True or false?<p>Microsoft is a company that actively tries to prevent any comparisons of its products with other products, sometimes through threats of filing legal proceedings.<p>True or false?<p>Only government agencies are capabale of discovering flaws in Microsoft Windows.<p>True or false?<p>A closed source kernel is more secure than an open source kernel.<p>(For the avoidance of doubt, here "open source" means open to public inspection free of charges, terms or conditions, such as various UNIX-like kernels. It also means the right to make changes, re-compile and re-distribute without charges.)<p>True or false?<p>This determination can be made without comparing the source code for both kernels.<p>Hypothetical and questions:<p>Product A has 5000-6000 new vulnerabilities per year, about 15 per day.<p>Product B has 5-20 new vulnerabilities per year.<p>Can we explain this difference by focusing on the parties who find the problems that require patching?<p>Alternatively, should we focus instead on the products?<p>What if Product A is more complex is than Product B?<p>Does this make any difference?<p>What if Product B can perform many of the same functions as Product A, particularly the functions that are most often used to exploit a vulnerability.<p>For example handling data to be sent or recieved from the an untrustowrthy network such as the internet. In other words, networking with <i>remote</i> computers ("internet") as opposed to only networking with <i>local</i> computers ("IBM-compatible PC LAN").<p>Unlike BSD UNIX, Windows was originally designed for only local networking, where very little if any security is required.<p>True or false?<p>Windows still retains some of this original design and source code.<p>That is a trick question because the Windows source code is not open source. How would anyone verify what is still in that source code?<p>Keeping the source code from the eyes of its users does not protect them.<p>It may be possible to reverse engineer Microsoft products or patches to learn how Windows works.<p>"Good guys" may do this as well as "bad guys".<p>A vulnerability could be discovered by someone who is not even old enough to work for a government.<p>Repeat question:<p>Should we focus on who finds flaws in Windows or should we focus on the Windows product itself?