Niek wrote: > MS appearantly had the patch read on 28 december 2005. > Suppose they released it 48 hours later, because the flaw is so serious. > Suppose everyone praises MS because they tackled it so quickly. > Suppose the MS patch breaks one of your applications. > Suppose I'd be reading your rant on this list a few days later, > on how MS sucks because they don't take the time to test things properly......
_In this case_ I'd say: Good on Microsoft for actually living up to the so far mainly BS but supposedly official 'security must take precedence over features' company line for several years. and to the hapless -- no, gormless -- developers of whatever third- party app(s) were broken I'd say: Serves you right for using a clearly insecure API, and why are you whining that your customers prefer security to some ill-conceived, security-lowering feature? Retorts along the line: But MS recommended we do it that way. would leave one hoping that their few remaining customers now desert them with all haste as they clearly don't give a rat's a*se about their customers' security so don't deserve to have any customers. Tough? Yes, but not as unacceptable as _expecting_ your customers to badly compromise their security for your convenience. Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
