There's a tradeoff here between making a new feature secure by default (i.e., disabled) and making it easy for your customers to take advantage of it ("No confi

There's a tradeoff here between making a new feature secure by default (i.e., disabled) and making it easy for your customers to take advantage of it ("No configuration needed: It just works.") How risky it is to have a feature enabled by default is a function of a) The complexity of the feature. b) The reliability of your development and testing process re: security. and c) The ultimate severity of any vulnerability. At the time Windows 2000 was being developed (late '90s), Microsoft tended to systematically underestimate a) and c), while overestimating b). Then came an internal push for better security practices and billg's "Trustworthy Computing" memo. There's a good discussion of it and the consequent sea change here: http://www.zdnet.com/article/10-years-since-the-bill-gates-security-memo-a-personal-journey/ http://www.zdnet.com/article/10-years-since-the-bill-gates-s...