“That alone is proof that SDL does in fact work.”

That is a gross misunderstanding of either 1) proof; 2) SDL; or 3) fact. At best, it may provide some information that seems to support your hypothesis, but that is it.

Here’s a simple alternative notion – if the amount of external bugfinding effort on Microsoft products has been reduced to 1/10th the effort involved prior to SDL, then it will take 10 times as long to find bugs and the software would have the same level of vulnerability.

Name one remote system vulnerability found in the last 12 months in a Microsoft operating system. That alone is proof that SDL does in fact work. When I say work, I do not mean it is the silver bullet solution but it does improve the security of code.

So this has nothing to do with making me feel good because there are still many improvements that can be made and obviously any process like SDL is only as good as those following it.

_ryan

That’s just it, that paragraph *is* his evidence. Which demonstrates my point that this whole issue is about faith and not evidence.

Yeah, couldn’t resist the fanboy comment..

Pete

Let me rephrase, by your logic you didn’t prove that he is a fan boy therefore you have some sort of vendetta against HellnBak.