It seems like there's a new XSA every month. Amazon have rolling EC2 blackouts whenever they have to update Xen for a critical security issue. Linode moved from Xen to KVM partially for the security benefits.

But, i don't know of any XSA-alike reporting system for KVM. Maybe KVM just gets less security attention since it's not yet the #1 market player. Certainly many qemu vulnerabilities impact both Xen and KVM.

My question is:

Does Xen's greater rate of disclosed vulnerabilities indicate less secure code than KVM, or, does it only indicate greater scrutiny?

closed as primarily opinion-based by techraf, S.L. Barth - Reinstate Monica, Xander, Matthew, WhiteWinterWolf Aug 27 '16 at 8:52

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    The answer to this would be too opinion based. Both ofthe two opinions you have put forth are valid. All I can say is secure coding is an ideal scenario. Better scrutiny would means well matured code over a period of time. – feral_fenrir Aug 26 '16 at 9:19