From: Mike '/m' 

On Sun, 1 Dec 2002 18:22:28 -0500, "Geo."  wrote:

>"Tony Williams"  wrote in message
>news:3dea6661$1{at}w3.nls.net...
>
>> As to their security, I'm inclined to agree with you that they don't
>> have a good record but that's offset by the speed at which they're
>> fixed. Like I said, it's an arms race.
>
>It's only an arms race when the exploit discoverer doesn't get a
>satisfactory reply from the vendor. I've discovered exploits and the vendor
>responded appropriately so the fix was included in the next patch they
>released and no public exploit was ever available.
>
>It's only when the vendor doesn't respond appropriately that it becomes an
>arms race, in an effort to force the vendor to fix the problem the exploit
>is published and the shiite hits the fan. Course there are some exploit
>discoverers who never give the vendor a chance..
>

... and there are some vendors (actually, one vendor) that has earned the
right not to have the chance due to the vendor's arrogance towards the
security community.

 /m


Microsoft has argued that open source is bad for business, but you have to
ask, "Whose business?  Theirs, or yours?"    --Tim O'Reilly

--- BBBS/NT v4.01 Flag-4