Re: [inbox] Re: RE: Linux (in)security

[Valdis.Kletnieks () vt edu]

On Thu, 23 Oct 2003 17:15:07 CDT, Paul Schmehl <pauls () utdallas edu>  said:

> This is an apples to oranges comparison.  Netware is a network OS. 
> "Windows" includes all the applications that come with Windows, whether 
> they are part of the base OS, part of the networking functions or addons. 
> (IE, OE, etc.)

On the other hand, the vendor swore up and down in court that things like IE
were an integral part of the OS.  As such, they get to have to count the IE
bugs as OS bugs, or recant their "IE is part of the OS" mantra.

> In 2003 ...

> Debian has had 176 during the same time period:
> http://www.debian.org/security/2003/

> During the same time period, Microsoft has had 47.  And those 47 include 
> things like Exchange Server and SQL Server, not *just* the Windows OS.  I'd 

So Debian had 176 advisories against the Linux kernel itself, not counting
things like all the userspace stuff? Let's see... visit that Debian page, and
the first 10 things are tomcat, openssl, openssl, webfs, freesweep, marbles,
ipmasq, kdebase, gopher, and libmailtools-perl.  

Freesweep??  Marbles??? That 176 includes bugs in the *GAMES*.  So all vendors
are including userspace stuff as well.  We are comparing apples to apples, but
doing it very poorly because it's not apples we really care about...

Sorry, but all you're *REALLY* measuring here is how forthright vendors are
being, and NOT measuring actual security.  If you're basing it on the number of
vendor advisories, any vendor could come out a clear winner simply by adopting
a "I see nothink... nothink...." attitude and releasing zero advisories.

Where in your equation do you count in the 31 known IE vulnerabilities that
were until recently listed on pivx's page?

Attachment: _bin
Description: