Re: [Ethereal-dev] Coverity Open Source Defect Scan of Ethereal

[Guy Harris <gharris@xxxxxxxxx>]

Andreas Sikkema wrote:
> > BTW, we have a lower defect rate than most of the projects on the list
> > including Apache, Firefox, FreeBSD, gcc, Gnome, Linux 2.6, OpenSSL,
> > Perl, and Python.  Of the projects > 1M lines of code, we have the
> > lowest defect rate by far.  Heh.
>
> As mentioned on lwn.net http://lwn.net/Articles/174426/:
>
> "On the other hand, ethereal shows a very low defect rate, which can be 
> hard to square with the long list of security advisories from that
> project."

If we stopped issuing security advisories, we could make it easier to 
understand those results. :-)

I.e., as Gerald noted, that might be a disadvantage of being somewhat 
vigorous about finding problems with, for example, the fuzz testing.