5 ms·
No, there is in fact a qualitative difference between a program where the expected number of CVEs is 1, and one where the expected number of CVEs is 0.02.
by TomSwirly 3y ago
No, there is in fact a qualitative difference between a program where the expected number of CVEs is 1, and one where the expected number of CVEs is 0.02.
- saagarjha 3y agoYes, there are fewer CVEs. So?
- oasisaimlessly 3y agoAre you being purposely dense? If the mean number of CVEs is low enough, some proportion of software has 0 exploitable flaws, and is invulnerable regardless of how much attackers spend.
- saagarjha 3y agoI consider that most software that people use is sufficiently complex enough that it will not fall in this bucket.