4 ms·

In other words, if you look by product - which you should, yes, Mac OS X was the most vulnerable OS. IF you look by company total, no Apple wasn't. And if you

by nolok 11y ago

In other words, if you look by product - which you should, yes, Mac OS X was the most vulnerable OS. IF you look by company total, no Apple wasn't. And if you even ignore type of product, then Adobe goes first, but this has no impact on "which OS was the most vulnerable".

awakeasleep 11y ago
Another thing that would add more information to the picture is something like "percent of installbase running vulnerable version." If, for example, researchers found 10k vulnerabilities in windows 3.1, it wouldn't make sense to ding microsoft for an insecure operating system, because no one runs that and it's not reasonable to expect support.
- krylon 11y ago
  > because no one runs that and it's not reasonable to expect support. I would not be overly surprised if it turned out somebody was still using Windows 3.1 - I know of at least one company still running NT 4 on at least a few select machines. (This does not invalidate your point, though.)
  - highmastdon 11y ago
    Someone still using it: https://news.vice.com/article/windows-31-is-still-alive-and-it-just-killed-a-french-airport https://news.vice.com/article/windows-31-is-still-alive-and-...
zepto 11y ago
No. Firstly the data aren't usable for this kind of analysis even if you bucket them differently: https://www.cvedetails.com/how-does-it-work.php https://www.cvedetails.com/how-does-it-work.php Secondly, we know nothing about exposure, because we don't know how the relative levels of attention or how quickly the vulnerabilities are patched. A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities. A high discovery rate plus relatively high rate of distribution of patches could means a system is less vulnerable. I'm not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.

by nolok 11y ago

awakeasleep 11y ago

Another thing that would add more information to the picture is something like "percent of installbase running vulnerable version." If, for example, researchers found 10k vulnerabilities in windows 3.1, it wouldn't make sense to ding microsoft for an insecure operating system, because no one runs that and it's not reasonable to expect support.

krylon 11y ago
> because no one runs that and it's not reasonable to expect support. I would not be overly surprised if it turned out somebody was still using Windows 3.1 - I know of at least one company still running NT 4 on at least a few select machines. (This does not invalidate your point, though.)
- highmastdon 11y ago
  Someone still using it: https://news.vice.com/article/windows-31-is-still-alive-and-it-just-killed-a-french-airport https://news.vice.com/article/windows-31-is-still-alive-and-...

zepto 11y ago

No. Firstly the data aren't usable for this kind of analysis even if you bucket them differently: https://www.cvedetails.com/how-does-it-work.php https://www.cvedetails.com/how-does-it-work.php Secondly, we know nothing about exposure, because we don't know how the relative levels of attention or how quickly the vulnerabilities are patched. A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities. A high discovery rate plus relatively high rate of distribution of patches could means a system is less vulnerable. I'm not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.