3 ms·

The issue was reported in October. "Whilst the Microsoft Security Research Center has acknowledged the vulnerability in Internet Explorer, they have also state

by dchest 14y ago

The issue was reported in October. "Whilst the Microsoft Security Research Center has acknowledged the vulnerability in Internet Explorer, they have also stated that there are no immediate plans to patch this vulnerability in existing versions of the browser." http://spider.io/blog/2012/12/internet-explorer-data-leakage/ http://spider.io/blog/2012/12/internet-explorer-data-leakage... So, instead of fixing it: - receive vulnerability report - don't fix it and wait until there's PR disaster - issue statement that now "we're working actively to fix it" - [future] fix the issue My question, again -- why the hell they didn't fix it in the first place? Why go though this? Do you have to be a psychic to figure out that any Microsoft's non-response to vulnerability (even if its effect is overblown) is a PR disaster?

kevingadd 14y ago
If Microsoft does not consider it to be a critical vulnerability, their behavior is entirely consistent with the issue being a task on a task list somewhere - possibly already fixed on the development branch for the next release (or service pack) of Internet Explorer 10. It is simply not possible to declare at this point that Microsoft decided not to fix it. Internet Explorer is a tremendously large piece of software used by millions of customers; do you think this is the only bug with potential security consequences in their bug database? More concretely: If, hypothetically, on October 1 2012, two security issues were reported, and this is one of them, which one do you think they should have fixed first and rushed an out-of-band patch for? Do you think it should have been this one specifically because it's a PR disaster? I agree that faster action is always better, and that better communication is always better. But you have to understand that teams working on products this large do not move quickly. In the time since this issue was reported to Microsoft, we have only passed through roughly one release cycle of Firefox and Chrome. So, assuming an identical issue was found and reported in Firefox or Chrome on the same date, would the fix even be in customers' hands? Most likely only if it were considered important enough to rush a fix.
- dchest 14y ago
  Your reply makes a lot of sense, much more sense than the linked post. Thank you.

by dchest 14y ago

kevingadd 14y ago

If Microsoft does not consider it to be a critical vulnerability, their behavior is entirely consistent with the issue being a task on a task list somewhere - possibly already fixed on the development branch for the next release (or service pack) of Internet Explorer 10. It is simply not possible to declare at this point that Microsoft decided not to fix it. Internet Explorer is a tremendously large piece of software used by millions of customers; do you think this is the only bug with potential security consequences in their bug database? More concretely: If, hypothetically, on October 1 2012, two security issues were reported, and this is one of them, which one do you think they should have fixed first and rushed an out-of-band patch for? Do you think it should have been this one specifically because it's a PR disaster? I agree that faster action is always better, and that better communication is always better. But you have to understand that teams working on products this large do not move quickly. In the time since this issue was reported to Microsoft, we have only passed through roughly one release cycle of Firefox and Chrome. So, assuming an identical issue was found and reported in Firefox or Chrome on the same date, would the fix even be in customers' hands? Most likely only if it were considered important enough to rush a fix.

dchest 14y ago
Your reply makes a lot of sense, much more sense than the linked post. Thank you.