Microsoft recently conducted a study which found that Microsoft’s Internet Explorer is more secure than Mozilla’s Firefox.
This is not surprising because I wouldn’t expect Microsoft to (a) be objective or (b) conduct the study in a meaningful way. Conducting a meaningful survey or evaluation of anything is deceptively difficult and depends greatly on choosing meaningful metrics – evaluating application security is no exception.
The metric that Microsoft chose was counting how many bugs were fixed by each company. This is awesome for three reasons. First, it assumes that all software bugs relate to security flaws. Second, it assumes bug tracking at one organization is done in the same way as bug tracking at another. Third, it assumes that both companies are equally committed to fixing bugs. Based on the fact that there are still bugs in Windows XP that existed in Windows 2000, I’m going to guess that Microsoft doesn’t bother too much with fixing bugs. They just call them “features” and move on (and the users should, too).
I didn’t read the whole report, but it appears Microsoft concluded that since Mozilla fixed more bugs than Microsoft in 2004, Microsoft’s browser must be more secure. As Mozilla’s Mike Shaver said, “Just because dentists fix more teeth in America doesn’t mean we have worse teeth than Africa.”
This is inspiring me to adopt the following software development philosophy: I will never fix another bug, thus making all my software 100% secure.










