full-disclosure

Open Source and information security mailing list archives

Message-ID: <CALx_OUCLA5LhUpQhTPL=q=R=zMUepvvsbeLZnAqbZOqYmgPn-g@mail.gmail.com>
Date: Wed, 28 May 2014 12:18:36 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: noloader@...il.com
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] What do you think of Trollc?

> I'd be interested to see analyses of short term affects of breaches.

A friend of mine pointed me to this paper:

http://www.heinz.cmu.edu/~rtelang/tse_published.pdf

I have issues with the methodology - most notably, the study covers
only 150 bugs out of thousands qualifying ones; half of them for a
single vendor, Microsoft - so perhaps the study simply qualifies the
wisdom of investing on some Tuesdays. (Inexplicably, just one bug is
said to have affected Adobe between 1999 and 2004.)

On top of that, it doesn't directly qualify gains / losses for a
potential investment strategy.

/mz

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives