What some have offered up as the ideal approach is to make the fix optional, but default to on. There might be some level of concern for the consequences of ad

What some have offered up as the ideal approach is to make the fix optional, but default to on. There might be some level of concern for the consequences of adding to the patch-maintenance load of technical organizations. Already, IT groups and application maintainers cannot always be fully relied upon to have their machine fleets and libraries up to date. It's also possible that an unpatched machine might suffer from some risk in the form of a significant privilege escalation vulnerability here. Some might opine that any such vulnerability should be closed off wherever possible, as there may be other threats than cryptolockers or botnetting.