it's kinda like, when your client has asked you for proposals to perform a certain action, you have to come up with all of the alternatives. One of the obvious alternatives that has to be included for completeness is "do nothing". That doesn't mean we recommend doing nothing, just that this is one of the alternatives. If (or should I say "when") Firefox vulnerabilities appear which only affect Firefox, one of the obvious alternatives is "do not use Firefox". Do you think that Microsoft critics will jump on THAT statement and say "CERT recommends anything but Firefox"?? I hardly think so.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/8998/27165#27165