Many servers will still be vulnerable, so now you have 2 problems. Zawinski meme aside, perhaps it would make sense to do it on a server-by-server basis when t

Many servers will still be vulnerable, so now you have 2 problems. Zawinski meme aside, perhaps it would make sense to do it on a server-by-server basis when the machines are verified patched. (Though, even then, how do you know they aren't passing information back to an Internet-exposed-but-unpatched database server?)