"...a long awaited public asseveration that Microsoft has finally put security above all else."....!?

Nice job on finding "asseveration," but it doesn't help your argument much.

Ask anyone who has worked for Intelligence agencies and/or financial instituitions and they will tell you that **nothing** mission-critical runs on MS--whether web-based or not--unless there is no other way around it. I've seen people fired for trying to do it, in fact.

No one is asking for MS to put "security above all else." We are asking them to put it at a level somewhere above the effort to come up with a new gorgeous shade of blue for the IE icon. I should think that we would all be quite surprised if they accept any responsibility for their faults--that they acknowledge that security vulnerabilities are almost always due to shoddy code.

I am hopeful. But when faced with the choice of admitting they were wrong and proving they were not, MS--as with petty people--usually begin immediately on the proof. And, though we should never say never, one should think Schneier would rather stoke the fires of hell than be a lackey for MS.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/54/10039#10039