Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750

From: Jim Eshelman (newsgroups_at_aumha.org)
Date: 10/05/03 

Date: Sun, 5 Oct 2003 10:09:48 -0700

Me2 wrote:
> Jim, George,
>
> I don't get it! Are you advocating that if a new Trojan/virus/worm is
> starting to infect thousands of machines in a serious way that
> Microsoft should NOT notify its customers just because they don't
> have a fix yet!!! I don't get it - where is this coming from?

Pretty close, yes. It's coming from prudence. It's coming from not making
the world a more dangerous place.

If the lock is broken on your front door, you won't be able to fix it for a
couple of days, and someone burgles your house, you don't hang a sign on the
front door that says, "Warning, my lock is broken and burglars can get in."

One new Trojan using a particular exploit won't necessarily be the last.
Every new sentence Microsoft makes public is further information that is
more valuable to the exploiters than to the end users. I believe they
shouldn't say a bloody thing to the public until they are ready to deliver
the fix. It is well established that virus makers watch Microsoft's notices
of such things as a good source of information on what they can exploit.

What Microsoft *should* do, though -- and I believe they in fact do -- is
make the information immediately available to the major antivirus makers.
That's where the fix should come from. People should rely on teir antivirus
software, and not on news bytes from Microsoft, to stay protected from
viruses including Trojans. 

-- 
Jim Eshelman, MS-MVP Windows
http://aumha.org/
http://WinSupportCenter.com/
Did you find this newsgroup on the web? A newsreader like Outlook Express
will make your online life a lot easier. Get better help! See:
http://aumha.org/win4/supp1b.htm and
http://support.microsoft.com/support/news/howto/default.asp

Relevant Pages

  • Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750
    ... > have a fix yet!!! ... Every new sentence Microsoft makes public is further information that is ... make the information immediately available to the major antivirus makers. ... Jim Eshelman, MS-MVP Windows ...
    (microsoft.public.security.virus)
  • Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750
    ... > have a fix yet!!! ... Every new sentence Microsoft makes public is further information that is ... make the information immediately available to the major antivirus makers. ... Jim Eshelman, MS-MVP Windows ...
    (microsoft.public.security)
  • Re: [Full-disclosure] Office 0day
    ... more and continue consulting for microsoft rather than criminal networks. ... to fix the product if it is flawed. ... That is like me trying to argue that after going to a car mechanic, ... "Members of the jury, by keeping quiet about the bug and not shipping a patch, ...
    (Full-Disclosure)
  • Re: spooler not starting
    ... If it still fails to run then maybe the hotfix is ... in that case you will have to call Microsoft for the fix. ... Lexmark tech support to download and install the fix. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Microsoft, please, a solution for the STB!!!!!!!
    ... Your statements of impact will be where I push for a fix but I ... and have had no response from Microsoft or from anyone that might be ... MCE 2005 really is an excellent product so far and i would love to ... learn/repeat these codes? ...
    (microsoft.public.windows.mediacenter)
Quantcast