full-disclosure - How to Report a Security VulnerabilitytoMicrosoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed Apr 13 03:24:58 2005
From: tuytumadre at att.net (tuytumadre@....net)
Subject: How to Report a
	Security	VulnerabilitytoMicrosoft

> mcbain@....com wrote: 
> 
> > But think about it, the testing scenarios that exist on planet earth can not 
> possibly be even accounted for let alone tested in Redmond. 
> 
> Point made; large install base requires more testing. 
> But like most things this does not apply to every patch/root-fix. It 
> seems they take their time on the simple fixs too most times. 
> 
> -- 
> dk 

Often times, the simplest of fixes tend to create the most complex architectural problems. Microsoft doesn't focus all their effort on pen-testing their patches, they spend their time mostly on ensuring that 3rd party software is not broken by their patches. That's why the simplest of fixes aren't as simple as they may seem. You only see the solution; Microsoft must dig through several solutions before they find the right one.

Paul
Greyhats Security
http://greyhatsecurity.org