Re: what we REALLY learned from WMF

[Niek <niek () asbak coding-slaves com>]

On 1/5/2006 11:07 PM +0100, James Lay wrote:
> I didn't learn anything new...just confirmed what I've thought all
> along...MS's Security sucks (who in their RIGHT MIND would have an
> image file reader able to execute code???), and that the REAL hero's
> are people in the security sector like here that created patches and
> did the work that MS should have been able to do with their team of
> people. I first started seeing things on wmf on December 29th on
> sans.org.  It took MS 8 DAYS to release this patch.  Not acceptable in
> my book...
>
> James

MS appearantly had the patch read on 28 december 2005.
Suppose they released it 48 hours later, because the flaw is so serious.
Suppose everyone praises MS because they tackled it so quickly.
Suppose the MS patch breaks one of your applications.
Suppose I'd be reading your rant on this list a few days later,
on how MS sucks because they don't take the time to test things properly......

Niek
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/