full-disclosure - Web sites compromised by IIS attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: denis at dimick.net (Denis Dimick)
Subject: Web sites compromised by IIS attack

LMAO.. I see it now, your makeing a joke out of it..



On Wed, 30 Jun 2004, Frank Knobbe wrote:

> On Wed, 2004-06-30 at 22:05, Denis Dimick wrote:
> > They pretty much do. That is if the application is one that users have 
> > found worth supporting.
> 
> Exactly. The responsible parties are doing their job. Now contrast that
> with commercial software.
> 
> > So can I assume that you would allow a vendor to remotely patch your 
> > system? 
> 
> Not remotely, but...
> 
> > Like I said, Do you REALLY want a vendor to install patches for you?
> 
> Absolutely. Have them send a technician ON SITE. Have them STAY and fix
> the product until it is working. (Free of charge mind you... just like
> the free repair of a recalled water pump for your car). If applied
> patches crash the system further, it is the responsibility of that
> technician (representing the vendor) to get it back in working order.
> 
> If he can't do that.... well.. since he is there, you can hold him
> accountable in any way you see fit. :)
> 
> If we were able to mandate such a response, how long do you think it
> would take before out-of-the-box software quality improves suddenly?
> 
> > I think Frank that your starting to point out a problem for M$ and other 
> > vendors. They don't have the money to support there products any longer. 
> > M$ has somewhere like 20,000 payed programers, How many programers are 
> > working on open source products? 100,000 plus, maybe more. How do you 
> > expect a company like M$ to compete? I don't think they can.
> 
> There are a lot of healthy, smaller commercial software shops out there
> that produce usable (and often surprisingly good quality) code. They
> typically also have good support and decent business ethics.
> 
> Some larger vendors these days are more concerned with increasing their
> own wealth rather than producing good quality software. That's
> unfortunate. 
> 
> In case of Microsoft, I think that this company has grown to such
> proportions that it is starting to collapse on itself, much like the
> operating system they produce. If that is going to happen as quietly as
> a cheese soufle or as loud as a supernova remains to be seen (although
> it will be spectacular either way). The next 5-10 years will be
> interesting.
> 
> 
> Anyhow. my main gripe is the sale of broken products. I don't remember
> if that was NT4.0 or some other product, but the box came with the CD
> for the software, and a CD with patches. "Here, your purchase. It's
> broken. Fix it yourself while you install it."
> 
> Regards,
> Frank
> 
>