Rupert Goodwins' Diary
If you've ever worked in technical support, you'll know the two stages of escalation. The first is RTFM, which as everyone knows stands for something like Read The Flipping Manual. The second, after the hapless user has RTFM and called back, is TSMYOYO -- Tough Sheep Mate, You're On Your Own.
All good fun. But if you're relying on security software -- oh, let's say ISS's BlackIce or RealSecure -- to defend yourself from a nasty beastie -- the ill-named Witty worm, for the sake of argument -- and you subsequently find that the worm takes advantage of a known flaw in the products, you may be less than impressed to get TSMYOYO when you try and get the patch. Actually, the correct phrase may be PUOFO -- Pay Up Or Flip Off -- as ISS would only supply the fix to people with a current maintenance contract.
Oddly, lots of people found this unacceptable. Neuzhund Munir Kotadia got wind of this dissatisfaction, and promptly wrote it up as a story -- not before checking with the company, of course. ISS was adamant that a maintenance contract was essential for getting a patch -- and moreover that "if you don't pay maintenance, you aren't allowed to use the product any more".
For some reason, the appearance of Mun's piece caused some conniptions in the ISS hierarchy. Further communications flowed. Of course people could download the patch regardless of maintenance status, the company, er, clarified. This had always been company policy. A senior executive called from the US to say that the original spokesperson had been 'confused'. And we were happy to relay this happy news to a relieved world.
Which would be fine and dandy, except for two things: that the free patch offer runs out in about a month, and that even while Mun was talking to the exec on the phone, the company's PR was forwarding an official statement confirming that there had been a change of policy. "In response to the recent security issue discovered in some of our products, ISS is offering a free update program to protect customers. This program will be extended to all customers regardless of maintenance contract status." the email said.
Fortunately, BlackIce and RealSecure customers now have a clear upgrade path. They can download the free patch, and have a month in which to find alternative security software. We suggest they look for vendors which don't try and use flaws in their products to extract more money, preferably ones who can at least get their story straight when they're talking to journalists.