On Tue, May 16, 2017 at 8:33 AM, Brad Knowles <b...@shub-internet.org> wrote:
> On May 15, 2017, at 4:31 PM, Jonathan Roach <jonathan.ro...@oracle.com> > wrote: > > > What's key is that administrators need to know how to secure their > > estates. If they've failed to apply the patch, that's their failure, not > > Microsoft's, but patching was not the only way to have curtailed this > > weekend's outbreak. > > But their failure leads to further intrusions elsewhere. Their failure > has consequences beyond their own borders. > > IMO, this is a herd immunity problem that Microsoft needs to get better at. > > > The analogy I would make here is the German versus the American approaches > to road fatalities. > > In the German approach, if there are significant road fatalities in a > given location, then that implies there is a failure with the way the road > system is engineered, and it needs to be fixed so that the number of > fatalities is brought down. No blame is automatically assumed on the part > of the drivers who failed at that location. > > In the American approach, if there are a significant number of road > fatalities, then it's the drivers own fault and they should have taken more > care. They are automatically to blame for their own failure. > > But if you're one of the other drivers out there who might be impacted by > the lack of due diligence practiced by another driver on the road, which > approach are you going to want to see implemented? > LOL. I think that is a really bad example and I see many facilities in it, including a hasty generalization, as intersections, and roads for that matter, in America have been resigned to improve safety. Isn't it true, with any tech product, the more complex features, the less secure it is? Ask yourself why this is the case, and I believe the true issue with tech lays there. If a country must build a China Wall duplicate in 300 days (for some reason, to save money lets say), unless the team can pull it off and depending upon how long it must be, the wall you end up with will probably have some holes in it or pieces of it may collapse at later dates. I don't know. It is hard to imagine a professional IT nowadays, seriously blaming Microsoft for every bad thing out there. What would be more of an interesting discussion, to me, would be why doesn't Microsoft know about these hoarding of vulnerabilities by State actors and plug them up? Are they really that clever of vulnerabilities? Does Microsoft not have the resources? Is Windows like the ocean, where there are just hundreds of new species awaiting to be discovered? Did Microsoft at least know of the NSA vulnerabilities, for example, and kept it classified until NSA told them to plug them up? -- Later, Joe