In general, I hold with the latter (position two) since, when successful, it can result in lower risk for users.

However, for purposes of this article, I want to try to apply the position as articulated by Mozilla and see how they hold up to the standard they assert should be applied to others:

"We count every defect distinctly. We count the ones that Mozilla developers find in-house. We count the things we do to mitigate defects in other pieces of software, including Windows itself and other third-party plugins. We count memory behavior that we think might be exploitable, even if no exploit has ever been demonstrated and the issue in question was found in-house." (from Counting Still Easy...)

There is the claim. They count every defect distinctly. Now, as far as I know, Mozilla has never actually published any reports or "counts" at all, but I'm not going to quibble about that. Instead, let's interpret what was really said as that they acknowledge and disclose all of the vulnerabilities that are in Firefox, so that one could count them easily.

Check #1—Does Mozilla "Count" All Vulnerabilities?

Okay, I'll start with a simple high-level check: A list of the vulnerabilities acknowledged and fixed in a Mozilla Foundation Security Advisory (MFSA). This makes up my "Mozilla has acknowledged the vulnerability" list.

Next, I compiled a list of all vulnerabilities in the NVD that purport to affect Firefox and filtered out any that were on the other list, leaving me with ones that have not (yet) been addressed in a Mozilla Foundation Security Advisory. Further, I removed any that the NVD noted had been marked as DISPUTED and removed any issues that only affected a BETA version of Firefox. I also filtered out ones where it turned out that it actually affected a plug-in rather than Firefox itself. I was left with this list of 44 vulnerabilities which don't appear to be "counted" in a Mozilla advisory:

CVE-2005-2114, CVE-2005-2395, CVE-2005-4685, CVE-2005-4720, CVE-2005-4809, CVE-2006-0496, CVE-2006-2613, CVE-2006-2788, CVE-2006-4310, CVE-2006-4561, CVE-2006-6585, CVE-2006-6970, CVE-2006-6971, CVE-2007-0801, CVE-2007-0802, CVE-2007-1004, CVE-2007-1084, CVE-2007-1116, CVE-2007-1256, CVE-2007-1736, CVE-2007-1762, CVE-2007-1970, CVE-2007-2162, CVE-2007-2176, CVE-2007-2671, CVE-2007-3072, CVE-2007-3073, CVE-2007-3074, CVE-2007-3827, CVE-2007-4013, CVE-2007-4038, CVE-2007-4041, CVE-2007-4357, CVE-2007-5335, CVE-2007-5415, CVE-2007-5691, CVE-2007-5896, CVE-2007-6715, CVE-2008-0367, CVE-2008-2419, CVE-2008-2786, CVE-2008-3444, CVE-2008-4324, CVE-2008-4723

It may be that fixes are coming in the future, and they would be counted at that point. Even if so, it is going to play havoc with their next "at risk" chart (see Part 2 for more info), since only one of these issues has been publicly disclosed for less than 100 days and only five of them have been public less than a year.