Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft to Issue Out-of-Cycle Patch for IE

Posted by CmdrTaco on from the download-reboot-repeat dept.

rsw writes "Microsoft will be breaking their normal patch cycle and issuing a patch for the Download.Ject attack (a.k.a. Scob). They claim that the forthcoming patch will be a "long-term solution to the core vulnerability" exploited by Scob." Note that this does not mean that they are replacing IE with FireFox.

7 of 391 comments (clear)

  1. Wow by Anonymous+Crowhead · · Score: 5, Insightful

    The released a patch when it's needed, not when it's scheduled. How novel.

    1. Re:Wow by EtherAlchemist · · Score: 5, Insightful

      I'm only playing devil's advocate here, but it's possible (likely?) that Microsoft suffers from internal politics, like many other software companys, that actually work against the process.

      I work for a software company where fixes to bugs on live products are held up for weeks and months on end while managers seek the person to blame, assign blame, come up with a plan to make the fix, revise the plan to include 8 other random and unrelated things they want to fix, slap them into one rollout that will now require 6 developers on 3 teams and 4 QA guys who will follow the spec to the letter (even if it is mispelled) and file 200 new bugs. This cycle goes on for a month or so and by the time the fix is released, a dozen other problems have surfaced and been deemed not important enough to fix now. Afterall, we just had a hariy cycle trying to get the last fix out.

      Now, the way it should have gone: Identify the problem, design a fix, make the fix, test the fix, deploy the fix. Days, not weeks or months.

      --
      R(k)
  2. Re:The mounting pressure by EnnTeeDee · · Score: 5, Insightful

    "Our [Microsoft IE] users should have confidence that as long as they're running the latest browser with all the latest security fixes, they will have the most powerful and secure browsing experience," Hachamovitch said.

    Umm, yeah, we should (in a perfect world) be able to have confidence that the biggest software company on the planet puts out the best product. But Microsoft is too big and juicy a target to inspire confidence.

    We also should be able to trust our elected leaders to be able to spend our tax funds wisely, but I'm not holding my breath on that either.

  3. Long-term solution? by RonnyJ · · Score: 5, Insightful
    They claim that the forthcoming patch will be a "long-term solution to the core vulnerability" exploited by Scob."

    So, are their patches normally NOT long-term solutions to vulnerabilities then?

  4. Re:Slashdot by LilJC · · Score: 4, Insightful
    Parent has been modded funny, but I think a lot of us do.

    I've walked into work before with the owners complaining of not being able to get to half the web sites they like to peruse and hit slashdot to see what's up. Half the time I'm back in 20 seconds with an satisfactory explanation about a recent or in-progress attack.

    Of course, I have to (for the umpteenth time) explain to my boss/CEO that I can't fix other peoples' servers, only ours. Wish I could at least get that guy to remember how a sort works in Excel.

    --

    The only thing more dangerous than a file named -rf is renaming it -rf\ /
  5. Re:Firefox is not the answer. by gnu-generation-one · · Score: 5, Insightful

    "Firefox is not an acceptable replacement for IE for 90% of the users out there so I really think we could have done without the snide comment."

    Huh?

    Microsoft Internet Explorer isn't an acceptable browser for 90% of the users out there.

    Nevermind your "snide" assertions about the websites that don't work, people are getting owned here. It's a serious problem. It's the spam problem and the virus problem and all the tech support problems, all stemming from this one application that's so insecure that everyone, from DHS to MSN themselves recommend getting rid of it immediately.

    If your favorite website doesn't work in a generic web-browser, get them to fix it, or get a new supplier. Even the banks have got HTML websites now.

  6. Why does everyone thing Firefox is "winning?" by NitroWolf · · Score: 5, Insightful

    I've been contemplating which thread to post this to, so I'll post it here.

    Why does everyone thing we're "winning" against Microsoft/IE with Mozilla Firefox? It's not that we are winning, it's that Microsoft isn't playing anymore.

    There's no reason for them to have the dominant browser on the market anymore, and one HUGE reason for them to explicitly NOT have the dominant browser. Their DOJ investigations focused, in part, on the fact that IE was bundled with Windows and thus constituted a monopoly. However, if Microsoft now lets IE flounder and lets Mozilla (or another browser) become dominant, they have a huge lever to use against any future DOJ or legal inqueries. They can then say they aren't a monopoly, as another browser is dominant.

    And why not? There's no money to be made on IE - it's strictly a resource drain. They don't make a single dime from it... why pay someone to keep IE up to standards, when they can get the whole Open Source community to do it for free - in the form of Mozilla.

    Stop and think about it for a moment, there's absolutely NO reason for MS to have the dominant browser any longer... there's no financial or legal advantage to it. A browser is effectively a commodity, and anyone developing one is going to have to expend resources to do so - with no return on that investment. Thus, Microsoft's only real logical conclusion would be to let IE slowly fade away, it solves not only the money/resource drain, but also protects them from further DOJ inquiries.

    So Firefox isn't winning, exactly... Microsoft just took their ball and went home, because the game had no point for them anymore.