> I wonder how long it would have taken Microsoft to respond to a similar situation. When ASP.NET's AES implementation was exposed to automated attack recently

> I wonder how long it would have taken Microsoft to respond to a similar situation. When ASP.NET's AES implementation was exposed to automated attack recently, the DevDiv guys got out in front of the issue with a workaround in about four days: http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx http://weblogs.asp.net/scottgu/archive/2010/09/18/important-... Then, they continued to stay on top of it, providing guidance until a real patch was available: http://weblogs.asp.net/scottgu/archive/2010/09/20/frequently-asked-questions-about-the-asp-net-security-vulnerability.aspx http://weblogs.asp.net/scottgu/archive/2010/09/20/frequently... http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-asp-net-vulnerability.aspx http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-... http://weblogs.asp.net/scottgu/archive/2010/09/27/asp-net-security-update-shipping-tuesday-sept-28th.aspx http://weblogs.asp.net/scottgu/archive/2010/09/27/asp-net-se... http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-security-update-now-available.aspx http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-se... http://weblogs.asp.net/scottgu/archive/2010/09/30/asp-net-security-fix-now-on-windows-update.aspx http://weblogs.asp.net/scottgu/archive/2010/09/30/asp-net-se...