Mr Lipner states that Microsoft has extensive software testing devoted to security issues, and that

because such testing is both boring and expensive it is not likely to be done well outside of the

commercial software development environment. Fine, I'm pleased to hear that Microsoft conducts

tests, but the question of whose code is more secure is still yet to be answered. The empirical

answer is found by simply comparing the incidence and severity of security flaws in Microsoft code

with that of other open alternatives. A casual following of the various security reports reveals a

large number of fairly basic flaws in Microsoft products, flaws that should have been caught in both

the design and security review phases. All software has bugs, but I do not think it is fair for

Microsoft to hold its model up as better than others when they stumble over the same pitfalls. It is

interesting to consider just how much Microsoft spends on such testing when the result is seldom

better than that of "free" software.

--Larry

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/191/5274#5274