Re: US-CERT Vulnerability Note VU#800113

On Fri, Jul 25, 2008 at 3:15 PM, Bill Larson <email@hidden> wrote:

On Jul 25, 2008, at 9:44 AM, Dave Pooser wrote:

If you come away from this discussion with one lesson, let it be that

you better be prepared to patch things yourself.  Apple has mislead

the newbies into thinking that everything is covered for them.  It

isn't.  My recommendation is: start reading those O'Reilly books and

really understand what's going on under the hood.  You can't expect

vendors to bail you out every time.

...although vendors who are not Apple did in fact bail their users out this

time. Apple stands essentially alone in *not* bothering to patch this gaping

vulnerability. And if I wanted to compile my own software every time I

needed an update, I'd use Fedora.

Not defending Apple, or Fedora, just making a statement.

I am reading the CERT notice about this.  At the bottom is a list of vendors and the status of their DNS server software.

Apple was notified by CERT on 05/05/2008 and they have NOT responded at all.  Personally, I think this is inexcusable.  They could have given any number of responses to CERT but provided the single most worst response possible.

Bill Larson

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

For fun, I submitted a radar security bug about the vulnerability, will see if it is closed or what the duplicate ticket is.

--
Chris Barker
Purveyor of Fine Suggestions
ACSA