Full Disclosure mailing list archives
RE: Bill Gates blames the victim
From: "Brent J. Nordquist" <b-nordquist () bethel edu>
Date: Wed, 3 Sep 2003 13:13:26 -0500 (CDT)
On Wed, 3 Sep 2003, Robert Ahnemann <rahnemann () affinity-mortgage com> wrote:
;; Q. "The buffer overrun flaw that made the Blaster worm ;; possible was specifically targeted in your code reviews ;; last year. Do you understand why the flaw that led to ;; Blaster escaped your detection?" ;; ;; A. "Understand there have actually been fixes for all of ;; these things before the attack took place. The challenge ;; is that we've got to get the fixes to be automatically ;; applied without our customers having to make a special effort."Let's relate this to real life (flame that line if you want). Your car has a defect that causes the oil pan to leak. Ford (I drive one, I can talk) issues a recall saying they know about the leak and are offering you a free fix, if you would just take the time to take the car to the shop. You decide that you know better and that you would rather not invest the time. You engine is lying on the ground three weeks later. Whose fault is it?
My issue isn't with the patch. And that isn't what the interviewer asked above, if you read carefully. The interviewee was allowed to duck the question by giving an answer to a different question. I wish he'd been called on it. If you want your real life analogy to be complete, you need to add (a) a Ford VP announcing that "all oil pan leaks have been found and fixed in our latest Ford model, about to be released" (yes, a Microsoft VP actually said that about buffer overflows in Windows XP) and (b) when questioned about why that latest Ford model has a leak after the "leak-free" declaration, the Ford rep. responds, "Well, we did announce a fix for the leak, if you had just brought your Ford in for repair." That *wasn't the question*. The question is whether the evidence to date should lead us to have confidence in your Trustworthy Motoring program, and your ability to find leaks in what you're building, and your own declarations of your products as being designed and built to be leak-free. -- Brent J. Nordquist <b-nordquist () bethel edu> N0BJN Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html * Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Bill Gates blames the victim Petr Swedock (Sep 03)
- Re: Bill Gates blames the victim Alexandre Dulaunoy (Sep 03)
- <Possible follow-ups>
- RE: Bill Gates blames the victim Robert Ahnemann (Sep 03)
- RE: Bill Gates blames the victim C. David Wilde (Sep 03)
- RE: Bill Gates blames the victim Lim Swee Tat (Sep 03)
- RE: Bill Gates blames the victim Brent J. Nordquist (Sep 03)
- Re: Bill Gates blames the victim Petr Swedock (Sep 03)
- RE: Bill Gates blames the victim Robert Ahnemann (Sep 03)
- RE: Bill Gates blames the victim Lim Swee Tat (Sep 03)
- RE: Bill Gates blames the victim Robert Ahnemann (Sep 03)
- RE: Bill Gates blames the victim Lim Swee Tat (Sep 03)
- RE: Bill Gates blames the victim Richard M. Smith (Sep 03)
- RE: Bill Gates blames the victim Nick FitzGerald (Sep 03)
- Re: Bill Gates blames the victim Valdis . Kletnieks (Sep 05)
- Re: Bill Gates blames the victim Nick FitzGerald (Sep 05)