full-disclosure - what we REALLY learned from WMF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Jan  6 01:04:58 2006
From: niek at asbak.coding-slaves.com (Niek)
Subject: what we REALLY learned from WMF

On 1/5/2006 11:07 PM +0100, James Lay wrote:
> I didn't learn anything new...just confirmed what I've thought all
> along...MS's Security sucks (who in their RIGHT MIND would have an
> image file reader able to execute code???), and that the REAL hero's
> are people in the security sector like here that created patches and
> did the work that MS should have been able to do with their team of
> people. I first started seeing things on wmf on December 29th on
> sans.org.  It took MS 8 DAYS to release this patch.  Not acceptable in
> my book...
> 
> James

MS appearantly had the patch read on 28 december 2005.
Suppose they released it 48 hours later, because the flaw is so serious.
Suppose everyone praises MS because they tackled it so quickly.
Suppose the MS patch breaks one of your applications.
Suppose I'd be reading your rant on this list a few days later,
on how MS sucks because they don't take the time to test things properly......

Niek