2 ms·
>We can't measure the number of security bugs, we're measuring how many get fixed. The number of bugs found should be trending towards zero since millions of p
by ksk 9y ago
>We can't measure the number of security bugs, we're measuring how many get fixed.
The number of bugs found should be trending towards zero since millions of people have the opportunity to improve the source code and prevent the bugs from being introduced in the first place. There are ofcourse other advantages to having the source be open, but if there is no security advantage to open source, that's going to put a dent in some of its marketing.
>Fewer eyeballs on Windows would imply fewer discoveries, and fewer bugfixes as a result.
Why would fewer people be looking at Windows compared to Linux? Security Researchers don't really discriminate. Or did you mean just the MS developers? Hmmm, I don't know how many windows bugs were found through external sources vs internal. Perhaps someone has already done that analysis..
- shakna 9y ago> The number of bugs found should be trending towards zero Only if no new features are ever introduced.
- Erlich_Bachman 9y ago> Why would fewer people be looking at Windows compared to Linux? As I wrote in the original post, this is because Linux is open-source. There are few people looking at Windows, simply because there is no source to look at, and as a result there are 10 times less people in the world who potentially even can look at it and check for bugs. That's why. With Linux you need basic systems programming skill and ability to code simple exploits. With Windows you either need to be working there (and be assigned to this task) - or reverse-engineer, which is a much rarer and complicated skill.
- ksk 9y agoYes, in theory all that is correct.