6 ms·
Running 3-5 year old code shows that the provider/company probably doesn't prioritize or fund testing as well as they should IMO. I'm sure Juniper would work wi
by eyeareque 15y ago
Running 3-5 year old code shows that the provider/company probably doesn't prioritize or fund testing as well as they should IMO. I'm sure Juniper would work with any company who asked for a patch or custom work around if they cannot upgrade now.
I see your point, Juniper missed a serious bug in their testing. But you can't hold them completely accountable when they've already announced and released a fix that corrects the issue.
- marshray 15y agoThe problem is, by releasing the patch they alert attackers to the existence of the bug. I don't know this to be the case here, but for things like Windows vulnerabilities the time between releasing the patch and it being exploited in the wild is only a few hours. For systems (like core routers) that are simultaneously too critical and too available to permit timely maintenance cycles, the only solution is to not have any bugs ever.
- baq 15y agogood luck with that. if something is too critical to be taken offline, it should have a hot standby, right?
- salem 15y agoThe bulletin is 3 months old. I would find it surprising if they updated their core router firmware that often, and even if they did, it's probably with a version that is already several months old and has been through lab testing and small scale test deployment. A bulletin like that would have likely reset the cycle.