It's actually becoming an ad hoc standard for vulnerability risk assessment, used by many non-MS-oriented camps of security professionals.
The same can not be said for the STRIDE system for classifying the type of vulnerability, which is obtuse and and disjoing... better approaches are the OWASP top 10, and the WASC vulnerability classification system.
In downloading patches and software from various MS sites (support, MSDN, etc), I frequently have to ignore the warnings that an SSL certificate digital signature is not signed by a Certificate Authority, but instead is signed by Microsoft. Given the fact that it is not unprecidented for a Microsoft site to become compromised (even temporarily), isn't this practice putting loyal customers at risk?
Also, it is the absolute exception that MS provides an MD5 or other hask to be verified via FCIV.exe or other utility to protect at least "power users" from running a trojaned binary. Why isn't there a comprehensive policy for in place for displaying validation hashes? With a little automation, it would seem the cost to fully adopt this practice would be pretty low for MS.
so the changes are encouraging and certainly a product of apache's capabilities... however, the programming model is limited to C++, not C# and other managed languages... and in talking to members of the IIS team at PDC, it sounds like there is no way to multi-instance if you want to chain reverse proxies, etc.
Slashdot Mirror
Damage potential
Reproducibility
Exploitability
Affected Users
Discoverability
It's actually becoming an ad hoc standard for vulnerability risk assessment, used by many non-MS-oriented camps of security professionals. The same can not be said for the STRIDE system for classifying the type of vulnerability, which is obtuse and and disjoing... better approaches are the OWASP top 10, and the WASC vulnerability classification system.
In downloading patches and software from various MS sites (support, MSDN, etc), I frequently have to ignore the warnings that an SSL certificate digital signature is not signed by a Certificate Authority, but instead is signed by Microsoft. Given the fact that it is not unprecidented for a Microsoft site to become compromised (even temporarily), isn't this practice putting loyal customers at risk? Also, it is the absolute exception that MS provides an MD5 or other hask to be verified via FCIV.exe or other utility to protect at least "power users" from running a trojaned binary. Why isn't there a comprehensive policy for in place for displaying validation hashes? With a little automation, it would seem the cost to fully adopt this practice would be pretty low for MS.
so the changes are encouraging and certainly a product of apache's capabilities ... however, the programming model is limited to C++, not C# and other managed languages ... and in talking to members of the IIS team at PDC, it sounds like there is no way to multi-instance if you want to chain reverse proxies, etc.