Slashdot Mirror
Early Warning For Microsoft Premium Customers
techmuse writes "According to internetnews.com, Microsoft is giving its premium customers early warning about vulnerabilities and patches. Those of us who aren't lucky enough to have such a relationship with Microsoft may find ourselves at greater risk than premium customers as a result."
Kindof like the paid customers using slashdot who get a chance to read the clicky links before it dies.
The U.S. government's Computer Emergency Readiness Team (US-CERT) has also been heavily criticized for providing security advisories to paying customers ahead of coordinated public release.
Microsoft and the government using the same strategy! I am shocked! (sarcasm mode off)
Other juicy information from the article:
There won't be a patch this month for a "highly critical" bug in Internet Explorer browser's drag-and-drop feature.
So we are suppose to buy access to problems that won't be patched in a timely fashion? You've got to be kidding me.
The only justification that I can see to this might be that microsoft wants to release it to their "elite" first... so that work-arounds and patches might be generated by the community instead of within microsoft. Thus, trying to get one of the open source benefits...
While that's a good theory... I bet it's really just microsoft praying on the security worries of companies. Considering I run a Microsoft network... that's a sad conclusion for me to have to make.
Let me guess another potential revenue stream for MS?
Security through $$$
another Roadkill on the Information Superhighway
Company gives preferntial treatment to its higher profit customers!
I've just signed legislation that'll outlaw Russia forever. We'll begin bombing in five minutes.
*shrug*
Doesn't sound like it affects overall computer security, really. It's nice for the organizations that sign on, so they have a couple more days to plan outages as necessary. It doesn't affect the vast majority of home users at all (I certainly don't plan my downtime, it just happens when I feel like it).
I can see this being irritating to customers who are unwilling to pay yet another Microsoft tax for early notification, but I don't see that it's some kind of horrible, evil practice, either.
Reality has a conservative bias: it conserves mass, energy, momentum...
I would re-write one sentence in the summary as:
"Those of us who aren't lucky enough to have such a relationship with Microsoft may find ourselves at greater risk FROM premium customers as a result."
(changed "than" to "FROM")
In a nutshell, is this not what MS is doing?
This is extortion! You cannot force me to pay you more money to provide a warranty that I'm entitled to under law. Just try this logic in any other industry... Oh, you're car's got a major issue that could cause injury, but we won't tell you about it, until we tell our wealthy customers first.
---
Programming is like sex... Make one mistake and support it the rest of your life.
Bugtraq is almost always ahead of microsoft where it comes to vulnerabilities in their software. Why in the world would I pay Microsoft to tell me what might be wrong tomorrow when bugtraq will tell me what's wrong today? Does anyone have an experience where MS came out with vulnerabilities first?
I submitted this story last night, and it didn't get posted.
We are all equal, just some of us are more equal than others.
This isn't so bad, it just means that the premium customers get to beta test the patches for the rest of us!
To the making of books there is no end, so let's get started
That is silly. Are "premium customers" going to be bound by some NDA not to talk about the vulnerabilities? What's to prevent some news outlet from becoming a "premium customer" and then publishing everything they hear five minutes later. But now MSFT will look bad (worse) because the press is announcing there flaws instead of them.
M$ says they are focusing on security, but how does giving advance warning only to subscribers support security? It's the average user who doesn't know how to patch their computer that is at the most risk (and can also propogate the most damage to the rest of us). And the average user won't be a premium customer.
Does it seem like M$ is saying one thing and doing another?
You won't hate yourself in the morning if you don't get up before noon.
It wouldn't take much for virus writer to sign up for this premium service to obtain and potentially exploit vulnerabilities that they didn't already know about.
Then again, if all that Microsoft is worried about is their bottom dollar then I suppose they don't care who's paying for their premium service.
Those of us who are lucky enough to have no relationship with Microsoft may find ourselves at even lower risk than premium customers
-truth
I had a steady B+ in my AI class until I failed the Turing test...
Imagine if companies in the car industry worked the same way:
People wouldn't stand for it. Why do they hold software companies to such lower standards?
just came in his own pants.
Asked why it has taken Microsoft 25 years to get trustworthy computing into the forefront of its efforts, he said: "Because customers wouldn't pay for it until recently."
Assholes.
No lie. Can't remember for which patch. It was right after they got burned on one of the many virus outbreaks.
At first I thought, cool, they are really taking this seriously. But then, I thought, what does he really think I'm going to do? go into the office and patch 1000 machines before morning?
Since then, we've just been getting these 'pre-warnings' via email. Which of course are marked as confidential.
For the record, we are an enterprise customer.
... GM announced today that a new "premium" warranty is available for it's vehicles. Vehicle owners who purchase this new warranty (Only $500, NDA required) will receive recall notices regarding vehicle roll-overs and potential explosions a full month before vehicle owners that do not have the new warranty option.
What they give is a heads up of what will be affected by the upcoming patches or updates. This allows very large organisations with thousands or even tens of thousands of boxes to do some pre-release planning. Updates and patches may need to be tested against other critical applications to make sure nothing breaks. Overtime may need to be planned out etc etc. Huge amounts of time and money may be involved so a few days extra time can be invaluable.
Patch one XP box is a far far simpler thing to do than patching 10k machines of varying Windows versions and functions.
http://www.mtholyoke.edu/~rzdalea/cs100/software_
http://www.baselinemag.com/article2/0,1397,154440
Also google for Therac-25
How does one become a "premium customer"?
Dedicated Cthulhu Cultist since 4523 BC.
All you get is an email from MS saying 'oh, next Tuesday we're going to release X patches, with Y rated critical, and Z rated serious'.
There are ZERO details on what the patch is going to fix, personally, I consider the advance notice almost useless except to tell you you need to have resources ready to roll out critical patches.
You get *no* details, *no* access to patches, and I have several emails from MS Security people who always include ' sorry, I can't give you any details about Tuesday's patch'.
Please, hate MS all you want, but at least hate them for a reason, not the typical /. drooling paranoia I see here.
--R.
I can only wonder: MS really is in quite deep trouble with their customers, especially those, who have paid big bucks to have the right to upgrades of their products. Since Longhorn is a long way out, and any upgrades (OS or Office) seem not hugely attractive, why is anyone paying the maintenance fees, which were designed to save you money on product upgrades?
MS has made their staunchest customers (i.e. the executives and managers having talked their companies into spending the extra money on maintenance) look absolutely foolish. So now, they desprately need to give those folks a story to tell their bosses, why they should not get fired for such a wanton waste of their companies' money.
Playing this security card shows an amazing act of desparation by a wounded giant. If even Gartner starts to critisize MS, there is a lot going wrong in the belly of the beast.
That's not fair, slashdot should give their information out freely to everyone...
Oh wait, they do, they just treat their paying customers a little better...
I really don't see this as much of an issue. The "premier" customers don't get the patches any sooner. They get an advance heads-up on what the patches will contain. Why will this affect anybody?
According to the article: Microsoft insisted the information provided in the notice was "very basic in nature" and intended only to provide general guidelines concerning the maximum number of bulletins that may be released, the anticipated severity ratings, and an overview of products that may be affected.
Microsoft isn't issuing patches to Premium Customers first. They're just letting them know when a patch is coming out and what's in it. You get an early warning. Your analogy assumes Microsoft isn't issuing patches to regular users simultaneously, which isn't true. But, this is Slashdot, therefore such is implied in the article summary for maximum bash-Microsoft effect in the discussion threads.
It's an early *warning*
If you can show me a virus writer who can take advantage of a hole by reading about it in a very generalised security bulletin, then I'd hire him on the spot.
(From the article: "The information is purposely not specific and does not disclose any vulnerability details or other information that could put customers at risk." )
you, being a 16-year old over-achiever, register yourself with Microsoft as a preferred customer using your daddy's company credit card. At that point, you learn of the impending vulnerabilities and release one hell of a worm virus on the net. Stick a fork in me, I'm done...
-- Game Developers: Stop porting badly-textured games from crappy console systems!
Please, hate MS all you want, but at least hate them for a reason, not the typical /. drooling paranoia I see here.
The drooling paranoia was built because of years of times when Microsoft really *did* screw over customers or competition in quite an unethical manner, like the DR-DOS application compatibility, or the IIS Netscape Navigator deprioritization. Microsoft generally didn't get in trouble for its misdeeds, so now IT folk angry after years of poor treatment have simply started attacking Microsoft for all sorts of things that really aren't very bad at all. Microsoft is simply paying back in installments for earlier nasty deeds.
May we never see th
Everyday they don't never come correct
You can ask my man right here with the broken neck
He's a witness to the job never bein' done
He would've been in full in 8 9-11
Was a joke 'cause they always jokin'
They the token to your life when it's croakin'
They need to be in a pawn shop on a
911 is a joke we don't want 'em
I call a cab 'cause a cab will come quicker
The doctors huddle up and call a flea flicker
The reason that I say that 'cause they
Flick you off like fleas
They be laughin' at ya while you're crawlin' on your knees
And to the strength so go the length
Thinkin' you are first when you really are tenth
You better wake up and smell the real flavor
Cause 911 is a fake life saver
So get up, get, get get down
911 is a joke in yo town
Get up, get, get, get down
Late 911 wears the late crown
- Public Enemy
...The National Weather Service has announced it will offer early warnings for natural
disasters such as tornadoes and earthquakes to subscribers of its new "Stay Alive Platinum" service.
I am offering a low-cost service to users of Microsoft products. For a mere $5, you will receive a notice that says:
WARNING -- Your product is riddled with security holes!
There, now people can be warned.
Hurry, send in your money now! Otherwise you won't receive notice that Microsoft products are vulnerable!
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
The poster clearly doesn't know what s/he's talking about, and is obviously just looking for something to cry about. Same old /. FUD.
/. is at least informed and grounded in reality. This is totally reactionary, underinformed cry-babyism.
The notifications sent to Premium customers are just that: notifications. We don't get the patches any earlier; the advance notice we receive simply gives us a general overview of the vulnerabilities and what they affect so as to help us plan the patch rollout.
And there's something wrong with that? Please... It's the responsible thing for Microsoft to do. And the poster thinks that leaves others "at a greater risk" than Premium customers? Please, explain to me how that could possibly be, given the fact that the patches are released to all customers (Premium and not) at the same time. Totally ridiculous FUD. You get the patches at the same time we do (unless you count betas, which... come on). We get advance notice because we have to plan for rolling out patches to tens of thousands of workstations and servers. We need to know in advance. Those of you who only have to worry about your PC (or maybe even 5 or 10 additional) don't. Simple as that.
Most of the anti-MS FUD on