Re: [SC-L] Spot the bug

2005-07-21 Thread Dave Aronson
ljknews <[EMAIL PROTECTED]> wrote: > The overarching bug seems to be the assertion that there is only one > bug, since those offering comments found two right off. What did you expect from MS? > The less excusable of the two bugs appears at first glance to be an > out of bounds reference to

RE: [SC-L] Spot the bug

2005-07-21 Thread Michael Howard
>>In any case, I'm glad to see someone in MS has come out of the closet on this issue. Writing Secure Code 2nd Ed is chock full of Microsoft-specific defects!!! [19 Deadly Sins] http://books.mcgraw-hill.com/getbook.php?isbn=0072260858 [Writing Secure Code] http://www.microsoft.com/mspress/books/5

Re: [SC-L] Spot the bug

2005-07-21 Thread der Mouse
>>> http://msdn.microsoft.com/security/ >> Heh. They want us to do their code review for them? > Did you look at it? I looked at the referred-to blog. I didn't see any code, though I didn't do much webcrawling looking for any - perhaps I was too early, or perhaps I just missed the crucial link,

Re: [SC-L] Spot the bug

2005-07-21 Thread Dave Aronson
Christopher Canova <[EMAIL PROTECTED]> wrote: > It seems to me that they may be shifting from a > Deploy-first-ask-questions-later tactic to a > Code-it-right-before-its-out-the-door. They always did "code it right before it's out the door". It's just a question of where you put the comma.