I've been meaning to write about this for a year or so, but for some reason I simply keep forgetting to do it! There's a hidden message in WSC 2nd ed. Since the book's release, only one person has found it. Here's a clue: it's in plain sight :)

Every once in a while I come across an old piece of email, or a document I archived that contains a little nugget; well, I just stumbled on one on a backup DVD. Last year, Microsoft made available a tool named the File Checksum Integrity Verifier (FCIV...

I'm not making excuses, just stating facts. In fact, I just read this from SANS... emphasis is mine. http://www.sans.org/newsletters/newsbites/newsbites.php?vol=7&issue=19 Fixes Not Yet Available for Firefox Vulnerabilities (9 May 2005) Two...

My colleague, Window Snyder presented last week at CanSecWest about some of the 'fun' we had getting Windows XP SP2 out the door. You can read some of her comments and analysis at SecurityFocus. http://www.securityfocus.com/news/11115

As you are no doubt aware, a couple of pretty nasty security defects have been found in the latest FireFox bits that allow remote code execution. The IE team has made some very gracious comments here about the issue. The official word about the...

This is kinda cool - a Visio connector that hooks up to the output from the Microsoft Baseline Security Analyzer (MBSA.) From the blurb: At a glance, you'll be able to: Pinpoint vulnerabilities on the color-coded diagram. Identify solutions...

Just spotted this while catching up on (lots of) email. So what's new in the Second Edition? In addition to the expected error correction and clarification that always accompanies new versions, coverage of Windows Server 2003, including SP1 and Windows...

I think I've said this a billion times, but I'll say it again. No-one has done more research into integer overflow (and underflow, and truncation and signed-ness) issues than my good friend and co-author, David LeBlanc. So here's the great news - he...

A couple of months ago I presented at an event called the "Microsoft Technology Summit" to some very smart folks who focus primarily on non-Microsoft technologies. I outlined the security process stuff we're doing here (Security Development Lifecycle...