[Full-disclosure] RE: what we REALLY learned from WMF

["Adrian Marsden" <amarsden@xxxxxxxxxx>]

Actually, what this whole situation proves is that a company with an installed 
base that figures in, what, the 90th percentile has an incredible amount of 
testing to do but that a talented individual can create a patch and issue it 
basically untested with the appropriate disclaimer quite rapidly.

In this instance the patch didn't fix the vulnerable code at the source and was 
truly a "patch". Had MS issued that patch immediately it seems to me that you 
would have criticised them for putting out a "half-assed" patch. Had they 
issued their actual patch untested and it broke a couple of percent of their 
user base's installs you probably would have castigated them for being 
irresponsible and not testing the patch.

What actually occured was that they, as is their policy, issued the best 
workaround they could, (unreg the .dll), and promised a patch by a certain 
date. They beat the schedule by what 25%, maybe 50% from the time they made the 
promise. In any performance evaluation one would have to conclude that MS 
performed "better than expected".

I would agree that not asking for improvement ever would lead to further 
mediocrity but at the same time, placing anyone in a no-win situation _all_ the 
time eventually leads to them losing interest. Giving credit where it is due 
isn't unfair in this situation and in the end you always get more with sugar 
than you do vinegar.


-----Original Message-----
From:   Gadi Evron [mailto:ge@xxxxxxxxxxxx]
Sent:   Thu 1/5/2006 7:12 PM
To:     Adrian Marsden
Cc:     bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx
Subject:        Re: what we REALLY learned from WMF

Adrian Marsden wrote:
> This is a silly post.... What are you trying to prove? That in some cases a 
> company can test a patch quicker than in others?
> 
> MS understood the issue, promised a fix on their scheduled date and did 
> better than expected.... So you criticise them....
> 
> Way to go.... Make it so they can never win.... then they won't bother... and 
> we all know who suffers then....

I may chose MS as an example that companies CAN do better. I believe 
this "fluke" gave us the perfect example of how security incidents 
should be handled.

Why should we now settle for less?

Naturally, each problem has its own issues and time demands. That 
doesn't change the fact of the matter.

        Gadi.



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/