full-disclosure - Re: Perhaps it's time to regulate Microsoft as Critical Infrastructure?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <18375.1264457476@localhost>
Date: Mon, 25 Jan 2010 17:11:16 -0500
From: Valdis.Kletnieks@...edu
To: rafael@....com.br
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Perhaps it's time to regulate Microsoft as
	Critical Infrastructure?

On Mon, 25 Jan 2010 20:03:03 -0200, Rafael Moraes said:
> This is a subject that need to be discussed very carefully. I agree, It
> should be "controlled", but, how far?

In particular, one must be *very* careful to not create unintended
consequences. For instance, in general the more regulated an industry is, the
more risk-adverse the companies get - both because regulation implies "don't
rock the boat" and the second-order effects of compliance paperwork and similar
issues.  Look at the mountains of paperwork needed to get the FAA to
type-certify a new airplane as airworthy - what if Microsoft had to do that
level of detail for Windows 8, the next release of Exchange, and the next
release of Office?

How do you make Microsoft "regulated" in any meaningful sense, and still allow
them the ability to ship an out-of-cycle patch?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/