Donkey On A Waffle
Patches, Advisories, and PR - OH MY!
Mon, 09 Jul 2007 15:19

Today has been a very interesting day. I've been up to my ears in advisories, found out my body is the age of a 40 year old (and I'm only 32), and that the California Franchise Tax Board are nothing but a pain in the arse.

Tomorrow is patch tuesday for Microsoft and I'm coordinating a vulnerability that will be released tomorrow. It's unbelievable the amount of work that must go into the "responsible" public disclosure of a vulnerability, especially one that is a biggie like this one. I didn't find the vulnerability myself, however I am one of the leads of the vulnerability release group for my organization and as such am tasked with organizing and running the process of disclosure. Trust me when I say that companies like iDefense and TippingPoint are doing a GREAT service for the researcher out there, and paying them to boot!

Releasing an advisory is an insanely complex thing. Not only do you many times have competing interests at stake (finder vs. vendor), but you also have to take into account the best interest of the general public regarding the disclosure of a particular issue. Add to that the business issues of being part of a large security consultancy and the fact that the vulnerability may have been discovered in the course of work for a client on a product that isn't even THEIRS!. Talk about complex. Then remember that you have a HUGE IT shop internally that may be using this product and want to be patched on day one coupled with any PR fallout that may happen, and you have sufficient evidence that vulnerability disclosure can be an exponentially growing headache. At least the next few in our release queue aren't as PR heavy as this one and should be a lot easier to get out the door.

On a "not so lighter note", I also found out that my body is the body of a 40 year old, when in reality I'm only 32. While I saw it coming, this definitely stings a bit. On the bright side, I know what needs to be done to fix the problem and am tackling it head on as we speak. Hopefully in a year's time I will go from 40 years old to somewhere near 33. Not everyone can say they are getting younger every day and really mean it! Otherwise, I'm just hoping not to kill myself in the process.

Finally a big FU to the California State Franchise Tax Board. From all of the hard working people out there you can just eat my ....

A little humor to finish this post:

This is the best book dedication I have ever seen! Pedram rocks!

Dedicated to George W. Bush

Thanks Jeremiah for digging this link up.