I'm afraid I disagree. Surely its better to disable by default, but leave it so that it can be turned on if necessary. People argue that windows needs to be shipped with services turned off, but not removed completely - a virus could turn these services on, but that isn't sufficient cause for removing them. It's a user preference, and if I want to be able to enter urls in user:pass@host format, then I should be given the option to do soSo obviously there are people out there that will have to scramble to get their things back working. After all, MS suddenly took it out... and, also expected, MS would have to provide a backdoor. We can just hope that a future fix will take it out for once and for all.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html