Re:Critical vulnerability of NPM package macaddress
by f055 on Monday June 11, 2018 @02:24PM
(#17286933)
I think comparing is pointless. You are correct that a project with a small number of vulns is no more secure than the one with a high number of vulns. But counting seem sensible - if a project spills major vulns at a continuous rate it means two things: the overall codebase is not improving, and who knows how many more vulns there are. It's not something to be happy about.
[ Parent
| on HN ]
Re:Critical vulnerability of NPM package macaddress
by staticassertion on Monday June 11, 2018 @03:04PM
(#17287411)
I disagree for exactly the reasons I've stated - "more vulns" doesn't take impact into account. "More vulns" doesn't take who is reporting them into account (internal? paid pentester?). These things matter a lot.
Again, look at projects that pay for vulns. They have hundreds a year - this is a good thing. They come in at a continuous rate.
Counting is pointless.