Freedom of speech

It's an oft quoted and utterly stupid statement that freedom of speech doesn’t include the right to shout "Fire!" in a crowded cinema. It does, if there is a fire.

Microsoft has problems with the way the latest flaw in their software has been publicised, and they have reason to be. Had this flaw been reported to them first they could have built a patch to solve it; as it is IT administrators have a rough weekend ahead.

There's considerable disagreement about how to deal with vulnerability reporting. Software manufacturers don't want flaws reported because it makes the hacker's job easier. Vulnerability testers want to make headlines and get business for themselves and claim if they didn’t publicise flaws then they wouldn’t get fixed.

There's a logical way out of this. If you find a flaw report it to the company. Give them time to find a patch, say three months, and then if there's no action release the news. When the patch is ready the person or firm who found the vulnerability gets the credit and administrators can deal with the problem immediately.

This latest announcement shouts of publicity hunting. So if you're thinking of hiring these people you might want to ask them to be a little more responsible next time.