Re: IE vulnerabilities...

From: Imhotep (NoSpam_at_nothanks.net)
Date: 05/18/05


Date: Wed, 18 May 2005 08:49:43 -0700

Karl Levinson, mvp wrote:

>
> "Imhotep" <NoSpam@nothanks.net> wrote in message
> news:pbzie.22955$aB.19726@lakeread03...
>
>> > "Jack" </dev/null> wrote in message
>> > news:8F5D5F27-8307-408C-9CA1-9FEB1574B498@microsoft.com...
>> >
>> >> Unfortunately, Microsoft is wasting a lot of time and money for no
>> >> good reason. Once again it is not alone but is most noticable for its
>> >> size
> and
>> > its
>> >> bragging. It seems as though the employees are pretending to work to
> rip
>> > the
>> >> company off. The language support could of
>> >> been fixed years ago with an i18n implementation, which is another
>> >> sign of wasting time and money. It seems as though more time is spent
>> >> on marketing and excuses than developing software and fixing bugs.
>
>> year! Second, what does this have to do with the original post? The
>> original post was to notify people that there are, at least, two new
>> critical security flaws in IE and that they are not going to be fixed
> soon.
>> What does that have to do with Mozilla or anyone else???
>
> The link you posted, and the message that you see "Jack" posted above,
> were not just discussing Microsoft vulnerabilities, but were tiredly
> claiming the
> superiority of open source software's security. If you only wanted to
> discuss the MS vulnerability, you could have posted the link to the
> original eEye article and not a blog entry on how MS security stinks in
> comparison. I am responding directly to the content of the link you
> posted, and to the
> post that Jack posted. I'm not the one bringing open source comparisons
> into this discussion.

First, that was the article that I first found the information. Why should I
not post it? Information is just information. Why are you being so
sensitive? It seems that you are an anti-open source/gnu person. That would
seems to explain your comments.

>> You are trying to make this "a rehashing of an old argument" I am simply
>> passing on a warning to people to protect themselves...
>
>> Again, that FACT has nothing to do with any other browser...this post is
> not
>> about a comparison, it is about a warning that these flaws are not going
> to
>> be fixed soon.
>
> One of the three sentences in the slashdot link you posted states "news
> sources are reporting that in comparison with the Mozilla Foundation's
> prompt fix for the recently reported Mozilla 1.0.3 vulnerabilities MS
> appear to be leaving a large window for the possible malicious
> exploitation of
> these flaws." I'm not allowed to respond to your post?

Sure, please respond and comment. I welcome it. However, you seemed to take
their message personally. Like it some who insulted you. First, you have to
be honest with me and yourself. They are accurate in their statement.
Mozilla/firefox did put a high priority on their security holes by fixing
it very fast. I was shocked to learn that MS was not doing the same. So,
fair is fair: the article is honest and accurate.

>> I am passing on
>> information so people can, hopefully, protect themselves. You are wasting
>> everyone's time by trying to bait me into a "browser flame war". I could
>> care less...
>>
>> Don't know what your motives are and frankly don't care...
>
> Maybe your newsreader screwed up the chronological display of this thread
> somehow, but none of what I posted above was directed at you, but at Jack.
> Unless you're Jack. As I clearly said, I appreciate your posting the link
> and have no problem with the share of information, at least some of which
> is
> undoubtedly based in fact.

I believe all of it and it is fact...1) Mozilla, like it or not, did fix
their security issues very quickly 2) MS is not to...

What else from the article do you want to debate?

Honestly, not matter which "side" you are on, I do not see any lying in the
article if you do, please point it out.

> I never saw you arguing here that "open source
> is better than Microsoft," so I never made any assumptions one way or the
> other about what your opinions are on this.

I am pretty neutral, although I will say one thing. My degree is in Software
Engineering. I started out doing just that. However, after a couple of
years it really depressed me. Companies were pushing deadlines instead of
quality. "Slap the code together we will fix it in a patch later" was the
battle cry. After a while this got so bad I left business and now work in
IT Security. About a month ago, a friend got me into programming on "open
source" projects and I will tell you this honestly, they approach software
design like it was supposed to be. They discuss the solutions, they map out
and document the design. No code is pushed before it is ready. To my shock
and surprise Open source programming is much more "professional" then
"closed source" programming. Much more...again, like it or not, I am being
honest...I now love programming and software design again and actually miss
it...

-Im



Relevant Pages

  • RE: Career Choice
    ... Almost all PD and SO's have volunteer programs. ... now finishing up my Bachlers degree in Network Security. ... > you how much programming experience helps. ... My current studies have only one programming language course ...
    (Security-Basics)
  • Re: Forget the security industry!
    ... basic principles of programming are present in all languages. ... <can infect uninfected ones, it is essential that the internet ... that is MS and the rest of the security and software business ... a safe manner. ...
    (comp.security.firewalls)
  • Re: (IE/SCOB) Switching Software Because of Bugs: Some Facts About Software and Security bugs
    ... arrogance regarding security have influenced the ... In this situation, bugs can be patched without fuss, and simple ... There are no secrets in Mozilla. ... to avoid using Internet Explorer until Microsoft patches ...
    (Bugtraq)
  • Re: Snoop-proof DSP: possible?
    ... Is it possible to fabricate a custom DSP ... It is possible to make a custom or semi-custom chip, ... experts here think of the security in the Altera MAX-3000 CPLD. ... out the programming code. ...
    (comp.dsp)
  • Re: Honeypot stats
    ... >> security problems, then the OS wasn't very secure in the first place". ... the same one upon routine exit. ... and/or recover from this but without this kind of defensive programming you ...
    (comp.os.vms)