Re: Microsoft Makes Concessions to Security Software Makers

[Nick FitzGerald <nick () virus-l demon co uk>]

Valdis.Kletnieks () vt edu to "Rob, grandpa of Ryan, Trevor, Devon & 
Hannah":

> > Yeah, I know.  But so far it has tended to be after the release.  I suspect that has 
> > more to do with laziness on the part of the blackhats than anything else ...
>
> Amen.  It's not worth the effort to write exploits against non-existent targets.

Well, a lot of folk (reputedly more than any previous release) are 
using various Vista beta/RC releases, and you can be sure that not all 
of them took heed of (or even read) the warning that being pre-release 
software it should not be used in production, or sensitive (aka 
"Internet connected") situations...

They still wouldn't make _much_ of a target though, but the bigger 
issue is that if you were a black hat with a Vista exploit, releasing 
it before Vista shipped would guarantee that the vuln would either be 
fixed as a last minute update/patch before the code finally went RTM, 
or if you made the release after RTM, the first thing Vista would do 
after going online was snag and install a critical security update from 
WU/etc that took you out of the game...


Regards,

Nick FitzGerald

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.