Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: what we REALLY learned from WMF
From: Niek <niek () asbak coding-slaves com>
Date: Fri, 06 Jan 2006 01:04:30 +0100

On 1/5/2006 11:07 PM +0100, James Lay wrote:
I didn't learn anything new...just confirmed what I've thought all
along...MS's Security sucks (who in their RIGHT MIND would have an
image file reader able to execute code???), and that the REAL hero's
are people in the security sector like here that created patches and
did the work that MS should have been able to do with their team of
people. I first started seeing things on wmf on December 29th on
sans.org.  It took MS 8 DAYS to release this patch.  Not acceptable in
my book...


MS appearantly had the patch read on 28 december 2005.
Suppose they released it 48 hours later, because the flaw is so serious.
Suppose everyone praises MS because they tackled it so quickly.
Suppose the MS patch breaks one of your applications.
Suppose I'd be reading your rant on this list a few days later,
on how MS sucks because they don't take the time to test things properly......

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]