I'd say clients first. And only the software companies where proof can be had that it was an exploit and not merely poor configuration.

Seriously, lets take the dreaded msft. Yes there are issues. Nobody can seriously deny that. But I really do NOT buy that it is msfts fault that some employer hired some kid who didn't know his a.. from his elbow and just configured the system poorly.

The point I make is simply this: Every time we read up on a hack people start automatically thinking 1, it must be a msft system, even if there is no mention of the system it is, and 2, it is another of the numerous flaws...

There is just so much more to it than that, and it isn't limited to msft systems when it comes to bad administrative practices. We are quick to msft bash, and sometimes it's warranted. But a lot of times it is the admins misconfiguring, and you CANNOT hold msft responsible for that if there are reasonable documents/courses/books on how to do it properly (subjective term i know). Just like you wouldn't reasonably hold Linus responsible for some idiot kid who may set up man entry for passwords to keep root password handy (extreme example i know, but you get the picture). Nor would you call it a flaw.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/10259/30001#30001