Re: LAMP vs Microsoft
Researcher "fads," differences in vendor disclosure practices, and
vulnerability database editorial policies will heavily influence
vulnerability statistics, to the point where comparing them is not
very informative (at least, you're not getting the whole picture).
You also have the challenge of defining equivalent platforms to
compare against each other.
However, there is one area where you can really compare 2 products to
each other: implementation of standards. These standards could be
protocol-based, file-based (e.g. image formats), or scheme-based (such
as authentication or crypto schemes).
It would be great to see some more focused efforts that are based on
standards that are implemented in a cross-OS fashion. This would
allow the community to harness the power of fuzzing and suite-testing
in a narrow fashion. We would only get narrow answers, of course -
"these kinds of implementation bugs were looked for and found on these
kinds of products" - but it would be much more manageable and
measurable, and above all, we would be comparing apples to apples.
If someone is interested in pursuing this further, you could probably
start with past data from PROTOS and other past fuzzing/suite-testing
results.
- Steve