full-disclosure - Bill Gates blames the victim

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <86bru1ve07.fsf@blade-runner.mit.edu>
From: petr at blade-runner.mit.edu (Petr Swedock)
Subject: Bill Gates blames the victim

"Robert Ahnemann" <rahnemann@...inity-mortgage.com> writes:

;; >> "Don't trust our software. But do trust our patching/update 
;; >> process..."
;; >
;; >Don't trust software but trust our software patches...
;; >
;; >We can continue the sentence by adding that the special effort is 
;; >needed because new bugs are generated by these patches.
;; 
;; Let's relate this to real life (flame that line if you want).  Your car
;; has a defect that causes the oil pan to leak.  Ford (I drive one, I can
;; talk) issues a recall saying they know about the leak and are offering
;; you a free fix, if you would just take the time to take the car to the
;; shop.  You decide that you know better and that you would rather not
;; invest the time.  You engine is lying on the ground three weeks later.
;; Whose fault is it?  They told you it was a problem.  You neglected to
;; address it.  I can tell you who will be paying for the engine.   Today's
;; society is about dissolving accountability.  I'm all for changing this
;; around.

Please don't lecture any-one here about accountability.  I'm guessing
we're all on the "front lines" of response and accountability in
computer use, else we wouldn't be here...

Your analogy is facile. The issue isn't one of timely fixes. It's 
an issue of the repeated need to fix even in the face of assurances
to the contrary.  In addition it's the singular nature of the fix.
If your car leaks you have the option to take it to the dealer or
say "send me the part, I'll fix it."  You also have the option to
replace the engine.

For instance, MS03-034 was just released.  It purports to 'fix' a
problem with NetBIOS.  The patch forced me to update and required
a reboot.  It never once asked if I wanted to disable NetBIOS and
simply not use it...

Peace,

Petr