full-disclosure - Reuters: Microsoft to give holes info to Uncle Sam first - responsible vendor notification may not be a good idea any more...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <42360305.4090603@sdf.lonestar.org>
From: bkfsec at sdf.lonestar.org (bkfsec)
Subject: Reuters: Microsoft to give holes info to Uncle
	Sam first - responsible vendor notification may not be a
	good	idea	any more...

Niek wrote:

>
> What I don't get is, if a patch is fit to be used by U.S government,
> why wouldn't it be for all other Microsoft users ?
>
> Is Microsoft using the U.S. government as test bunnies for their 
> patches ?
> If that's not the case, then why wait up to a month to supply them to
> the general public ?
>
>
Just a guess, but the presumption would be that the US Government has 
more regulatory restrictions placed on their systems than the average 
person does and, as such, the US Government will be able to better 
manage patch distribution and testing. 

The same *should* work for other large organizations as well, assuming 
that they are even remotely managed environments.

                -Barry