I agree, optional auto-patching is a good idea for server based products. But MS being a hypocrit because they didn't patch every server, hmm, donno bout that. There must be 20,000 employees at MS spread all over the world. To expect everyone of them to perform the same way...I'm sure there were a lot of servers that MS did patch, but like everyone else, they missed some. The point is, they released a patch, then a patch that messed it up, then a service pack, before the worm hit. They could have done a better job, but the did do their job and fixed it. If you had removed the human equation and had patching automated, then maybe Slammer wouldn't have done much damage. In most cases of large attacks on known exploits, I place blame on the admins, not the software company. While our SQL servers weren't exposed to this problem, our network still went down because we had a hole in the firewall, and something else got through. My bad! I fixed it, and life moves on. The hole exploited a Win2k machine vulnerability, but I dont blame MS, cause it was my fault for leaving the hole open on the firewall.
|