Bugtraq mailing list archives
Re: LAMP vs Microsoft
From: "Steven M. Christey" <coley () mitre org>
Date: Tue, 11 Jul 2006 17:03:00 -0400 (EDT)
Researcher "fads," differences in vendor disclosure practices, and vulnerability database editorial policies will heavily influence vulnerability statistics, to the point where comparing them is not very informative (at least, you're not getting the whole picture). You also have the challenge of defining equivalent platforms to compare against each other. However, there is one area where you can really compare 2 products to each other: implementation of standards. These standards could be protocol-based, file-based (e.g. image formats), or scheme-based (such as authentication or crypto schemes). It would be great to see some more focused efforts that are based on standards that are implemented in a cross-OS fashion. This would allow the community to harness the power of fuzzing and suite-testing in a narrow fashion. We would only get narrow answers, of course - "these kinds of implementation bugs were looked for and found on these kinds of products" - but it would be much more manageable and measurable, and above all, we would be comparing apples to apples. If someone is interested in pursuing this further, you could probably start with past data from PROTOS and other past fuzzing/suite-testing results. - Steve
Current thread:
- Re: LAMP vs Microsoft, (continued)
- Re: LAMP vs Microsoft Darren Reed (Jul 15)
- Re: LAMP vs Microsoft Bob Beck (Jul 15)
- Re: LAMP vs Microsoft Darren Reed (Jul 15)
- Re: LAMP vs Microsoft Bob Beck (Jul 15)
- Re: LAMP vs Microsoft Bob Beck (Jul 18)
- Re: LAMP vs Microsoft Darren Reed (Jul 22)
- Re: LAMP vs Microsoft Darren Reed (Jul 15)
- Re: LAMP vs Microsoft George Capehart (Jul 18)
- Re: LAMP vs Microsoft Darren Reed (Jul 18)
- Re: LAMP vs Microsoft Hugo van der Kooij (Jul 18)