@Enigma Oh, I know. The Windows engineer team would say on the SSIRP calls for DWM etc that that they know there’s a thousand unfixed variants of the same issue, but had nobody to fix them. So they’d wait until somebody reported it in active exploitation, then fix it months later.
Both that team and the team who find vulns should be properly resourced. Microsoft have the money to not ship defective product.
RE: https://cyberplace.social/@GossiTheDog/114504451845204949
An update - one good side effect of the GenAI boom is it’s forcing Microsoft to fix decades of under-investment in security engineering. The DWM stuff is finally getting patched each month.
