Re: Be very careful from now on...

["Jim Franz" <franz400@xxxxxxxxxxxx>]

it's interesting that almost all MS security fixes come after reports
from others outside MS. I imagine it's been a big cost savings
to have others test your code for free. Now if they realease into
the wild their code - someone will code the fix (for free).
<seen to many x-files>
jim
----- Original Message ----- 
From: "James Rich" <james@xxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, February 17, 2004 12:27 PM
Subject: Re: Be very careful from now on...


> On Tue, 17 Feb 2004, Adam Lang wrote:
>
> > The reverse is also true, which is the theory behind open source.  The
good
> > guys get to see the code now also and can see what holes there are that
only
> > MS knew about.  that is why your comment "clearly seeing things that we
> > can'" is wrong.  Now you can see as much as the bad guy can see.  The
code
> > being out there puts everyone on even footing in regards to knowing how
> > things work.
>
> In this case that isn't necessarily true.  With open source, the good guys
> do get to see the code, and do far more than the bad guys bother to.
> However, the good guys don't want trouble with MS and don't want to
> violate any copyright laws or use technology without license or taint
> their ability to work unfettered.  Looking at the MS code can cause all of
> these problems.  Because of the license of the code, the good guys aren't
> looking at it.  They don't want to jeopardize their careers by looking at
> unlicensed code, and I don't want to either.
>
> James Rich
>
> "As for security, being lectured by Microsoft is like receiving wise words
> on the subject of compassion from Stalin."
>       -- mormop on lwn.net
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>