3 ms·

Breathlessly panicking about vulnerabilities is worse than no PR at all. There are well-established avenues for keeping up with vulnerabilities, and anyone ope

by stonogo 12y ago

Breathlessly panicking about vulnerabilities is worse than no PR at all. There are well-established avenues for keeping up with vulnerabilities, and anyone operating an Internet-addressable computer who is not familiar with any of them is incompetent. Speaking of incompetence, it was Qualsys' desire for fame which caused them to retain a PR firm, which is why this vulnerability was announced as such before major vendors had patches available. If Qualsys had stuck to the normal avenues, there would not have been any need for the ridiculous panic felt by half-informed administrators. The vast majority of people who read about security vulnerabilities primarily via press releases are almost certainly not in a position to fix them. What, then, is the motivation for presenting them with a goddamned logo?

mentat 12y ago
"anyone operating an Internet-addressable computer who is not familiar with any of them is incompetent" Sorry but I just can't take such a statement seriously. There are millions of people who are in this situation. Calling them incompetent is just ridiculous. Perhaps you were around for the big worms but vulnerable internet facing systems are purely reality. Making people more aware is not some kind of problem.
- mkehrt 12y ago
  I expect the actual number is billions, not millions.
  - mentat 12y ago
    Well, there are 4 billion addresses but the definition of internet addressable is a bit odd with attack vectors through email and web outbound access.
- stonogo 12y ago
  Yes, and the vast majority of those millions of people have an arrangement with their OS vendor to receive updates, including security-related updates. The ones who don't rely on Windows Update, Red Hat alerts, or similar services from various vendors are the ones who have presumably chosen an operating system deliberately outside of those with curated update procedures -- and please note that even relatively small projects tend to have security notification lists. That leaves a vastly outnumbered, tiny minority of people who are either willfully ignoring crucial information or are constitutionally unable to consume it, and neither group is doing humanity any great service in the process. In short, retaining a PR firm does nothing to enhance the overall internet's security posture, and just leads to a lot of half-informed worry on the part of people who can't take any action anyway.

by stonogo 12y ago

mentat 12y ago

"anyone operating an Internet-addressable computer who is not familiar with any of them is incompetent" Sorry but I just can't take such a statement seriously. There are millions of people who are in this situation. Calling them incompetent is just ridiculous. Perhaps you were around for the big worms but vulnerable internet facing systems are purely reality. Making people more aware is not some kind of problem.

mkehrt 12y ago
I expect the actual number is billions, not millions.
- mentat 12y ago
  Well, there are 4 billion addresses but the definition of internet addressable is a bit odd with attack vectors through email and web outbound access.
stonogo 12y ago
Yes, and the vast majority of those millions of people have an arrangement with their OS vendor to receive updates, including security-related updates. The ones who don't rely on Windows Update, Red Hat alerts, or similar services from various vendors are the ones who have presumably chosen an operating system deliberately outside of those with curated update procedures -- and please note that even relatively small projects tend to have security notification lists. That leaves a vastly outnumbered, tiny minority of people who are either willfully ignoring crucial information or are constitutionally unable to consume it, and neither group is doing humanity any great service in the process. In short, retaining a PR firm does nothing to enhance the overall internet's security posture, and just leads to a lot of half-informed worry on the part of people who can't take any action anyway.