These hackers did not have this target before; if Lynn hadn't presented his findings, many, or most of them would likely not even know about it. (All indications are that it will be an exceptionally difficult flaw to exploit, and took Lynn years of research to find. On the other hand, a large group of hackers working in concert could substantially reduce that time). But now that Lynn's blown the lid off of it, every hacker from Boise to Shanghai knows about it. That's simply not smart.
It does not surprise me that the independent voice of the Microsoft IT community doesn't get the reality of Lynn's disclosure. If the theme of this all is broken security culture, this a yelp from the center of the black hole. If Mike had discovered a new vulnerability in BIND that Vixie already had a patch out for, no one would be making the arguments this guy is. The whole point is that Mike exposed a type of attack that people had not been considering a present threat. Of course all the hackers are working on it. That's the type of eternal vigilance we practice in our craft. We now see a space in which problems can and will occur, we must know the extent of it, and fully engage the problem. Anything else is the wrong approach. Redmond, Thanks for Nothing... |