Slashdot Mirror
Microsoft: Patches, Patches Everywhere!
Ridgelift writes "Even though Microsoft's recently announce they would not be issuing any new patches for the month of December, the boys at Redmond were scrambling today to figure out why some systems are being patched. The reason? They haven't got a clue."
The patch was due out in November, but it got missed so they re-issued. It's sort of going against what they said but it's understandable and I doubt it will make the world stop spinning. Why is this front page slashdot? If it had been any other company than Microsoft it never would have been news.
So the computers are patching themselves now, are they?
When exactly was it that the Cylons are supposed to attack?
...and of course you read the announcement about this, didn't you? And as such you know that they will still release zero-hour patches for vulnerabilities which are actively being exploited in the wild and/or are to the top left of the threat matrix (remote/system level explots).
I want a new world. I think this one is broken.
Ever since we started using Software Update Services this has been cake.
All the clients just pull the windows critical updates that we approve from OUR servers.
I feel sorry for anyone who is trying to run around and do them by hand.
"Average intelligence is pretty damn stupid"
If I understand this right, there was a bug. Maybe this bug was introduced by the previous patch, or maybe the previous patch did not work as expected, or whatever, but no matter what the reason, there was a bug, they could fix it, and they sent out a patch. That is the correct behavior.
They were probably being pretty stupid to say "no new patches". Due to Murphy's law, that guarantees that a problem will come up within days. Probably if they said "we are going to issue more patches than ever" then suddenly all their programmers would start have trouble finding bugs or figuring out how to fix them...
Anyway we can laugh at marketing for the "no new patches" but technically they did the right thing.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
It's an undocumented upgrade.
They keep sending me those security patches in email, and I keep applying them. I wish they'd stop it.
-- I have monkeys in my pants.
In other news today, the Cracker community announced it would commit to new virus and worm releases on the second Wednesday in each month.
With automatic patching of machines from Windows Updates at Microsoft, it seems that everyone is thrown into chaos at the same time.
Do we really trust Microsoft enough to think that they will get their updates right everytime?
We once again apologize for the fault in the patch process. Those responsible for patching the patchers who have patched the patch process, have now been patched.
Remain calm! All is well!
As someone who has to keep over 1000 clients patched, I have no idea what they're talking about when they say "admins want this".
You know what admins want? I'll tell you. They want to know about bugs AS THEY ARE FOUND, not AS THEY ARE PATCHED, so that we can block ports/attachments/capabilities and aren't sitting there vulnerable for months waiting for a patch. Then, when we get the patch, we want the patch to work. Lastly, we want products that aren't as much in need of patches. Are you listening? That's my top 3 requests--I don't give a rat's ass about monthly patch releases.
Here's how it works out in the real world, Microsoft. Nobody trusts your patches. After you release them, do you think we just cross our fingers and install the thing? Hell no. We do a test deployment, let it run for a few weeks, and if there aren't any problem, THEN we do the general deployment. And guess what? Frequently, we find problems with your patches and don't deploy them at all.
So this leaves us vulnerable. Sure, that's bad, but we were ALREADY vulnerable the whole time we've been using this software, and more alarmingly, we were vulnerable and you knew about it and didn't tell us while you were working on a patch.
We didn't choose to be vulnerable when we chose not to install your broken patches, we chose to be vulnerable when we chose to use your products.
Windowsupdate is the offical service to update Windows.
All versions of windows use this service.
If Windowsupdate sends out a bogus patch, millions of machines install the patch.
See where this is going? WindowsUpdate could easily be utalized to infect millions of machines with a virus. It could also bug out and send a patch that breaks millions of machines.
This service should *NOT* be sending out mysterious patches that no one knew anything about.
Browse at -1, because trolls are often the most creative part of
It's no skin off your nose, but you're not the admin for 1500 machines.
The admins of large scale deployments have asked Microsoft to make patches more predictable so they can do planning for patch deployment. Microsoft complied.
As others have stated, when a known vulnerability exists, or when sample code is publicly available, Microsoft will release the patch as soon as it's written.
Patch bites can be preti nasti mind you
"I only speak the truth"
Karma: null(Mostly affected by an unassigned variable)