Slashdot Mirror
Microsoft: Patches, Patches Everywhere!
Ridgelift writes "Even though Microsoft's recently announce they would not be issuing any new patches for the month of December, the boys at Redmond were scrambling today to figure out why some systems are being patched. The reason? They haven't got a clue."
I guess they are going to have to issue a patch to stop the machines from patching....ironic.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
At the end of the article it says that MS wants to do monthly patches to make it less of a surprise to sysadmins... Anyone else see a problem with waiting a month for your windows machine to get updated?
...Yes, well...
I watched C-beams glitter in the dark near the Tannhauser gate.
Simple, there is a bug in the patch issuing s/w which needs to be patched .
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
...They haven't a clue.
On Wednesday morning, Microsoft discovered that a glitch in the patching process resulted in a November fix not being applied to some Windows XP computers. The same patch was sent out again via the Windows update service on Tuesday night. The company is still investigating why and how the patch was reissued.
It looks like someone modified a patch. When a patch gets updated, the KB articles (and often the fixes) are auto-published.
I'd be more interested in knowing why some corporate SUS (Software Update Services, like an in-house Windows Update) subscribers were reporting to NTBugTraq today that they got about a DOZEN updated patches last night!
Imagine a Microsoft product doing something without reason...
The patch was due out in November, but it got missed so they re-issued. It's sort of going against what they said but it's understandable and I doubt it will make the world stop spinning. Why is this front page slashdot? If it had been any other company than Microsoft it never would have been news.
So the computers are patching themselves now, are they?
When exactly was it that the Cylons are supposed to attack?
Ever since we started using Software Update Services this has been cake.
All the clients just pull the windows critical updates that we approve from OUR servers.
I feel sorry for anyone who is trying to run around and do them by hand.
"Average intelligence is pretty damn stupid"
"Hey Bob...did you patch this?" "No, I thought you did." "Phil!" "What?" "Is this your patch?" "Not me. No patches in December, remember? It's our gift to the world." "Then who the hell...hey Eddie!" "Not now...I'm trying to track down this patch..." "Crap."
Fin.
If I understand this right, there was a bug. Maybe this bug was introduced by the previous patch, or maybe the previous patch did not work as expected, or whatever, but no matter what the reason, there was a bug, they could fix it, and they sent out a patch. That is the correct behavior.
They were probably being pretty stupid to say "no new patches". Due to Murphy's law, that guarantees that a problem will come up within days. Probably if they said "we are going to issue more patches than ever" then suddenly all their programmers would start have trouble finding bugs or figuring out how to fix them...
Anyway we can laugh at marketing for the "no new patches" but technically they did the right thing.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
the boys at Redmond were scrambling today to figure out why some systems are being patched. The reason? They haven't got a clue.
The do have a clue. Read the article. It's because a November patch for frontpage wasn't applied to some machines.
The theory of relativity doesn't work right in Arkansas.
The idea of monthly patches was to ease the burden on corporate sysadmins.
MS makes an update server freely available, and it can serve XP Pro, NT Workstation and 2000 Workstation -- the official corporate clients.
How hard is it to have your central corporate update server get the patches DAILY, if necessary, and push them out on a schedule with SMS? Or a login script, or...
This also gives the sysadmin time to regression test some patches if that is their policy.
Big business clients -- you know, the ones benefitting from the monthly schedule -- shouldn't be using Windows Update anyway!
-Charles Hill
Learning HOW to think is more important than learning WHAT to think.
It's an undocumented upgrade.
They keep sending me those security patches in email, and I keep applying them. I wish they'd stop it.
-- I have monkeys in my pants.
Patches? We don't need no stinking patches!
Any other company like Microsoft no, the catch being of course that there arent any other companies like Microsft. Microsoft is singled out because it stands alone in its class, and it is an undeniable adversary of the GPL ... no other reason.
if you read the WHOLE article you find this:
The same patch was sent out again via the Windows update service on Tuesday night. The company is still investigating why and how the patch was reissued.
So, they have a reason for it to be released, but they don't actually know why or how it got released... so... maybe 'they haven't got a clue' is a bit of overstatement, but they certainly don't have the whole clue.
ìì!
How can a company claim that:
There will not be any patches issued in the month of december
and
they release patches more promptly than Linux vendors?
What has *science* done?!? -- Dr. Weird (ATHF)
In other news today, the Cracker community announced it would commit to new virus and worm releases on the second Wednesday in each month.
With automatic patching of machines from Windows Updates at Microsoft, it seems that everyone is thrown into chaos at the same time.
Do we really trust Microsoft enough to think that they will get their updates right everytime?
If it had been any other company than Microsoft it never would have been news.
But it wasn't any other company. It's the company that believes it knows what's best for everyone. The same company that believes it deserves to control all software on Earth. When they make a "big" policy change, even these insignificant ones, and then mess it up right away, it's news.
Developers: We can use your help.
As someone who has to keep over 1000 clients patched, I have no idea what they're talking about when they say "admins want this".
You know what admins want? I'll tell you. They want to know about bugs AS THEY ARE FOUND, not AS THEY ARE PATCHED, so that we can block ports/attachments/capabilities and aren't sitting there vulnerable for months waiting for a patch. Then, when we get the patch, we want the patch to work. Lastly, we want products that aren't as much in need of patches. Are you listening? That's my top 3 requests--I don't give a rat's ass about monthly patch releases.
Here's how it works out in the real world, Microsoft. Nobody trusts your patches. After you release them, do you think we just cross our fingers and install the thing? Hell no. We do a test deployment, let it run for a few weeks, and if there aren't any problem, THEN we do the general deployment. And guess what? Frequently, we find problems with your patches and don't deploy them at all.
So this leaves us vulnerable. Sure, that's bad, but we were ALREADY vulnerable the whole time we've been using this software, and more alarmingly, we were vulnerable and you knew about it and didn't tell us while you were working on a patch.
We didn't choose to be vulnerable when we chose not to install your broken patches, we chose to be vulnerable when we chose to use your products.
Lest we forget...
www.trustworthycomputing.com
Ruby on Rails Screencast
head for the hills
Windowsupdate is the offical service to update Windows.
All versions of windows use this service.
If Windowsupdate sends out a bogus patch, millions of machines install the patch.
See where this is going? WindowsUpdate could easily be utalized to infect millions of machines with a virus. It could also bug out and send a patch that breaks millions of machines.
This service should *NOT* be sending out mysterious patches that no one knew anything about.
Browse at -1, because trolls are often the most creative part of
It's no skin off your nose, but you're not the admin for 1500 machines.
The admins of large scale deployments have asked Microsoft to make patches more predictable so they can do planning for patch deployment. Microsoft complied.
As others have stated, when a known vulnerability exists, or when sample code is publicly available, Microsoft will release the patch as soon as it's written.
One patch isn't "patches, patches everywhere!". If you want to see "patches, patches everywhere" for the month of December, look at Red Hat 9.
Seems like they've released yet another patch every other day this month. I know it hasn't been quite that many, but it's been several, and much more than Microsoft.
Could we have a little more fact, and a lot less Microsoft FUD? It makes Slashdot look rubbish.
The "Linux community" could stand to ridicule less and study their enemy more. Then maybe they wouldn't be slowly slipping behind the Windows Server platform more and more in providing more of the features people need.
MS has claimed that worms come from reverse-engineering vulnerability patches, but I'm not convinced. If an outside researcher found the problem, what makes you think a Black Hat didn't (and has been keeping quiet)?
Patches want to be free!
This is the first action of the Patch Liberation Front!
"You know you want me baby!" - Crow T Robot
> If that doesn't give you cause for concern, you're not a computing professional.
:-).
You don't understand: it doesn't give me cause for concern because I _am_ a computing professional. I see software that affects thousands of computers belonging to other people where the manufacturers have no idea why. In fact, I usually have no idea why something goes wrong with my own software until I've spent a couple of hours looking at it. In fact, sometimes I never do find out what went wrong with my software.
I think you're the one that's not a computing professional
...in announcing regular times when you WONT be issuing patches. What if a new flaw is discovered? Shouldn't you get the patch out ASAP? Wouldn't that be best for customers if a big security hole was discovered that needed to be FIXED NOW? (Pre-SP1 XP, anybody?)
If sysadmins wanted a monthly patch schedule, they're smart enough to do it themselves. Check WindowsUpdate every month, get all the new stuff, rinse & repeat every 30.4375 days.
I fail to see the advantage in Microsoft deliberately delaying fixes to problems that, for some, can be very very immediate.
This almost reminds me of a time when Konqueror and IE had an SSL security hole. While Microsoft buried its head in the sand, the Konq guys just solved the damn problem (in a matter of hours, if memory serves).
Maintaining important software is only hindered when some buraucratic colossus feels the need to babysit the process.