full-disclosure - Re: Which is more secure? Oracle vs. Microsoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 21 Nov 2006 10:39:53 +0000
From: "David Kierznowski" <david.kierznowski@...il.com>
To: davidl@...software.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Which is more secure? Oracle vs. Microsoft

David,

Interesting paper. I do have a couple of points though:
a. Your graphs show the number of risks found, however, it would be
interesting to note the comparison in the severity of risks found. So
I did a quick count on issues =~ (overflow) (format string):
Microsoft SQL Count 39
Oracle Count 19

b. You also mention SDL being the reason as to why Microsoft have had
so few issues. It seems to good to be true that SDL would really solve
all these problems, then again maybe it has. Looking at my comments
above (see a.), could I not suggest that some of these issues are not
re-occuring due to stack protection being implemented in XP2 and
Windows 2003?

Kind regards,
David Kierznowski

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/