From: Thees Peereboom 

Geo,

>Not less safe, my point was that once someone discovers a flaw in a library
>function, it's easy for the hackers to find all parts of open source
>software that use that function and to immediately begin probing those areas
>to find new exploits. This results in more public exploits. On the closed
>source side, only the programmers who have access to the source can do this,
>so they find the same thing but the exploits are never in the hands of the
>evil hackers.
>
>Evil Hackers don't report exploits and give vendors a chance to patch them,
>so it's not the same as when the security community reports an problem.
>These types of secondary discoveries get used in the wild quite quickly.

So what do you think the consequence of a published flaw in IIS is? Would
it be any different than what you describe?

- Thees Peereboom

--- BBBS/NT v4.01 Flag-4