I find it convenient that a few of the companies most notorious for having exploitable products are bringing in (paying?) some of the companies known for finding the exploits and essentially telling them to keep quiet about said 'sploits.

As someone else already pointed out, at least one of the involved companies has been extremely sluggish in the past to make available reasonable patches or workarounds for critical security flaws. I don't see how covering up their mistakes and defusing the light of truth will encourage them to make their products more secure going forward.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/5458/20377#20377