Full Disclosure mailing list archives
Re: Microsoft takes 7 years to 'solve' a problem?!
From: "Eric Rachner" <eric () rachner us>
Date: Tue, 25 Nov 2008 11:25:57 +0100
Hey, kid - If you've got any better ideas about how to fix NTLM, the industry is ready & waiting to hear them. The fact is, NTLM is an old & busted protocol that happens to be used * everywhere*, and there's no way to fix it without breaking compatibility with, oh, just the entire installed base. I was happy to see MS08-068 because the technique it implements is better than nothing - it offers a nice, clever way to reduce the exploitability of the issue without breaking anything important. Don't bother telling us all how M$ should just bite the incompatibility bullet and turn NTLM off - that's been an option for users, theoretically speaking, since about the time Windows Kerberos support became mature, and practically speaking, nobody seems to be turning NTLM off here in the real world. - Eric On Tue, Nov 25, 2008 at 7:44 AM, Memisyazici, Aras <arasm () vt edu> wrote:
<RANT> <snip:: taken from MSRC Blog: http://blogs.technet.com/msrc/archive/2008/11/11/ms08-068-and-smbrelay.aspxWhat we released today with MS08-068 is that security update. It addresses the SMBRelay issue (discovered in 2001) does so in a way that doesn't have the negative impact on applications that we originally believed addressing this issue would have. </snip> So... Hmm... I wonder what would happen if the rest of the world followed suit with M$' approach, and took 7 years to "fix" an issue in order to "not cause a significant impact"... Scenario: Ppl: Hey Ford, if one brute-forces the keyless entry on the door, you're car explodes... Ford: well... I'll offer you three choices, two immediately, and the last one 7 yrs later. You can either not use the keyless entry system (we'll give you some shiny duck-tape to cover it) or you can use the biometric-knub system which requires that you have a knub... So those who have arms & legs can't use the system... (btw this will give birth to a whole new industry that will allow ppl to pay money for a product that fakes a knub for people with appendages) But it's biometric & cool this way! Or you can wait for 7 years and we'll release a non-exploding version of the keyless-entry system. *************************************** OK... Maybe I'm going a bit extreme, but WTH?! Am I the only one who is interpreting this, this way? Really? When has releasing a solution to a problem 7 years later ever been acceptable? Jus' sayin' ... </RANT> Aras 'Russ' Memisyazici Systems Administrator Virginia Tech _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Microsoft takes 7 years to 'solve' a problem?! Memisyazici, Aras (Nov 24)
- Re: Microsoft takes 7 years to 'solve' a problem?! Randal T. Rioux (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Valdis . Kletnieks (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! James Matthews (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Valdis . Kletnieks (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Paul Schmehl (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! James Matthews (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Valdis . Kletnieks (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Paul Schmehl (Nov 26)
- Re: Microsoft takes 7 years to 'solve' a problem?! Randal T. Rioux (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Paul Schmehl (Nov 26)
- <Possible follow-ups>
- Re: Microsoft takes 7 years to 'solve' a problem?! Memisyazici, Aras (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Charles Morris (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Kurt Grutzmacher (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Mike C (Nov 26)
- Re: Microsoft takes 7 years to 'solve' a problem?! Charles Morris (Nov 25)
- Re: Microsoft takes 7 years to 'solve' a problem?! Elazar Broad (Nov 26)
- Re: Microsoft takes 7 years to 'solve' a problem?! Paul Schmehl (Nov 26)
- Re: Microsoft takes 7 years to 'solve' a problem?! Eric Rachner (Nov 27)
- Re: Microsoft takes 7 years to 'solve' a problem?! Eric Rachner (Nov 27)
- Re: Microsoft takes 7 years to 'solve' a problem?! Elazar Broad (Nov 28)