Slashdot Mirror
Microsoft Plans An Overhaul For Patch System
sckienle writes "ZD-Net has an article about Microsoft's plans to overhaul their patch system. 'Ninety-five percent of attacks happen after a patch for a known software vulnerability has been issued' says Scott Charney, chief trustworthy computing strategist at Microsoft. Basically, Scott is promoting the idea that Microsoft can do a better job, in many ways, so people will trust and be able to install patches quickly. Microsoft has a transcript of Scott Charney's talk on their site."
As reader sweeney37 summarizes, " Microsoft's plan is to reduce the patch installers from eight to two, they want to have one patch installer specifically for the OS side and one specifically for the applications." Sweeney37 points out this InformationWeek article on the planned change.
What about the recent patch that "broke" peoples net connections... I don't want something like that automatically applied.
If you are running WinXP, you can set up Windows Update to download the latest patches anytime you are connected to the web. This will get you the latest updates just about every time you use your computer.
If you turn off this feature, it's really your own fault that you get hacked. If it is true that most attacks occur *after* the patch has been issued, there is no one to blame but the user.
But I'm sure we can twist this into an anti-MS thread anyway.
I have been pwned because my
It's so difficult for Administrators to manage all these patches.
We take a risk by delaying patches, we take an even bigger risk by patching without decent amounts of testing.
The last thing we want is to have tested the patch and find out we rolled it out incorrectly. MS appears to be going some way to help us good guys out.
.. I sincerely doubt that their reputation for releasing patches that break as much as they fix will be affected very much by this move. I think most business users will see it as an attempt to appear as though they're trying to address the issues instead of actually doing anything.
It's kind of like a balding man with a really bad comb-over. It looks okay from a distance, but it doesn't really fool anyone.
Users who do not patch their default Linux installs are the ones to blame when they get hacked, but Windows users who turn off automatic updates are off the hook because Microsoft didn't roll out a patch correctly?
Double standard, anyone?
After i just go through hell with m$s last patch to fix a security problem... connection problems. That thing took 5 hours to remove and still i see side effects of it (like aim wont connect and stay connected for long). But hey, that's how they make their killing: tech support. Sadly I'm not (dumb|smart) enough to (write|call) them on this one. Maybe its time for a patch system that simply removes the files they over wrote and stores the old ones somewhere.... that'd be really nice..
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Hi, A good idea to improve the speed of patch adoption should be not to use patches to sneak in system "enhancements". I use XP for some tasks at home and once I applied one "cumulative security patch for Internet explorer" I found out Windows was keeping me from watching my region 1 DVDs ( I live in Spain ). Of course I re-installed windows and I stop installing whatever patch and I am trying to move all my desktop needs to Linux; anyway I believe this behavior is shameful if not criminal. I have since advise all my clients to plan an exit-strategy from Microsoft products. The belief from Microsoft they can restrict product features set, after you already bought it makes dangerous to "bet" your business on their good faith as they do not have any
Come on, that's hardly reasonable.
How is a user supposed to trust a patch being issued by a company that is known to release vulnerable software in the first place?
Yes, it's not a reasonable standpoint for a user to have, but it's still valid!
Take this example: My system works. Apple releases Quicktime 6.3, iMovie 3.0.3, iSync 1.1, and Bluetooth 1.2.1 today. You expect me to update all of them?
Why? Just because? Because there are new features? Because they fix bugs? Because they improve performance? Just because Apple decided to release them?
But the difference is that I do trust Apple. Having used their OS and system for 2 years, now, I have found that Apple updates don't introduce more problems, do increase functionality, performance, and reliability, so I *will* update just because.
However, there *are* pieces of software I haven't updated. I haven't updated my base station software, yet, because it works and I don't want to restart it. I haven't updated my iPod software, again for the same. I haven't updated my IE because I don't use it, and have deleted it.
But I *don't* trust Microsoft. I've been using them for 10 years, and I won't update until there's feedback on whether there are new instabilities, problems, crashes, etc.
That... and did I mention I don't trust Microsoft?
GPL Deconstructed
Not only do they need to standardize the patch installers more, they also need to put into patches the ability to slipstream them with new installations, like you can do with a service pack. The number of critical updates we have to install after every new installation of XP is ridiculous when they could just provide us with an easy method of integrating the changes into the source files.
After the spam legislation becomes law I hope to see your ass in the slammer.
http://saveie6.com/
Sorry, Charney, it's not the patch installation software that's the problem. Sure the changes you suggest will make things a lot easier, but their absence isn't why people don't install your patches. The problem is the patches themselves.
Yes, the patches themselves. People don't install them because they break critical production software which must not be broken. And in some cases those patches can't be backed out without a complete wipe and reinstall of the system, witness the recent VPN protocol "fix". As long as this is the case, people will still not install the patches no matter how easy the installation process is.
If MS wants to improve their patch process, they need to do a few things:
Microsoft never fails to surprise me with their futile attempts to try to gain the trust of the IT world. Here we have another story of a billion dollar company, run by a 10 cent brain, i.e. Bill Gates, et al.
I don't think this patch problem is all about number play, i.e. reducing from 8 to 2. They should be more focused at producing a good product in the first place, not just creating a quick podge-job and then bombarding their customers with patches (which are usually also full of bugs).
They claim to be "Secure by Design" and yet they probably one of the worst track records when it comes to security related issues. This is just Microsoft spreading propaganda just to make it look like they're doing they're job.
Any time something wrong with Linux is pointed out, you are then reminded that somehow, this is a good thing. Linux is always perfect.
Not so with MS. They can do no good ever. According to Slashdot, MS has NEVER come out with anything decent. They could compile an exact duplicate of Linus' personal kernel, and somehow, the Zealots would find something wrong.
It's amazing how MS is slagged as not having an ounce of innovation, what about Linux itself? This is not an OS that was developed independently, with no legacy ties. In fact, it was written to be a substitute for Unix, a copy, a clone. Linux could not exist with Unix.
This is the thinking of the supplicants who recently touted "Feet of Fury" as innovative.
Of course, this will be modded down. Contrarian opinions are not tolerated here (the supposed bastion of free thinking). You think Bill is the Borg? You haven't met a Zealot.
Just because passwords are being sent in the clear, doesn't mean you can necessarily intercept them. You need to be able to intercept the packets containing the username/password combination from the remote user. You could do this at one of three locations: the remote machine, the server, or in transit. If you own the remote machine, you could just trojan *any* client used, so telnet isn't any worse off than a more secure protocol. If you control the server, the point is already moot.
So let's look at the "intercept the packets in transit" approach. You could try to sniff the packets by compromising one of the routers, or listening in on a wireless LAN if that's what the client was using, or installing a physical wiretap. None of these would work against a secure protocol.
Anyway, let's assume the attacker has intercepted a username/password combination for a particular machine. He could then do anything that user could. However, that doesn't get the attacker full control over the system. For that, the attacker could then use a local root exploit.
Additionally, many of the daemons that provide services like FTP or telnet have had many remote root holes in them.
So, whilst telnet and non-anonymous FTP have their security issues, and you probably shouldn't be running them and certainly shouldn't be exposing them to the world, exploiting their weaknesses isn't quite as easy as you might think.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
I see this as Microsoft taking a much needed step towards addressing the #1 security problem plaguing the Internet: Joe User.
Joe User doesn't even know what Windows Update is, so never installs any patches for the operating system. Joe User clicks on any E-mail he gets that says "L@@K NEW WINDOWS SECURITY PATCH!" or "ANNA KOURNIKOVA NAKED!!1" As a result, Joe User is running several different trojans, and his system is being used as a DDoS attack drone whenever it is online.
As much as we might decry a percieved invasion of our right to run our own systems, forcing Joe User to keep his system up to date with the latest patches is a good thing for all of us. Fewer packet floods, fewer lamers on compromized hosts, and possibly less spam. It's likely that Joe User doesn't even CARE that Microsoft is installing whatever it wants, whenever it wants, on his box. In the end, as long as those of us who know what we're doing can disable this feature (and those of us who don't CAN'T), I can only see this being a good thing for everyone concerned.
So if you have a pirated copy, and you constantly get infected by worms because you can't get any security patches, wouldn't that make you more inclined to BUY THE SOFTWARE?
That critical production software NEEDS a patch, f.e. it has a security hole, or runs on top of an OS that has a security hole. THerefor it IS already broken and thus needs patching. THere is NO excuse for not patching your software, like there is also no excuse for having security holes in your software.
That's a rather simplistic view. In practice you have to decide if the odds of being affected by the bug the patch fixes are greater than the odds of the patch screwing up the system in some unknown way. Sometimes it comes down to "the devil you know vs. the devil you don't"
There is NO excuse for not patching your software, like there is also no excuse for having security holes in your software.
To quote Morpheus, "welcome to the real world". What if your choice is between these two:
1) running software with a security hole, but being able to bill your customers, and
2) not running software because the patch breaks the application that allows you to bill your customers, thus not making any money and going out of business.
Unfortunately, sometimes this is a real situation, and not just with microsoft software.
While a patch system overhaul is long overdue given the number of affected legacy systems, Microsoft should see this as an oppurtunity to save themselves some serious money (and, as a side effect, do some actual good). If they can learn from this experience, and use this as a learning experience on the importance of writing good code, this could be a great oppurtunity for them.
Instead of having the large full time support staff they do, as well as the crews of people scanning the web for new exploits, how much time, effort, and money could they save by hiring a couple of full time people to check _all_ buffers on all code after it's been committed to sourcesafe? Also, it would reduce data loss due to crashes and other problems. Wow, Microsoft increasing their bottom line in a way that actually helps consumers. What a thought.
Contact Me (got tired of viruses emailing me).
if you'd allowed the pirates to receive patches instead of trying to screw them with an insecure version of the OS
;-)
Good one, you steal their software, and then accuse them of screwing you?
Hmm, they're separating out patches for the OS and its applications? Interesting, considering their recent move to make the latest version of IE the last 'standalone' one... How will they differentiate OS and applications if they keep doing this? (Real question, not sarcastic/rhetorical)
Their desire to enable all sorts of program functionality to be controlled through COM and scripting programs means that a virus can now do just about anything you could, and do it faster too. If they want to really nail down the OS they're going to have to start disabling these services, or let users do it for them.
All those moments will be lost in time, like tears in rain.
you (the admin) still have to hunt down all the non-MS patches yourself. RedHat does this for you :-)
Redhat provides patches for everything it distributes.
Microsoft provides patches for everything it distributes.
I fail to see the problem.
Tarsnap: Online backups for the truly paranoid
Neither is there a single place to go for patches in the Open Source world, Debian and Redhat are fine and all, but so far I haven't seen a single GNU/Linux system that could live without compiling a handfull packages manuelly from the official source, bypassing the packaging system and thus making automatic updates not possible.
Funny, I always thought the key to software security was to write good code in the first place. Automating a patch system to improve software security is like building automatic bandaid dispensers into children's clothing to make playgrounds safer. It's an extension of security-through-obscurity, at the expense of user freedom.
The majority of hack attacks happen immediately after a patch is announced, implying that announcing the patch announces the vulnerability. So MS is saying the problem isn't the vulnerabilities themselves, it's that hackers respond more quickly to the announcements than ordinary users do. Microsoft's solution is to speed up the response. So what if the users have to give up control of their computers? They're going to have to turn over the keys anyway when Palladium gets shoved down their throats, right?
Casting users as the weak link is ultimately a lame defense for the fix-it-later commercial software development philosophy. Rushing software out the door because the marketing dept has promised it to retailers who want to sell it before Xmas is not the only possible way to do development.
The free software world may not be perfect but it doesn't suffer from that particular disadvantage. One way to make your system more secure might be to run code that was released when the developers decided it was actually ready.
Maybe just partly because then they wouldn't need to force you to use Internet Explorer to visit Windows Update.
Oh, I'll hapiily pay! ... For quality software against a reasonable price, that is. Now if Windows XP didn't cost me a kidney but 50 euros or something OR MS would drastically improve/cough up some versions of their OS worth the money, (stable*, secure*, fast*, bloat-free, no evil licensing schemes/integrated crap) then I'd happily pay! Unfortunately, right now, I'm not going to fork over 300 euros for Win XP Pro only so I can have one huge piece of bloat slow down my computer while MS monkeys/lawyers are constantly trying to think up the holy grail of licenses which in legal terms state that MS will own my house, car, wife, first born and have the right to sell my soul to Satan for favours.
* = Surprisingly, they already managed this. A windows machine CAN be made fairly stable if properly taken care of, same with security. And XP Pro boots pretty fast on my Celeron 300, faster then 2k on an AMD XP 1900 :\ Remember kids, while MS is still evil, most faults can be attributed to human error/incompetence still!
Hate me!
Well this is interesting. All the MSI file is is an archive file with a header that tells the Microsoft Installing Engine how to install this file. It's the equivalent of an RPM really, but only with a slightly more intutitive installing system.
And even with the MSI installing engine, would you really trust Microsoft integrating the engine into the operating system? Think about it, every time you connect to the internet it would look for patches, and automatically install them, breaking everything (including your face), while "patching" the operating system. And what if Microsoft turned even MORE evil and decided to install DRM software or spyware software without you even knowing? Or worse, sold out to Bonzi Buddy, and everyone got a furry little desktop companion... Truthfully there are things that need to be integrated into the operating system more than the current patching system, like antivirus software.
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
A problem? Maybe not, but I see an obvious difference. A Red Hat distribution includes tons of applications (e.g., Open Office and language compilers/interpreters). A Microsoft Windows distribution doesn't include much more than the OS. Yes I know that it includes stuff like Windows Media Player and Outlook Express, but that's still nothing compared to what comes with most Linux distros.
Oh, I'll hapiily pay! ... For quality software against a reasonable price, that is. Now if Windows XP didn't cost me a kidney but 50 euros or something OR MS would drastically improve/cough up some versions of their OS worth the money, (stable*, secure*, fast*, bloat-free, no evil licensing schemes/integrated crap) then I'd happily pay! Unfortunately, right now, I'm not going to fork over 300 euros for Win XP Pro only so I can have one huge piece of bloat slow down my computer while MS monkeys/lawyers are constantly trying to think up the holy grail of licenses which in legal terms state that MS will own my house, car, wife, first born and have the right to sell my soul to Satan for favours.
:\ Remember kids, while MS is still evil, most faults can be attributed to human error/incompetence still!
/, and other geek sites make all geeks look like a bunch of whiney little children who are just looking for everything for free...
* = Surprisingly, they already managed this. A windows machine CAN be made fairly stable if properly taken care of, same with security. And XP Pro boots pretty fast on my Celeron 300, faster then 2k on an AMD XP 1900
So let me get this straight. You'll pay if the software is stable, secure, fast, bloat-free, and has licensing you like. You admit Windows XP is stable, secure, and fast (even though you later go on to contradict yourself and say that it will slow down your computer). If it is stable, secure and fast (as you admit it is), bloat just means it has extra features you don't use, which don't affect any of the previous 3 apparently. So because you don't like the licensing terms (but apparently approve of the rest of the product) you will pirate the software. This seems like the whiniest protest I've ever heard. The software is great, but until they change their licensing and price (which I can afford, since I can afford a computer) I'm going to steal their software. Jesus, and people wonder why non-geeks think
"Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
That's the biggest load of bullshit I've ever read. If you think Windows is such a bloat-ridden insecure piece of crap, why are you still using it? The truth of the matter is, you can get away with not paying for it, so you will. You're a thief, end of story.
UNIX has been around for a decade longer than even the earliest efforts from MS and it still works really nicely.
That's besides the point. Microsoft is stuck with what they have right now, which is this giant, semi-monolithic applications platform. The best they can do is try to audit it for security and hope they don't break anything, and even that is a trying job. Give credit where credit is due, because for all its clout Microsoft lacks much of the flexibility of its competitors.
In Soviet America the banks rob you!
You mean... like RPM? DEB? It's nice to know that MS is getting on board for things like centralized dependency checking, but do they have to make everything sound like they're inventing it?
You're right, everyone knows that Linus invented dependency checking, and Red Hat were the first to use it.
Get over yourself and get a clue.
Your comment illustrates the nature of the problem. In the Open Source world the creation of the software separate from the support.
The Apache guys rightly consider their job done once they've put the patch on their web site. It's up to the distributor, or whoever else wants to make money from support, to deal with it from here.
Proprietary software writers, however, want to support the products themselves. That's good sometimes, but it means the end-user has to deal with each software vendor separately in order to manage patches.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
This is simply another example of Microsoft's ongoing strategy to sell products:
1. Release lots of marketing hoopla about initiatives to improve security, each of which is followed by an embarassing new security breach.
2. Spread FUD about other products that are gaining ground against their products because of an established record of security they just can't seem to produce (see 1 above).
3. Rush patch after patch after patch out the door without proper testing, creating more problems than they fix.
4. Blame the user for each new embarassing security breach.
5. Do anything EXCEPT address the underlying design and implementation philosophies that created all of this mess in the first place!
I no longer patch my Windows systems. I don't have to. I have to run Windows for some of the software that is only available on Windows, but I don't have to expose them to the 'net. My Windows systems hide behind a firewall. Outlook and IIS are banned from my systems. I don't send out Word or Excel files and any that come in are screened and cleaned before I open them.
My Windows systems are sealed in jails with only tight little windows (every pun intended) through which to look out at the Wide Wide World (get it?). Attempts to communicate with the family in Redmond are blocked; contraband coming in from the outside world are routinely scanned for and removed.
And who is the jailer? Right now, Linux. Linux runs on the firewall. My server is Linux. Mail is routed and cleaned though Linux software incoming and outgoing.
Get a clue, Microsoft. This is the way of the future. This is my Microsoft strategy. Increasingly, it is also the strategy of people I consult for: if not now, soon after the next virus attack or server hack. Microsoft software simply cannot be trusted to work in the Wide Wide World.
Here's something to think about. Microsoft's patch system authenticates you before it will give you patches (not you specifically, but the Activation Code you're using, I believe).. with the last service pack they made a whole lot of pirated corporate editions not able to use Windows Update.
:)
This doesn't mean all the pirates are going to say "gee, guess I'll go legit and buy a copy", it more likely means they'll stay unpatched.
It would be interesting to know how many systems that are participating in DDoS attacks are not patched because they can't patch because they're illegal copies of Windows...
(Yes, patches are available in other ways than Windows Update, but Microsoft is doing all their work to make Windows Update easy - maybe what we need is a "rogue Windows Update" for the pirates
- Steve
Redhat is coming close to establishing monopoly status within the linux market.
Hardly. They can't raise the price of their distro with impunity, barriers to entry are low, and there's little vendor lock-in.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Windows even has that "MSI" stuff, then why is a Microsoft patch not distributed as a .MSI file?
Because the software needed to support MSI isn't installed as part of the base OS package, so they can't be sure it would work.
Yes. I can always download the CDs or copy from a friend or create a derivative distro.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
"but it wouldn't surprise me at all if Redhat starts to get into antitrust problems."
I would.
The difference is that:
1. MS distributes it's own products with Windows. If they distributed Netscape then it wouldn't be antitrust.
2. RedHat is not a monopoly and therebefore cannot get into antitrust problems.
If you're a monopoly then you have less freedom. That is the law.