Re: What do you think of Trollc?

[Michal Zalewski <lcamtuf () coredump cx>]

> I'd be interested to see analyses of short term affects of breaches.

A friend of mine pointed me to this paper:

http://www.heinz.cmu.edu/~rtelang/tse_published.pdf

I have issues with the methodology - most notably, the study covers
only 150 bugs out of thousands qualifying ones; half of them for a
single vendor, Microsoft - so perhaps the study simply qualifies the
wisdom of investing on some Tuesdays. (Inexplicably, just one bug is
said to have affected Adobe between 1999 and 2004.)

On top of that, it doesn't directly qualify gains / losses for a
potential investment strategy.

/mz

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/