The Costs of Patching

prestidigital writes "vnunet has a brief but interesting article in which Craig Fiebig, general manager of Microsoft's security business unit, is quoted as saying "In dollar terms, patching is the most expensive security measures and keeping your antivirus descriptions up to date is the least." That seems like an important statement coming from a company who's patches are possibly responsible for 45% of traffic on some networks."

Comments

Wow...it took them this long...

[Fallen Kell]

... to realise that it costs more to do things 2, 3, or 4 times then if they had done it right the first time...

And that is costs more to have a new programmer look at and try to modify code that wasn't written by himself/herself...

Amazing reality breakthrough!

Re:Wow...it took them this long...

[Blaine Hilton]

Is this going to be how they justify paying for huge license fees?

Re:Wow...it took them this long...

[Surak]

The real cost, aside from downtime, is in the integration testing of those patches. If you don't do the integration testing, the cost is potentially even HIGHER because you don't know what those patches could break. Unfortunately, doing proper integration testing means you end up way behind the curve in terms of the patch cycle, which ultimately means an even greater risk of attack.

So you're damned if you do and you're damned if you don't.

Hey, I know, maybe Microsoft could do this new thing called PROPER BETA TESTING, and then maybe the could get it right THE FIRST TIME!

Nah, that'd be too easy. ;)

Re:Wow...it took them this long...

[JDizzy]

That is exactly the issue we face at my large coorporation. We finally got to the point that we download the patches centrally, create a mega-patch consiting of the various Qxxxxxx patches from MS, and then test those on a staging server that minics various vital functions thoughout the enterprise. We had problems with loose cannons going around and appling windows-updates to production servers that then had problems with a certain piece of software, or what not. Anyways... you right.. half the time spent by MS techs is quality testing the patches.

Re:Wow...it took them this long...

[rf0]

My personal feeling is this is due to the development cycles. Now I'm not saying that people can produce bug free code but I can't help think that more quality control would avoid some of these. Surely some automated testing could be done on some sort of security holes

Rus

Re:Wow...it took them this long...

[jlusk4]

Hey, I know, maybe Microsoft could do these new things called DESIGN REVIEW and CODE REVIEW, rather than trying to test out bugs.

(Maybe Microsoft isn't the only guilty party here, either.)

Re:Wow...it took them this long...

[4of12]

You make a good point. MyCorp has a group that does this kind of testing, too.

It's one thing for MS to bring out patches and to test them with a handful of recent applications. (Lessee, works with the latest IE, Office, IIS, - I think we're good to go!)

It's a local burden most companies face, using a range of applications and systems, testing the exact same patches to make sure they don't inadvertently break an important local application.

I have to believe that if MS made good, hard, well-defined, well-behaved, well-documented interfaces in their software that needs for local patch compatibility testing would be less than what they are.

Re:Wow...it took them this long...

[vsprintf]

Hey, I know, maybe Microsoft could do these new things called DESIGN REVIEW and CODE REVIEW, rather than trying to test out bugs.

You must have missed it. After Bill declared a new focus on security, they did a code review -- one month of review for twenty years of code. The next code review is scheduled for 2022. :)

Re:Wow...it took them this long...

[Anonymous Coward]

Don't be an idiot. Writing an OS is no easy feat, and debugging the beast probably takes years. Other operating systems are not without their own bugs, but Microsoft's are merely the most visible, due to the enormous number of users.

Plus you have the /. crowd who rather suprisingly always choose to harp on the biggest/bestest. I say suprisingly because most of you in highschool prolly took all the beatings from the dumber kids in the class because you were the smartest. Nice to see you learnt your lesson and go after all the other poppies.

Re:Wow...it took them this long...

[Anonymous Coward]

I've been very amazed that Microsoft can keep putting out patches for such a wide variety of environments and have them work. What they are doing is quite complicated. That they admit it is difficult is something I guessed and now it has been confirmed.

I work for a software company which holds the quarterly profits as the holy grail. If you don't get it done this quarter, you might lose your job. So, buggy software gets put out as a result. Then we spend more time later deciding if and when to patch, and how many hours, people it will require. Sometimes patches aren't created because it would take away from next quarter's revenue. And so the cycle goes.

I'd like to see the stock market disappear and companies get back to producing quality products, not crappy products on a deadline.

Also known as...

[Evil Adrian]

This statement is also known as "an ounce of prevention is worth a pound of cure."

Re:Also known as...

[bricriu]

Or, "a stitch in time saves nine."

Re:Also known as...

[Anonymous Coward]

Or "why buy the cow when you can get the sex for free?"

Re:Also known as...

[Angry White Guy]

Dad, is that you?

Re:Also known as...

[Doodleman3]

And for those of you who live in Canada it's "a gram of prevention is worth a kilo of cure"

Re:Also known as...

[Anonymous Coward]

Or how about an ounce of windows is worth a pound of crap...
ok, i know I'm deserve a troll ranking for that one...i'll go back to my cave now

Patching has saved my hundreds of dollars

[Anonymous Coward]

Rather than throwing away an otherwise perfectly good pair of pants, patches have allowed me to fix them and extend their life. In some cases, patches can even be fashionable. Sewing is a great skill that all geeks should learn.

Re:Patching has saved my hundreds of dollars

[Frank of Earth]

Would darning socks also be a desirable skill for geeks to learn?

Re:Patching has saved my hundreds of dollars

[Ravenscall]

Well, it certainly is more socially acceptable than damning them

Re:Patching has saved my hundreds of dollars

[iabervon]

Pants are easy to patch, and well worth it. All of the Microsoft systems I've tried to patch have gotten really screwed up as soon as I stuck the needle through them...

Re:Patching has saved my hundreds of dollars

[AnotherBlackHat]

Sewing is so 18th century.
Iron on patches are quicker and easier, and you can attach them with nothing more than a heat gun.
But duct tape is still the best IMO.

-- this is not a .sig

Re:Patching has saved my hundreds of dollars

[rf0]

Remeber you can increase the life of your pants further by wearing them both back to front and inside out

Rus

Re:Patching has saved my hundreds of dollars

[stefanlasiewski]

Well, it certainly is more socially acceptable than damning them

From their silence, we can tell that the socks don't care one way or another.

Re:Patching has saved my hundreds of dollars

[more fool you]

i'd say the socks don't give a darn

Re:Patching has saved my hundreds of dollars

[Anonymous Coward]

Perhaps all the damned socks run away, never to be seen again. That would explain why it seems like there's always one missing from loads of laundry.

Re:Patching has saved my hundreds of dollars

[stefanlasiewski]

Hillarious... I really missed my chance at a good pun! How could I have missed it!

Re:Patching has saved my hundreds of dollars

[laughing_badger]

Yep. The only time I've been in the position to say 'Damn, my pants.' I certainly wasn't socially acceptable. Furthermore it was drafty!

Patches

[Anonymous Coward]

Using the patch is about as expensive as smoking, but will be more benificial in the long run because after a while, you'll be done with the nicotene forevar and not need to buy patches no more.

Re:Patches

[Anonymous Coward]

Good god.. why in the world is this "Insightful" ? I knew /. mods didn't read the articles before posting (hence the dupes) but now thats been extended to posts too?

Re:Patches

[tshak]

And, if there was a way to do a patch "rollback", then faulty patches wouldn't bring down a system until a new fix-patch was released.

For at least the past few years each patch has been removeable via the Add and Remove programs interface. A much more elegant and stable system debuted in ME (ironically), and is very robust in XP called "system restore". Before any system changes (like a patch) occur, a "snapshot" is automatically taken of the system. You can then rollback the changes if problems occur after the patch is applied.

Re:Patches

[freeweed]

(One of the recent MS patches was found to cause some machines to stop booting)

So just don't re-boot your machines.

Oh wait..... :)

Re:Patches

[Anonymous Coward]

Umm... I've had XP remain hosed even after a "system restore" to supposedly pre-patch state.

Re:Patches

[Anonymous Coward]

I guess we can cut down on the expenses we pay for schools, since there doesn't seem to be no larnin' there no more... ;)

Cost of not patching?

[rhfrommn]

The difficult question is whether the costs of patching outweigh the costs of NOT patching. There's a lot to be said for "if it ain't broke, don't fix it" sometimes.

However, with security patches usually you have no choice. The only decision for some security patches is how long do you wait before deploying it. Don't wanna be the first ones to put a bad patch on now, do we?

Re:Cost of not patching?

[H310iSe]

Whenever deploying new patches OR antivirus DAT files (they cause havok as well) we did a full regression test of the standard desktop image.

Fist a high level person would look at the patch (usually using install shield's application repackager), read the documentation, etc. and look for possible conflicts with the production environment. This took between 2-4 hours per patch x $60/h. The regression test took one lower-level tech about 2 days to do. We'd lump a few patches together so say 1 tech x $40/h (at least, w/ benefits, etc.) x 2 days / 3 patches per test = about $213/patch + eval ($180 per patch) = around $400 per patch to test. Deployment took another hour to write the install script (rarely did we rely on MS's installer alone), 1 hour to document and send to the regional offices and each office probably spent an hour implementing the thing. Total cost around $600 per patch for a 1,000 desktop, 11 office environment.

Now you know.

Re:Cost of not patching?

[B3ryllium]

Fist a high level person

Yeah! That's right! Fight the power!

Re:Cost of not patching?

[Cyberdyne]

The difficult question is whether the costs of patching outweigh the costs of NOT patching. There's a lot to be said for "if it ain't broke, don't fix it" sometimes.

For the usual "feature" patches ("This patch adds pretty shiny things to the edge of your window"...), you're absolutely right: making any kind of large-scale change (like putting a new patch on 1000 machines) is a big deal. Even if it's all automated via network management tools, you'll need to test, prepare and then support it. Do you really need that little tweak added?

However, with security patches usually you have no choice. The only decision for some security patches is how long do you wait before deploying it. Don't wanna be the first ones to put a bad patch on now, do we?

That's a tough one. Deploying a patch seems like a big hassle, especially when you need to test it thoroughly and have a fallback option if it fails. Big hassle, that is, up until it's too late and you have to clear out a few dozen CodeRed or Nimda infected machines! Like insurance: seems too expensive, right up until you actually need it...

Of course, they don't seem to mention the alternative, of not needing to patch ;-) As Bernstein says, reliability means never having to say "sorry" - and never having to patch, either!

Re:Cost of not patching?

[pmz]

The difficult question is whether the costs of patching outweigh the costs of NOT patching.

The lowest cost method of patching Windows is to use the special one-time CD-ROM distributions available out there that fix Windows once and for all. I can recommend several brands: Slackware Disk 1, Red Hat Disk 1, Solaris Install Disk 1, and OpenBSD Disk 1. There are other very good ones, as well, but they all have about the same level of Windows-patch elimination power.

Re:Cost of not patching?

[Johnny Mnemonic]

The only decision for some security patches is how long do you wait before deploying it.

That's not quite the only choice--you have two other choices: adopt Linux; adopt Macs. If the cost of patching is really that great, it raises the cost of the machine--until maybe purchasing a Mac isn't all that expensive after all.

Re:Cost of not patching?

[PhilHibbs]

Good grief, I remember the spat between Novell and Microsoft back in '93, IIRC, when Microsoft poked fun at Novell for the number of patches that had been issued. Novell claimed that NetWare was superior because they admitted that no software was written perfectly first time, and faced up to their security obligations responsibly. Now it looks like the positions have reversed!

Re:Cost of not patching?

[Joe the Lesser]

Somehow reminds me of this scene...

JACK (V.O.)
I'm a recall coordinator. My job was to apply the formula. It's
simple arithmetic.

TECHNICIAN #1
Here's where the baby went through the window. Three points.

JACK (V.O.)
It's a story problem. A new car built by my company leaves Boston
traveling at 60 miles per hour. The rear differential locks up.

TECHNICIAN #2
The teenager's braces locked around the backseat ashtray. Kind makes a
good "anti-smoking" ad.

JACK (V.O.)
The car crashes and burns with everyone trapped inside. Now: do we
initiate a recall?

TECHNICIAN #1
The father must've been obese. See how the fat burned into the
driver's seat, mixed with the dye of his shirt? Kind like modern art.

JACK (V.O.)
You take the number of vehicles in the field (A) and multiply it by the
probable rate of failure (B), multiply the result by the average
out-of-court settlement (C). A times B times C equals X. If X is less
than the cost of a recall, we don't do one.

INT. AIRPLANE CABIN - TAKING OFF - NIGHT

Next to Jack, a chubby, middle-aged LADY gawks at him, appalled.

LADY ... Which ... car company do you work for?

JACK
A major one.

Re:Cost of not patching?

[Overly Critical Guy]

Then you'll get to have fun updating libraries whenever you want to install something, as well as patching BIND, sendmail, the kernel, etc.

Next.

Re:Cost of not patching?

[stefanlasiewski]

you have two other choices: adopt Linux; adopt Macs.

From a patching perspective. Why would this cost less? Macs and Linux still require patching, because ALL software has bugs.

Macs especially: Buying a whole new computer is more expensive then using your existing hardware. I don't see where you get the "Mac is cheaper" argument.

Re:Cost of not patching?

[rhfrommn]

I don't buy that argument (although you may just be joking).

I'm a Solaris admin and have no love for Microsoft. But even I have to admit that all operating systems need patches. Solaris does, Microsoft does, every version of Linux does. Just changing to another OS won't solve all your patching problems. I'll grant you that Microsoft seems to be worse than average in terms of number of patches needed and the hassle involved so changing may definately be a good idea. It just isn't a complete fix.

Re:Cost of not patching?

[pmz]

Then you'll get to have fun updating libraries whenever you want to install something, as well as patching BIND, sendmail, the kernel, etc.

It doesn't have to be all that bad. Packages are relocatable, so unusually sensitive applications can be put into their own root directory hierarchy. Using NFS wisely can allow for one set of applications on a network (patching once and only once is quite nice). Only one or two servers on the whole network should be running Sendmail and BIND in a vulnerable mode. UNIX is also easier to pare down, so there are much fewer things that need to be patched. With a good network design, patches can be rolled out automatically over SCP, and UNIX machines tend to reboot pretty reliably, unless a patch screws up an init script.

It is just a simple fact that UNIX is less complex than Windows. It has fewer lines of source code, more transparent modularization, strict separation between the GUI and the kernel, widely available and thorough documentation, three decades of experience behind it, almost complete scriptability, among other things. Windows, on the other hand, is as opaque as mud--there could be a golden city under there or just more mud, but we'll never know.

Re:Cost of not patching?

[pmz]

I don't buy that argument (although you may just be joking).

I'm partly joking. Windows is a much higher-risk venture than any UNIX/Linux/BSD system I'm aware of.

Re:Cost of not patching?

[flink]

I wouldn't say that fisting a high level person is fighting exactly...

Re:Cost of not patching?

[freeweed]

Because this is Slashdot, where if you suggest migrating *anything* to Linux, you automatically get modded up. Even if it's an organization running on Commodore 64s, 'install Linux' is somehow insightful.

Considering the ease of use and effectiveness of the latest Samba exploit, anything thinking Linux machines are somehow magically more secure and cheaper than Windows machines is kidding themselves. It's all about how you configure/maintain them.

Re:Cost of not patching?

[luzrek]

Quick Question:

Does anyone use a MAC as an enterprise level server?

As far as a comparison between GNU/Linux and Windows, GNU/Linux patches have a couple of big advantages. First, they don't require turning off the machine, so there is much less downtime. Second, you can install them so that they can be "undone" in case there is a problem. Third, they ussually come out much faster when a security flaw is discovered relative to Windows patches. For example, there was a flaw which afflicted Konqueror (or was it Mozilla?) and Internet Explorer. The open source one had the patch avalible the next day, Microsoft at first denied it, and then took three months to provide the patch. Finally, if you are sufficiently familiar with a system running an OSS OS you can fix the problem yourself instead of waiting for someone in Redmond to figure it out (or get around to it).

Re:Cost of not patching?

[jpetts]

There's a lot to be said for "if it ain't broke, don't fix it" sometimes.

But the geek motto is "If it ain't broke, fix it till it is".

Re:Cost of not patching?

[jpkunst]

Does anyone use a MAC as an enterprise level server?

No. But there might be someone who uses a Mac as an enterprise level server.

Re:Cost of not patching?

[VGPowerlord]

Of course, they don't seem to mention the alternative, of not [openbsd.org] needing [cr.yp.to] to [kernel.org] patch [freebsd.org] ;-) As Bernstein says, reliability means never having to say "sorry" - and never having to patch, either!

Wow, so you're saying that there's no reason for me to use the Linux 2.4.20 over the 2.4.0 kernel? or the 2.2.0 kernel? or the 2.0.0 kernel?

If you'll tell me the IPs of some of your machines, I'll be glad to crack them for you!

Re:Cost of not patching?

[stefanlasiewski]

Does anyone use a MAC as an enterprise level server?

I've known a couple of businesses in San Francisco who have server farms made up of the dual-CPU Xserve machines. These are big dotcoms who are still in business, so I'm not sure if that qualifies as 'enterprise level'.

Good deal. Cheaper then their Sun machines, and you have good support. Downsides: No SCSI, no serial terminal, and no HW raid options (This was before Apple released their Xserve RAID).

This was an experiment to see if Xservers could be cheaper then the Sun options. Not sure what their decision was.

Re:Cost of not patching?

[tupps]

I just read a story about an ASP in Australia that is hosting its site on XServe boxes. It is graphic design related and hooks into Quark and InDesign, but the whole site is hosted on XServe not just the InDesign stuff.

Re:Cost of not patching?

[Overly Critical Guy]

It is just a simple fact that UNIX is less complex than Windows.

Microsoft's R&D department is laughing at you.

Re:Cost of not patching?

[Cyberdyne]

Wow, so you're saying that there's no reason for me to use the Linux 2.4.20 over the 2.4.0 kernel? or the 2.2.0 kernel? or the 2.0.0 kernel?

If you'll tell me the IPs of some of your machines, I'll be glad to crack them for you!

Really? Name a kernel security hole which would give you root access, without any services running. I think you'll have a hard search! Linux was probably the worst of the four links for security (not sure about FreeBSD) - but, as their website proudly boasts, OpenBSD has had one single remote vulnerability in 7 years. The Linux kernel, of course, has had none (since there are no services, there's virtually nothing to exploit!)

Whichever you choose, though, you'll be doing far, far less patching than you would with an equivalent WinNT/2k/XP system. Bernstein's code on an OpenBSD system? Almost no patching ever needed; you could have a 7 year old machine, having been patched slightly once (or just disable SSH!) and you're pretty safe.

Incidentally, my 2.4.x machine is on 192.168.0.100. Cracking it may prove challenging for you...

Re:Cost of not patching?

[Anonymous Coward]

$40/hr for mid-level tech?

And what market are you in?

Re:Cost of not patching?

[Bedouin X]

How has Netware reversed this position? Because they don't release NEARLY as many patches as MS?

Re:Cost of not patching?

[VGPowerlord]

Incidently, although the kernels were explicitly mentioned for those, I have yet to see a system operate with only the kernel itself installed.

Other things that are a requirement to installing programs, such as glibc, have had major security holes in the past.

Re:Cost of not patching?

[goonda]

I agree in theory, but working at a financial services company with significant investment in Unix, specifically Solaris and HP-UX, the perspective is quite a bit different. This is due to the fact that we have literally _thousands_ of third-party and homegrown apps for various financial systems. Some of these have been written by consultants, contractors, other folks who have since moved on, etc. Without doing proper integration testing, you are fscked, because it becomes almost impossible to know what apps you might impact. So basically, everyone is behind the curve in this area. Like the other poster said, I have no love for MS, but every sysadmin must deal with patching whether they like it or not, and accept the fact that they'll almost always be behind the curve.

Re:Cost of not patching?

[_Sprocket_]

Microsoft's R&D department is laughing at you.

It's probably more of a nervous chuckle than a laugh. After all, Win2003 developers are paying attention. To the point:

Why is there no command line only version?
We're looking longer term to see what can be done, looking at the layers and what's available at each layer and how do we make it much closer to the thing the Linux guys have -- having only the pieces you want running. That's something Linux has that's ahead of us, but we're looking at it. We will have a command line-only version, but whether it'll have all the features in is another matter. A lot of the tools depend on having the graphical interface. Printing, for example, requires all the graphics subsystems because we have the "what you see is what you get" model. You need to have the whole of the display stuff to render it. It's a very tangled subsystem.

Maybe there's something to that whole simplicity idea.

Re:Cost of not patching?

[PhilHibbs]

Microsoft said Netware was poor because of the number of patches, Novell say it's good because they are fixing the bugs.

Now, Microsoft say Windows is secure because of the number of patches, whereas "Novell states Microsoft has released 310 patches in the last four years..." which I read to mean that Novell are poking fun at MS for the number of patches released.

Re:Cost of not patching?

[Cyberdyne]

Incidently, although the kernels were explicitly mentioned for those, I have yet to see a system operate with only the kernel itself installed.

Care to tell that to my firewall? The kernel is fully capable of acting as a firewall without any userspace services running. (You still need some kind of init script to configure interfaces, but there is no security exposure there: they aren't network services.)

Other things that are a requirement to installing programs, such as glibc, have had major [cert.org] security [cert.org] holes [cert.org] in the past.

Funny, my firewall's boot floppy doesn't seem to have glibc on. Or any network applications accessable from the Internet: being a firewall, that's all firewalled off.

Yes, glibc blows from a security point of view. That's why I didn't include it in my links above! Ditto wu-ftpd, BIND... - but it's entirely possible to run a system without any of that crap. Especially a desktop system: WTF would I need an FTP or DNS server on a desktop system for? Strip out all the services, and even the oldest of unpatched RedHat systems will be secure from network intrusion - not so Windows, thanks to ActiveX, Windows Scripting Host and Outlook!

Re:Cost of not patching?

[Anonymous DWord]

That's pretty silly. Everyone knows if you're running Commodore 64s, you install NetBSD.

Re:Cost of not patching?

[kesuki]

Well, depending on the high level persons sexual prefereces fisting them might be a useful way to obtain a payraise, thus why they cost $60/hour vs $40/hour.

Re:Cost of not patching?

[Overly Critical Guy]

No, it's an outright laugh. UNIX is way more absurdly complex than Windows, on all levels.

Microsoft's fault

[DonkeyJimmy]

It's their damn fault. When I decide to accept the stupid auto-update "critical" patches to Windows, it's usually less then 10 days before I have to do it again. Maybe if they didn't release software a year before it's ready it wouldn't be so bad.

Re:Microsoft's fault

[AndroidCat]

How is the parent a troll? I always hated installing a new version of Visual C++ (hot off the press from MS) because I knew that I would immediately have to download 80M+ patches. (And another set a few weeks later.) And then there's the issue making sure each developer's machine has the same set of patches. (And don't get me going about mismatched "system" DLLs at client sites.)

interesting debate

[ih8apple]

This document was part of an interesting debate over the last year and a half between MS and Novell over whose product was more buggy (measured in terms of number of patches.)

(Google cache version in html.)

Re:interesting debate

[zero-one]

Yup, that document was funny. I liked this bit: "Additionally, Novell has neglected to be clear about the fact that GroupWise runs on Windows NT and Windows 2000, so patches that apply to Exchange customers also apply to GroupWise customer running a GroupWise system on Windows systems". So Microsoft are arguing that Novel haven't taken full account of the security issues due to Microsoft in a report bashing Microsoft. I am not sure that is an argument that Microsoft should be shouting about!

Re:interesting debate

[pmz]

(measured in terms of number of patches.)

The number of patches must be the worst possible metric for measuring bugs. A better measure is: (several bugs per 1000 lines of code) X (40,000 thousand lines of code in Windows) = over 100,000 bugs in Windows. Thus, it follows that (100,000 bugs/installation) X (100,000,000 installations) = 10,000,000,000,000 Windows bugs worldwide.....OMG, the plauge of the apocolypse is upon us!

Re:interesting debate

[sqlrob]

Except you're more than a little off.

The number I remember hearing is 25 Million lines of code for XP. That's a touch more than 40,000

Re:interesting debate

[Anonymous Coward]

Well, 40,000 is one thing. But "40,000 thousand" is quite another - it's 40 million.

Re:interesting debate

[pmz]

Well, 40,000 is one thing. But "40,000 thousand" is quite another - it's 40 million.

Thanks for clearing that up. I guess writing "40,000 thousand" instead of "40,000,000", to some people, is like turning on auto-hide for the status bar in Windows ("Uh, Mr. Support Person, my compooter is broken, I need you to fix it for me")

Re:interesting debate

[beebware]

Ah, 24million lines were just "*/ comment: WTF? How's this meant to work? To be fixed later */"

Patching most expensive

[jonfelder]

Well...patching is also one the most important things you can do with regards to security. So at least in this case the expense is justified. Although patching is annoying, until people learn how to write perfect code it is a necessity.

IMHO getting hacked is much more expensive.

NEW MATH

[stratjakt]

responsible for 45% of traffic

But spam is responsible for, what was it Taco, 60% of traffic on networks?

I'm at 105% utilization already!

BTW, it's just as costly, if not more, to have to rebuild your linux kernel, SSL, apache webserver, or samba installation when a bug is found there.

Quit pretending that MS has some sort of monopoly on software bugs. "Bad code" is a patentless technique used ubiquitously.

Re:NEW MATH

[Anonymous Coward]

>BTW, it's just as costly, if not more, to have to rebuild your linux kernel, SSL, apache webserver, or samba installation when a bug is found there.

Only if you're stupid and re-download the file on each box, rather than burning it to a CD, or using your LAN.

You often can't do this in a corporate network with windows updates (note: There are some exceptions, such as using SUS, but they are far from perfect, and don't work on anything but Windows Server).

Re:NEW MATH

[aridhol]

Don't forget the 70% that is porn.

Let's face it. There's no real way to know for sure what is on those wires unless you monitor them. And I don't think anybody here wants to open that can of worms.

Re:NEW MATH

[spencerogden]

As for the utilization, you were probably making a joke, but he did say 45% on _some_ networks.

The difference of patching on Linux as I see it is that, kernel patches are rare, and are just about the only update that requires a reboot. All other services can be upgraded without affecting the rest of the system.

Windows seems to give these black box security updates, all of which prompt for a reboot, whether it is technically neccessary or not, I don't know.

Re:NEW MATH

[clambake]

responsible for 45% of traffic

But spam is responsible for, what was it Taco, 60% of traffic on networks?

I'm at 105% utilization already!


Didn't you see that the article was about Microsoft? I'm sure there is at least SOME overlap in the spam/patch metrics.

Re:NEW MATH

[Anonymous Coward]

iptables -t nat -A PREROUTING -i eth1 -s slashdot.org -j UP_MY_ASS

Maybe if you would stop inserting things up your ass you wouldn't be so cranky all the time.

Re:NEW MATH

[Scarblac]

responsible for 45% of traffic

But spam is responsible for, what was it Taco, 60% of traffic on networks?

I'm at 105% utilization already!

We conclude that at least 5% of network traffic is Windows patching spam. Please don't be so narrow minded.

Windows patching porn spam, actually, incorporating further data from this thread...

(Actually, there's no problem at all - 100% of traffic on some networks may be Quake, while 100% of the traffic of some other networks may be something else...)

Re:NEW MATH

[DriceX]

45% for patches
60% for spam

That leaves -5% for my p0rn. omg that expalains where it has all been going too!

Re:NEW MATH

[Anonymous Coward]

"Bad code" is a patentless technique used ubiquitously.
I am thinking this could get through the UPSO.

Re:NEW MATH

[Anonymous Coward]

Your webserver still comes down to upgrade apache, your fileserver comes down to upgrade samba, your transaction server comes down to upgrade PostgreSQL, etc, etc..

Downtime is downtime. Whether it's for a reboot or a reinstall is pretty much irrelevant on the big picture.

Re:NEW MATH

[BrynM]

"Bad code" is a patentless technique used ubiquitously.

Quick! Get Bezos! We've got to file a patent on Bad Code before anyone else does!

Re:NEW MATH

[Pyrosz]

If your going to bash someone, make sure you are correct first. Taco did not write that comment and you didn't even read the entire comment correctly as it states "...possibly responsible for 45% of traffic on some networks." If Taco had written the comment it would not have been in Italics.

Re:NEW MATH

[Anonymous Coward]

But the difference in downtime between a reboot and a reinstall is huge. I can upgrade apache without any noticable downtime (1-2 seconds as it restarts). Same for PostgreSQL, MySQL ,samba and a plethora of other services. I guess what matters is your approach to upgrading.

In the big picture, 1 or 2 seconds is irrelevant, a reboot once every week is not.

Re:NEW MATH

[etrnl]

The time to upgrade Apache is minimal, once you have everything ready to roll. Config, compile, install... then it's just the time betwees apachectl stop and apachectl starl(ssl).

And if you have a box with multiple services, everything else keeps running. Unlike MS patches, where you really have to reboot. Add in SCSI cards, LUN probing, and reboots cause a lot more downtime than a service restart.

--etrnl--

Re:NEW MATH

[cpeterso]

responsible for 45% of traffic

But spam is responsible for, what was it Taco, 60% of traffic on networks?

Microsoft's patches obviously contain spam! I would consider desktop icons for AOL or MSN count to be spam.

Re:NEW MATH

[Joe U]

The percentage of utilization problem is easily solved by forwarding your spam, porn and mp3 collection thru the patch servers and using Quake, instead of Windows Update to install them.

Re:NEW MATH

[user311]

So wait...

If 45% of traffic is patching...
And 60% is spam ...
AND 70% of all traffic is porn...

That must mean that approx. 5% of the 45% of patching traffic is actually spam which can sorta makes sense. Now, we can consider that 60% of the 70% of porn traffic is due to spam, then the rest of it can be blamed to patching (in cryptic easter eggs)!

HAHAHA! Now none of the porn coming to my computer is my fault! All of it is due to unwarranted and/or necessary traffic! Come on kids, tell your parents now that the non-spam porn is actually Microsoft's fault!

Re:NEW MATH

[Anonymous Coward]

Let's face it. There's no real way to know for sure what is on those wires unless you monitor them. And I don't think anybody here wants to open that can of worms.

I'd like to open that can of worms.

Sincerely,
John Ashcroft

Re:NEW MATH

[Anonymous Coward]

Not to mention that Windows Server 2003 lets one server grab the updates and then distribute them across a network and install them, so it's actually easier to upgrade hundreds of boxes that way.

Re:NEW MATH

[freeweed]

That seems like an important statement coming from a company who's patches are possibly responsible for 45% of traffic on some networks.

(emphasis mine)

Perhaps you're unfamiliar with the term 'some'.

Also, if you could provide a link where Rob claims spam is 60% of traffic on every network in existence, please, enlighten us.

I do agree with the rest of your comments, however - the number of RedHat advisories in my inbox this month outnumbers Windows by at least 20:1.

Re:NEW MATH

[StealthBadger]

> iptables -t nat -A PREROUTING -i eth1 -s slashdot.org -j UP_MY_ASS Owww... If you're going to go to the trouble of NATting access back there, why open up such a well-used back door? *winces* It's only gonna get bigger with time...

Re:NEW MATH

[argel]

If Taco had written the comment it would not have been in Italics.

And would have had several spelling mistakes and grammatical errors! =:-)

Re:NEW MATH

[Gunfighter]

BTW, it's just as costly, if not more, to have to rebuild your linux kernel, SSL, apache webserver, or samba installation when a bug is found there.

Naaa... just emerge sync; emerge -u world and head home for the evening.

Re:NEW MATH

[sharkey]

It's not new, it's called "Slashdot Math" and it's been around for quite awhile.

Re:NEW MATH

[Anonymous Coward]

The difference is that when you rebuild or apply a patch to Apache, Samba, etc, etc, etc your neighbors toaster does not stop working and all the tires on your car don't suddenly go flat for no reason.

The Raven describes my opinion of MS OS's. "Never more."

Re:NEW MATH

[the-dude-man]

are possibly responsible for 45% of traffic on some networks is the quote you were misquoting.

They keywords here are possibly and some networks

On some networks, it is 45% of the traffic, if you happen to be running a m$ network, its probably more like 70%. Then agian on other networks, such as government and acadamia, 95% of the traffic is porn.

I prefer Linux, but...

[Meat Blaster]

to be honest, I spend a whole lot more time doing patching and regression testing on my Linux systems than I do on the WinXP machine. Granted, the end result is usually more stable on Linux, but it better be for all the mucking about I have to do in /etc and playing line-up-the-library-versions.

Sometimes I wish there was the equivalent of Windows Update for Linux. If it wasn't worth the effort I wouldn't be using it, of course, but the asymmetry between the Windows patches and Linux patches doesn't seem to matter much when all the Windows patches are applied in one go and the Linux patches require individual attention.

Re:I prefer Linux, but...

[Jerrry]

Sometimes I wish there was the equivalent of Windows Update for Linux.

At least with Linux you don't have to reboot the machine every time you apply a patch like you need to do after patching Windows.

Re:I prefer Linux, but...

[BlueTooth]

RedHat's up2date works pretty well so long as you stick to their RPM releases of the software you want to keep updated.

It works well for me, and all I need to stay on top of are things I build be hand (typically Webserver and its ilk plus kernel), but all my libraries stay nice and fresh.

Re:I prefer Linux, but...

[Nothinman]

Sometimes I wish there was the equivalent of Windows Update for Linux

apt-get update
apt-get upgrade

I don't run Debian's precompiled kernels though so I don't know what the patch/release policy on them is, but for all userland things it's better than WU.

Re:I prefer Linux, but...

[amorsen]

RedHat has up2date. It will even let you push updates to all the company computers, if you set them up for that. It costs money though.

Re:I prefer Linux, but...

[stratjakt]

You still have to take the machine offline for all practical purposes. You cant upgrade samba or apache in place, without interrupting service.

So who cares if the downtime is for a reboot or a recompile? From the users point of view the machine is inaccessable.

Re:I prefer Linux, but...

[Anonymous Coward]

You might want to look at Gentoo. They have a bsd style ports system. I run a cron script every night that leaves a text doc in my home dir what needs to be upgraded. Its a very good system.

Re:I prefer Linux, but...

[Anonymous Coward]

RedHat has the Up2date feature which is better than Windows Update in that it upgrades all software included in the distribution, not just operating system level software. Whenever updates are available, a red exclamation mark starts blinking on the system tray to notify the user. Double click, hit a couple of "Next" buttons and you know the entire distribution is up to date.

Re:I prefer Linux, but...

[Anonymous Coward]

Sometimes I wish there was the equivalent of Windows Update for Linux.

Both RedHat and Mandrake (and I'm sure others) have this ability already.

Re:I prefer Linux, but...

[YrWrstNtmr]

At least with Linux you don't have to reboot the machine every time you apply a patch like you need to do after patching Windows.

Not always. Depends on the particular patch being applied.
Random FUD and misinformation does no one any good.

Re:I prefer Linux, but...

[arkanes]

Restarting apache (you don't need to go down for the recompile) is faster than a Windows reboot (and less obnoxious) under any circumstances.

Re:I prefer Linux, but...

[spencerogden]

If you are worried about down time, it takes a hell of a lot longer to reboot a machine rather than restart a service. In the case of a stateless service like apache, users probably wouldn't even notice.

Re:I prefer Linux, but...

[RollingThunder]

Sometimes I wish there was the equivalent of Windows Update for Linux.

In essence, there is. Just requires (as always) a little manual setup on your own.

I have one central update box. It runs fmirror every three hours, pulling down the latest Mandrake patches (8.2, 9.0, 9.1) and emails me if there has been a change.

That box has NFS exports (you could use ftp, if you wish, to avoid the NFS problems) to all the other servers.

The other servers have the update box defined as an "update" source in urpmi.

I can then just log on and run:
urpmi.update -a (updates the list of available RPM's on the local server's cache)
urpmi --update --auto-select (installs any updated versions of RPMS, autoselecting any dependencies)

Dead simple. I don't auto-patch for various paranoid reasons, but there's no reason I can't put in the list update automatically too.

Is this as dead simple as using Windows Update? No.

It is, however, simpler than MAKING windows update was for Microsoft, and that's largely the work I've replicated.

Re:I prefer Linux, but...

[Maniwaki]

And if you run Mandrake

urpmi.update -a
urpmi --auto-select

Re:I prefer Linux, but...

[mistcat]

Well for less rich organizations out there, bringing one service down on a box is much preferable to bringing THEM ALL DOWN. Some of our servers run our email & our websites and others run our development enviornments and our intranets. The ability to bring one service down and then back up is much preferable to having to reboot the whole box.

=)

Re:I prefer Linux, but...

[RealAlaskan]

>>At least with Linux you don't have to reboot the machine every time you apply a patch like you need to do after patching Windows.

>Not always. Depends on the particular patch being applied.

So far as I know, you never HAVE to reboot Linux after doing apt-get upgrade. You can even upgrade your kernel package without rebooting. To actually get the new kernel running, you must stop the old one and start the new ... that's a reboot. But you don't have to do that until you're ready. Patch today, reboot next week. Further, you may be able to go years at a time between necessary kernel patches.

So, if I understand correctly, Linux has one package, the kernel, which can't be replaced completely without a reboot. I suspect that Linus, et al, are working on that little problem.

Here at work, users' machines must be rebooted after the noon patch. This suggests that reboots are a lot harder to avoid after patching on Win2K. I think that Win2K will generally function after patching without the reboot, but I don't think that the new DLLs replace the old until the reboot. That's not nearly so easy to deal with as the Linux case.

Then there's the problem of ``what are the patches going to break?'' On Debian, that hasn't been a problem for me so far (knock on woody). I ran Potato for nearly two years, and have run Woody since midway through the freeze, and security updates haven't broken anything for me yet (knock knock...). I suspect that's because the stuff in the stable distribution is pretty well integrated, and pretty well understood by the guys doing and testing the patching.

Now, MS, on the other hand, is a whole 'nother disaster. I don't think that the Microserfs care about third-party software, and I'm not sure that they understand enough about it or their own nightmare to be able to avoid breaking stuff if they did care. We know that MS patches have a nasty reputation for buggering up other folks applications. Sometimes that breakage looks intentional. THAT's why patching is such a big problem in MS-land: you must test it to find out whether the cure is worse than the disease.

I suspose that if I had big bucks riding on a server, I'd stress-test Debian security patches, too. It would be mostly pro forma; I'd be surprised to find any show-stoppers.

We've been talking about MS versus Linux. Is there anyone reading who has experience with AIX, Solaris, HP-unix, Tru64, and such? Is it safe to patch there? Is it common for third-party apps to be broken by patches? Are there lots of bugs that require patching? Is it common for the vendor to get you patches fast enough?

Re:I prefer Linux, but...

[Chris Burke]

You still have to take the machine offline for all practical purposes. You cant upgrade samba or apache in place, without interrupting service.

So who cares if the downtime is for a reboot or a recompile? From the users point of view the machine is inaccessable.

Holy specious reasoning, Batman!

First, you don't need to take down the service while you're recompiling, only when you're done and want to use the new version. Second, obviously restarting apache is faster than rebooting windows, so your downtime is smaller (a second instead of... however long it takes to boot windows).

Re:I prefer Linux, but...

[Jerrry]

So who cares if the downtime is for a reboot or a recompile? From the users point of view the machine is inaccessable

Sure, compiling the update takes a few minutes, but moving the new binaries into place takes a few seconds. Shutting down Apache for a few seconds while moving the binaries and then restarting it is preferable to the length of time it takes to reboot a box running Win2K Server (which can take 15 minutes).

Re:I prefer Linux, but...

[Anonymous Coward]

If you have Gentoo:

emerge -u world

Re:I prefer Linux, but...

[argel]

You still have to take the machine offline for all practical purposes. You cant upgrade samba or apache in place, without interrupting service. So who cares if the downtime is for a reboot or a recompile? From the users point of view the machine is inaccessable

You've never had to reboot a system with several SCSI drives in it, have you? The difference between cycling a daemon and cycling the box can be considerable.

Re:I prefer Linux, but...

[ostiguy]

Dude, I am a MCSE-type, but the recompile happens, then make install, and then you stop and restart the service. Rebooting an server and watching it count gig(s) of ram, count and check 75 scsi ids, and load the os is a totally diffrent story. MS has made some progress for patches not needing reboots, but IE fucking ruins everything, just as usual.

ostiguy

Re:I prefer Linux, but...

[ookaze]

Actually, for Samba and Apache, on a Linux box (and surely on a AIX box too), the downtime is the time of stopping and restarting the service, as you can install the new version on top of the old one, without disrupting anything (as long as there's no ldconfig or several hours between the install and the restart).
And the time of the stopping/restarting is so low that your users won't be able to tell their ssl session was killed because of your Apache server restarting ;)

Re:I prefer Linux, but...

[molarmass192]

I don't even move the bins, I use a symbolic link for "apache" and point it to a new dir. Total downtime, about 3 seconds: ./apache/apachectl stop; ln -sf apache-1.3.27-20030501 apache; ./apache/apachectl startssl. The only downside is that SSL sessions get disconnected, but you can't beat the cycle time!

Re:I prefer Linux, but...

[drsmithy]

If you are really worried about downtime (not the insignificant worry most here have about the number "uptime" returns) you have redundant systems to take over while each machine being patched is unavailable.

Re:I prefer Linux, but...

[cultobill]

I'll throw my 2 cents in on this.

Gentoo has something similar to Windows Update. True, it's not as (shiny | graphically intensive) as WU, but it does the same thing. It even updates more than just those Microsoft programs, too.

I've only had it require watching in two instances: upgrading glibc, and upgrading PAM with a server (not just PAM, not just the server). In those two cases, reboot of the machine for glibc, or a restart of the service for PAM/service took care of it.

Re:I prefer Linux, but...

[NuShrike]

portupgrade -ai for FreeBSD is nice. Kick it off, upgrade every single third-party (port) program installed.

Then, there's also the classic:
make buildworld
make installworld

for the system binaries.

Re:I prefer Linux, but...

[Alioth]

Sometimes I wish there was the equivalent of Windows Update for Linux

There is: if you use RedHat, there's up2date. If you use Debian there's apt.

Re:I prefer Linux, but...

[Anonymous Coward]

FreeBSD: cvsup whatsup-file

Whee, we can post anonymously-while-logged-in again!

Nothing new there

[Timesprout]

The software industry has known for years that the later you find a bug the more expensive and messy it is to resolve

Want security? don't install the kitchen sink!

[MrBoombasticfantasti]

If you want security on your boxen it is prevalent to install just the components you need and no more than that. For example, it is safer to have a dedicated firewall/router and a seperate desktop machine for accessing the Internet than to just connect with a 'one-size-fits-all' installation. This goes for Windows as well as for GNU/Linux and/or *BSD. Myself, I have an OpenBSD box connected to my DSL-line and patching is seldom needed (at least compared to other OS'es). This way I can fool around on my (seperate) desktop machine till my hair falls out but it won't get h4x()r3d...

Not suprising

[Neophytus]

People who say 'they should have patched' do not understand the stress that installing a patch however critical on a few hundred servers, then in many cases rebooting them, can put in a commercial environment.

Well then...

[Bendebecker]

Maybe M$ shoudl concentrate more on amking better software dso it doesn't need to be patched so much!

Re:Well then...

[Bendebecker]

And maybe I should spend more time proofreading my own posts so that I don't mangle words so much!

Re:Well then...

[geekoid]

nope, they took the short cut and made it so there new severs can get the patch and instll automatically without reboot.

it is an OPTION, so if you like installing a patch on 100 servers by hand,by all means go for it.

Re:Well then...

[Anonymous Coward]

Heheheh did you see how he substituted a $ for the S. This implies that money is all Microsoft is about, and money is the root of all evil. HA HA HA Damn that is funny!!!!!!! Thank God for you!

Lamers

[grub]

Pff.. you lamers with your fancy-pants Windows or your free Linux or *BSDs are all clueless. I haven't patched my Apple ][+'s DOS3.3 for 20 years and it still has yet to be 0wned.

Re:Lamers

[BubbaTheBarbarian]

My Kaypro3 with it's 800BBS modem is much more secure. CPM is the BOMB!!!

Re:Lamers

[Anonymous Coward]

j00 4R3 73h 5uX0R

Patches

[zzxc]

If MS wouldn't include so much "junk data" to keep their proprietary data secret in patches, they wouldn't be so large. And, if there was a way to do a patch "rollback", then faulty patches wouldn't bring down a system until a new fix-patch was released. (One of the recent MS patches was found to cause some machines to stop booting)

-----------
From Ape to Man: Evolution

Interesting sidebar.

[Infernon]

After reading this post, I checked windows update and found two brand new criticals... That makes five in three weeks. If they'd get it right the first time...

The most expensive security measure is...

[mikeophile]

Relying on Microsoft products for your security.

rim-shot

Thank you. I'll be here all week. Tip your waitresses.

Re:Lamers - Oh Yeah?

[freeze128]

Try to enter today's date in Appleworks.

Re:ummm

[Anonymous Coward]

Good to see that the subscription service kept the shit from rising to the top (or first, however you want to look at it).

Obligatory debian plug.

[Anonymous Coward]

Just remember debian gnu/linux is a secure OS. Every package goes through extensive scrutinization and auditon by thousands of debian users. As a result, the stable distro uses slightly older packages, but they have had nearly every bug squeezed out!

If you wan't to see how secure it is, try it for yourself

Remember more secure means less patching, which means more uptime, less traffic and more profit.

Downtime?

[lexcyber]

"Fiebig (pictured) also acknowledged the policy of patching was rendered less effective because of administrators' dislike of network downtime."

He should say: "Since we at microsoft has a broken system where you can't upgrade stuff without a reboot, it is hard for us" - I dont think a apt-get update && apt-get upgrade in cron is that hard work.

Re:Downtime?

[Henry V .009]

Wasn't Microsoft supposed to have a system that would patch without rebooting by now? I thought Windows 2000 was supposed to do it. But here we are on XP, and you still have to reboot for nearly all of the critical patches.

Re:Downtime?

[robbo]

I dont think a apt-get update && apt-get upgrade in cron is that hard work.

Yikes. I don't think 'apt-get update && apt-get upgrade' in your crontab is very smart. The probability of breaking something is too high. In fact, that's the message I'm reading between the lines: virus upgrades won't break anything, so they're no problem to automate, but OS/IIS/IE patches pose a much higher probability of risking extended downtime. I don't think the situation is all that different with the Red Hat Network-- look before you leap.

Re:Downtime?

[BrynM]

That all depends on what is being patched. Services and applications can be re-started, but DLLs and other files that are in use by the operating system itself need a re-boot because file system protections prevent the file from being overwritten. MS just locks files too much.

Re:Downtime?

[lexcyber]

It was just a suggestion, the cron:ed apt-get update etc. - So far I haven't had a single broken package in debian stable.

Re:Downtime?

[robbo]

I used to use autorpm to keep a medium-sized network up to date, and for the most part I never had problems, but from time to time RH would release an update that would break some configuration and I'd have to dissect the problem. At the time, different package maintainers had different policies for which conf file, the old or the new, would be saved as rpmsave. In a production environment, the bottom line is that you have to vet each and every update on a test box before you deploy it. With an update a week from MS, I can see where that would start to cost.

Re:Downtime?

[Anonymous Coward]

I have been doing this for years(3 or 4 at least) and I have never had any significant breakage on a Debian stable box. Not once. And that includes the times when upgrading a stable box meant going from potato to woody. Hell, I even do it on quite a few unstable boxes and rarely have any trouble.

Re:Downtime?

[druse]

apt came from the debian distro, not redhat. debian stable is exactly what the name implies. Running this from cron to apply patches when you're only sourcing debian stable and the security is not going to break anything.

Re:Downtime?

[lexcyber]

I would never run the hobby-dist RedHat on anything. Even less on anything remotly in production.

Or,

[zrk]

Lockdown your servers, you insensitive clod!

MS patches are creepy...

[allanj]

I've applied my fair share of patches from MS, but lately I've become really nervous about doing so. I'm always thinking "what kind of DRM will they include in this one?". It's gotten to the point where I will NOT apply patches for anything but server products, and only reluctantly so. Call me paranoid if you wish, but I can't really shake that feeling. Hey MS, great way to promote security - making users reluctant to apply patches...

Re:MS patches are creepy...

[BigNumber]

Not just the DRM but what kind of new EULA restrictions are you agreeing to?

Re:MS patches are creepy...

[Meshach]

i heard that ms was changing the eula when they released patches
so basically if you agree to the first eula and then install a patch you may be unwittingly agreeing to another eula that is more restrictive / limited / allowing more intrusions then the first one
that is what made me nervous about applying too many ms patches

Re:MS patches are creepy...

[Anonymous Coward]

Time to put on that tin foil hat and join the Linux fantasy world!

Re:MS patches are creepy...

[allanj]

No such luck - I work at an all-MS shop, and apart from the all-MS issue it's a great job.

At home I've got an old box running RedHat to play around with, so I get out of the clutches once in a while where *I* decide what gets to run on my machine...

Re:MS patches are creepy...

[cptgrudge]

I'm always thinking "what kind of DRM will they include in this one? It's gotten to the point where I will NOT apply patches for anything but server products, and only reluctantly so.

Where? At work? Your end users shouldn't be doing anything with DRM enabled media on the machines anyway, they don't own them. The company that bought them does. Besides, if you *do* let them do that sort of stuff, and the DRM starts interfering with the user's ability to play their media, it would be a great opportunity to educate people about what Microsoft is doing.

> User: "I can't play my new song I downloaded. It says, 'DRM License Signature File Not Found'. What's that?"

> Tech Support: "Let me tell you a little story..."

It's your responsibility as the overseer to keep the systems secure, not play politics with something you personally don't agree with. I'm sure your boss would agree.

On your home machines however, it's a whole different story. You can definately tell Microsoft exactly where to put their patches.

Re:MS patches are creepy...

[mabhatter654]

90% of the time it's the BOSS that wants the stuff! Most workers are OK with personal stuff not working, but the bosses [it's a small business] want to bring stuff from home, etc and get upset when you tell them that "they don't need that at work".

Bosses are also the reason Admins hate downtime. No matter how well you schedule it, work weird hours around everyone else's schedules, the boss will always "need" to come in [or dial in] at 2:00 am saturday night while you're in the middle of an upgrade! Whether you tell um or not, they get upset about being "inconveninced"! It's outrageous and stupid, but that's IT.

Re:MS patches are creepy...

[Anonymous Coward]

So do you make your tinfoil hat yourself, or do you order it from a special store?

it make sense they would say this..

[geekoid]

..because one of the many new feature of server 2003 is the ability to update patches auotmatically.
So they will use this 'cost savings' to push the new product. At the launch event, they bagged on there older products pretty damn hard.

It's part of there latest slogan
"do more with less".
personally, I dln't know who this less guy is, or why I would want to do more with him. Ironically I prefer less to more.

Re:it make sense they would say this..

[Anonymous Coward]

didnt you know?

less is more

Re:it make sense they would say this..

[Keeper]

You can apply patches automatically on Win2k and WinXP as well...

Re:Lamers - Oh Yeah?

[grub]

Yeah and? Today is Thursday, May 1 10003.

NEW ENGLISH

[Bendy Chief]

"...statement coming from a company who's patches are possibly responsible for 45% of traffic on some networks."

For once, someone was actually misquoted. (Rather grievously)

I feel the pain

[Remlik]

As the only sys admin in a company of 50 desktops and 4 Win2k Servers I can fully support the notion that patching is expensive...but not for the company...for ME!

Guess who gets to come in the office between 8 and 10pm to apply these patches to live servers...who has to wait if someone decides to work late. Who has to cross his fingers with every patch hoping that nothing else breaks...ME! And the only thing I get out of it is to be able to leave an hour or two early that friday...woot.

Sure some things I can and do install from remote, but almost every patch requires a reboot and you just never know when a Win2k system isn't going to boot properly and require you to drive in at 1am wearing your bath robe.

Re:I feel the pain

[Anonymous Coward]

And in return - you're probably decently paid, have healthcare, and don't have to work in a dangerous environment. It's called a career choice. If you don't like it, find something else. Patching systems is part of the job description.

I'm sure that there's a bunch of people out there who will gladly replace you, for 2/4 of the salary and half of the whining.

Re:I feel the pain

[Anonymous Coward]

Sure some things I can and do install from remote, but almost every patch requires a reboot and you just never know when a Win2k system isn't going to boot properly and require you to drive in at 1am wearing your bath robe.
The system probably boots properly. More likely its just the security guard breaks it cos they get off seeing you in you bathrobe

Re:I feel the pain

[duffbeer703]

If you followed your sigs advice and applied change management and controls to your servers, a script would have kicked off the patch and rebooted w/o a hitch.

Work smarter.

Re:I feel the pain

[donutello]

I can fully support the notion that patching is expensive...but not for the company...for ME!


Nope. It still costs the company. Because if you didn't have to do all those things they could probably pay you less or have you do something else that you don't have the time to do today. At the end of the day, it costs your company money.

Re:I feel the pain

[Anonymous Coward]

My 'sysadmin' does not even manage to make a backup of our servers. I got myself pretty impopular by suggesting that 5 months worth of incremental backups, with no testing, might loose us some data. It sure did, when shit hit the fan. But then, the 'sysadmin' is a drinking pal of the CEO.

Re:I feel the pain

[indiigo]

Jesus you just described me to a t, bathrobe and all. :( Big frown.

Re:I feel the pain

[White Roses]

who has to wait if someone decides to work late.

Clearly, you have not read enough BOFH. If someone decides to work late, you ensure that he can never leave the office again!

And what, really, is wrong with kicking everyone off the server at 10:30 AM and not getting the patch installed until 4:30?

Learn more user-control tips here.

Re:I feel the pain

[ihilani]

Perhaps you should consider working with your management to establish a formal, weekly, change-window.

For example, many companies block off Thursday evenings for changes. Tuesday and Thursday afternoon, you would then send out to everyone in the company a brief summary of what's going to happen, why it's needed, and when it's going to start. Sending it out twice gives people a chance to respond with time-issues.

A formal weekly (or more often) change-window can ensure timely updates as well as allowing everyone to plan, and of course you wouldn't have to come in on an unpredictable schedule.

SuSE's YOU

[Kaimelar]

Sometimes I wish there was the equivalent of Windows Update for Linux.

SuSE has a utility called YaST Online Update (YOU), which has similar functionality to Windows Update. Works great for me.

I'm sure other distros have similar features. Do some looking around on Google or Distrowatch.

Re:SuSE's YOU

[usotsuki]

Why do I find a Soviet Russia joke coming on? LOL

Well, okay, I can't resist. "In Soviet Russia, software updates YOU!"

-uso.
I told you so.

Apt4rpm

[hughk]

apt4rpm works very nicely for RH. It will not auto update kernels (I regard this as a feature) but it will pull them down if you ask specifically.

Well, as you surely know...

[bigmouth_strikes]

79% of all percentages are made up on the spot.

Re:Well, as you surely know...

[Xerithane]

79% of all percentages are made up on the spot.

I think you need to back that up with some facts!

(joke, for those lacking common sense and social skills)

Re:Well, as you surely know...

[usotsuki]

And "ninety percent of everything is crud", don't you know? *g*

-uso.

Re:Well, as you surely know...

[luzrek]

Oh, people can come up with statistics to prove anything. 14% of people know that.

--- Homer Simpson

Re:Well, as you surely know...

[Maserati]

"Facts, schmacts. You can use facts to prove anything that's even remotely true."

I don't understand...

[Anonymous Coward]

Patching should be priority, and very rarely breaks applications, yet so many companies don't patch because they feel the need to test patches first...

can someone shed some insight?

Re:I don't understand...

[Zirnike]

Business application math:

(Some patches break some applications) + (Applications being down means lost productivity, sales, possibly data, depending on the app) + (MS apps won't let you roll back the patch, so you can't recover) = Many companies feel the need to test the patches first.

My computer at work doesn't get patched all that often (luckally it's behind multiple firewalls), because Unigraphics is very touchy (according to our support people).

Patching?

[Anonymous Coward]

What is the patching that you speak of?

Security Professional, CISSP

Re:Patching?

[prestidigital]

I don't speak of it. Craig Feibig does. I took it to mean releasing bug fix updates in general. 98% of Windows Updates are security "patches."

RHN

[mao che minh]

Sometimes I wish there was the equivalent of Windows Update for Linux

Redhat network works wonders for me. It catalogues all of the software that shipped with Redhat, and lets me know which of my systems requires what errata (updated software). Third party isn't a term that most open source companies recognize. =)

Best part is, I don't have to be on my actual system to check for available updates. I just log in to the RHN and look at the list of my registered systems. This trounces Windows update IMHO.

Patching vs UnPatching

[gosand]

BTW, it's just as costly, if not more, to have to rebuild your linux kernel, SSL, apache webserver, or samba installation when a bug is found there.

Actually, just the act of patching may roughly equal. But UN-patching a system can be done very easily on a *nix based system. How do you UN-patch a Windows based system?

Also, when I rebuild apache, I know what I am affecting. When I install a Windows patch, I cross my fingers.

Re:Patching vs UnPatching

[johny_qst]

Well thats easy. You go from start through settings to control panel and then add/remove programs... select the patch you want to remove from the list and click the button that says uninstall software. And if you want to know what the patch is actually doing just open it up with a package management tool. Installshield makes a gawdy one that you have to pay for, but there are several that you can try for free. Maybe you should stop crossing your fingers and analyze the logic problem before you. It's not like windows doesn't require administration.... just try to hold your nose while doing it and everything will be fine.

Re:Patching vs UnPatching

[Anonymous Coward]

What about the certain percentage of MS patches that I see with "Once installed, this package cannot be uninstalled" in the information?

Am I missing something?...

[YetAnotherAnonymousC]

...or is this equivalent to buying a new house, and then having the builder say, after the discovery of a defective front door: "we shouldn't have to fix this. why don't you just hire a security guard with a gun to sit in your foyer 24-7?"

Re:Am I missing something?...

[prestidigital]

I see where you are coming from, but I don't reckon it is the same. Hiring the security guard would be more expensive than fixing, irregardless of who is paying. Also, I don't think Microsoft is trying to pass the buck on fixing their broken software. Mr. Fiebig is just stating his informed opinion that, for better or worse, fixing (the implication is security holes) is more expensive than running good antivirus.

Re:Am I missing something?...

[etcpasswd]

Bad analogy. It's more like having leaky faucets fixed.

Re:Am I missing something?...

[Anonymous Coward]

Prestidigital wrote:

Hiring the security guard would be more expensive than fixing, irregardless of who is paying.

I think the writer of the analogy forgot to mention that the builder would have you prosecuted under the DMCA (Digital Millenium Carpentry Act) if you fixed the problem yourself.

Stating the Obvious

[BrynM]

Once again, MS generates news by stating (or admitting) the obvious. Patching is a pain! Patching takes ($valuable$) time! Patching hogs bandwidth! Patching doesn't always work or may break things!

In other news, the sky has been discovered to be blue and the planet has been proven round....

Re:Also known as... n same as

[Anonymous Coward]

Same as...

Proper planning prevent piss poor performance.

System Update Server

[mr_z_beeblebrox]

Microsoft has a free product out called SUS (see subject) the SUS works in conjunction with the BSA (no, Baseline Security Analyzer) to determin patch levels of 2000/XP clients and servers it then downloads all neccessary patches in a SIS (single instance storage) at the server. In this way every patch on your network is downloaded only once. If you only have four PCs this cuts update traffic by 75%. This is nearly as effective as ISA server but it is FREE. It is not as effective as coding it write the first time LOL but it is a start.

Re:System Update Server

[prestidigital]

Nice info. I'd have modded you up if I'd been given mod rights just now. :^) This sounds better than letting all your clients run separate connections to the internet for automatic updates from MS. But you still have to update all those clients from the internal server holding the SIS, right? Doesn't that still bog down your network? I guess you do have more control over updating during downtimes using the SIS method, though...

Re:System Update Server

[Lumpy]

I get the same thing for free with linux by simply configuring a SQUID proxy to heavily cache all http traffic from update.microsoft.com. then have all the W2K boxes automatically run their updates 1 day after the master PC does this. Voila... the squid proxy caches all the updates so every other pc in my WAN get's them from the squid server lightning fast. same as the virus scan and all the other "update" sites we seem to use here.

Works great and my mrtg graphs prove that it works to me :-)

Re:System Update Server

[Anonymous Coward]

I'm waiting for the Apache version before I install this.

Re:System Update Server

[Anonymous Coward]

Sure. What SUS really effectively is is your run your own INTERNAL Windows Update site for your users.

The advantage IMO isn't so much the bandwidth, it's

a) blocking users from easily updating to Bad Patches by pointing their windows update url to you
b) [related] having control over the patching process - being able to test some of this inhouse and only deploy when/if you need them

Re:System Update Server

[ostiguy]

You are onto something, and you don't even fully know it. SUS is free, BTW

I am playing with SUS server and its group policy settings, and there is no way for end users to initiate downloads. I can make updates happen over night, and force pc reboots, but I am not thrilled with that solution (i feel that may negatively reinforce user's locking their workstations as a routine behaviour). SUS doesn't interact with windows update at all - disabling windows update via group policy isn't an ideal solution either.

grrrrrr.

ostiguy

Re:System Update Server

[boskone]

you might want to look seriously at SMS capabilities. Yes, SUS is free, but if you are running into issues where you'd like more control and flexibility as an administrator, I would check out SMS.

Re:System Update Server

[mr_z_beeblebrox]

But you still have to update all those clients from the internal server holding the SIS, right? Doesn't that still bog down your network?

Yes, it will bog down your network. That can be handled by having multiple sus servers, which first update off of your primary server then having groups of client PCs working at different times (and on well designed lans...on different subnets). This is all automated! Good job MS, now if your other 200 products could be designed with end user (admin) needs in mind....

Re:System Update Server

[mr_z_beeblebrox]

I get the same thing for free with linux by simply configuring a SQUID proxy to heavily cache all http traffic from update.microsoft.com. then have all the W2K boxes automatically run their updates 1 day after the master PC does this. Voila... the squid proxy caches all the updates so every other pc in my WAN get's them from the squid server lightning fast.

That is cool, I will give you that. However, it will not give you the level of automated control that MS SUS does (at least not easily) My clients only get updates that I choose to publish and I can automate selection. I am an open source advocate as well but in this I have to say MS has made a damn fine distribution server.

Re:System Update Server

[mr_z_beeblebrox]

I'm waiting for the Apache version before I install this.

I don't blame you. Mention that to your MS rep. You will find that they are making all sorts of cute inroads since the whole trial thing. The 2000 Server Utilities CD will install PERL if you want!!

Mistake...

[Anonymous Coward]

That seems like an important statement coming from a company who's patches are possibly responsible for 45% of traffic on some networks."

Their patchesd aren't responsible - people not applying their patches are responsible. What costs more? Patching or not patching?

Re:Mistake...

[prabhath]

Well in many cases patching actually ends up costing more because of incompatibilites and problems that crop up.. Hence the reason for the staging server mentioned above and well as the interesting fact that Microsoft often doesn't patch their own systems right away.

Say it ain't so!

[RealAlaskan]

apt-get update
apt-get upgrade

That's what I do, and I'm not sure what all the fuss is about. Things get fixed, usually before I ever knew they were broken, deamons get restarted, nothing gets interrupted, life goes on ... If I took the trouble to make it a cron job, I'd never even know.

... Craig Fiebig, ... is quoted as saying "In dollar terms, patching is the most expensive security measures ...

Is Mr Fiebig telling us that things don't go so smoothly if you use MS products? Or that MS can't keep up with a bunch of amatures? Do MS patches break non-MS apps? Could all this be why so many worms and viruses manage to spread across unpatched MS products? Could it be that MS patches are as bad as the bugs they fix? SAY IT AIN'T SO, CRAIG!

Re:Say it ain't so!

[heikkile]

apt-get update
apt-get upgrade
If I took the trouble to make it a cron job, I'd never even know.

I have them in my cron (upgrade -d -qq, so everything gets downloaded) (and another job sends me a mail if need be), but I prefer to be connected to the box and to see that the upgrade goes well (as it has. except for minor details around the one time Debian Woody became Debian stable) Ought to make the cron job run the updates automatically, if they have been laying around for more than a week - probably safer... Isn't there a debian package for all that?

Re:Say it ain't so!

[drsmithy]

Is Mr Fiebig telling us that things don't go so smoothly if you use MS products?

No, he's telling us what some of us already know - that the cost of *properly* rolling out application and/or system updates across a whole swathe of machines is a very expensive exercise. Why ? Because it requires many man-hours of preparation and testing - not to mention the dramas of the occasional rollback when things go pear-shaped.

Re:Say it ain't so!

[Anonymous Coward]

Windows users don't even have to go through that trouble.

After installing XP SP1 or Win2k3, I just click the little bubble that says 'Auto Updates' click 'Keep my Windows Up To Date' and click a time. 'Daily at Z am'

Thats it, auto patching at its best.

What the article talks about is PROPERLY applying patches, not just auto-update but testing and regressions, and doing a planned live rollout of patches.

Yeah you do the same thing in Solaris too, and Linux, and even MacOS X (My OS-X box has had over a hundred of megs of patch downloads in the past year alone!) To think about it, any managed environment requires patch management and its always expensive no matter WHAT the platform.

(And damn, solaris patches are the WORST of the bunch.)

Re:Say it ain't so!

[Anonymous Coward]

apt-get install cron-apt

Question?

[Billly Gates]

C/C++ functions like strngcopy have been known to be a cause of overflows for decades.

Bell labs(now lucent) and various hackers have made string functions that do the same thing but are buffer safe. They are made to create more secure apps.

My question is if gcc or visualc for that matter switched to more buffer safe libraries would it make a difference? Trusted Debian is compiled with buffer safe string functions.

It may be time gnuc did this by default assuming all the apps could be recompiled without a problem.

This would seem to get rid of %90 of holes in user as well as kernel space.

Re:Question?

[prestidigital]

I've wondered about this myself. Maybe this is getting off topic, but I would think Microsoft would have special training and reviews specifically to prevent/correct buffer overruns! :^)

Re:Question?

[geekoid]

perhaps send all there developers off site to learn security, then write a book,, and make the developers study it, and then took..say.. 2 month just so the developers can look at the code from a security point of view.
that would be the smart thing. Which is probably why they did it.

Re:Question?

[Entropy_ah]

Someone correct me if I'm wrong but I believe the reason is that safe string functions arn't as fast.

Re:Question?

[PickaBooga]

The basic string copy functions in C and C++ don't keep a value for the maximum length of a string.
(Actually, they don't even keep a value for the current length of a string, it is calculated by scanning the string and looking for the terminating null.)

The buffer safe string libraries are not designed to be a drop-in replacement for the basic string library, because they demand more information about maximum lengths from the code using them.

Re:Question?

[Anonymous Coward]

Geekoid I love you.

I want your hot throbing cock in my manhole. I want to have cats with you.

I know your gay because you were looking for men in the Vancouver area who are also geeks.

Re:Question?

[rabidcow]

For string/array copies, the difference is negligable (but it is there). Where you have risk of some remotely significant speed difference is checking bounds on every array access.

More likely it's because strcpy et al take two arguments and anything that checks the length of the buffer must take at least three.

Re:Question?

[Anonymous Coward]

The kernel doesn't use c library (it has it's own version of some c library functions).

I've never compiled a kernel with any king of gcc array bounds checking but I think you would run into trouble. A lot of the kernel is written in assembly or in c such that the assembly output is predictable. Messing around with that is a recipe for disaster.

I do like what the OpenBSD people are doing to stop buffer overflows in userspace. That's very interesting work.

Re:Question?

[Anonymous Coward]

"More likely it's because strcpy et al take two arguments and anything that checks the length of the buffer must take at least three."

You can do it with modified memory allocation functions. E.g.:

provide a modified malloc that reserves N+X bytes (N = bytes requested, X = some sufficient constant), puts the number of bytes allocated in the first X/M (M = some constant smaller than X) bytes, fills the last X - X/M bytes with a fixed sequence and/or checksum generated from the size of mem allocated, and returns a pointer to the N/Mth byte.

If you have a buffer overrun, the checksum/sequence at the end (whose proper location can be found by examining the first N/M bytes (i.e., pointer - N/M), will be clobbered (this would be checked by your modified strcpy etc)).

Of course, this is a f*cking slow kludge that I (a relatively unskilled noob, in the scheme of things) just thought of while idly wondering how something like Electric Fence might be made to work. I'm sure that faster methods exist.

Re:Question?

[dkf]

The problem is, at root, that C arrays do not know their own length (you can think of C strings as arrays of characters, of course.) And there is a vast amount of code out there that *depends* on this for a very wide variety of (correct) optimisations. Because of that, you can't just have a drop-in replacement for strcpy() and its ilk. Because of that (and the fact that programming effort is usually spend elsewhere) there will continue to be stupid buffer overrun bugs for a long time yet.

If you want safe arrays/strings, you use Java or Perl or Python or Tcl or whatever. Most languages have the required amount of safety these days, as the designers feel that catching overrun bugs is better than cranking out that last tiny bit of performance. Usually because they've previously debugged code with buffer overruns... :^)

(Curiously, I don't use most of the C string functions in my C code; strlen() is the only exception and that's only where I'm going from the uncounted-string to the counted-string domain. Once I know the length of a string, I can use memcpy() etc at the low level and work with higher-level abstractions through the rest of the code.)

Re:Also known as... [ot]

[FroMan]

Why is this site so US-centric? If you USians would just use the SI system you'd get 62.5 times better ratio of prevention to cure. You'd have a gram of prevention is worth a kilogram of cure.

Geesh, I seem to have an anti-european streak today...

Translated Google link:

[mao che minh]

see the subject

Still no liability?

[pmz]

Between the costs of patching, the two weeks of downtime per user per year, and the flaws that threaten national security, has no one yet found a good way to sue for damages??? WTF?

YUM

[MacJedi]

If you use an RPM based system you may want to check out YUM.

/joeyo

precompiled kernels

[twitter]

I don't run Debian's precompiled kernels though so I don't know what the patch/release policy on them is, but for all userland things it's better than WU.

Precompiled kernels work just fine and Debian's /etc/modules file makes it easy to change around hardware. Going from 2.2 to 2.4 was easy stuff. I can only imagine that they will use the same kind of upgrade policy for kernels as they do for every other package now, therefore I expect my kernels to be patched if some kind of flaw is discovered.

The poster who thinks there is less trouble to taking care of Windoze boxes than there it to Linux boxes is nuts or ignorant.

but the patch is . . .

[kraksmoka]

currently my favorite form of nicotine relaxation.

Re:Lamers - Oh Yeah?

[Anonymous Coward]

Ha! Ha! The joke's on you! AppleWorks doesn't run on a DOS 3.3 Apple II+!

MOD UP +1 FUNNY

[Anonymous Coward]

For all you clueless moderators out there, this is actually a very funny post. The guy is writing in pig latin because it is better than Microsoft's!!! Let me translate:

Hey there Slasdot dudes. I'm writing in pig latin because it's way better than the best security systems that Microsft has to offter... And no I'm not joking! One time I sent a supposedly 128-bit encrypted email to my boss (it was for his eyes only), but an Outlook bug prevented it from being encrypted. By serendipity, I had also managaed to CC one of my coworkers... No problem if the encryption would have worked right? Unfortunately, the coworker (whom the email was about) read the email and reported it to my section manager. To make a long story short, I ws put on indefinite leave for two weeks and then transferred to a different area of the company, complete with a lower salary and a shitty job. All because Microsoft can't program beyond a third grade level. (On the plus side, I ended up leaving the company three months later and started by own business. Haven't looked back since).

Phew!!! How come English-To-Pig Latin translators are easy to find, but you have to translate back by hand? Anyway, enjoy! (oh yeah and, MS sucks!!)

The difference between patching the two...

[Anonymous Coward]

is that Linux doesn't require a reboot. Often, Windows doesn't either, but you're going to get the standard "reboot" messages every time.
Most people just reboot.

patches hurt people too

[dwgranth]

Man, I can attest to this... patches... especially ones that screw up systems not only cost time/money/bandwidth but they cost HAIR.. yes thats right... admins lose their hair b/c of the stress this makes them go through..... ::looks in the mirror:: arrhhggghh..

Re:patches hurt people too

[cptgrudge]

If it irks you so much then shave it off. It makes for much cooler summers. :)

Microsoft isn't going to change their business practices because you are going bald.

Cachable updates?

[Anonymous Coward]

Why don't they support cachable updates with technology like md5 and PGP?

(Maybe they do and charge for it...I'm not aware of it) This can make it cachable WITHOUT the danger of trojans. Caching locally would decrease WU data transfer over the internet significantly, and all you'd have to get from MS is the md5 sum (and do you need a PGP key from the source? Not sure...I don't know anything about PGP). Simple. Bim bam boom, done. I'm pretty sure they can even use this technology for free, and it won't mess around with any of their pretty licenses...Not sure though, IANAL and I don't know much about OSS stuff.

Re:Lamers - Oh Yeah?

[usotsuki]

I thought 3.0 fixed that. BTW, that's ProDOS 8, not DOS 3.3 ;)

I wonder what OS will underlie Contiki, though.

-uso.

Hmmm...

[istartedi]

Well... before the knee-jerk MS-bashing starts, let's think about it.

If you patch, you have to recompile the component, and possibly re-boot the machine or re-start the application. This is true for Linux too (unless there's a way to fast-swap kernels that I haven't heard about).

If you update, you don't need to re-start anything.

If you patch, you could have to patch just about anything on the system.

If you update, you are working through one application.

Of course, there's nothing to stop an OSS developer from writing something that just sniffs incoming data for known exploits, like a virus scanner does.

Ahhh... but that would slow the system down.

So I think you have to add "better performance" to the pro-patch argument.

But then, there is probably less effort to updating, especially if it's automated. Is there any OSS system with automated patching that people are willing to trust?

Either way, I think it's an interesting discussion. In practice, I patch.

Re:Hmmm...

[geekoid]

" Is there any OSS system with automated patching "
yes
"that people are willing to trust?"
errr.. no.

change it to
"that corporations are willing to trust?"
yes..Windows 2003.

Re:Hmmm...

[Ambassador Kosh]

Is there any OSS system with automated patching that people are willing to trust?

Debian Stable

And what exactly does this quote mean

[moocat2]

"In dollar terms, patching is the most expensive security measure and keeping your antivirus descriptions up to date is the least."

"If customers could do both it would eliminate the bulk of security problems."

That second sentence seems very oddly phrased. It makes is sound like they can't do both which is definitely not true. I get the feeling that this may be the beginning of some MS campaign to somehow tie Virus updates and patching into a single system. I'm not sure what the ramifications of such a system are, but my guess is that it will continue to tie people to MS products.

Re:And what exactly does this quote mean

[Anonymous Coward]

I assume you haven't read anything about the new Windows Server 2003. One of the new "features" that MS has been touting is that Windows workstations logging onto a Windows 2003 domain will be scanned for appropriate patch levels *and* virus updates.

Re:Also known as... [ot]

[Anonymous Coward]

You have failed to close your whine tag, now you are doubly whining. Or you might be French.

not FUD

[martian]

(s)he said "don't have to reboot the machine every time"...

sorry to nitpick

what cost?

[Anonymous Coward]

apt-get update && apt-get dist-upgrade
y

cost: 40 keystrokes :-)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

You're correct!

[Anonymous Coward]

Well, okay, I can't resist. "In Soviet Russia, software updates YOU!"

Well, actually you are correct here since, if you're running SuSE in Russia, and use YOU, then YOU can update itself!!!!

not really...

[kylecito]

Today is Tuesday January 1st, 1980 ...

Re:Also known as... [ot]

[FroMan]

Doh! My bad.

Actually, American.

That's one more reason to like Apple.

[crovira]

Apart from the Music dowload, uh, stuffff, at their web-store, SoftwareUpdate is the right way to do it.

The download sites are controlled by Apple (and Akamai for all I know) but Apple really serves up the content.

Also they have a better, more secure OS that's conservatively designed and carefullly implemented so viri scouring and bug fixes aren't quite so desperately required by the system owners.

M$ may be too anal-retentive for their client base's own good. The only thing they want to conserve is their cash flow.

Re:That's one more reason to like Apple.

[Anonymous Coward]

Thank you for our daily dose of Apple bullshit.

Distinctions

[Heinr!ch]

I think there's a big difference between AV definitions and OS patches. AV definitions can be loaded and unloaded dynamically and have minimal effect on uptime. OS patches (in Windows) tend to be all over the place. MS' System Update Server is a good idea for now - in reducing traffic due to patches. However, in most of my environments, the only things we patch regularly are IE and IIS. We typically only patch the OS pre-SP1, but after that we only apply service packs. In addition, we have IP filtering active on every Win2k server (managed via GPO Registry Settings) so we can granularly control port access. As a result, our Win2k servers have uptimes comparable to our Linux servers, with the exception of reboots related to service packs and major software installations.

Re:Lamers - Oh Yeah?

[jdavidb]

If he's running DOS 3.3, he can't run Appleworks. He'd need ProDOS for that.

Re:Lamers - Oh Yeah?

[jdavidb]

Oh, and for that matter, if he's running DOS 3.3 on a ][+, the operating system can't take advantage of the system clock, assuming there is one.

Or Is The Cure Worse Than The Disease

[EXTomar]

One real issue with the way MS patches there products is simply that you can't roll them back. Without large IT bugdets that support "beta" servers, the only real way to test to see if a patch works is to try it in a semi-live environment. If it doesn't work budget some time to reinstall because there is no way to take it back.

Instead of the patch/rollback thing other OSes enjoy its a shoot in the dark with MS server products. "Oops" are less costly if you can rollback. How is MS Server 2003 going to save me money if I spend just as much time or more with spooky patches?

Backwards?

[limekiller4]

Oh, that's cute. In other words, he's admitting that writing these patches really eats into Microsoft's bottom line and all of us need to be more vigilant about using aftermarket protection -- at our own expense -- to help them as much as possible.

That's awesome. The bullshit that sells best is the stuff they wave right in front of your face where you can get a good strong whiff of it, as Carlin would say...

CVSUP even my applications get patched

[DrSkwid]

you can't beat a bit of daily patching
I've got "cvsup ports-supfile" on a cronjob
Every day I get emailed a list of the applications that have been updated and I can choose when it's worth patching them (they might not be installed - for instance)

to upgrade my *whole* set of port installed software :

#portupgrade -ra

& everything stays in regular updated form

I magically keep in step with the mozilla builds

it's great

that's why FreeBSD ain't dying

Re:CVSUP even my applications get patched

[cperciva]

Don't forget to patch the base system:

# cd /usr/ports/security/freebsd-update && make all install
# mv /usr/local/freebsd-update/update.conf.sample /usr/local/freebsd-update/update.conf
# /usr/local/sbin/freebsd-update fetch
# /usr/local/sbin/freebsd-update install
# echo "0 2 * * * /usr/local/sbin/freebsd-update cron" >> /etc/crontab

If you repeat it, that makes it true?

[Anonymous Coward]

This "45% of network traffic" bullshit was thoroughly debunked before, yet now you've repeated it as if it was truth. Truth of convenience perhaps.

Re:If you repeat it, that makes it true?

[prestidigital]

Is it that post a hoax? I'm not aware of its debunking. Maybe I'm misinterpreting what I've read, but I think several commentors are taking that stat out of context. I, for one, would not make any claim that is anything like: Windows Update takes up 45% of Internet bandwidth. When people say stuff like "plus the 60% for spam," and "don't forget the 70% porn," they are jumping to the conclusion that the stat (45%) means "on average." I can't speak of how the post was intended, but the way I read it, a (single?) routine inspection of cache revealed a particularly bad day...and nothing more. (Note also that I said "possibly.") Was it typical? I really don't know. In any event it seemed noteworthy in the context of the reported statments from a knowledgeable MS executive. I think it's good that they are looking at problem.

He's making a silk purse from a sow's ear.

[Ungrounded Lightning]

... Craig Fiebig, ... is quoted as saying "In dollar terms, patching is the most expensive security measures ...

Is Mr Fiebig telling us that things don't go so smoothly if you use MS products? Or that MS can't keep up with a bunch of amatures?

Looks to me what he's doing is spin control. Claiming that Microsoft software is better than open source because it's cheaper to use antivirus configuration updates than patches - when the only way to defend open source against a viral exploit is with a patch.

Of course that completely neglects the enormous difference in vulnerability levels - so you don't have to patch your open-source stuff as often as you do Microsoftware.

His company's software is SO VULNERABLE that it has spawned a BILLION DOLLAR INDUSTRY to protect it from exploits so common that multiple new ones are released daily. And he's trying to spin this into a cost-saving feature.

What gall!

Re:He's making a silk purse from a sow's ear.

[Anonymous Coward]

forest fires dont burn in the desert

Well, I hate to say this but...

[Anonymous Coward]

I spent an unpleasant Monday evening clear through to Tuesday morning this week reconstructing a G4 running Mac OS X Server.

Why did it crap out? It kernel panicked just before completing the 10.2.5 Server combo update (updating from 10.2.3)-- I mean, like a fraction of an inch of non-blue space left on the progress bar. Which is apparently the most important part of the process.

When I power cycled the G4, it would not reboot. I tried again and threw it into verbose mode, and the errors and failures just cascaded by.

To matters worse, I could not do the standard 'archive and install' thing to fix it. 10.2.0 refused to install over top of 10.2.5.

Luckily, I had good backups, and there was no loss of any of my client's data from the drive anyway. Still, I had to nuke the drive and set it up all over again, because nothing I tried to revive the existing install of the OS had worked.

Virus definition files...

[Goonie]

Yep, I know I have to keep updating those on my Debian box...*giggle*

Seriously, MS has had years to redesign MS Office, Outlook, and so on, to make it hard for viruses. Why is this still an issue?

Re:Virus definition files...

[Anonymous Coward]

Seriously, MS has had years to redesign MS Office, Outlook, and so on, to make it hard for viruses. Why is this still an issue?

oh, heck, you mean to say the should have have made i harder for the viruses to propagate?
but that would destroy the market for av vendors, id vendors, firewall vendors and not forgetting how utterly impossible it would be for world+dog owning your box.

2 in one reply

[A_Non_Moose]

Well... before the knee-jerk MS-bashing starts, let's think about it.

You've been here how long, again?

and
M$ patches on the other hand have been responsible for some of our WORST outages,

Ever tried to block ports with IPSec?

Windows 2000 Server *requires* a reboot every freaking port you close

AAAAAAAAAAAAAaaaaaaaaaaaaaaaaaaaaarrrrrrrrrrrruu uu uuggggggggghhhhhhhhhhhhh!!!

14 ports and 20 something reboots later.

Why no embrace-and-embed?

[serano]

Why hasn't the company that has gobbled up any novel software and made it part of the operating system never attempted to make anti-virus software part of its system? I'm not saying I have ever liked their model of embrace and embed, but why haven't they done that in an area where it really would be logical and useful?

Spare me the anecdotal evidence Taco

[Call Me Black Cloud]

That 45% figure is such BS. I don't see where the guy ever backed it up. Here is my reply to that article. I run Windows XP Home and keep it fully patched, at least for critical items, plus some optional items (like Movie Maker). So far this year I've installed 19 patches (Windows Update has a history feature). Let's say each update is 5MB (which is a very liberal estimate. Most are under 1MB). That's 95MB over 4 months, or roughly 20MB/month. If that is 45% of the ISP's traffic then that ISP is getting off cheap and shouldn't complain...especially if you consider that my estimate is probably 3x too high.

OpenBSD

[jhines]

OpenBSD just did an audit of their code for these kind of problems. So if this is an issue for you, that is the place to start.

What's testing got to do with it?

[einhverfr]

Lets face it-- if the bugs that cause the critical bugs even make it to beta, there is something wrong because there is a good chance they will get through even with the best testing.

The problem is not the testing or even the coders. The problem is often the application designers/architects who often are thinking "features" when they should be thinking "security."

I suspect that $1 of design is worth $10 of coding, $100 of testing, and $1000 of patching for Microsoft, let alone the poor customers.

But you forgot...

[dorfsmay]

apt-get moo

I have to do it once in a while, I always get a good laugh !!

To be fair...

[dorfsmay]

I am no Microsoft fan, but even when if you were to write the software "right", you have to remember that,to quote Pressman, software deteriorate. Therefore even a perfect piece of software will need to be patched at some point in the future because the environment around the software will change (new OS, new hardware, unforeseen complication (can you say Y2K ;-)). Can anybody quote one OS that never needs patching ?

Once you have accepted that you will have to patch, then you do it on a regular basis, on your test box first, then you move the "patch bundle" to the prod boxes. The only problem with this method that has come up recently is the time-sensitivity of security patches, if you want to stay safe you can't really afford the slow cycle of waiting for the patch bundle to come out, let it mature, apply in dev, apply in prod. I have no answer to this one, I'd love to hear other's opinion on it.

There are strategies to reduce patches, like the one that is rarelly mentioned and that I like a lot is de Raadt's idea of code audit , once you found a bug, you know that you have made the same error somewhere else and should go through your code to find it and fix it.

Debian

[INAN]

A great way to handle integration testing is to participate in a group that does it together like, say Debian. I really appreciate the community's work to make sure that everything works.

Really? Which do you think costs more?

[Dolemite_the_Wiz]

1) Patching servers and Virus scanners?
2) Repairing a company's reputation after being hacked or brought down as a result of neglecting #1?

If you chose #1 you need to find a new job in a different, non-technical industry.

Dolemite
_________________________

Try calculate the cost of writing PERFECT proggies

[Taco Cowboy]

Wow...it took them this long to realise that it costs more to do things 2, 3, or 4 times then if they had done it right the first time..."



Well, try calculate the cost of writing PERFECT PROGRAMS that has NO BUGS, and all the features are implemented PERFECTLY.


I know about the planning process, I know about programming methodologies such as Extreme Programming but in this real world that we live in, believe it or not, NOTHING IS PERFECT and software patches become the second best thing one can have.

Re:Wow...it took them this long to ANNOUNCE it

[oldCoder]

Obviously they've done a study of some costs and the guy announced what everybody already knew. Patching is more expensive for server and for workstations than keeping up anti-virus libraries.

Microsoft does test the various releases, and it tests the patched systems, but they have a tremendous number of users and of hackers to contend with. The mind-set at Microsoft for many years was; One computer, one user. And deliver the promise of the microprocessor. When they did the big Internet switchover they networked together systems that were "Secure enough" for single-user usage. The whole idea of hackers and hacking just wasn't properly understood by of a lot of the developers and managers. (I'm sure there were a few choice e-mails, by the smarter visionaries about network security, that they wished they'd paid more attention to).

You can look at Microsofts security problems as a fallout of the dot-com bubble, when MS and everybody else tried to very quickly adjust to the new Internet-business reality. The microprocessor revolution ran into the Internet revolution, and a certain amount of roughness resulted.

The idea that these problems are happening because of a lack of testing or of code review or of understanding how to do good software just doesn't add up. Creating good software is hard, creating good software for a large market is harder.

I am reasonably certain that Microsoft tests their products more than the Linux vendors do. Microsoft has teams of thousands of full-time testers using tens or hundreds of thousands of test machines running both automated and hands-on tests. I dont' think any Linux vendor does that. Did you think all of the 30,000 employees were coders and marketers?

Re:Also known as... [ot]

[Anonymous Coward]

Why are you using 'European' tags? Or are you unaware that it's the REST OF THE WORLD that uses Metric? Yeesh.