On Thu, 23 Oct 2003 17:15:07 CDT, Paul Schmehl <pauls@utdallas.edu> said: > This is an apples to oranges comparison. Netware is a network OS. > "Windows" includes all the applications that come with Windows, whether > they are part of the base OS, part of the networking functions or addons. > (IE, OE, etc.) On the other hand, the vendor swore up and down in court that things like IE were an integral part of the OS. As such, they get to have to count the IE bugs as OS bugs, or recant their "IE is part of the OS" mantra. > In 2003 ... > Debian has had 176 during the same time period: > http://www.debian.org/security/2003/ > During the same time period, Microsoft has had 47. And those 47 include > things like Exchange Server and SQL Server, not *just* the Windows OS. I'd So Debian had 176 advisories against the Linux kernel itself, not counting things like all the userspace stuff? Let's see... visit that Debian page, and the first 10 things are tomcat, openssl, openssl, webfs, freesweep, marbles, ipmasq, kdebase, gopher, and libmailtools-perl. Freesweep?? Marbles??? That 176 includes bugs in the *GAMES*. So all vendors are including userspace stuff as well. We are comparing apples to apples, but doing it very poorly because it's not apples we really care about... Sorry, but all you're *REALLY* measuring here is how forthright vendors are being, and NOT measuring actual security. If you're basing it on the number of vendor advisories, any vendor could come out a clear winner simply by adopting a "I see nothink... nothink...." attitude and releasing zero advisories. Where in your equation do you count in the 31 known IE vulnerabilities that were until recently listed on pivx's page?
Attachment:
pgp00116.pgp
Description: PGP signature