Slashdot Mirror

← Back to Stories (view on slashdot.org)

Slow Down the Security Patch Cycle?

Posted by michael on from the security-through-insecurity dept.

Ant writes "Computerworld has an editorial article about slowing down, not speeding up, patch releases."

3 of 302 comments (clear)

  1. The goal of this author by Ice+Station+Zebra · · Score: 2, Troll

    Is to create questions in the CIO's head about open source and software updates in an attempt to make open source look bad. Remember it was just a little while ago that Bill Gates told all the crackers the only security holes they found were from reading security patches.

  2. Re:in related news by MrRuslan · · Score: 0, Troll

    That is not news...thats common knowledge...cmon it's microsoft for god sakes...

  3. Buffer overflows. Why? by Pig+Hogger · · Score: 1, Troll
    From the article:
    By far, the most common type of exploit is the buffer overflow, and software vendors are spending millions of dollars to find and prevent these types of vulnerabilities. These vulnerabilities still exist -- they are getting fewer in number, however, and finding them is now much more difficult. Part of my consulting practice to software vendors and their major customers is finding and reporting these types of vulnerabilities. Where I used to be able to do the "find vulnerabilities blindfolded with one arm tied behind my back" routine, I now actually have to work to find them in major software products.
    Why use a primitive language (C, C++) that is nothing but a glorified assembler that likes to pretend it is a high-level language to write apps? Granted, there is muchos macho appeal to work in C, but if the resulting code is buggy like a chickenwire collander, what good it is to be a jock coder? (I am **NOT** impressed by clever code - and this comes from someone who worked a long time with Forth).

    There are far better choices than C* to code programs; there is no excuse to write programs that offer buffer overflows for all to rape.