I don't work for Cisco or any other vendor of networking equipment, I'm an administrator. I am vendor neutral, I believe many companies have good and bad products, and I have dealt with tech support from many different companies. Cisco has the best tech support that I've encountered (so far) as I said before, although Marconi was very good too. A couple of times their engineers called me personally on TAC cases.
However, you can't deny the fact that Cisco used a very weak encryption method for it's local passwords on this VPN client. This is a conscious decision on their part, which I consider worse than a real "bug" which is usually due to an error or some other unintended consequence of the code. Sure, there are better ways of using this client that avoid the issue altogether, but why intentionally make a product that has a weakness? This is a question that has been getting more attention lately, so much so that some places are considering legislation that would make programmers liable for bugs in their software! Now I consider that ridiculous, but really, who should take the blame in the event sensitive information is stolen? Is it the programmers fault for not reviewing his or her code properly, is it the company's fault that produces the program, or is it the consumer's for buying it?
Point is, we as consumers shouldn't be satisfied with bugs and security vulnerabilities (e.g. Sony's rootkit), even as ubiquitous as they are becoming. I know it's probably an impossible ambition, but hopefully this attitude will bring use better things.
-Jeremy-
