full-disclosure - [inbox] Re: RE: Linux (in)security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200310241406.h9OE6YVn017216@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: [inbox] Re: RE: Linux (in)security 

On Thu, 23 Oct 2003 17:15:07 CDT, Paul Schmehl <pauls@...allas.edu>  said:

> This is an apples to oranges comparison.  Netware is a network OS. 
> "Windows" includes all the applications that come with Windows, whether 
> they are part of the base OS, part of the networking functions or addons. 
> (IE, OE, etc.)

On the other hand, the vendor swore up and down in court that things like IE
were an integral part of the OS.  As such, they get to have to count the IE
bugs as OS bugs, or recant their "IE is part of the OS" mantra.

> In 2003 ...

> Debian has had 176 during the same time period:
> http://www.debian.org/security/2003/

> During the same time period, Microsoft has had 47.  And those 47 include 
> things like Exchange Server and SQL Server, not *just* the Windows OS.  I'd 

So Debian had 176 advisories against the Linux kernel itself, not counting
things like all the userspace stuff? Let's see... visit that Debian page, and
the first 10 things are tomcat, openssl, openssl, webfs, freesweep, marbles,
ipmasq, kdebase, gopher, and libmailtools-perl.  

Freesweep??  Marbles??? That 176 includes bugs in the *GAMES*.  So all vendors
are including userspace stuff as well.  We are comparing apples to apples, but
doing it very poorly because it's not apples we really care about...

Sorry, but all you're *REALLY* measuring here is how forthright vendors are
being, and NOT measuring actual security.  If you're basing it on the number of
vendor advisories, any vendor could come out a clear winner simply by adopting
a "I see nothink... nothink...." attitude and releasing zero advisories.

Where in your equation do you count in the 31 known IE vulnerabilities that
were until recently listed on pivx's page?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031024/fb8e9cde/attachment.bin