full-disclosure - M$ - so what should they do?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200406212246.i5LMkN7m006831@pop-7.dnv.wideopenwest.com>
From: mvp at joeware.net (joe)
Subject: M$ - so what should they do?

Absolutely, I posted that same message in a MS specific listserv today. My
comments were along the lines of treat it like a purchased app and set up a
new team to rebuild the app from the ground up, all new code. That way all
of the hidden nuggets waiting to bite people are gone and you can say from
the ground up security is considered. Anything built on old legacy code can
always be questioned as unsafe given the number of old issues that keep
popping up even now.

  joe

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Ron DuFresne
Sent: Monday, June 21, 2004 5:07 PM
To: joe
Cc: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] M$ - so what should they do?

	[SNIP}

>
> The second one, I concur completely, get the App stuff out of the 
> Windows folders.
>

Which includes IE.

Thanks,

Ron DuFresne