2 ms·
CVE numerology is not a good way to assess comparative security. A search of the comments of local CVE enjoyer tptacek is a decent jumping-off point: https://h
by pvg 3y ago
CVE numerology is not a good way to assess comparative security. A search of the comments of local CVE enjoyer tptacek is a decent jumping-off point:
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Atptacek%20cve&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- WorldDev 3y agoYes, I have seen that argument often. I agree number of CVEs is a very rough metric. However, I am still confused as to why none of Chrome's CVEs would be Brave's CVEs?
- pvg 3y agovery rough metric The argument is, fundamentally, that it's not even that. It's not a rough proxy for the thing you want to evaluate, it's not any kind of proxy for it at all - that's a qualitatively different argument from your restatement of it. If you want a very rough comparative proxy, an obvious one is 'Brave is a much smaller downstream consumer of Chrome, Chrome has a larger security team/infrastructure than Brave has employees'. I think you can draw more meaningful conclusions from that alone than from CVE tallies.