The ISS founder and CTO claims to have contacted Apache at around 9:30am, and then released the advisory sometime in the afternoon. Don't you think that was a little bit irresponsible of Internet Security Systems to release it without at least WAITING for a reply from Apache? It's all about ISS' sad attempt at trying to make themselves look like the "good guys" with their useless patch (that they still claims works), while desperately trying to grab as many customers as possible. (You think those are real profits they show? 95% VC money... hahaha)

GOBBLES still did the right thing in my opinion.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/493/13176#13176