[Windows Phone 7 General] addicus:
Interested in seeing what code was actually tested, I signed up and got the PDF from the people testing. These results are great. Still the industry standard you speak of isn't all inclusive. This is the industry standard for OPEN SOURCE operating systems. Here it is in the documentation:

"Coverity Software Integrity Report Results for the

Android Kernel

We take advantage of all of the traits mentioned in the previous section with the introduction of the Coverity Software

Integrity Report (Integrity Report) for the Android Kernel. This report, which will be used to share results from other

open source projects, can be used as a kind of “thermometer” for software.

The Coverity Software Integrity Report for the Android Kernel is based upon our analysis of the Android kernel 2.6.32

(“Froyo”). The analyzed kernel is targeted for smartphones based on the Qualcomm MSM7xxx/QSD8x50 chipset,

specifically the HTC Droid Incredible. In addition to the standard kernel, this version includes support for (among others)

wireless, touchscreen, and camera drivers.

The kernel source was obtained from the HTC Developer Center7. Since the HTC-provided source does not include a Linux

.config file, we obtained this from a third party. Note that because we analyzed a configuration meant for a specific phone,

the code we analyzed includes device drivers and other software that are specific to this configuration of the Android kernel

and might not apply to other Android devices.

Our main conclusions about this version of the Android kernel are:

• The Android kernel used in the HTC Droid Incredible has approximately half the defects that would be

expected for average software of the same size. This qualifies the code for Integrity Level 1. (Integrity levels are

described later in this report.) Because Android is based on Linux, most of the code is identical to a Linux kernel

• We found the Android-specific code that differs from the Linux kernel had about twice the defect density of the

core Linux kernel components. The Android-specific code also had the most high-risk defects of any component.

In a way, this result is not surprising. The Android-specific components and drivers are more likely to be recently

written code, and newer code will tend to have higher defect density even if it is tested rigorously. Moreover, the

core Linux kernel has had years of static analysis performed on it, so many defects from the past have already

been resolved.

• The Android kernel has better than industry average defect density (one defect for every 1,000 lines of code).

However the report discovered 359 defects that are believed to be in the shipping version of the HTC Droid

Incredible. We believe the defects we found are a sample of what could be shipping in many OEMs devices and

products that leverage the Android platform.

• We found 88 high-risk defects in Android. 25% of the Android defects discovered, including memory corruptions,

memory illegal accesses, and resource leaks, are considered high-risk with significant potential to cause security

vulnerabilities, data loss, or quality problems such as system crashes. These are traditionally defect types that many

of our customers fix and eliminate completely prior to shipping a product.

7 http://member.america.htc.com/downl...inaries/incrediblec-2.6.32.15-gb7b01d1.tar.gz

COVERITY SCAN: 2010 OPEN SOURCE INTEGRITY REPORT

11

• Accountability for Android software integrity is fragmented. The problem is no different with Android than what

we see across open source. Android is based on Linux, which has thousands of contributors. Compound that with

the Android developers from Google, the contributors to Android from the larger development community, and

OEMs that supply components for specific configurations of Android to support different types of devices and the

lines of accountability are quickly blurred. It is not clear who is ultimately accountable, but it is apparent that a new

level of visibility is needed to provide the OEMs that incorporate Android in their software supply chain with an

objective measurement of Android software integrity."

Also you gave an incomplete/incorrect quote on the results of Android from the Information Weekly article (http://www.informationweek.com/news...icle.jhtml?articleID=228100092&itc=ref-true):. What is says is:

"An analysis of the Android kernel on an HTC Droid Incredible reveals about half as many software defects as expected, according to a report released by software security firm Coverity on Monday.

The Android kernel was found to have 0.47 defects per thousand lines of code, compared to an average of 1 defect per thousand lines of code.

Optimize your Exchange 2010 Deployment

Dell EqualLogic PS4000XV SAN vs. The Competition - Virtualized Exchange Performance

But if Android is twice as good as the industry average, it's half as good as the Linux kernel in terms of defect density. The Android operating system is based upon Linux.

Coverity says this is to be expected given that Android-specific components have been written more recently and newer code tends to have a higher defect density than code that has endured years of static analysis, like the Linux kernel."

This shows that as an open source OS Android is by far the best Linux based/open source OS for the mobile market currently, but defect density is expected to continue as the use of the OS grows. The testing company went as far to even mention fragmentation as an issue, which we old school WM users have long insisted since we've been there and done that.

Here is the pdf for anyone wanting to read all the results of the test.

http://hulkshare.com/2ti25x8kjwy4