Microsoft will make the most from WannaCry

>as an opportunity to tell people they need to update their software.

How are defining update? I don't think anyone has issues with security updates but being force-fed a new version of Windows10 every 6 months is questionable especially when its a true re-imaging of the PC and a migration of apps and data, often screwing up in some way mostly with putting in older or buggy drivers that the end user has replaced with newer ones on the previous version. Every update has broke my trackpad on my laptop and badly hurt my gaming performance on my desktop until I could find the proper nvidia drivers. On top of having to deal with all the UI changes and other changes, none of which seem documented in a easy end-user digestible way. Also some of which have to be discovered by sysadmins like Win10 Pro now ignoring GPOs to block the store, for example.

I think MS is going to use anything to justify an evergreen Windows 10. I'm not sure that's a good thing. I'm not more secure with the current version with this issue patched compared to the previous version with this issue patched. Its the same level of security. I dislike it when companies disingenuously conflate feature updates with security updates. These are two entirely different things.

I think is Win10 moved at a much slower pace for feature upgrades, say every 12-18 months, people wouldn't be so wary of it. Instead, MS is forcing things down the throats of customers that are not desired or asked for. Worse, it validates a "ship and fix later" approach that will always lead to poor quality software.

Lastly, MS is just being downright dishonest. Most of the infected weren't Win10 or 8/7 users too lazy to update, but old copies of XP still in use. Those XP users have auto-update running, but MS has chosen EOL it. Fine, but don't browbeat Win10 users sick of endless and buggy feature updates because of it. The two have nothing in common.

>They could've released it before the NSA

They were looking for buyers this whole time. Perhaps you are unaware but there's an entire cottage industry of selling and buying of vulnerabilities out there. There are many zero days being sat on. No one is getting 'lucky.' They will be sold and used as needed by whatever group.

There seems to be this narrative developing about how this exploit is some rare thing. There are hundreds of serious exploits discovered in Windows a year and those are the ones we know about. There was no nation state involved with conficker, slammer, codered, heartbleed, etc. So its silly to focus solely on the NSA here. Exploits will be found, forever. We don't have the ability to make defect-free software.

The "web" button below title is intended for paywalled content.

Despite their posturing, how can we trust Microsoft (and other companies like it) ? Windows is a black box. How do we know that there are no backdoors/spying routines to please some governments ? How can we trust that it behaves ethically with all the data it collects ? We only have their word for it.

EternalBlue CVE-2017-0144 was [edit:allocated/reserved instead of "assigned" per tweet] 2016-09-09. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144

Source: https://twitter.com/_supernothing/status/864021595303456768

> MS has known about this bug since 09/2016 (when CVE was assigned) and patched in 03/2017. 240day