Barney's Blog

Blog archive

Microsoft Not the Only Technology with Holes

Critics love to beat up on Microsoft for its security. But in its defense, Redmond is clearly the biggest and most fun hacker target. It also has a ton of products. So it makes sense that holes will be found and attacks mounted.

Microsoft, at least once a month, discloses (and closes) these holes in a very public way. Meanwhile, the Web has no Patch Tuesday, and consequently its holes can stay open for a long, long time.

In fact, according to security concern Cenzic, some 70 percent of the Web apps it looked at lacked secure communications. Two-thirds of these apps were deemed "easily exploitable." In many cases, there's no system in place or real plan to improve Web security and plug holes. The two biggest vulnerabilities, Cenzic reported, are SQL injections and cross-site scripting.

Posted by Doug Barney on May 14, 2008


Featured

  • Microsoft Offers Support Extensions for Exchange 2016 and 2019

    Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Notebook

    Microsoft Centers AI, Security and Partner Dogfooding at MCAPS

    Microsoft's second annual MCAPS for Partners event took place Tuesday, delivering a volley of updates and directives for its partners for fiscal 2026.

  • Microsoft Layoffs: AI Is the Obvious Elephant in the Room

    As Microsoft doubles down on an $80 billion bet on AI this fiscal year, its workforce reductions are drawing scrutiny over whether AI's ascent is quietly reshaping its human capital strategy, even as official messaging avoids drawing a direct line.