full-disclosure - Re: 6 Month Vista Vuln Report, Debunked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 26 Jun 2007 08:59:13 -0700
From: "Security Admin (NetSec)" <secadmin@...secdesign.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"dailydave@...ts.immunitysec.com" <dailydave@...ts.immunitysec.com>
Subject: Re: 6 Month Vista Vuln Report, Debunked

so far I have seen the same items patched in Vista as for XP SP2 and 2003 SP1/SP2. If this trend continues the rationale for Vista upgrade will disappear. I for one am recommending user's wait until at least Vista SP1 is released; however if the same exploits work on all platforms might make more sense to wait until 2009-10 for next client OS release. Even Dell is selling XP again.  One should count the number of reboots necessary;  only kernel updates require a reboot in Linux.

This is not any Microsoft bash, but it is disturbing that despite the TCI so many vulnerabilities that are common to current OS releases and previous releases have been found--not just in Vista. One would think that TCI would result in developers and engineers discovering previously undiscovered bugs. I fear that Microsoft still may rely too much on testing as opposed to engineering analysis. QA studies with which I am acquainted show that 60 percent or more of bugs discovered before general availability releases are discovered through engineering analysis, not testing.

Edward Ray

-- 
This mail was scanned by BitDefender
For more informations please visit http://www.bitdefender.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/