Why Counting Flaws is Flawed
Summary: Krebs on Security argues that annual vulnerability-count reports, such as Bit9's 2010 "Dirty Dozen" list, measure a multi-faceted problem from a single dimension and offer little insight into overall product quality. The post notes that Bit9 ranked Google Chrome first with 76 reported flaws in the first 10 months of the year, while Krebs contends Adobe deserves the top spots given repeated windows of attack, including a Reader and Acrobat flaw announced Dec. 15, 2009 that went unpatched until Jan. 7.
Why it matters: Krebs cites his own 2006 comparison finding exploit code for known, unpatched critical flaws in pre-IE7 Internet Explorer was publicly available for 284 days of the year, versus a single nine-day window for Firefox - the kind of exposure measure a raw flaw count never surfaces.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026