Microsoft Blog Takes On .ANI Bug Post-Mortem
A program manager on Microsoft's security team wrote up a post-mortem on the .ANI vulnerability and how the bug worked its way from Windows 2000 all the way up into Windows Vista.
Michael Howard wrote a lengthy explanation in Microsoft's newly hatched Security Development Lifecycle (SDL) blog late last week.
"A core tenet of the SDL is to take and incorporate lessons learned when we issue a security update, and there is a great deal to learn from the recent animated cursor bug," wrote Howard. "SDL is not perfect, nor will it ever be perfect. We still have work to do, and this bug shows that ... we will update our education as necessary with lessons learned from this bug."
