Slashdot Mirror
Early Warning For Microsoft Premium Customers
techmuse writes "According to internetnews.com, Microsoft is giving its premium customers early warning about vulnerabilities and patches. Those of us who aren't lucky enough to have such a relationship with Microsoft may find ourselves at greater risk than premium customers as a result."
The U.S. government's Computer Emergency Readiness Team (US-CERT) has also been heavily criticized for providing security advisories to paying customers ahead of coordinated public release.
Microsoft and the government using the same strategy! I am shocked! (sarcasm mode off)
Other juicy information from the article:
There won't be a patch this month for a "highly critical" bug in Internet Explorer browser's drag-and-drop feature.
So we are suppose to buy access to problems that won't be patched in a timely fashion? You've got to be kidding me.
The only justification that I can see to this might be that microsoft wants to release it to their "elite" first... so that work-arounds and patches might be generated by the community instead of within microsoft. Thus, trying to get one of the open source benefits...
While that's a good theory... I bet it's really just microsoft praying on the security worries of companies. Considering I run a Microsoft network... that's a sad conclusion for me to have to make.
Company gives preferntial treatment to its higher profit customers!
I've just signed legislation that'll outlaw Russia forever. We'll begin bombing in five minutes.
*shrug*
Doesn't sound like it affects overall computer security, really. It's nice for the organizations that sign on, so they have a couple more days to plan outages as necessary. It doesn't affect the vast majority of home users at all (I certainly don't plan my downtime, it just happens when I feel like it).
I can see this being irritating to customers who are unwilling to pay yet another Microsoft tax for early notification, but I don't see that it's some kind of horrible, evil practice, either.
Reality has a conservative bias: it conserves mass, energy, momentum...
I would re-write one sentence in the summary as:
"Those of us who aren't lucky enough to have such a relationship with Microsoft may find ourselves at greater risk FROM premium customers as a result."
(changed "than" to "FROM")
In a nutshell, is this not what MS is doing?
This seems perfectly valid practice to me. People who pay more should get better service. Think of the subscribers to /. they get better service than the rest...
You pay more, you get more.
Bugtraq is almost always ahead of microsoft where it comes to vulnerabilities in their software. Why in the world would I pay Microsoft to tell me what might be wrong tomorrow when bugtraq will tell me what's wrong today? Does anyone have an experience where MS came out with vulnerabilities first?
I submitted this story last night, and it didn't get posted.
That is silly. Are "premium customers" going to be bound by some NDA not to talk about the vulnerabilities? What's to prevent some news outlet from becoming a "premium customer" and then publishing everything they hear five minutes later. But now MSFT will look bad (worse) because the press is announcing there flaws instead of them.
But just maybe, this might be logical, if you have to update everyone about a glitch in your software then that would take time*. If everyone starts to download patches at the same time you just might get slow downloads
It would be a Bad Thing for MS if their premium customers were the last ones to be notified (as in, turn the story around) or had to wait just as long as some John Doe who copied Windows, to get a patch or download it at some lame speed.
This is just economics, nothing to see here
*Especially if bugs are your business
Maybee I'm reading it wrong but I never read anything about having to pay for this "service" when they say Premium... do they just mean people who buy alot more of M$'s programs? i.e. Large Corprations, and is this just a notice to them because in a Large Corparation its alot harder to update 1000s of machines vs lets say a office of 15? They just send a e-mail stating that there will be a update, its not like it actually contains the update.
Loading Please Wait....
M$ says they are focusing on security, but how does giving advance warning only to subscribers support security? It's the average user who doesn't know how to patch their computer that is at the most risk (and can also propogate the most damage to the rest of us). And the average user won't be a premium customer.
Does it seem like M$ is saying one thing and doing another?
You won't hate yourself in the morning if you don't get up before noon.
I can see there's some genuine reasoning behind this: When they announce an exploit potential, they're serving warning to those who can actually generate the exploit. If they control WHO gets the information first, they can keep their "worst case scenario" customers happy.
Script kiddies aren't likely to subscribe, and if they were, it might make it easier to track them down or trap them.
I can see the logic in it. I don't know if it's a "good" solution, but it must be difficult when they become aware of a problem that has not been exploited yet. It's open season on the security hole thanks to reverse-engineering the patch, but if they don't announce it then their at fault for a "known hole"
I think anything where there's a working exploit out should be released immidiately to everyone, but non-exploited holes might be well served by slowly releasing it to clients that pay to have that information-- and therefore are more likely to listen up and patch their systems.
The only question is what it takes to become a "premium cusomter". Is it simply a matter of giving MS a few bucks, or is it up to them to choose their friends? MS has a monopoly on the ability to patch their operating systems; if they don't market it openly and fairly then perhaps they'll get another visit from the DoJ (well, I guess this depends on what happens in November...).
Disclaimer: I work for a company, but I don't speak for them.
I wonder if this might backfire. Microsoft already has a rep amongst techies for its slowness to respond to its numerous security holes. Now maybe it'll get a rep with the PHBs as the company that charges its users to fix its own mistakes.
Head down, go to sleep to the rhythm of the war drums...
Imagine if companies in the car industry worked the same way:
People wouldn't stand for it. Why do they hold software companies to such lower standards?
Always with the car analogies. This isn't Pontiac only recalling and replacing a defective part if you pay more. This is Pontiac recalling and replacing a defective part on exactly the same schedule for everyone, but telling premium customers three days earlier "hey, we're going to be recalling something on the 2005 GTO in three days. Get ready."
This just isn't a big deal.
Reality has a conservative bias: it conserves mass, energy, momentum...
>>Security through $$$
You mean "a false sense of security through $$$", right?
wbs.
Huh?
Security through $$$ might even work for them to except for the fact that to date Microsoft has shown almost zero ability to produce anything that's actually "secure".
Even if I were so inclined to pay someone for security Microsoft would be the last company on the face of the earth I'd go to to get that.
Their pile of cash is legendary and no matter how much they have (or can figure out how to get) they seem unable to incorporate this "security" thing into their products. What would make anyone think that throwing more money at them is going to change that?
Appended to the end of comments you post. 120 chars.
Slashdot is giving early previews of stories to paying customers. Those of us who aren't lucky enough to have such a relationship with Slashdot may find ourselves at greater risk of missing the story than premium customers as a result."
Tech, life, family, faith: Give me a visit
Pay us or we WON'T tell you about the next worm/vulnerability.
Wait, that's not terrorism, that's extorsion.
I don't mind them witholding premium services as long as there are no safety issues with doing that.
For example, a hospital that ISN'T paying Microsoft through the nose for these "heads-ups" can have it's medical data destroyed because of it.
For SHAME, Microsoft, for shame.
I don't know the meaning of the word 'don't' - J
How does one become a "premium customer"?
Dedicated Cthulhu Cultist since 4523 BC.
I can only wonder: MS really is in quite deep trouble with their customers, especially those, who have paid big bucks to have the right to upgrades of their products. Since Longhorn is a long way out, and any upgrades (OS or Office) seem not hugely attractive, why is anyone paying the maintenance fees, which were designed to save you money on product upgrades?
MS has made their staunchest customers (i.e. the executives and managers having talked their companies into spending the extra money on maintenance) look absolutely foolish. So now, they desprately need to give those folks a story to tell their bosses, why they should not get fired for such a wanton waste of their companies' money.
Playing this security card shows an amazing act of desparation by a wounded giant. If even Gartner starts to critisize MS, there is a lot going wrong in the belly of the beast.
That's not fair, slashdot should give their information out freely to everyone...
Oh wait, they do, they just treat their paying customers a little better...
I really don't see this as much of an issue. The "premier" customers don't get the patches any sooner. They get an advance heads-up on what the patches will contain. Why will this affect anybody?
According to the article: Microsoft insisted the information provided in the notice was "very basic in nature" and intended only to provide general guidelines concerning the maximum number of bulletins that may be released, the anticipated severity ratings, and an overview of products that may be affected.
Pay us lots of money and we will give you advanced warning of vulnerabilities to protect you from the rest of our customers and their owned boxen?
"Our funds have never taken part in toxic or death spiral convertible financings of any sort" -BayStar's managing partne
It's an early *warning*
If you can show me a virus writer who can take advantage of a hole by reading about it in a very generalised security bulletin, then I'd hire him on the spot.
(From the article: "The information is purposely not specific and does not disclose any vulnerability details or other information that could put customers at risk." )
Not every corporation with a large number of computers to administer is a Microsoft premium customer, so it's not just individuals with 2 or 3 computers that have to wait. The premium customers are paying Microsoft to be more prepared competitively against the bug guys- not for advance information that the little guys don't need.
you, being a 16-year old over-achiever, register yourself with Microsoft as a preferred customer using your daddy's company credit card. At that point, you learn of the impending vulnerabilities and release one hell of a worm virus on the net. Stick a fork in me, I'm done...
-- Game Developers: Stop porting badly-textured games from crappy console systems!
Please, hate MS all you want, but at least hate them for a reason, not the typical /. drooling paranoia I see here.
The drooling paranoia was built because of years of times when Microsoft really *did* screw over customers or competition in quite an unethical manner, like the DR-DOS application compatibility, or the IIS Netscape Navigator deprioritization. Microsoft generally didn't get in trouble for its misdeeds, so now IT folk angry after years of poor treatment have simply started attacking Microsoft for all sorts of things that really aren't very bad at all. Microsoft is simply paying back in installments for earlier nasty deeds.
May we never see th
So Microsoft is profiting out of:
1. Building a necessity to be informed because of failuires in thier software
2. Making these failuires so deadly that quick action must be taken to save money
3. Screw up all thier patching, and take time to patch vunerabilities they do patch
So, the more they do the above, the more money they can take from those companies now learning the meaning of being 'tied to a large metamorphic rock plunging happily down into the Mariana trench'.
Microsoft - a monopoly in profiting from failiure, fear, and fraud.
#hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
A car company recalls their last car model for defective brakes only to their higher profit customer.
The warning for the normal customer will be issued 2 weeks later...
</joke>
Every company has the right to give "preferential treatment" to its higher profit customer.. but we're not talking about discount or special offers.. we're talking about defects and vulnerabilities and I guess all the customer have the same right to know it they're using an unsafe environment.
On the other side, as stated on the article, it makes perfect sense to warn "critical infrastructure company" before releasing information that could be used by malicious users.
This message doesn't need a sig
If you actually read the article, you would know that they aren't actually offering patches early to their premium customers, they are only letting them know that patches are on the way. Everyone in the world gets the patches at the same time. Premium customers are at the same risk as we are.
Not true. To continue the vehicle manufacturer analogy, Ford motor company realizes their brakes may fail when the vehicle is operating +80mph. Engineers are working diligently to resolve the issue, but a fix will not be available for another week. Wouldn't you agree that a premium customer, who is notified of the issue would be at less risk than someone who believes their car to operate properly?
If there is a vulnerability in the Microsoft file system and an administrator is aware of it, he may take action to protect crucial information from the vulnerability (i.e. move it to a UNIX server or server running different version of windows).
What is the next logical step for MS?, intentionally introduce more bugs to get more customers to sign up for the premium service?
Or needlessly delay the release of patches for the same reason?
This is almost a strong-armed shakedown.
MS is basically saying "..Yo buddy, we knows you gotch yer license, but see it's like this, Billie boy says youse gotta cough up a little more dough, or things just ain't gonna work out the way you planned..."
C'mon M$, if your customer's already have a license for your product, and your product is broken, then it is YOUR (Microsoft's) responsibility to FIX it........
That depends on what side you are. If you are the one who pays, or the one to whom the info leaked to, regardless of the color of your hat, you have an advantage against the ones who aren't.
Which puts to disadvantage all the ones who aren't members of (or friendly with) big corporations or e-crime rings. For a small admin of a small network it means just that the adversaries have more time to write worms and that the time between a vulnerability getting known and a vulnerability getting exploited shrunk again, at least for the ones who didn't play the advance-info racket (who will pay for it once more, indirectly, in the form of bandwidth wasted by worms from even more machines patched too lately).
Luckily, as some other posts suggest, the advance information is in this case next to worthless anyway.