3 ms·
By that reasoning, Flash would be safe enough to stay around, seeing how many CVEs it had (1078 since the first CVE for it was published Dec 31, 2005). It’ll b
by qwantim1 6y ago
By that reasoning, Flash would be safe enough to stay around, seeing how many CVEs it had (1078 since the first CVE for it was published Dec 31, 2005).
It’ll be gone tomorrow though, or January 12, or later in 2021.
- Foxboron 6y agoI don't think flash proves anything. It's an extreme example after all.
- qwantim1 6y agoHow would you modify your argument rather than dismiss the evidence against it? For example, could you propose an equation using the number of CVEs and their severity along with the the rough number of known users, showing that some curve or values would indicate maturity rather than risk? Some data for Flash[1] CVEs are available at CVE Details. Possibly you could find other products you consider safe and see how they compare. I’d be curious if an analysis would show correlation of what you’d consider greater risk with a year that Adobe started outsourcing to a particular company or decided to EOL it; I’m not proposing that quality went down due to one of those things or that they outsourced, but analyzing the data could be useful. [1]- https://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-6761/Adobe-Flash-Player.html https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...
- Foxboron 6y agoflash predates systemd by around 5-6 years. Flash has 1000+ CVEs. Systemd has less then 20. I don't think pointing at flash proves anything.
- qwantim1 6y agoYou believe the security of systemd is strong, and that CVEs are a sign of use and maturity, then you’re saying ~2 CVEs per year on average is compatible with good security. I understand you believe this, but I don’t see how it’s rational.