Nor will you with Windows. Look at the 47 bulletins for this year and you'll find things like Messenger, Internet Explorer, Outlook, Access, Content Management Server, ISA Server, etc., etc., none of which are part of the OS, despite MS's bs claims in court.
Among those advisories you mention on the Linux sites, I see subjects including tomcat4, openssl, freesweep, marbles, gopher, sendmail, mah-jong, wu-ftpd, exim, perl, phpgroupware, mutt, qpopper, squirrelmail. And many more that are similar in that they've no relationship with the OS save being shipped with it. Hardly *just* the Linux OS. Some of those packages mentioned on the Debian site were begun long before there _was_ such a thing as Linux.
Even if you classify things like XFRee86 and Samba as being part of the OS for purposes of comparing with Windows, which features much tighter coupling between the OS and some of its services than do the UNIX-like OSs, I believe you're going to be hard-pressed to come up with 47 advisories against the OS. Or anything remotely near that number.
But *none* of this childish tit for tat is the point. The point is that lots of software has significant, security related bugs, and the way software is taught and done obviously needs to change. It's evident to an impartial observer that buffer overflows are a problem in almost *everyone's* software. So something is wrong with the way software is "done", *not* with the end result, which is OSes and applications.
I've read here that it's not possible to write software that doesn't have flaws because programmers are human. I think that's a crutch that allows us to accept less than the best. There was an article in Fortune, back in March of this year, that refutes that. I'll give you the URL, but you'd have to pay to read it. <http://www.fortune.com/fortune/imt/0,15704,427288,00.html>
The bottom line is that there is a company in Canada, QNX Software Systems, that writes an OS that simply does not fail and does not have bugs in it. Their website is here if you want to take a look:
<http://www.qnx.com/>. Their software powers cars and laser surgery devices and it simply *cannot* fail, and so they make sure that it doesn't by doing it right the first time.
Do you really believe it matters what the exact numbers are?Let's compare apples to apples, so to speak, if we're going to invest the effort in the first place, into making silly comparisons.
Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html