The resonsiblity for buggy software lies in the motive for release. If all testing has been done in good faith, and all known bugs patched or at least made note of in a eratta file, then one could say due diligence was applied. Your examples of Sun, SSH and Sendmail are all true, but unrelated to the way Microsoft (for example, they're not the only perpetrators) tends to release buggy and insecure code knowingly without any information being passed to the end user about possible problems.

Your analogy falls flat because in most cases the proper processes are followed to produce a quality product and respond in a timely manner. Microsoft and any software make which chooses to follow the security through obscurity route and then gets burned deserves whatever they have coming to them

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/47/9258#9258