RE: Lame studies that people quote as fact that haveno basis in reality and still don't prove anything even if they did

[Rodney Thayer <rodney () canola-jones com>]

At 05:44 PM 2/4/2004 -0800, you wrote:
> Matt wrote:
> > > I also think they were referring more towards cases in which new
> > > functionality needs to be added to existing code, or existing
> > > functionality modified to some significant degree. Vulnerabilities
> > > don't tend to fall into either of these categories.
> >
> > Are you for real? How do you define vulnerability?
>
> Neither of the above imply the software is broken while a vulnerability
> does. Software can a) get redesigned or b) have features added without c)
> discovering or repairing any vulnerabilities. Both a and b are probably more
> expensive than c.

No, (b) is less expensive, because the energy cost of producing new
features is less due to organizational issues (a/k/a greed 'cause you
can sell more)

It's not until vulnerabilities cut into profit or otherwise get in your
way that it becomes a business issue.

Dave, you bitch, you had to open this can of worms, didntcha ;-)

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave