> From: "Geo." 
> "Adam Flinton"  wrote in message
> news:d09287.523777{at}harborwebs.com...
>> Ah right so if the EU makes MS bundle Real Player etc along with windows
> then
>> Real Player etc will be part of Windows? How about Mozilla? Or maybe they
> might
>> say that MS messenger is squeezing out other IM clients such that AOL IM,
> GAIM
>> etc must also be on the CD. Would then the 0.75 GAIM vuln be a windows
> vuln?

> Depends on how it's bundled. If it's on it's own CD that Real provides and
> MS just has to include it in the box with windows much like you get AOL CD's
> when you buy a cheeseburger then no I wouldn't consider MS responsible for
> patching it. 

Why not? They are distributing the software. It may "come with
windows". According to Rich if it's part of the
"distribution" then MS will be responsible for providing the
fixes etc.


> If it's on the NT CD and there is an install option for it, yes
> because MS would have to replace the defective CD if it's exploitable.

When have they replaced CD'es because they were exploitable & hence
defective? I have a Win XP disk which is only 6 months or so old & no
replacement so far.

>> You can't have it both ways Geo. Either the backup & defrag
stuff is 3'rd
> party
>> along with AOL IM, Real etc or the backup/defrag/Extra competing 3'rd
> party
>> products are all part of the windows distrib.
> the way backup and defrag utilities are provided in W2K, it is part of the
> product and as such it's MS's responsibility to provide patches.

& if Real or WinAmp or Mozilla came "in the box" then MS is
distributing it &
hence MS is (according to Rich) responsible for fixing those apps.


>> So? Mandrake includes a "non free apps" CD (CD3) where
non free = not OSS
> (some
>> are to pay for & some are free in a monetary sense).

> I do not consider sampler CD's to be part of the distribution. If the CD is
> labeled Mandrake CD2 then I do consider it part of the distribution.

They're proper apps. They're just not "free" (as in speech) &
thus can't be on the main CD'es. An example would be say the sun JVM.

> It's
> like when you buy a scanner and get some image editor with it, if the editor
> is labeled as being a separate product then it's a separate product, if it's
> labeled as being the "scanner software" then it's part of the scanner.

Ah right so all Mandrake or RH need to do is to provide the actual base
linux stuff on one CD & then put all the 3'rd party apps onto another
CD & job done wrt distributing fixes?

> It's
> no different than SQL server today compared to how it will be considered
> when it's part of the next version of windows.

SQLServer is MS'es own product. GAIM & Mutt aren't Mandrake's or RH's product.


>> & If it turned out that say GAIM was on an
"optional" "CD2" for say both
>> Mandrake & RH? i.e. "in order to install GAIM please put
CD2 in the cd
> drive
>> now" sort of thing.
> If it's labeled Mandrake CD2 then its part of the distribution. If it's
> called Mandrake plus pack then it's still mandrake's responsibility but it's
> a separate distribution, if it's labeled free third party shit we downloaded
> and provide for free then it's a separate product and not their problem.

Are right so simply changing the label will make all the difference?

>> Now think that the dist might come as a couple of CD'es or a single DVD.
> Does
>> moving to a single DVD thus alter the entire picture?
> If it's on the Mandrake DVD so that you have a defective DVD from mandrake
> if the software should contain an exploitable feature, then it's Mandrake's
> responsibility to replace the defective product they sold you.
> Geo.

Even if the directory the 3'rd party rpm'es are in is labelled "3'rd
party applications"?

Adam

--- BBBS/NT v4.01 Flag-5