And that's a big problems with IIS. Microsoft 1) denies many problems 2) minimizes their risk 3) puts out fixes when they feel like it.


You missed:

4) Gets pissed (and pissy) when someone points out their foibles, and publishes a scenario where the defect can be exploited.

Once all the bluster and bullshit they spout about their hurt feelings subsides, 4) tends to cause 3) to occur with shorter lead time than would otherwise be the case.

(I wish I could find the link to the Register article about this...)