Tom Ferris Quotations

Microsoft obviously takes way too long to fix flaws, ... All researchers should follow responsible disclosure guidelines, but if a vendor like Microsoft takes six months to a year to fix a flaw, a researcher has every right to release the details.

I have been e-mailed a couple of times by people asking for an exploit. This tells me the Trojan writers are out there looking for something.

It's not like any other flaw in IE?it's definitely different.

I'm guessing they are working on a patch. Who knows, though?

I am walking a fine line, but I am doing it very carefully because I am not disclosing actual vulnerability details, ... I do this to inform users that flaws still do exist in IE...I don't like it that Microsoft tries to give users a nice warm feeling that they are disclosing everything researchers report to them.