News Unpatched Windows flaw sparks concern

http://www.bit-tech.net/news/bits/2009/09/10/unpatched-windows-flaw-sparks-concern/1

An as-yet unpatched flaw in Windows Vista and the RC versions of Windows 7 and Windows Server 2008 have system administrators worried.

 

*smugly smiles at the Netlimiter icon*

 

so why worry?

 

basicly it affects anyone that runs IIS going to be haveing fun

 

Doesn't routers already block all ports by default.
So it only concern internal attacks under environment that sees IIS. I believe that Microsoft will have a patch until October 22nd which is in over a month away.

 

From MS's security advisory:

Response:

We - the purchasing consumers - encourage all software producers to (a) produce quality code in the first instance, and (b) audit that code to make sure these bugs don't get released in the first place. We feel such practice is in everyone's best interests.

 

And while you're at it, I'll have some world peace.

Removing all the bugs from anything as complex as an OS is statistically impossible, no matter how many man hours you throw at it or methods used. This is doubly true for exploits, since the developers have to think of everything a hacker *could* come up with. The hacker only has to think of *one* thing the developer hasn't to have an exploit.

 

I agree that no system is 100% secure (save for one that's not switched on), but that's not at all what I said. I suggest you spend some time exploring the (shoestring budget) OpenBSD project as an example to see why what you've said doesn't hold water. It is well within MS's resources to release clean code. It is, however, another added cost for them which eats into their profitability. From an economics point of view, I understand that. However, it still doesn't excuse them from the fact that many of the 'vulnerabilities' in Windows is due to poor coding which can be fixed. What they said in their advisory was complete hypocrisy. That was my point.

 

+1. Whilst MS have certainly improved (IIS has few recent exploits) and the SDL seems a decent approach, you can't feel sorry for them given their past slackness and poor coding (features and quick release always won over security and testing)...the holy trinity applies to building software just as well as it does to building hardware.