Replies

Yeah, this is a fascinating ongoing saga.

The other software companies patch their software a.s.a.p., and MS refuses to even admit there's a problem.

This is exactly why so many of us have a problem with MS. Rather than stand behind their products, they do this kind of thing.

Imagine if any other industry tried to get away with this.

Imagine if any other industry tried to get away with this.

The federal government gets away with it all the time. They still won't admit that TWA Flight 800 was taken out by a missile.

Excerpt from the Computerworld article:

Microsoft said it's working on patches for Windows 98, Me, NT4, 2000 and XP. It wouldn't say when the patches would be available.

"This SSL flaw has been described as an [Internet Explorer] problem, but it is a Windows issue. It's in the crypto of the operating system, so we have to patch the OS," said Scott Culp, manager of the Microsoft Security Response Center. "IE is a consumer of those crypto services."

He described it as an "implementation problem in the way SSL certificates are processed, where information is not available in the certificate or it is available in two places and there is a conflict."

This is just MS jockeying for more debug time. They know it's a problem and they are fixing it, but they're trying to avoid user panic and criticism by minimizing it now. Typical.

And I'm surprised (shouldn't be) at The Reg for their lack of balance in this story... they should have checked into it a little further.