Full Disclosure: Re: Microsoft's new warning about the old SQL server/MSDE problem

[Blue Boar <BlueBoar () thievco com>]

Richard M. Smith wrote:
> A friend of mine just received the attached email from Microsoft
> advising him to patch his copy of MSDE.  Talk about closing the barn
> door after the cows have already escaped......
Not neccessarily... when did he download the eval software?  If it was 
after the worm came out, and he doesn't patch, he will still be vulnerable 
and get infected.  MS has no way of knowing who has enough clue to know 
they need a patch for a piece of software they got 5 minutes ago.
You can maybe blame MS for making unpatched software available for general 
download.  They can't do a lot about the CDs out there.
I for one would really like to see patches that also patch an installer 
image, so that when I install a piece of software on day x, it's current as 
of day x.  As it is now, if I install some version of Windows, I have to 
patch it with a long list of fixes.  If it's an older version of Windows, I 
also have to apply all the same patches again when I make a configuration 
change that causes a "new" feature to be installed.
Or maybe it's time to go forward with the dead man's switch for OSes.

                                                BB

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html