That's not what he's saying at all. Microsoft has a long history of hiding security issues until either a) they get around to fixing it or b) someone spills the beans and puts them on the spot.

This is totally different from Mozilla where they have a list anyone can go check that lists all the security issues.

What he's saying is that the media then shotguns all these announcements with their media-ese thus offering no additional value from the security list that the Mozilla folks produce and regular folks see all these announcements--many of which don't mean what the media thinks they mean--and don't really know enough to grok it all. Thus the theory produced in this article is that this shotgun approach by the media and security researchers for disclosing security issues causes more harm than good.

The issue here is not that security issues should be disclosed, but the method in which they're disclosed by the media.

/will

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/114/16765#16765