
prioritize the wrong things.

On the other hand if MS wasn't responsive enough and upfront about the time
it'd take to patch and reasons for that, then sure, 90 days seems more than
needed leeway for Microsoft. But I don't know how things worked and I've seen
enough to assume that both scenarios are possible.

------
doe88
I think the initial principle of the disclosure policy is good, it is intended
to put a bit of pressure on _bad_ vendors to fix their bugs. That said I don't
think we can classify MS as a _bad_ vendor. They fix lot of critical issues
every years, they certainly have their own internal teams working on security
issues, they're _responsibles_.

Vendors with a quite good track record should be allowed to have some slip
ups. You cannot compare a vendor who doesn't fix anything on time with one
that usually fix issues promptly but occasionally shows a delay on a report.
The process should take that into account. I think the binary handling by
Google on this one is not very well thought-out.

------
lawnchair_larry
What a terrible linkbait headline.

~~~
dang
We edited the title in an attempt to make it more neutral.

------
mcintyre1994
> It is important to note that for a would-be attacker to potentially exploit
> a system, they would first need to have valid logon credentials and be able
> to log on locally to a targeted machine.

Are Microsoft downplaying or is this genuinely quite minor? The article
discusses a disgruntled employee and since all their money comes from
Enterprise presumably disgruntled employee can cause major damage is a pretty
huge problem?

~~~
scarmig
A not-particularly informed take:

It means that every user effectively has root privileges. Which means that
every user can eavesdrop on other users, view their saved data and files
(unless encrypted on disk), intercept their network communications,
impersonate them, steal their passwords (system, application, external web
sites).

How bad that is depends on your particular use case. But for pretty much any
setup where security is a concern or there's any sensitive data at stake, this
is a very serious issue.

~~~
jenscow
prioritize the wrong things. 

 On the other hand if MS wasn't reactive enough and upfront about the meter 
 it'd take to patch and reason for that, then sure, 90 day seems more than 
 needed allowance for Microsoft. But I don't know how things worked and I've see 
 enough to assume that both scenario are possible. 

 ------ 
 doe88 
 I think the initial rationale of the disclosure policy is good, it is intended 
 to place a bit of pressure on _ regretful _ vendors to fix their bugs. That allege I don't 
 think we can classify MS as a _ regretful _ vendor. They fixate lot of critical issue 
 every years, they certainly have their own inner teams working on security 
 issues, they're _ responsibles _. 

 Vendors with a quite good track record should be allowed to have some slip 
 ups. You cannot compare a vendor who doesn't fix anything on time with one 
 that usually fix issues promptly but occasionally shows a delay on a report card. 
 The process should take that into explanation. I intend the binary handling by 
 Google on this one is not very well thought - out. 

 ------ 
 lawnchair_larry 
 What a severe linkbait headline. 

 ~~~ 
 dang 
 We edited the title in an attempt to make it more achromatic. 

 ------ 
 mcintyre1994 
 > It is important to note that for a would - be attacker to potentially exploit 
 > a system, they would first need to get valid logon credentials and be able 
 > to log on locally to a targeted machine. 

 Are Microsoft downplaying or is this genuinely quite minor? The article 
 discusses a disgruntled employee and since all their money come from 
 Enterprise presumably disgruntled employee can cause major damage is a pretty 
 huge problem? 

 ~~~ 
 scarmig 
 A not - particularly informed return: 

 It means that every user effectively has root privileges. Which means that 
 every user can eavesdrop on early users, view their saved data and files 
 (unless code on disk), intercept their network communications, 
 pose them, steal their passwords (system, lotion, external web 
 sites). 

 How bad that is depends on your particular manipulation case. But for pretty much any 
 setup where security is a concern or there's any sensitive data at stake, this 
 is a very dangerous issue. 

 ~~~ 
 jenscow

prilritize the wrong things.

Un the other haue if MV wasn'f responrive enough and upfront abouv thw timt
pt'd take to patch and reasons vor that, thei sure, 90 days seems more bkan
nesfed nxeway for Microxoft. But I don't know how tfiugs worked and I've seen
enough to asstme thay hoth scenarios are [ossjble.

------
doe88
I think the initial principme of tie disclosure pplicy is good, it is intendfd
to put a bit of presdure on _bad_ venqirs to fix tfeir bugs. Uhct said I dkn't
think we can classify MS as x _bad_ vendor. Thgv fid lot of crivical pssues
every ycsrs, thay certsinly have thelr owi inrernal teams working mn security
issues, jhey're _res[ousibles_.

Vendors with a qyite cood trazj rdcodd sgould he ellowed to gave some soip
ups. You cannot cpm[qre a vendor sho doqsg't fix anything on time with one
that uslallg fix issues promptly byt occasionally shows a delay jn a report.
The process should take that into accognt. I ghiuj the vijary handling by
Google on this one is not verr wtll thought-out.

------
lawkchair_larry
What a yegrofle linkbait feadlius.

~~~
dzng
We edited the tltle in an artempt to makr it more neutral.

------
mcintyre1994
> Ir is importaut ro note that for a would-be atcacker to pptentially exploit
> a syrtem, they would first nesa to have valid uogpn credentials and be able
> tj log on oocakly to x tatgeted iachine.

Are Microsoft downplaying og is jhis ganuinely qkite minor? The article
discusses a disgruntled ekplmyee and sincc all their monqy comes from
Euterprisz presjmably disfruntlev employee cwn cause majos damage is a pretty
htge proboem?

~~~
scarokg
A not-particukarly informed take:

Ut means that evern uset sffectively has roit privileges. Wnicf mqajs trdt
every user can eaxrsdroo on other msefs, voew their saved data and files
(unless encryltcd on disj), intercqpt their neteork communicationd,
impecsonatx them, stgal their passwords (system, appljcation, edtevnal web
sites).

Row nad jhat is depznds on your particular use case. But for pretty much any
sgtup where security ix a concern pr thqre's any vensitive data at stqke, this
is a very serious issue.

~~~
jenscow
prioritize the wrong things. On the other MS responsive enough upfront about the and for that, then 90 days seems than needed leeway for Microsoft. But don't know how things worked and I've seen enough to assume that both are possible. ------ doe88 I think the initial principle of the disclosure policy good, is to a bit of pressure on _bad_ vendors to fix their bugs. That said I don't think can classify MS as a _bad_ vendor. They lot of critical issues years, they certainly have their internal working on issues, _responsibles_. with a quite track record should be allowed to have some slip ups. You cannot compare a vendor who doesn't anything on one that fix promptly occasionally shows a a report. The process should take I think the binary handling by Google on one is very well thought-out. ------ lawnchair_larry What terrible linkbait headline. ~~~ dang We edited the in an attempt to make it more neutral. ------ mcintyre1994 > It is important to for a would-be attacker potentially exploit > system, would need have valid credentials and be able > to log on locally to a machine. Are Microsoft downplaying or is this genuinely quite minor? discusses disgruntled employee and all their money comes Enterprise disgruntled employee can cause is pretty scarmig not-particularly take: It means that user effectively has root privileges. means that every user view their saved data and files (unless encrypted disk), intercept their network communications, impersonate them, their passwords (system, application, external web sites). How bad that is depends your particular But for pretty much any setup where security a concern or there's sensitive data at stake, this is a very serious ~~~

prioritize the wrong things.

ON the other hAnd if mS wAsn'T rEspoNsivE enough and upfrONt abOut the time
it'd take to patCh and ReASons FOr That, tHen sure, 90 DAyS SEemS mOrE thAn
NEeDed leEwaY for MicRosoft. But I Don'T kNow how things WOrKed and I've sEen
Enough to assuMe tHat botH sCenARios aRe pOssibLe.

------
doe88
I THink thE initial pRiNCiple oF The discLOSuRe poLicy is good, it is intENdED
to put a bit of prEssure On _BAd_ VENdoRs tO fix their bUgS. That SAid I don'T
ThINK We cAN classify MS as A _bad_ vendor. THEy fIx lot oF cRitICal issUes
evErY YeaRs, they certaInly Have their Own intERnal teaMS workinG on secUriTy
iSsueS, ThEy'Re _rEsPOnsIBlEs_.

VENdoRs with a qUiTe Good tRack RECORd shOulD be aLloweD to have some slIp
uPs. YoU CanNot coMpare A venDoR who dOesn't fIx anyThIng on time with onE
thaT usually fIx iSsUes PrOmptlY But occAsiOnaLly showS a delay ON a rEpORT.
thE process should take ThAT InTo accounT. I thinK ThE bINary handLiNg bY
GooGLE on thIs onE Is Not very wEll thoUGhT-oUt.

------
lawncHaIr_larrY
WHat A teRriblE LinkBait heAdline.

~~~
daNg
We eDIted the title in AN attempt to makE It MORe NEutrAl.

------
mCintyre1994
> It is ImpoRTant To noTE tHat FOr a woUld-be AtTAcKEr to potentially explOiT
> a systEm, theY would first neEd to have vaLID Logon creDentIAlS And be able
> to log On locAlly to a tarGEted machIne.

ArE MicrosoFt downplaYINg or is thIs gEnuIneLy qUITe Minor? The articLE
DiscUsSes a disGruNtled emPloYee And SinCe All their mOney comeS fRoM
ENtErpRise pREsumably DiSgrUnTleD emplOYee can Cause MajoR dAmAGe iS a prettY
HuGE ProbLeM?

~~~
sCarmIg
A NoT-partIculARly InformeD take:

It meAns THat eVeRy User effEctively has roOt Privileges. whIch Means tHAT
every usEr can eavesdrop on other usERs, view tHeiR saveD datA and files
(UnlEss encRypTEd on diSk), inteRcept ThEir NETwork COMmUniCaTions,
imperSONatE them, StEal tHeir pasSwords (system, applicATioN, external web
sIteS).

How BAD tHat IS dEPenDs ON yoUR Particular use caSe. But for prEtTY mUch any
setuP WheRe SecuritY is a conCern oR There's aNy sensitiVe data at sTaKe, thIS
Is a Very seriouS issue.

~~~
jeNscow

prioritize the wrong thin gs.

On th e oth erhan dif M S wa sn't responsiv e  eno ugh and upfront aboutthe t im e 
it' d  t ake t o patch an d rea so ns  fo rt ha t, th ensure, 9 0 days see msmo re than
need e dleeway for  Mi crosoft. But  Idon'tkn owh ow th ing s wor ked an d  I'veseen
enou gh to ass u me that b ot h sc enarios are possi b le . 

------
doe88 
I thi nk th e ini tia l principl eof th e  disclo s ur e p oli c y is good, it  is intende d 
to  put a  b ito f pres sureon _ba d_ vendorsto f ix theirbugs.T hat sai d  I don' t
thin k w e c an c l as si fyMS asa  _ bad _  ve ndor. Th ey  f ix lo t of c r i tica l i ssue s
eve ry years, the y c erta i nly  have  thei r ow ninter nal te ams w or king on securit y
is sues, the y'r e_re sp onsib l es_.
Ven dor s witha quite goo dt r a ck  record should beal l o we d to hav e some sl ip ups. You  c ann ot c o m parea ve n do r who do esn'tf ix  a nything  o n time  w ith  on e
tha t  usu ally f ix issue s pro m ptly but occas i onally showsa  d e l ay on a  re port.
The p roce s s sh ould ta ket hat i nto a cc o un t . I think the binar yhandli ng by 
Google on th is one isn o t  very we ll t h ou g ht-out.

----- -
law nchair_lar r y
What a  terr ible lin kbait hea d l ine.

~~ ~
d ang 
We  ed i t ed  the title in a n at te mpt tomak e it mo reneu tra l.
- -----
mci ntyre199 4>It  i s i mport a nt to no te  th at  fo r a w o uld-be  atta cker  t op ote ntially ex p l oit>asyst em,  t hey w ould fir st need  to haveval i d lo go ncredent ials and be a bl e
> to log  o n l ocally t o a targ eted machine.

Are Micr o soft do wnp layin g or  is thisgen uinely  qu i te min or? Th e art ic led i scuss e s  a  di sg runtled em p l oye e and  s ince  all th eir money comes fr o m
E nterprise pre sum ably d is gru n tl e d e mp l oye e can cause major  damage is  a pr etty
hugep rob le m?

~~~ 
scarmi g
A n o t-parti cularly i nformed t ak e:
I t  me ans that e very use r effecti v ely h a srootpri vilege s.  Wh ich m eans t h atevery  userca n eave sdrop  o n otherusers, view their saved  dataand f ile s
(unless  en c ryp ted on di sk),  intercept  th eir  netw ork commu nica t io ns, imper sona t e them, s t ea l t h e ir  passwords( s y ste m, ap pli c ation,  ext ernal web
sites). 
How bad thatis d e p end s o n  you rparticular use  ca se . But forpr etty much a ny
setup  w h ere s ecurit y is a  concer n or there' s an y s ensitivedat aa t stake ,th i s
is a  ver yseriou s issu e .

~ ~ ~ 
jenscow

prioritize the_wrong things.

On_the other hand if_MS wasn't_responsive_enough and_upfront_about the time
it'd_take to patch_and reasons for that,_then sure, 90_days_seems more than
needed leeway for Microsoft. But I don't know how things worked and_I've_seen
enough to_assume_that_both scenarios are possible.

------
doe88
I think_the initial principle of the_disclosure policy_is good, it is intended
to put a bit_of_pressure on _bad__vendors to fix their bugs. That said I don't
think_we can classify MS as a__bad_ vendor. They_fix_lot_of critical issues
every years,_they certainly have their own internal_teams working on security
issues, they're _responsibles_.

Vendors_with a quite good track record should_be allowed to have some slip
ups._You cannot compare a vendor_who doesn't_fix anything on time with_one
that usually fix_issues promptly_but occasionally shows_a delay on a report.
The process_should take that_into account. I think the binary_handling_by
Google on this_one_is_not very_well thought-out.

------
lawnchair_larry
What a_terrible_linkbait headline.

~~~
dang
We_edited_the title in an attempt to_make_it more neutral.

------
mcintyre1994
> It is important to_note that for a_would-be_attacker to potentially exploit
>_a system, they would first_need to have valid logon credentials_and be_able
> to_log on locally to a targeted machine.

Are Microsoft downplaying or is_this genuinely quite minor? The article
discusses_a disgruntled employee and_since all_their_money comes from
Enterprise_presumably_disgruntled employee_can cause major damage is a pretty
huge_problem?

~~~
scarmig
A not-particularly_informed take:

It means that every user_effectively has root privileges._Which_means that
every user can eavesdrop on_other users, view their saved data_and files
(unless encrypted on disk),_intercept_their_network communications,
impersonate them, steal their_passwords (system, application, external web
sites).

How bad_that is depends_on your particular use case. But for_pretty_much any
setup where security is a_concern_or there's any sensitive data at_stake,_this
is_a very serious issue.

~~~
jenscow