationships with upstream projects
75 (10%) found by Red Hat
70 (10%) reported to us by 3rd party (secalert@redhat.com or other)
64 (9%) from relationship with other peer vendors
51 (7%) vendor-sec
46 (6%) from the public feed of new CVE names
13 (2%) from some co-ordination service like CERT/CC

(Data taken from https://www.redhat.com/security/data/metrics )