Micorsoft expressed concern??? Good for them. Were they actually paying security researchers a pre-determined sum for finding vulnerabilities then they might actually have a say in the issue. They should be thankful that they are given a heads up at all, and are given time for a fix. Fixes which by an large are always in excess of the generally accepted sixty days. Microsoft has made some excellent gains as of late, but this whining about lack of notice is a litte rich. Perhaps they should follow the lead of other companies and openly announce they will pay those who find vulns in their s/w. That would be a novel approach.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/58/214#214