Slashdot Mirror
Microsoft: Patches, Patches Everywhere!
Ridgelift writes "Even though Microsoft's recently announce they would not be issuing any new patches for the month of December, the boys at Redmond were scrambling today to figure out why some systems are being patched. The reason? They haven't got a clue."
I guess they are going to have to issue a patch to stop the machines from patching....ironic.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
At the end of the article it says that MS wants to do monthly patches to make it less of a surprise to sysadmins... Anyone else see a problem with waiting a month for your windows machine to get updated?
...Yes, well...
I watched C-beams glitter in the dark near the Tannhauser gate.
My machine got patched this morning, and I thought "funny, didn't microsoft say no patches for this month?" and then i saw they were dated november... but it was too late.
My Stack Overflow user
Simple, there is a bug in the patch issuing s/w which needs to be patched .
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
...They haven't a clue.
On Wednesday morning, Microsoft discovered that a glitch in the patching process resulted in a November fix not being applied to some Windows XP computers. The same patch was sent out again via the Windows update service on Tuesday night. The company is still investigating why and how the patch was reissued.
It looks like someone modified a patch. When a patch gets updated, the KB articles (and often the fixes) are auto-published.
I'd be more interested in knowing why some corporate SUS (Software Update Services, like an in-house Windows Update) subscribers were reporting to NTBugTraq today that they got about a DOZEN updated patches last night!
Imagine a Microsoft product doing something without reason...
The patch was due out in November, but it got missed so they re-issued. It's sort of going against what they said but it's understandable and I doubt it will make the world stop spinning. Why is this front page slashdot? If it had been any other company than Microsoft it never would have been news.
So the computers are patching themselves now, are they?
When exactly was it that the Cylons are supposed to attack?
Ever since we started using Software Update Services this has been cake.
All the clients just pull the windows critical updates that we approve from OUR servers.
I feel sorry for anyone who is trying to run around and do them by hand.
"Average intelligence is pretty damn stupid"
"Hey Bob...did you patch this?" "No, I thought you did." "Phil!" "What?" "Is this your patch?" "Not me. No patches in December, remember? It's our gift to the world." "Then who the hell...hey Eddie!" "Not now...I'm trying to track down this patch..." "Crap."
Fin.
If I understand this right, there was a bug. Maybe this bug was introduced by the previous patch, or maybe the previous patch did not work as expected, or whatever, but no matter what the reason, there was a bug, they could fix it, and they sent out a patch. That is the correct behavior.
They were probably being pretty stupid to say "no new patches". Due to Murphy's law, that guarantees that a problem will come up within days. Probably if they said "we are going to issue more patches than ever" then suddenly all their programmers would start have trouble finding bugs or figuring out how to fix them...
Anyway we can laugh at marketing for the "no new patches" but technically they did the right thing.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
the boys at Redmond were scrambling today to figure out why some systems are being patched. The reason? They haven't got a clue.
The do have a clue. Read the article. It's because a November patch for frontpage wasn't applied to some machines.
The theory of relativity doesn't work right in Arkansas.
The idea of monthly patches was to ease the burden on corporate sysadmins.
MS makes an update server freely available, and it can serve XP Pro, NT Workstation and 2000 Workstation -- the official corporate clients.
How hard is it to have your central corporate update server get the patches DAILY, if necessary, and push them out on a schedule with SMS? Or a login script, or...
This also gives the sysadmin time to regression test some patches if that is their policy.
Big business clients -- you know, the ones benefitting from the monthly schedule -- shouldn't be using Windows Update anyway!
-Charles Hill
Learning HOW to think is more important than learning WHAT to think.
It's an undocumented upgrade.
I have my PC set up to autodownload updates. It's no skin off my nose if I get a "you have updates ready to install" more than once a month.
It's probably just an attempt to increase the appearance of security (by decreasing patch frequency) while not actually increasing security (and in fact decreasing security as machines can be unpatched for longer).
Boffoonery - downloadable Comedy Benefit for Bletchley Park
They keep sending me those security patches in email, and I keep applying them. I wish they'd stop it.
-- I have monkeys in my pants.
Patches? We don't need no stinking patches!
I mean, are people retarded or something? My grandpa who could barely figure out how to use a mouse was able to do an update of his computer after some simple instructions.
I suppose they could just have your PC patch itself by default but in my opinion that would suck.
Conserve Oil, Recycle, Boycott Walmart
I went to Windows Update like all users should (must)do and found one patch for Win XP. It is a Frontpage Server Extensions Patch. It looks pretty serious and I can see why they would want it released quietly. Here's the URL:
k b; en-us;810217
http://support.microsoft.com/default.aspx?scid=
Any other company like Microsoft no, the catch being of course that there arent any other companies like Microsft. Microsoft is singled out because it stands alone in its class, and it is an undeniable adversary of the GPL ... no other reason.
See, here's how it goes.
-Microsoft knows their software is weak when it comes to security.
-Microsoft pleads to the security community not to make any vulnerabilities public prior to notifying them for at least a few weeks, and sues everyone who doesn't fall in.
-Microsoft reveals the reason it wants vulnerabilites not to go public.... So CTOs can claim that security updates only happen every month rather than every day, keeping their job intact and making more money for MS in the long run.
-Somebody who cares about security rather than marketing posts a needed FrontPage Extensions update.
See.... someone at Microsoft has a clue. They just don't talk to the marketing folks. I don't blame 'em.
if you read the WHOLE article you find this:
The same patch was sent out again via the Windows update service on Tuesday night. The company is still investigating why and how the patch was reissued.
So, they have a reason for it to be released, but they don't actually know why or how it got released... so... maybe 'they haven't got a clue' is a bit of overstatement, but they certainly don't have the whole clue.
ìì!
How can a company claim that:
There will not be any patches issued in the month of december
and
they release patches more promptly than Linux vendors?
What has *science* done?!? -- Dr. Weird (ATHF)
Any ideas why this would be beneficial at all? Are they going for the record thing, like some work places have a big sign that say "It's been days since the last workplace injury"? Are they trying to say "hey, Windows is secure! See, no patches released in days"?
What if a highly critical bug is discovered tomorrow, something big enough that several exploits are in the wild by next week? Will they release a patch then, or will they stick to their policy and hold out on us until 2004?
no comment
In other news today, the Cracker community announced it would commit to new virus and worm releases on the second Wednesday in each month.
With automatic patching of machines from Windows Updates at Microsoft, it seems that everyone is thrown into chaos at the same time.
Do we really trust Microsoft enough to think that they will get their updates right everytime?
If it had been any other company than Microsoft it never would have been news.
But it wasn't any other company. It's the company that believes it knows what's best for everyone. The same company that believes it deserves to control all software on Earth. When they make a "big" policy change, even these insignificant ones, and then mess it up right away, it's news.
Developers: We can use your help.
You can keep using smaller and smaller patches, and eventually, you can stop smoking.
Or, you can keep using larger and larger patches and eventually become a smoker.
As someone who has to keep over 1000 clients patched, I have no idea what they're talking about when they say "admins want this".
You know what admins want? I'll tell you. They want to know about bugs AS THEY ARE FOUND, not AS THEY ARE PATCHED, so that we can block ports/attachments/capabilities and aren't sitting there vulnerable for months waiting for a patch. Then, when we get the patch, we want the patch to work. Lastly, we want products that aren't as much in need of patches. Are you listening? That's my top 3 requests--I don't give a rat's ass about monthly patch releases.
Here's how it works out in the real world, Microsoft. Nobody trusts your patches. After you release them, do you think we just cross our fingers and install the thing? Hell no. We do a test deployment, let it run for a few weeks, and if there aren't any problem, THEN we do the general deployment. And guess what? Frequently, we find problems with your patches and don't deploy them at all.
So this leaves us vulnerable. Sure, that's bad, but we were ALREADY vulnerable the whole time we've been using this software, and more alarmingly, we were vulnerable and you knew about it and didn't tell us while you were working on a patch.
We didn't choose to be vulnerable when we chose not to install your broken patches, we chose to be vulnerable when we chose to use your products.
Lest we forget...
www.trustworthycomputing.com
Ruby on Rails Screencast
head for the hills
Windowsupdate is the offical service to update Windows.
All versions of windows use this service.
If Windowsupdate sends out a bogus patch, millions of machines install the patch.
See where this is going? WindowsUpdate could easily be utalized to infect millions of machines with a virus. It could also bug out and send a patch that breaks millions of machines.
This service should *NOT* be sending out mysterious patches that no one knew anything about.
Browse at -1, because trolls are often the most creative part of
One patch isn't "patches, patches everywhere!". If you want to see "patches, patches everywhere" for the month of December, look at Red Hat 9.
Seems like they've released yet another patch every other day this month. I know it hasn't been quite that many, but it's been several, and much more than Microsoft.
Could we have a little more fact, and a lot less Microsoft FUD? It makes Slashdot look rubbish.
The "Linux community" could stand to ridicule less and study their enemy more. Then maybe they wouldn't be slowly slipping behind the Windows Server platform more and more in providing more of the features people need.
The story talks about a patch for FrontPage. Well, there was a patch for Windows XP Media Center Edition machines today too. So there :P
MS has claimed that worms come from reverse-engineering vulnerability patches, but I'm not convinced. If an outside researcher found the problem, what makes you think a Black Hat didn't (and has been keeping quiet)?
For some reason windows update wants to install Nvidia drivers from 6th October on my machine as opposed to the ones dated 9th December that I installed earlier.
www.linuxisnotsecureeither.com
Patches want to be free!
This is the first action of the Patch Liberation Front!
"You know you want me baby!" - Crow T Robot
They say that the patch was a previously issued patch, and it just was re issued. That is a problem, but not a major one (unless the re issued patch has some undocumented modifications). I also see many people saying that the once a month patch gives black hats time to exploit a critical flaw. I dont remember where it was said, but I read that the critical flaws were to be patched immediately and the minor flaws were going to be patched monthly. I am going to do a search and post a link in response to this post when I do find the article.
Stop signs are only Suggestions
> If that doesn't give you cause for concern, you're not a computing professional.
:-).
You don't understand: it doesn't give me cause for concern because I _am_ a computing professional. I see software that affects thousands of computers belonging to other people where the manufacturers have no idea why. In fact, I usually have no idea why something goes wrong with my own software until I've spent a couple of hours looking at it. In fact, sometimes I never do find out what went wrong with my software.
I think you're the one that's not a computing professional
Microsoft FUD? It makes Slashdot look rubbish.
Actually, it makes Slashdot look like Slashdot.
Once again, we seem to have an influx of new Slashdot readers and posters. Let me spell it out for you: THIS SITE IS DECIDEDLY PRO-LINUX, PRO-OPEN SOURCE, AND ANTI-MICROSOFT. It has been since day one, and it will be until MS acquires OSDN or whoever the owner is. Deal with it, stop your bitching, and if you don't like it, there are plenty of pro-Microsoft newssites out there.
Yeesh. Every story lately these people are coming out. Listen kids, Microsoft doesn't need you to defend them. And you don't look cool just because you bash what's the popular thing around here. In my day, we used to call that "trolling".
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Not only did they release a patch - they removed a bunch and reissued quite a few. Here is the log from last night's SUS sync...
(Note if you don't know what SUS is, try http://susserver.com/)
Automatic Sync Started- Thursday, 11 December 2003 12:59:56 AM Successful
Updates Added:
Critical Update for Windows XP Media Center Edition 2004 (KB830786) - KB830786_WXP_MCE2_ENU_c512cb910f28d8b6051537519556 0b3.EXE
Updates Removed:
810847: February 2003, Cumulative Patch for Internet Explorer 5.01 Service Pack 3 - Q810847_B3CA04E8D113EBDE0D561AB3AFAA02EBC3922F36.E XE
813489: April 2003, Cumulative Patch for Internet Explorer 5.01 Service Pack 3 - q813489_7526690df0c1e078957b0d83f8018c0.exe
818529: June 2003, Cumulative Patch for Internet Explorer 5.01 Service Pack 3 - q818529_1d67aa22e752bb5ca55eba289ee1e9f.exe
Q324929: December 2002, Cumulative Patch for Internet Explorer 5.5 - Q324929_E34CB7562E3FADE04E0FBA7A8DF20236ABFC6C46.E XE
810847: February 2003, Cumulative Patch for Internet Explorer 5.5 Service Pack 2 - Q810847_102065CAD52C737EBBF4422AEF2CAC5E100B6EFA.E XE
813489: April 2003, Cumulative Patch for Internet Explorer 5.5 Service Pack 2 - q813489_8ebdafa9c0f5c09d0678826b4c04de5.exe
818529: June 2003, Cumulative Patch for Internet Explorer 5.5 Service Pack 2 - q818529_d8d150d39cc718ff858be51239ea081.exe
Q324929: December 2002, Cumulative Patch for Internet Explorer 6 - Q324929_55049C7F14E3EFF258F10F95FE0A3C179833CB17.E XE
Q324929: December 2002, Cumulative Patch for Internet Explorer 6 SP1 - Q324929_A90F1A87F766965A4D0FC5F1395F3E808ABE7D27.E XE
810847: February 2003, Cumulative Patch for Internet Explorer 6 - Q810847_DDE9BE0E09FF7E261B1E32AFF6F597FA27A72B6A.E XE
810847: February 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 - Q810847_C3902604B28A9E2AAD419E883ACC553FD69B84F9.E XE
813489: April 2003, Cumulative Patch for Internet Explorer 6 - q813489_2fd2c598d4beecc513c2798f443cf8e.exe
813489: April 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 - q813489_3a4cba12c72c64d461b611365375bc9.exe
818529: June 2003, Cumulative Patch for Internet Explorer 6 - q818529_5a71949492d46d5a9ed0713ed68cc98.exe
818529: June 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 - q818529_94327511db0b86d509decf6a3becf73.exe
818529: June 2003, Cumulative Patch for Internet Explorer - WindowsServer2003-KB818529-x86-ENU_0f07225ca313bf4 5fe205783dd059d0.exe
Reissued Update(s):
Security Update, February 14, 2002 (Internet Explorer 5.5) - VBS55NEN_A76B47D34E497BB2C14BA3CBED923CC042406C8B. EXE
Security Update, March 7, 2002 - Q313829_F56D00FEAAE71A0F246EA0A042B92AEEEC822F9D.e xe
814078: Security Update (Microsoft Jscript version 5.1, Windows 2000) - js51nen_8812c08817b46676876f0e06a3cda5b.exe
814078: Security Update (Microsoft Jscript version 5.6, Windows 2000, Windows XP) - JS56_DB18C6EA0F4E8522715BEEA284F6843ECE71D944.EXE
Windows 2000 Service Pack 4 Network Install for IT Professionals - w2ksp4_en_7f12d2da3d7c5b6a62ec4fde9a4b1e6.exe
Flaw In Windows Media Player May Allow Media Library Access (819639) - WindowsMedia9-KB819639-x86-ENU_bfd620da8e1529c3e4f fadfb93f33fa.exe
Q329390: Security Update - Q329390_WXP_3F60064794271F0053892985402FE5B6679D3F 2D.EXE
Q329115: Security Update (Windows XP) - Q329115_WXP_SP2_X86_1D09793FAF21249FEBCC160D341612 338DFD3154.EXE
Security Update for Windows XP (KB810217) - WindowsXP-KB810217-x86-ENU_696190f151ea0bcb063f0a8 9471e45b.exe
Q811114: Security Update (Windows XP or Windows XP
What were the skies like when you were young?
Sort of disconcerting if they don't have enough 'quality control' to even know who put the patch into effect to be distributed..
Considering the ramifications of patches and their 'assumed authority' with autopatch, this is a very bad blunder.
---- Booth was a patriot ----
Where is Edward James Olmos?
Forget that. Begin the thawing of Lorne Greene.
Toronto-area transit rider? Rate your ride.
It isn't enough that it creates some of the crappiest html since Pagemill, but an html editor that creates security holes, too? What will they have to patch next? Notepad?
The potato it is uninformed.
...in announcing regular times when you WONT be issuing patches. What if a new flaw is discovered? Shouldn't you get the patch out ASAP? Wouldn't that be best for customers if a big security hole was discovered that needed to be FIXED NOW? (Pre-SP1 XP, anybody?)
If sysadmins wanted a monthly patch schedule, they're smart enough to do it themselves. Check WindowsUpdate every month, get all the new stuff, rinse & repeat every 30.4375 days.
I fail to see the advantage in Microsoft deliberately delaying fixes to problems that, for some, can be very very immediate.
This almost reminds me of a time when Konqueror and IE had an SSL security hole. While Microsoft buried its head in the sand, the Konq guys just solved the damn problem (in a matter of hours, if memory serves).
Maintaining important software is only hindered when some buraucratic colossus feels the need to babysit the process.
Am I the only one who finds the new updater for XP really unhelpful?
Having been burned in the past, I configured the updater to just download the patches, but not install them, so that I can read the "details" before deciding whether to install the patch.
Clearly, Microsoft's definition of "details" diverges significantly from my own. Their detailed description always seems to be something like "There's a problem in application X that could allow an attacker to gain administrator privilege on your machine." Optionally, they might warn me that I won't be able to remove the patch once it's installed.
This is wildly insufficient. For one thing, if the patch is unremovable, the details should contain at least a capsule explanation of what the tradeoffs are likely to be --- in particular, whether or not installing this patch is likely to bust some beloved function. I still remember ruefully the time I installed a patch that busted synchronization of my WinCE handheld (I have since switched to a PalmOS device). I had to reinstall Windows to fix that one, and it cost me the better part of a work day.
The patch descriptions are also inadequate. E.g., the latest patch reports problem with FrontPage Server extensions. It's not even clear whether the problem is only if I'm running FrontPage server, or whether MS has just given a back door into my machine to any server that uses FrontPage.
I know, one can go to the Knowledge Base to get more details, but what part of "details" doesn't Microsoft understand? When I click on "details" I want details, not an opportunity to go yet further for the real details....