RE: anonymized

[Rodney Thayer <rodney () canola-jones com>]

At 01:36 PM 8/27/2004 -0400, Mike Bailey wrote:

> I mean the standardized format. Not just "a" review but a buyers guide
> system that lists how the performance goes over time using the same criteria
> for all products. I know it's easier to say than do with software revisions
> new products, obscuring function with form and so on..

I realize that reviews aren't the same thing as a standardized format.
I meant to say that SOME attempts by SOME people are happening, so the
world is not totally devoid of attempts to check these things.

It's hard to do. It's been attempted
with varying degrees of success (ICSA, VPNC, etc.) in other cases.

The real hard part is that vendors, in general, don't have the corporate
cojones to have their products seriously tested.  If I said "I'm buying
a copy of Canvas and a copy of Core Impact and setting up a Metasploit 
testbed and testing your product against that and publishing the 
results" I'd get very few volunteers.

(that's not quite a technically precise test but you see my point, I suspect.)

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave