Slashdot Mirror
Windows XP SP2 Delayed Until Late 2004
Aiua writes "BetaNews is reporting that Microsoft has pushed back the release date for the second Windows XP service pack to the third quarter of 2004 without giving any reasons." Update: 08/19 12:52 GMT by M : Another article claims it will be out three months earlier, no later than June 2004.
What?? You mean there are problems with XP?
-- "Quidquid latine dictum sit, altum sonatur."
- Whatever is said in Latin sounds profound.
Due out November 12th 2003
when they ban enctryption only criminals wi$21*J *#JF$%!@#$':
If they're referring to fiscal year 2004, that's between January and March of next year, which isn't nearly so bad.
Reasons... who needs reasons? When you're Microsoft, you don't have to give reasons for anything. Especially in a time where you're coasting through a big vulnerability in your operating systems without really providing many answers. I figure by late-2004, a clean install of XP with SP1 should have about 50 additional critical updates for it (... there are 27 since SP1), and the entire installation process will take 2 hours (an hour to install XP w/ SP1 slipstreamed.. and an hour to install the 50 updates). What a shame.
Redhat
Debian
SuSe
Apple
Linux-Mandrake
Gentoo
FreeBSD
There is nothing wrong with being gay. It's getting caught where the trouble lies.
Isn't that the time that "Clean" up worm is set to expire?
Sig it.
Of course, the real reason for the delay is that after SP1, XP is almost completely bug free (except for thost pesky third-party apps that keep crashing...)
As I stated to daddypants, who IGNORED ME ahem, Michael, Wininformant has the real story. Due out in Q1-Q2 2004, not Q3-Q4.
My journal has hot
Could it be some unknown vulnerabilities that need to be patched or need bugs in their patches fixed? In SP1, they silently fixed some serious "script kiddie" internet explorer vulnerabilities that they would rather not admit to having. Could it be that they're trying to do this again?
The security community breathed a collective sigh of relief that there would be no new influx of security patches to patch the new service pack until late next year.
Then they went back to tracking the CURRENT vulnerabilities.
-- You can't idiot-proof anything, because they're always coming out with better idiots.
They finally understand what a buffer overflow is, and this time, they'll *really* *really* fix all of them.
WinInformant says that the statement meant Fiscal year 2004, which ends in June 2004 for Microsoft, and that SP2 is due out mid 2004.
The Register reported on 28 March this year that a service pack 2 build has been leaked. So if the Service Pack is more or less ready, what is Microsoft going to incorporate into it in 1.5 years ?
My mom never taught me to sign.
Convenient...
The story is basically saying that SP2 will incorporate things that MS "innovated" in the last year. Firewalls, anti-virus, etc, all stuff thats also supposed to be in Longhorn. Silly.
"If you're not confused by quantum mechanics, you really don't understand it." - Niels Bohr
Windows users will have to wait till 2004 for a new set of features that can be exploited.
At least as the other article linked in the first comment of the article in question plainly states.
-
There's always a reason! I think Blaster is a reason enough.
How is that a reason? The exploit that worm used was fixed months ago.
Microsoft have been talking about making auto-updating enabled by default in a service pack which may be linked to the delay. They will need to make sure patches are installed without having too many adverse affects. And a way for business users to have it disabled because they would typically not want it enabled.
I.O.U One Sig.
When has that ever stopped Microsoft before?
. there used to be a sig here.....
(Isn't it a good /. tradition neither to read the article, nor to have any idea what it is about, while participating in the discussion?)
How is that a reason? The exploit that worm used was fixed months ago.
Yeah, it was fixed about a month ago, but this recent incident that had a huge effect on their customers _must have_ increased their willingness to improve the security of their products once and for all - thus the delay. Or perhaps I'm just daydreaming.. I don't know.
They probably want to make their Windows Server 2003 customers feel better by making sure *their* SP comes first. Y'know, to make up for the "but it's secure out of the box!" gaffe.
Or maybe they are thinking about stuffing in the virus scanning "features" they've been rumoring about...
Eh, it's just a service pack...
Sometimes it really concerns me when my computers have more "MS Hotfixes" installed than actual programs.
Hmm... I guess the more you install the better it runs. That sure sounds odd.
Hard loop..... huh?
Dynamic Designs
No, no. The Blaster hole was fixed about a month ago. People just didn't patch their products.
What I ment was that the Blaster incident was probably the last nail in their coffin - maybe they finally had enough and decided to take security a little bit more seriously from now on. That would explain the delay.
Something strange is happening at Microsoft ...
IE development ended (sort of)
Outlook express development ended
Service packs under long delay
Just an observation.
Skiers and Riders -- http://www.snowjournal.com
Errm... XP does have an automatic update facility, which can be set to automatically download critical updates... you can choose whether to be prompted before downloading and again and before installing... of course many people disable this because they don't want Microsoft installing stuff on their machines without them knowing.
Or, manually, you can simply click "Windows Update" in the start menu/programs, which will determine what patches are available and allow you to select/deselect which ones you want to download and install.
I'm not really sure how it could be much easier???
I copied this sig from someone else (but where did they get it from?)
No it was NOT fixed months ago. It was fixed about 3 weeks before the worm came out.
I love how misinformation about this gets out, shifting the blame from MS to the sysadmins of the world.
Freedom Is Universal
Linux-Universe
. Antivirus software for the platform is capable of downloading and applying updates to itself, and it wouldn't be a bad idea for Microsoft to take a page out of their book.
Let's see...
The blaster fix opened a hole on some systems
NT SP5 completely destroyed network connectivity
Tell me again why it should be automated downloads?
And by the way guys, this mindless MS bashing just isn't funny anymore. It long since ceased to be Redmond that was made to look stupid by these comments, it is now Slashdot itself, and by extension Linux. Which is a shame. True Linux and Open Source advocates would do well to consider some basic notions from the field of public relations.
When I click on windows update right now all I get is
Thank you for your interest in Windows Update
Windows Update is the online extension of Windows that helps you get the most out of your computer.
The latest version of Windows Update is available on computers that are running Microsoft Windows 98, Windows 98 Second Edition, Windows Millennium Edition, Windows 2000 (except Windows 2000 Datacenter Server), Windows XP, and the Windows Server 2003 family.
That's all it says - no where to click for an update. What's with that?
If Microsoft want to makee auto-updating default for the clueless without offending business users who would (presumably) want it disabled, so they can control rollout of fixes themselves (both to reduce bandwidth by using the full downloads and the software delivery mechanism of their choice, and just because they want to give things a proper test first), why not do what I think they should have done all along - first only make it the default for XP Home Edition, and second make it a configurable during install.
"I Know You Are But What Am I?"
Linux: The ultimate NT servce pack.
For Joe User and for admins of relatively small business networks, 3 weeks is ample time to try out a service pack to make sure it doesn't break anything that you rely on and to roll things back if it does. For the admins of larger networks, where there may be an even larger number of applications that have to be compatibility tested, 3 weeks may not be enough. If previous MS supplied patches hadn't fscked up application stability in the past, this might not be an issue, but as they have, it is.
Not every article on slashdot will have profound significance to your life. Get over it.
Conserve Oil, Recycle, Boycott Walmart
What I don't understand is why the process of discovering, downloading, and applying security patches has to be as difficult as it currently is.
Use the Red Hat Network Update Agent sometime if you want to see an updating process that's REALLY a pain in the ass.
For example, when trying to find a patch for the vulnerability that Blaster is currently exploiting on many systems...
Going to Google and typing "blaster patch" isn't easy enough? Considering the news coverage it's getting, you'd think that by going to any news site and doing a search for Blaster, you'd get some clue where to look next. Or, you could do what I did... SUBSCRIBE TO CERT. That way, you get the vulnerability notification the same day all the other professional system administrators do.
the vulnerability I thought it was, then find a download link, then be presented with a multipage license agreement -- all for one fix.
Two points I'd like to make. First, when is there a vulnerability that gets airtime on the major news channels (like CNN, Fox, ABC, CBS, NBC, etc.) that should NOT be fixed immediately? Second, clicking 3 times (Windows Update, Scan for Patches, Install) is a lot simpler than the 10 or so that Red Hat requires. (I only have Red Hat Network to compare to, so if there's any better way to update RH8, someone let me know.)
My thought is that Microsoft would do better to be a little more proactive in their approach.
You mean besides the bubble that pops up near the clock that says "You have updates. Click here to install."? You'd prefer a popup window that takes up 80% of the screen when it boots that says "Jesus Fucking Christ, update your system, dumbass!"?
I'd appreciate having the machine automatically seek out the patches I need and apply them (particularly the most critical) without requiring my intervention...
It already can do that. When you format a new machine, the first or second time it boots, a little bubble pops up near the clock that says "Set up automatic updates." One of the options (out of the 3) is "Automatically download and install patches." For those of us that don't know where to look without formatting our systems, that's under Start, Control Panel, System, Automatic Updates. I prefer to take a look at the updates before I install them though... just my preference.
"It's better to have a gun and not need it than need a gun and not have it." ~ Christian Slater, True Romance
Wasn't this the release that the courts told them they had to include Sun's official version of Java in?? MHMMMMM!!
Microsoft have been talking about making auto-updating enabled by default in a service pack which may be linked to the delay.
It doesn't matter...
The blaster patch on Win2K requires at least SP2 which requires 8 hours, 10 minutes to download via dial-up. Because of this, I disable auto-updates on any dial-up PC that I work on. It just isn't bandwidth effective.
IMHO, Microsoft should be *required* to send critical updates on a CD package via postal mail. The updates should be hands-free, though I doubt that we'll still have trouble getting newbs to run a fix on a PC that doesn't appear to be broken.
The other twist would be the built-in firewall software. Simply run updates to auto-configure it to block known exploits. Anyway that you look at it, there is a big problem.
Life is the leading cause of death in America.
I'm quite content to not have to deal with another XP service pack for a while. The last one for XP gave me fits on several computers that required a complete re-install. And the recent 2K server service pack 4 took our email server out of comission for a day till we uninstalled it. Microsoft's service packs are generally not to be trusted...
Hmm, it's Tuesday. Must be "bitch about Microsoft not issuing updates". Tomorrow is "bitch about Microsoft issuing too many updates".
There is enough valid stuff to complain about when it comes to Microsoft, let's not start just speculating wildly.
My beliefs do not require that you agree with them.
Auto updates don't have to suck. For instance, take a sample of your users, say the three or four that actually have a clue, and can survive should their PC be down for 30 minutes (hint: office assistants. Managers who like to feel special) while you re-image it. Set their machines to download and install the updates automatically, once a week. Let them know that if they see anything out of the ordinary, call you on the spot. The rest of the flock updates once a month.
Now you've got a control group to test updates on. If MS manages to drop the ball and release a huge failure of a patch (not all mickeysoft patches are failures), you haven't lost your entire system. In a perfect world, bad patches don't get released, but the world's not perfect and *all* operating systems need to be patched.
Another option. You've got three different settings for auto updates. Notify before download and notify before install, Download automatically and notify when they're ready to be installed, and Auto download, auto install. Set your boxes to download/notify and don't install until you know the patch to be safe. I will grant you that Auto/auto can be suicide in a production environment.
Bitching because microsoft makes 2nd rate software is a fine avocation. Bitching because you have to support their crap software is the slashdot equivilent of the national past time. But bitching because you're too lazy to make an effort? Try lighting a candle for once instead of just cursing the darkness.
There are some people that if they don't know, you can't tell 'em.
What everyone seems to forget, is the new/re-installations of Windows XP. I for example updated the Windows from ME to XP (about time), and the update went fine...except that Tiny Personal Firewall didn't work anymore. 3 minutes after installation, before I was able to even connect to Windows Update, I got the nice RPC shutdown message of blaster. Oh but if the worm would've been more destructive, I think it would impact the installations of Windows...hmm...
Come on, lets get real. You can't secure something as dreadfully wide-open as Windows with a Service Pack. If they say they can, thats just a lie. If they THINK they can, then they should consult a psychiatrist about their tenuous grip on reality.
A project that complex has to be built against a secure design from the drawing board forward. You can't just decide, deployment +18 months later that you're going to now change the software to make it secure. Hey MS has known about this hole for a while (the Slashdot story was, what, two months ago?) and only patched it last month.
It is also possible they want to synchronize the release of "secure" windows XP with the sunset of Windows 2000 to encourage people to upgrade. I'll say this, that MS will be seen for what they are if this turns out to really be the strategy. IT Managers who have struggled against MS worms, virii, and trojans for years will now see that secure Windows was only released to coincide with him forking over thousands of dollars to "upgrade" to a product with features that should have been in (because they were advertised as being there) 1.0. I refer to the ability to plug it into a network without becoming an instant DDoS zombie.
Who did what now?
What do you mean, they bury it where no one looks? Every install of XP I've ever done, the Auto Update icon shows up on the start bar after using it a short while, and prompts you to run the Automatic Update Wizard. The wizard gives you the option to automatically download updates and prompt you to install them, which is the default behavior and the one I prefer as well. Or you can just have it auto-install them.
So, no one really has to look for it, unless they wish to change their wizard selections. If they do, it's on the auto updates tab in Control Panel > System.
Please subscribe to see the more insightful version of th
The product isn't ready for users. Note that this didn't stop them from shipping Bob, ME, XP-SP1, or other problematic software. (I apologize for leaving anyones favorite "what a piece of c**p" off the list)
Shipping SP2 now would negatively impact the bottom line. Would I perform an very expensive upgrade to the next OS (Longhorn) if I had just installed SP2?
Delaying SP2 will help the bottom line. In 2004, MS can offer users a choice between a patch of that pesky ol' XP, or The Fabulous, Great, Incredible New, Improved OS that Does So Much More,More,More. Yea, it's hype, but never, EVER underestimate the power of the Microsoft marketing department.
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
Second, clicking 3 times (Windows Update, Scan for Patches, Install) is a lot simpler than the 10 or so that Red Hat requires. (I only have Red Hat Network to compare to, so if there's any better way to update RH8, someone let me know.)
OK. From a mostly default install of RH7.1 on my Dell Inspiron 5000e laptop (which installed flawlessly btw):
1) I click the little red circle with the '!' on the task bar. This opens the "Red Hat Network Alert Notification Tool".
2)Click "Launch Up2date"
3)Enter root password
4)Next
5)Next
6)Click "Select all packages"
7)Next
8)Next
9)Next
10)Finish
11)Close the "Red Hat Network Alert Notification Tool"
See, that easy. 11 easy steps instead of 3 for Windows.
Uh, shit...
(Non-gamer, so no Windows machine. Is it really just 3 clicks to update Windows? Probably needs at least 1 reboot though. HAH!)