I encourage you to read Part 1 and Part 2 of this series for background and context. As I discussed in Part 1, I challenged Mozilla claims that Firefox "won't harbor nearly as many security flaws as those that have Microsoft's Internet Explor" with an Internet Explorer and Firefox Vulnerability Analysis, which resulted in rebuttal from Mozilla's Mike Shaver (please do read it, so you have his viewpoint).

My main issue with the rebuttal is that rather than address the issue of software vulnerabilities and acknowledging that Writing Secure Code is hard (for everybody in the industry), it takes the approach of changing topics to redirect the conversation away from Firefox and towards Microsoft, asserting that my analysis of security flaws is a poor measure of security. Of course, that ignores the fact that it is a really good measure of specific claims about having low numbers of vulnerabilities.

I still think the issues raised should receive a vigorous and open discussion, today I will dig into one of the two main points raised by Shaver: "You Can Only Count What The Vendor Wants You to See."

You Can Only Count What the Vendor Wants You to See

Rather, I would say you can count everything that gets disclosed in a broad and public way, by security researchers or vendors. This is at the heart of the theory of Full Disclosure and I am comfortable asserting that most vulnerabilities across the industry in open and closed source models are disclosed by someone other than the vendor or development teams. Vendors do disclose issues, but it is typically a small percentage of the overall set of vulnerabilities.

If that's true, why is this issue even raised? Probably because of the issue of so-called "silent fixes" and because this was a hotly debated concern a few months before my analysis was released. After studying the discussions quite a bit, I see this as another incarnation of the various interpretations of Full Disclosure and a continuation of the debate between differing camps:

• (position one) Full disclosure requires that full details of a security vulnerability are disclosed to the public, including details of the vulnerability and how to detect and exploit it.
• (position two) The disclosure process and what information is disclosed should be guided by the best efforts to minimize overall risk to users. I lump the "disclose the minimum" crowd in here too.