As usual, George presents us with more useless rhetoric rather than any solutions. Makes me wonder what he really does at that "think-tank" other than just bashing Microsoft. If you look at the last few months of CIAC high risk vulnerabilities, you'll see that Microsoft vulnerabilities are right beside announcements from Cisco, IRIX, wu-FTPd, etc. Patching systems to fix flaws certainly isn't something new and will always be a less desirable, though necessary, task for all types of systems. If George's solution is to hold "Microsoft" financially accountable for the time spent to patch systems, then who holds accountable those who fail to patch? It would be nice if vendors would write perfect code, but that's simply not going to happen any time soon. I wonder if George can come up with a practical solution for easy, reliable patching across an enterprise though I think we'll keep hearing the same old useless Microsoft bashing from him.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/185/22315#22315