Date: Sat, 2 Feb 2002 05:04:02 +0200 From: Giorgos Keramidas <keramida@freebsd.org> To: Dillion Klein <dillionklein@hotpop.com> Cc: freebsd-questions@freebsd.org Subject: Re: OS Vulnerability Statistics Message-ID: <20020202030401.GC4473@hades.hell.gr> In-Reply-To: <GJEMJMGHBEKNGLGPHJDNIEIPCDAA.dillionklein@hotpop.com> References: <GJEMJMGHBEKNGLGPHJDNIEIPCDAA.dillionklein@hotpop.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--45Z9DzgjV8m4Oswq Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2002-02-01 15:40, Dillion Klein wrote: > I was directed to a very interesting list of stats on OS vulnerabilities, > and was interested in any comments on FreeBSD's massive drop in vulns' > from 2000 to 2001.=20 >=20 > Just by chance, or were there massive changes in the way the code was > written, etc.? >=20 > According to the stats, Windows NT/2000 is more secure than Linux...=20 >=20 > Link: http://securityfocus.com/vulns/stats.shtml This type of statistics is not really very informative though. With security problems, what is more important is not just the number of them found. Having many vulnerabilities can mean one of many things, the most promiment among them being: a) The OS is a can full of worms, viruses and problems. b) The source code is being heavily audited and problems are identified, fixed as the world moves on to more interesting things. Which one of these two characterizes the numbers posted there for each operating system? I know it's hard to tell by just looking at the number of them vulnerabilities. What is more important to try and find out, given statistics like these is ``what is the average time that is required after a vulnerability has been identified, in order to have a fix available for all the users?''. It seems to me (but that is my own personal opinion, on the matter) that having one, just one, vulnerability that goes unfixed for more than a couple of years year, is far worse than having tracked down, spotted and fixed more than a dozen of them, averaging less than a few hours for each one. Cheers, --=20 Giorgos Keramidas . . . . . . . . . keramida@{ceid.upatras.gr,freebsd.org} FreeBSD Documentation Project . . . http://www.freebsd.org/docproj/ FreeBSD: The power to serve . . . . http://www.freebsd.org/ --45Z9DzgjV8m4Oswq Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) iD8DBQE8W1ch1g+UGjGGA7YRAgOXAJ9BofIfeG0qx+wASvHRt3iIHQMGDgCfaEff 7R3MSNHhdcUhwXePYq9/mSQ= =2ixH -----END PGP SIGNATURE----- --45Z9DzgjV8m4Oswq-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020202030401.GC4473>