I believe this is a really bad idea on Microsoft's part. My company PivX Solutions has emailed Microsoft 2 times prior to releasing large vulnerabilities, or even just to help them correct an error in their work around; but we never seem to receive a reply.

Our policy is to notify the vendor, in this case MS, and if there is no reply within 20-40 days, we go forward with next steps (releasing, publishing, fixing, etc..).

Microsoft needs a better system and possibly better people to deal with the apparent influx of vulnerabilities coming their way daily, but I certainly think that an web-wizard-form is not the way to go.

I think I speak for everyone when I say, 'if I see another web form instead of an email address, or a phone number, I am going to vomit'.

Geoff Shively, CHO

PivX Solutions, LLC

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/545/15805#15805