I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic
I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic
Posted Jan 21, 2016 1:16 UTC (Thu) by PaXTeam (guest, #24616)In reply to: I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic by FLHerne
Parent article: Dutch consumer group sues Samsung over Android updates (OSNews)
> They might have crap code and no testing, or it might have been some really obscure edge-case in an otherwise good project.
that distinction would say very much about that attitude to security. however i don't see how the suggested metric helps here.
> if a serious vulnerability is left unpatched for more than a few days _after_ the maintainers are told, you know _for sure_ not to rely on them for security.
except for certain individuals or teams with single-digit member counts no entity can turn fixes out that fast so it's still not a useful metric because it would make most entities unreliable. and i still don't see how a phone becomes secure on those days when the public is unaware of any particular vulnerability.