mailing list archives
Re: what we REALLY learned from WMF
From: Niek <niek () asbak coding-slaves com>
Date: Fri, 06 Jan 2006 01:04:30 +0100
On 1/5/2006 11:07 PM +0100, James Lay wrote:
I didn't learn anything new...just confirmed what I've thought all
along...MS's Security sucks (who in their RIGHT MIND would have an
image file reader able to execute code???), and that the REAL hero's
are people in the security sector like here that created patches and
did the work that MS should have been able to do with their team of
people. I first started seeing things on wmf on December 29th on
sans.org. It took MS 8 DAYS to release this patch. Not acceptable in
MS appearantly had the patch read on 28 december 2005.
Suppose they released it 48 hours later, because the flaw is so serious.
Suppose everyone praises MS because they tackled it so quickly.
Suppose the MS patch breaks one of your applications.
Suppose I'd be reading your rant on this list a few days later,
on how MS sucks because they don't take the time to test things properly......
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
RE: what we REALLY learned from WMF Donald N Kenepp (Jan 06)
Re: what we REALLY learned from WMF Florian Weimer (Jan 06)