Sandi - Microsoft MVP wrote:

kurttrail wrote:

2 days between patch release and the nasties release. It was a lucky
thing that it wasn't a MS hole.

http://www.greymagic.com/security/advisories/gm005-mc/

'GreyMagic started work on this issue with Microsoft on 11-Mar-2004.
They have quickly confirmed our findings and were able to produce a
fix less than two days later. As a result, Hotmail is no longer
vulnerable to this method of exploitation.
All attempts to contact Yahoo unfortunately failed. Mail was sent to
security and secure at yahoo.com and at yahoo-inc.com, no replies were
received to date. '

And your point is? What does that have similar to a what a Zero-Day bug
would do explointing a flaw in MS OSs, where most people wouldn't be aware a
flaw, a patch, and a bug already existed. MS got Hotmail protected in two
days. Congratulations are in order, but some day soon, a Zero-Day bug is
inevitable, and if the target is MS's OSs, and we haven't attempted to break
up the mono-culture of the MS desktop, the consequences will be global in
its impact. A wise society doesn't put all its eggs in one basket, because
you risk breaking all those eggs with one careless step.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"