Now, let me see. Have hundreds of thousands of pages been hacked? Yes, they have. Were the pages stored on IIS, the Microsoft Web server software? Yes, they were. Did they involve SQL Server, the Microsoft database management system? Yes, they did. When you put that all together, what does that mean? To me, it means that Microsoft products have been hacked and that damage has been done.They can say, I suppose, that it is not their fault. They can also say that the Earth is flat. It is hard, however, to see how either can be true. It’s their software and the attacks were successful. Oh, wait, I get it! Microsoft has simply decided that they have no mandate to provide us with secure products! That’s what it means! They sell leaky products that allow your system to be hacked, but they never intended, I guess, to sell software that was secure. That must be it!
Or, it may just be that the folks at Microsoft just figure that we are lied to every day by politicians, people trying to sell us things, people trying to get their hands on our money, and everybody else with an ax to grind, so they may as well join in. From their point of view, I’m sure that makes sense. From mine, it does not. It just reinforces the uncaring image that Microsoft has so rightfully acquired.
The problem has nothing to do with Microsoft's software, it's lazy web developers not properly sanitizing their database inputs. No patch from Microsoft will be able to fix this flaw, it all has to be done by web developers to fix security holes in how their site's code handles data inputs. I'm sure the attack could be just as easily preformed on another type of server, just the database commands would have to be changed up a bit.
Posted by: Anonymous | April 28, 2008 11:44 AM | Permalink to Comment