2025-05-14 00:01 UTC
@GossiTheDog@cyberplace.social the alternative answer might disappoint... that there is active security auditing, and active bug filing by security teams at Microsoft, but the product team has conflicting priorities to balance against fixes...
My biggest soap box has always been, 'adding more security people, doesn't make software more secure... better alignment, prioritization, and resourcing for defect accountability in engineering does.'
Replies (1)
-
@GossiTheDog@cyberplace.social 2025-05-14 05:07
@Enigma@infosec.exchange Oh, I know. The Windows engineer team would say on the SSIRP calls for DWM etc that that they know there’s a thousand unfixed variants of the same issue, but had nobody to fix them. So they’d wait until somebody reported it in active exploitation, then fix it months later. Both that team and the team who find vulns should be properly resourced. Microsoft have the money to not ship defective product.