3 ms·

"I hope some responsible are looking for new jobs." If they look for (and find) new jobs wouldn't that just mean the problem is diffused? Personally I would ho

"I hope some responsible are looking for new jobs." If they look for (and find) new jobs wouldn't that just mean the problem is diffused? Personally I would hope they learn from the experience of failing than to get punished for it.

mikeash 11y ago
That's a great sentiment, but sometimes we have to stick to more realistic hopes.
cmurf 11y ago
Personally, I hope everyone else (not at Trend Micro) learns from this experience. Computer security auditing is a serious expertise, it's hard but made much harder to impossible when you don't have experts on the team and instead consider security expertise as a hobby for the qualifier. trendmicro.com > About > "Smart, simple, security that fits" And then second is, "a global leader in IT security" and "25 years of security expertise". What a crock. I'm supposed to take the company's position statements and products seriously after reading this issue report? This is like finding a sponge in the body cavity of a patient. It's functionally malpractice. The CIO and CTO should be fired. The CEO probably should resign, what else is the purpose of a CEO other than to make sure the main things the company stands for are true, and actually ships products that demonstrate it stands for those things? If they don't resign the board needs to fire them.
- cmurf 11y ago
  I'd like to point out that it'd be an even bigger and redder red flag (if that's possible), should Trend Micro fire some team "security" developer, or even the product manager. How is it possible, that a company which describes itself in the terms it has [1], have not done a thorough code review of all products before making them public? That is implicit in their own description of what their business does. I'm not even sure the worst parts of this particular product's flaws would have escaped cursory code review by someone who is actually a security expert. And if that's true, then selling this product as it was before patching, might be fraud. [1] http://www.trendmicro.com/cloud-content/us/pdfs/about/ds_corp-facts-stnd-size.pdf http://www.trendmicro.com/cloud-content/us/pdfs/about/ds_cor...

mikeash 11y ago

That's a great sentiment, but sometimes we have to stick to more realistic hopes.

cmurf 11y ago

Personally, I hope everyone else (not at Trend Micro) learns from this experience. Computer security auditing is a serious expertise, it's hard but made much harder to impossible when you don't have experts on the team and instead consider security expertise as a hobby for the qualifier. trendmicro.com > About > "Smart, simple, security that fits" And then second is, "a global leader in IT security" and "25 years of security expertise". What a crock. I'm supposed to take the company's position statements and products seriously after reading this issue report? This is like finding a sponge in the body cavity of a patient. It's functionally malpractice. The CIO and CTO should be fired. The CEO probably should resign, what else is the purpose of a CEO other than to make sure the main things the company stands for are true, and actually ships products that demonstrate it stands for those things? If they don't resign the board needs to fire them.

cmurf 11y ago
I'd like to point out that it'd be an even bigger and redder red flag (if that's possible), should Trend Micro fire some team "security" developer, or even the product manager. How is it possible, that a company which describes itself in the terms it has [1], have not done a thorough code review of all products before making them public? That is implicit in their own description of what their business does. I'm not even sure the worst parts of this particular product's flaws would have escaped cursory code review by someone who is actually a security expert. And if that's true, then selling this product as it was before patching, might be fraud. [1] http://www.trendmicro.com/cloud-content/us/pdfs/about/ds_corp-facts-stnd-size.pdf http://www.trendmicro.com/cloud-content/us/pdfs/about/ds_cor...