Researcher "fads," differences in vendor disclosure practices, and vulnerability database editorial policies will heavily influence vulnerability statistics, to the point where comparing them is not very informative (at least, you're not getting the whole picture). You also have the challenge of defining equivalent platforms to compare against each other. However, there is one area where you can really compare 2 products to each other: implementation of standards. These standards could be protocol-based, file-based (e.g. image formats), or scheme-based (such as authentication or crypto schemes). It would be great to see some more focused efforts that are based on standards that are implemented in a cross-OS fashion. This would allow the community to harness the power of fuzzing and suite-testing in a narrow fashion. We would only get narrow answers, of course - "these kinds of implementation bugs were looked for and found on these kinds of products" - but it would be much more manageable and measurable, and above all, we would be comparing apples to apples. If someone is interested in pursuing this further, you could probably start with past data from PROTOS and other past fuzzing/suite-testing results. - Steve
