bugtraq - Re: Oracle - the last word

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 May 2006 18:28:38 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: davidl@...software.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Oracle - the last word

David Litchfield said:

>When Oracle 10g Release 1 was released you could spend a day looking
>for bugs and find thirty. When 10g Release 2 was released I had to
>spend two weeks looking to find the same number.

This increasing level of effort is likely happening for other major
widely audited software products, too.  It would be a very useful data
point if researchers could publicly quantify how much time and effort
they needed to find the issues (note: this is not my idea, it came out
of various other discussions.)  Level of effort might provide a more
concrete answer to the question "how secure is software X?"

Some researchers might not want to publicize this kind of information,
but this would be one great way to help us move away from the
primitive practice of counting the number of reported vulnerabilities.
(and while I'm talking about quantifying researcher effort, it might
be highly illustrative to measure how much time is spent in dealing
with vendors during disclosure.)

- Steve