full-disclosure - Hotmail & Passport (.NET Accounts)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <JAEGIICLHAJHLINAEHLBCELKCOAA.erc@pobox.com>
From: erc at pobox.com (Ed Carp)
Subject: Hotmail & Passport (.NET Accounts)

> > I sure hope that
> > folk won't be sucked into bogus "MS released fewer IE patches last
> > year" claims based solely on the year-on-year comparison of the
> > number of patch releases (as indicated by security bulletin count).
>
> Most vendors and even open source software projects roll up security
> fixes, usually when issues are classed as minor or if several severe
> issues can be announced and fixed at the same time.  To know how many
> issues get rolled up you need to be able to count issues or
> vulnerabilities and that can be quite subjective.  However we can
> normalise on CVE data to get useful statistics:

Counting vulnerabilities is a ridiculous way of assessing security!  Common
sense should tell you that, an no explanation is needed for this very
obvious fact.