bugtraq - Re: LAMP vs Microsoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 11 Jul 2006 17:03:00 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: LAMP vs Microsoft

Researcher "fads," differences in vendor disclosure practices, and
vulnerability database editorial policies will heavily influence
vulnerability statistics, to the point where comparing them is not
very informative (at least, you're not getting the whole picture).
You also have the challenge of defining equivalent platforms to
compare against each other.

However, there is one area where you can really compare 2 products to
each other: implementation of standards.  These standards could be
protocol-based, file-based (e.g. image formats), or scheme-based (such
as authentication or crypto schemes).

It would be great to see some more focused efforts that are based on
standards that are implemented in a cross-OS fashion.  This would
allow the community to harness the power of fuzzing and suite-testing
in a narrow fashion.  We would only get narrow answers, of course -
"these kinds of implementation bugs were looked for and found on these
kinds of products" - but it would be much more manageable and
measurable, and above all, we would be comparing apples to apples.

If someone is interested in pursuing this further, you could probably
start with past data from PROTOS and other past fuzzing/suite-testing
results.

- Steve