> You have it now, hope you're happy. In general, yes very. Thanks. > How are you using it? I'm not, I don't have Windows boxes. Did you miss that? > Becaus

> You have it now, hope you're happy. In general, yes very. Thanks. > How are you using it? I'm not, I don't have Windows boxes. Did you miss that? > Because there's nothing you can do!!! you're sold!!! there are companies with thousands of Windows seats. How can you just go and say "not having Windows users"? That shows very poor judgement and a seriously worrying detachment from reality. Nope, I just double-checked my entire inventory and there aren't any Windows computers. That's an example of how by knowing more about it, I can make better decisions. For now, for this bug, for me, 'nothing' is an acceptable response. > It also shows me you actually don't really give a shit about security and know nothing about the challenges in the real world. Exactly the opposite. You're sounding like you've never considered mitigations. You're parroting a corporate message that has caused more vulnerabilities over the years than null-terminated strings. > Are you sure? I don't think you really know that Microsoft is these days a huge and (for many big companies) reliable security vendor. Compliance, tooling, innovation, products... They've got their hands on everything. They even help shutting down botnets. Shutting down botnets is admirable. But it's not platform security. Microsoft is still too focused on extreme user convenience, etc, to make the hard choices. Their cloud offerings still have problems with filenames their OS accepts, and when it dies it just refuses to copy some of the files. It's not a security bug but it shows a lack of attention to details and improper sanitization. It's hard to imagine them actually properly executing on a robust and secure solution. I wouldn't trust a builder living in a crooked house... > I don't think [Google has] got prejudices. However, it is proven by your comments that you do have those prejudices and you're basing your opinion on them. Yes, I also remember their total lack of concern in the 90s which does color my view but the issue is that I still see those behaviors from them. When they release mitigations in days, not patches in months, I'll revise that opinion. > How? What's your mitigation strategy? What a sysadmin can do to mitigate this? If your answer is don't use Windows, which could be a good long term plan, you're again out of touch with reality. You seem not to read the posts you respond to. I have no idea because I haven't even read two lines about this bug. It doesn't affect me or my charges and so I'll focus my energy on things that do. In the hypothetical where it was in software my users used, I would probably just block that software for everyone. Rarely are even mission-critical apps actually so, in practice. Failing that I'd block that type of media, etc. Or restrict it to a small subset of users who I could trust, and I'd revoke a bunch of other privileges for them temporarily to avoid the attacker gaining anything of value. For instance, Disable the PDF reader, block all PDF attachments, and forward all email with an attachment to a user with a reduced-access machine to sanitize. This could be done in minutes which is why I care about finding out about things right away. I can slam the door even without fixing the problem, then analyze it at leisure. > If you'd like a silly comparison, this is like Google releasing blueprints to create super cheap surface to surface missiles because they were being used by a nation against another. Now they have weaponized any script kiddie out there. If Google found the blueprints then anyone else could. And yes, we'd want to start analyzing them for weaknesses before they were flying towards us. > Holy shit. I hope I'm not using any of your products. This is not how you do security. Haha, but you're totally wrong. Security (in any domain) is about doing what you can and understanding the limits of it, not about stupid ivory-tower perfection. My users would be safer in minutes, your users would be ignorantly vulnerable for months. > I thought I was discussing with someone that took security seriously and that I could learn a thing or two (I can't call myself an expert, maybe a hobbyist); it does seem though you're in this conversation just because you like to stick it to Microsoft (or to the big guys, or whatever) and can't be objective about it. MS isn't even on my radar and I normally say this sort of thing about other vendors. I don't care to wait on their patch cycle, or wait for them to make a tidy patch, I want as much of a mitigation as possible, as soon as possible. Some companies have bitten the bullet and pushed updates to disable whole areas of broken functionality and taken the PR hit, others would rather wait and hope nobody notices. > If you'd like to continue this conversation I'd like to ask you to tell me how can we be safer after the disclosure. Trivially, because without the disclosure nothing you do with make you safer. With the disclosure you've got a range of options. > How can I help my friends running small and medium businesses to protect themselves against the exploitation of [any] bug? Even knowing when to just unplug the network and wait is still a huge step up over being ignorantly plundered. When you've done everything you can, stop and assess. Maybe there'll be a more fine-grained mitigation (blocking a smaller subset of incoming traffic for instance), or an actual solution by then.