Hacker News Reader

That list inconsistently splits some things by version (windows), and groups others (Debian, android, etc).

What it says is that a single version of Windows had more than half as many CVEs as the entire Linux kernel has ever had. That doesn't exactly support what you are trying to convey. If you add up all windows versions, it would top the list.

View on HN

Since Windows versions share most of their code; I wonder how many vulnerabilities on that list are counted multiple times -- once for each version.

It's a terrible list one way or the other.

That's because the vulns are repeated across the Windows versions, adding the versions together counts the same vuln multiple times

I’m not sure if it’s worse to have the same vulnerability across two versions, or to have two distinct vulnerabilities.

It's almost like saying "vulnerabilities in our code exist for decades before they are noticed by anyone (with a whitehat)".

Sure, that happens in open source projects too (openssl anyone?), but it seems like an exception rather than a rule. If there are so many of these multiple-version vulnerabilities in Windows that the author of the list had to specifically break Windows into individual versions, then that speaks for itself.

Reply on news.ycombinator.com