1/4     http://news.cnet.com/news/0-1005-200-8358574.html?tag=mn_hd
        \_ Did nweaver post this because he was quoted in the article? :-)
        \_ This guy picked the Christmas week to notify AOL and then claimed
           waiting for a week is too long.  Hmm.  Maybe he just wanted the
           publicity.
           \_ The article I read said that AOL didn't even bother to respond
              to him.  It's not just that they didn't fix it in the first
              week after he reported it -- they didn't even acknowledge that
              the problem *existed*.  Then when he goes public they fix
              it in 24 hours?  Sounds like he was right to go public.
                \_ At most tech companies, there was no one around to respond
                   to anything from Dec. 22 - Jan. 1.
                   \_ Sounds like the best time to exploit a hole :)
                   \_ I can't think of any legitimate reason for their
                      escalation path for security problems to be broken,
                      even for holidays.  Whether they failed to respond out
                      of arrogance or incompetence doesn't make much of a
                      difference.
                      \_ suppose you find a major security hole in AIM.  Whom
                         do you email?  Does AOL have a special email address
                         hotline for reporting critical exploits?  Do they
                         publicize it?  I'd guess that the answer to at least
                         one of those questions is "no".  So now you're left
                         with filing a bug report using the standard support
                         channels, which most likely get flooded with mail from
                         clueless newbies.  Do the real developers field all
                         these questions, or does a low-paid grunt deal with
                         them?  Does this support grunt check email every day
                         during his vacation?  give him a break.
                         \_ When I call AOL tech support, I usually
                            get prompt and complete service. signed, AOLuser
                         \_ You send it to support.  It is the responsibility
                            of their support organization to classify the
                            incoming report correctly and advise their
                            management so they can direct it to the
                            appropriate engineers to repair.  An organization
                            the size of AOL doesn't have a single support
                            grunt who goes on vacation and leaves the support
                            email unanswered; they have a large group of
                            people processing incoming support requests, and
                            there's always somebody there.  The front line
                            people have more senior people they can escalate
                            things to (usually multiple levels).  Even during
                            holidays and weekends, there should be somebody
                            on call in engineering capable of addressing the
                            problem.  Coordintaing support and engineering like
                            this is hardly a problem unique to AOL.  Oh, and
                            AOL never said they hadn't seen it; they said
                            they wanted more time to work on it.