stupid security audit approach   (link)

http://www.securityfocus.com/columnists/299
More and more, we see articles questioning the security of a given platform based solely on the number of advisories published -- and this approach is simply wrong.

The quality of the software in question directly affects the number of advisories -- this should go without saying. Software with fewer security flaws will generate fewer security advisories. In a simple world, the number of advisories published by a given entity might be a direct indication of how secure that software is. But the reality of software and operating systems today is far more complex; many other factors affect the number of security advisories, which can be lumped into three broad categories: scope, policy of publication, and audit efforts. Let's look at each of these briefly.