full-disclosure - Re: Re: GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040218175301.GN19903@uriel.eclipsed.net>
From: gr at eclipsed.net (gabriel rosenkoetter)
Subject: Re: Re: GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

On Wed, Feb 18, 2004 at 09:12:59AM -0800, Tim wrote:
> Say you are an engineer at a large car manufacturing company.  Suppose,
> 6 months after the 2004 model of your sedan goes out the door, you
> discover, as an engineer who helped build it, that the car's frame is
> flawed.  Suppose that it is so flawed that after 3 years, it may break
> due to normal use, potentially causing bad crashes.

You are under several misperceptions.

The first is that this IE bug is life-threatening. It's not.

The second is that IE cost the users' money. It didn't.

> Is it your moral obligation to notify customers?  Sure you are going to
> fix it in next year's model, that is a given.  But what about all those
> people with a potentially deadly model?

It's not my moral responsibility to list every single component
that's wrong if I recall the vehicle. Microsoft has, several times
now, recalled the vehicle and replaced it for free.

Where's the problem?

> Obviously, this is not the auto industry.  Some will argue that we are
> not talking about life-and-death situations here.  But the reality is,
> we are.  Software bugs can cause death, and have before, both on the
> small scale, and the large scale.

This is outrageous FUD. Web browsers are not used in medical
appliances.

-- 
gabriel rosenkoetter
gr@...ipsed.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 186 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040218/869a39ba/attachment.bin