Bugtraq mailing list archives
Re: Oracle - the last word
From: "Steven M. Christey" <coley () mitre org>
Date: Wed, 10 May 2006 18:28:38 -0400 (EDT)
David Litchfield said:
When Oracle 10g Release 1 was released you could spend a day looking for bugs and find thirty. When 10g Release 2 was released I had to spend two weeks looking to find the same number.
This increasing level of effort is likely happening for other major widely audited software products, too. It would be a very useful data point if researchers could publicly quantify how much time and effort they needed to find the issues (note: this is not my idea, it came out of various other discussions.) Level of effort might provide a more concrete answer to the question "how secure is software X?" Some researchers might not want to publicize this kind of information, but this would be one great way to help us move away from the primitive practice of counting the number of reported vulnerabilities. (and while I'm talking about quantifying researcher effort, it might be highly illustrative to measure how much time is spent in dealing with vendors during disclosure.) - Steve
Current thread:
- Oracle - the last word David Litchfield (May 10)
- <Possible follow-ups>
- Re: Oracle - the last word Steven M. Christey (May 11)
- RE: Oracle - the last word Lee Kelly (May 12)
- RE: Oracle - the last word Iggy E (May 15)
- Re: Oracle - the last word Stefano Di Paola (May 12)
- RE: Oracle - the last word Lee Kelly (May 12)