RE: [inbox] Re: RE: Linux (in)security

[Steven Evans <steve () netwaynetworks com au>]

Just a question.  We are counting bugs, right?  Why arent we counting the
bugs that got fixed in, for example, SP4 for windows 2000?  That was
released this year, correct?  It contains atleast 670 bugs fixed.  Are we
counting remotely-exploitable bugs that microsoft has acknowledged and
supplied a hotfix for, or are we counting all remotely exploitable bugs
(including the 32 that havnt been fixed in IE), or all bugs on the Windows
platform in general?

I am a confused panda.

Cheers,
Steve

-----Original Message-----
From: Paul Schmehl [mailto:pauls () utdallas edu] 
Sent: Friday, 24 October 2003 12:40 PM
To: full-disclosure () lists netsys com
Subject: Re: [inbox] Re: [Full-disclosure] RE: Linux (in)security


--On Thursday, October 23, 2003 5:11 PM -0700 Dan Wilder <dan () ssc com> 
wrote:
> Among those advisories you mention on the Linux sites, I see subjects
> including tomcat4, openssl, freesweep, marbles, gopher, sendmail,
> mah-jong, wu-ftpd, exim, perl, phpgroupware, mutt, qpopper, squirrelmail.
> And many more that are similar in that they've no relationship with
> the OS save being shipped with it.  Hardly *just* the Linux OS.  Some
> of those packages mentioned on the Debian site were begun long before
> there _was_ such a thing as Linux.
>
> Even if you classify things like XFRee86 and Samba as being part of the
> OS for purposes of comparing with Windows, which features much tighter
> coupling between the OS and some of its services than do the UNIX-like
> OSs, I believe you're going to be hard-pressed to come up with 47
> advisories against the OS.  Or anything remotely near that number.
Nor will you with Windows.  Look at the 47 bulletins for this year and 
you'll find things like Messenger, Internet Explorer, Outlook, Access, 
Content Management Server, ISA Server, etc., etc., none of which are part 
of the OS, despite MS's bs claims in court.

<snip>

Netway Networks Pty Limited
t   02 - 8920 8877 
f   02 - 8920 8866 
e   support () netwaynetworks com au 
w   http://www.netwaynetworks.com.au