RE: bill gates' claim about security vulnerabilities per LOC in Unix versus Windows

Hi,
	A very interesting series of studies at
http://www.cs.wisc.edu/~bart/fuzz/ may provide some interesting
(perhaps, somewhat dated) empirical data for this discussion. Although
it has been some time since I've read these papers and I don't believe
their results are expressed in terms of bugs per line of code, I think
the information is pertinent to this discussion.

Mike 

-----Original Message-----
From: [email protected] [mailto:[email protected]] 
Sent: Friday, October 31, 2003 6:07 PM
To: [email protected]
Subject: bill gates' claim about security vulnerabilities per LOC in
Unix versus Windows


in an interview done after his speech at the ms developer's conference,
http://www.itbusiness.ca/index.asp?theaction=61&sid=53897
bill gates claims (among other things)...

..."The fact is, there are security vulnerabilities in peoples'
applications in many places. I mean, people act like some other systems
don't have vulnerabilities; actually all the forms of Unix as well as
Linux have had more vulnerabilities per line of code. They don't
propagate as much because they're not as dense as our system is, so the
things that prevent the propagation are particularly important for our
world."...

The "density" claim I think refers to the distribution of Windows
systems, densely packed on the agar dishes of corporate lans. 

But does anyone actually know what studies might have compared
vulnerabilities per LOC among different operating systems?

the distinction between "bugs" and "exploitable vulnerabilities" 
may come to bear.

or maybe the huge number of lines of code in the denominator is what
makes this claim is based on.