Portal de Periódicos da CAPES

Does OpenBSD and Firefox’s Security Improve With Time?

2022; IEEE Computer Society; Volume: 20; Issue: 4 Linguagem: Inglês

10.1109/tdsc.2022.3153325

2160-9209

Jian Shi, Deqing Zou, Shouhuai Xu, Xianjun Deng, Hai Jin,

Security and Verification in Computing

Ozment and Schechter (USENIX Security’2006) analyzed the evolution of OpenBSD vulnerabilities over the span of 7 years (1998-2005) and concluded that its security increases with age. In this paper, we extend their study by analyzing the evolution of OpenBSD vulnerabilities over the span of 22 years (1998-2020) and Firefox vulnerabilities over the span of 9 years (2011-2020). Our empirical study leads to a number of insights, including the following: both OpenBSD and Firefox get more secure (i.e., less vulnerable) with time, but today’s developers do not necessarily produce more secure code; OpenBSD and Firefox developers tend to make similar security mistakes, but Firefox vulnerabilities are easier to exploit; finally, Firefox’s vulnerability density is almost one order of magnitude higher than OpenBSD’s, meaning Firefox is more vulnerable.