Re: Office 10 applications & flashdrives can be used to browse

[Paul]

In-Reply-To: <066F402A7185F04E8B7506F582E00E895E4C4C@mcg-ex02.mcgov.org>

>VENDOR RESPONSE
>This issue was reported to Microsoft on Feb 11, 2005, acknowledged by
>support, and as of today our best efforts to get a hotfix (or even a
>commitment to produce a hotfix at some later date) have been fruitless.

You believe that Microsoft should release a hotfix for this vulnerability, although a service pack allegedly fixes it. This does not make sense to me and only seems like an attempt by you to bash Microsoft and make yourself look "powerful". Service packs
are released to fix large quantities of vulnerabilities such as this one and releasing hotfixes for each individual vulnerability fixed by a service pack would require large sums of money and time. Seriously, people, cut Microsoft some slack. They're doin
g the best they can.

Paul
http://greyhatsecurity.org

[Jay D. Dyson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 25 Feb 2005, Paul wrote:

> Seriously, people, cut Microsoft some slack. They're doing the best they
> can.

Considering that Microsoft is a multi-billion dollar corporation,
I cannot agree that it deserves any slack. If Microsoft can afford to
sell software that leaves its customers at risk, it can afford to issue
hotfixes to remedy the problems that it created. And I don't buy into the
"get the Service Pack" argument after having dealt with the ridiculously
FUBAR'd mess called SP2 for XP that went down last year.

Bottom line: Microsoft customers are paying gourmet prices for
Redmond's products and are getting McDonald's quality for security.

- -Jay

( ( _______
)) )) .-"There's always time for a good cup of coffee"-. >====<--.
C|~~|C|~~| (>----- Jay D. Dyson -- jdyson@treachery.net -----<) | = |-'
`--' `--' `-I just started World War III. You're welcome.-' `------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iD8DBQFCILLlBYoRACwSF0cRAmorAJwNfCme2RBnV6rrqGqTjH MH/2friwCeMZjH
OtuTdoBHOvXjZSg0kSOfHKE=
=ENFp
-----END PGP SIGNATURE-----

[Jay D. Dyson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 26 Feb 2005, Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:

> Go back and read the original post.

Why? I'm not even replying to the original post. I couldn't give
a good rip about the original post.

> "VENDOR RESPONSE

First mistake. I take every vendor response with a grain of salt
since it's always run through their PR department and their corporate
lawyers before we ever get treated to the watered-down (and usually
fact-free) missive that they design to toss at us like so many table
scraps. Those of us who have been around long enough will starkly recall
the "vendor response" that Ford Motor Company had when its Pintos
developed a penchant for exploding when rear-ended. Nufsed.

> Whether or not you want to cut Microsoft some slack... there's a process
> of ethical and responsible disclosure that I would expect Sonny as a
> representative of a governmental agency would understand. He not only
> put his own government computers at risk but others in this disclosure,
> yes?

In my book, Microsoft is the entity that put those systems at risk
with their shoddy malware. Sonny only showed that the flaw existed. I'll
leave it to the philosophy majors to debate the ethics of the issue.
Personally, I believe in full disclosure. And considering that Microsoft
has (for want of a better expression) money coming out of its butt, I
should think they'd be able to spend that money in a fashion that would
put security first...and quick.

And I'm glad your SP2 implementation went well. I had to deal
with VPNs when SP2 rolled out. If you'd had to, your outlook on that
service pack would be decidely less than cheery.

- -Jay

( ( _______
)) )) .-"There's always time for a good cup of coffee"-. >====<--.
C|~~|C|~~| (>----- Jay D. Dyson -- jdyson@treachery.net -----<) | = |-'
`--' `--' `-I just started World War III. You're welcome.-' `------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iD8DBQFCIOr5BYoRACwSF0cRAhtNAJ0VuDDs2yPVS722o67lIs/JgEyX9wCeIfi9
uJ/xN56JliAYBfIrVorn2P4=
=Mg87
-----END PGP SIGNATURE-----