Hacker News Reader

Comment by benaadams | Hacker News Reader

> MS Windows has been the "most" exploited OS in our history.

Doesn't look that way

Top 50 Products By Total Number Of "Distinct" Vulnerabilities https://www.cvedetails.com/top-50-products.php

  Vulns  Product

1. 2124 Linux Kernel Linux OS

2. 2084 Mac Os X Apple OS

3. 1924 Android Google OS

4. 1741 Firefox Mozilla App

5. 1664 Debian Linux Debian OS

6. 1546 Chrome Google App

7. 1495 Iphone Os Apple OS

8. 1123 Ubuntu Linux Canonical OS

9. 1103 Windows Server 2008 Microsoft OS

10. 1057 Flash Player Adobe App

11. 984 Safari Apple App

12. 961 Windows 7 Microsoft OS

13. 951 Internet Explorer Microsoft App

14. 951 Acrobat Adobe App

15. 856 Thunderbird Mozilla App

16. 818 Windows Vista Microsoft OS

17. 784 Opensuse Novell OS

18. 731 Windows Server 2012 Microsoft OS

19. 731 Windows Xp Microsoft OS

20. 698 Seamonkey Mozilla App

21. 685 Acrobat Reader Adobe App

22. 665 Windows 8.1 Microsoft OS

23. 641 Mac Os X Server Apple OS

24. 636 Windows 10 Microsoft OS

View on HN

That list inconsistently splits some things by version (windows), and groups others (Debian, android, etc).

What it says is that a single version of Windows had more than half as many CVEs as the entire Linux kernel has ever had. That doesn't exactly support what you are trying to convey. If you add up all windows versions, it would top the list.

Since Windows versions share most of their code; I wonder how many vulnerabilities on that list are counted multiple times -- once for each version.

It's a terrible list one way or the other.

That's because the vulns are repeated across the Windows versions, adding the versions together counts the same vuln multiple times

I’m not sure if it’s worse to have the same vulnerability across two versions, or to have two distinct vulnerabilities.

It's almost like saying "vulnerabilities in our code exist for decades before they are noticed by anyone (with a whitehat)".

Sure, that happens in open source projects too (openssl anyone?), but it seems like an exception rather than a rule. If there are so many of these multiple-version vulnerabilities in Windows that the author of the list had to specifically break Windows into individual versions, then that speaks for itself.

By Vendor:

  Microsoft : 9673
  Apple     : 6157
  Adobe     : 3939
  Mozilla   : 3888
  Linux     : 2124

That's some seriously funny counting. You added together everything by "vendor" even though the CVE count can't be summed that way since they are reported for every affected version; so you would have double, triple, quadruple counting for a single vulnerability.

Then on the opposite side of the coin for Linux you left everything off except the kernel which is very misleading since it's really distros that most users need to be concerned with.

> You added [...]

I did not, I just reported the numbers given at the bottom of benaadams' linked page.

It seems a bit strange that all the Windows kernels are in separate versions, while Linux is all bundled in to one?

The vulns are reported for each version of Windows they exist in e.g. https://www.cvedetails.com/cve/CVE-2018-8307/

Number of fixed vulnerabilities does not equal number of times exploited. A vulnerability may be exploited many times by many different people.

1/3 of that list is Windows!

is this a list of reported and as of yet still vulnerable, or is this a list of all reported vuln including ones that have been fixed?

Following the links it includes fixed vulns

Reply on news.ycombinator.com