From: Mike N. 

On Thu, 18 Dec 2003 17:10:16 -0500, "WitchDr"
 wrote:

>Also, Microsoft says you don't need to use URLScan under IIS6 because of
>their superior coding and we're trying to convince developers that it's a
>good precaution because we're pretty sure sometime in the future, the
>measures coded into IIS will be exploited. Are we paranoid?

   Microsoft is just being shortsighted.  Unless they included the
equivalent URLScan functionality in IIS6, there is always the possibility
of an exploit that URLScan could have avoided.   URLScan makes it *VERY*
difficult to exploit IIS vulnerabilities.   That may be why the hacking
community migrated to more fertile territory - RPC and the browser.

--- BBBS/NT v4.01 Flag-5