[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: why do iceweasel et al have more frequent security issues?



we're getting off track of my original point and rather than continue
this festival of delights ;) I am going restate my original statement
and attempt to demonstrate one more time what I meant originally. And
then I'll be done. I'm sure you will either accept what I've said or
counter it, but either way, I'll leave it at that. If we end up
disagreeing, so be it, I'll agree to that ;). Fair enough?


Your original statement with which I take issue:

>>>> On Thu, Jul 26, 2007 at 10:52:07PM +0200, Erik Persson wrote:
>>>>> Anyhow, the basic fact that there is fewer security alerts in Konq 
>>>>> makes this a more secure browser, whether this maybe is because only of 
>>>>> a smaller user base or not.

this statement is very clear: 

assume: the browser with greater # sec. holes is less secure which I
think we all generally accept.

  statement: #konq-sec-alerts < #ff-sec-alerts therefore #konq-sec-holes < #ff-sec-holes

Your original statement does not say "likely" to be more secure or
"should" be more secure or any other measured statement. You have
asserted this as a certainty. This is akin to stating:

  statement: #bass-caught < #trout-caught therefore #bass < #trout

this is clearly not necessarily true. It _might_ be true. It is even
highly likely to be true. And if the sample size is large enough we
could even say that it has a vanishingly small chance of _not_ being
true. But, based on the information we have, it cannot be proven one way or the
other. If we were to drain the lake and count all the fish, we could
know whether this was true. Likewise, if we were omniscient and could
count _all_ the security flaws in a browser, we would know whether this
is true. But we can't do that. We can only make assumptions, or
statements as to what is likely. We can go so far as to apply numbers
to the likely-hood. This statement of certainty you have made is not logical. 

That really was my only point. In subsequent mails, you have changed
your statement to use words like "might" or "should" or "likely". All
of these things I generally agree with. 

If you had originally said something like:

Anyhow, the basic fact that there is fewer security alerts in konq
{makes it likely to be a more secure browser,makes it reasonable to assume its
more secure,implies that its more secure}... 

Then I would have never replied to the message at all, because I would
agree. But you said the lower number of reported security flaws makes
it a more secure browser with no conditions. Its really a petty and
pedantic point on my part and was probably better left unsaid, but
there it is. 

Everything else i have said was based on the idea of pointing out that
what you said in the original statement, stated by you as a
"certainty", is not necessarily the case. My woefully bad car analogy
and contructed konq v. ff security holes example were only intended to
point out how your statement of certainty was not valid. The implied
assumption, which is what I think you were intending to state, is
perfectly valid. It is not however, as I've pointed out, the only
possible scenario, which is what your original statement claimed.

that is all. my best regards

A

Attachment: signature.asc
Description: Digital signature


Reply to: