Slashdot Mirror
Microsoft Opens Access to Vulnerability Notifications
joseph schmo writes "Microsoft has announced that it will throw open the floodgates of vulnerability notifications for everyone who wants them. Previously, it was only offering early notifications to 'Premier and other 'representative' customers,' or those customers who would sign a Non-disclosure statement."
A pre-emptive strike perhaps ?
Just set a Slashdot RSS up? Does the same thing!
About 5 years too late I think.
I guess this is their way of saying... "We don't understand these things either!"
You still won't be able to learn about vurnerabilities due to overflooded mailbox.
It was probably talking about this.
If this is indeed as open as it sounds, then it's a massive step forward. MS will be forcing itself not to become complacent and hide behind the obscurity of a vulnerability that may not be known, but instead will have to deal with the vulnerability in the correct way - fixing the thing.
Whether it's actually this open, and whether they do end up fixing more problems because of it still has to be seen. Past behaviour has me cynical.
Get your early warnings here:
Microsoft Security Bulletin Advance Notification
Another news story about it:
BitTorrent traffic down to 33% of all internet traffic.... 28%... 22%... ~BS
Home of the EULA shirt
So?
Big deal, how is posting useful information Karmawhoring?
I'm sure that when everyone started out, they've tried to getting their karma atleast a few times.
Atleast he's helping everyone out -- it sure as hell beats posting pointless AC comments and adding nothing worthwhile to the discussion.
Was anyone really waiting for this to happen?
I'm fine with the automatic Windows update!
Computer Weekly
Considering the high amount, this could be considered a new form of spam ;)
... because before I was having to use an unpatched backdoor in IIS in order to access the webpages detailing the latest vulnerabilities.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
Pfft. But then what do they do when you're on the road and need to access your documents and have forgotten their user name and password? They're screwed. ~BS
Home of the EULA shirt
... that I would want to sign up for that. I don't think my mail server would be able to handle the strain.
What are you expecting to find here?
What they will do is pre-announce the forecoming security bulletings 3 days in advance, and without details.
So, on saturdays, every 3 months, you'll get something like : Next tuesday, there will be 5 new vulnerabilities, 2 of them being critical.
#include "coucou.h"
Who The Hell Uses Microsoft Products Anymore?
About 90% of the world's home/office computer users. No stop asking stupid questions.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
I don't already get enough email.
--- Asking inconvenient questions for over 30 years...
Hasn't everyone moved on to OS X and Linux?
What, are you saying you need to run both to get an improvement over Windows?
Anyway, yeah I'll switch to OS X. Just hand me the damn hardware.
Beware: In C++, your friends can see your privates!
"Microsoft has announced that it will throw open the floodgates of vulnerability notifications for everyone who wants them"
...and people thought spam was bad. Prepare to find mail-bombed by MS:-)
Anyways, yes, I'm being facetious. This is a good announcement for everyone. I could never understand what the logic was by trying to hide what vulnerabilities were fixed in an update. This should allow those in charge of admin to reasonably evaluate the state and impact of the updates and vulnerability.
The cave you are in must be very deep, unless that was some very poor attempt at humour on your behalf?
When I get up in the morning, I always drink my coffee over the Dayly Vulnerability Report.
Expensive
Compared to what? My PC cost ten times what I can buy XP Pro for. I've personally used software costing hundreds of thousands of pounds.
buggy
Show me a complex piece of software that doesn't suffer from bugs. Linux distributors and Apple also release buggy software (and no, pointing out that most of the software that comes with a Linux distro is written by third parties is not an excuse - the distributor has the source and chooses to include the app. They assume some responsibility for it)
insecure
Put it behind a firewall, keep it up to date with patches, and don't be an idiot about using it - just as you should be doing with any network-aware piece of software.
Hasn't everyone moved on to OS X and Linux?
Actuall, I've moved back to Windows having used Linux for a couple of years. No real complaints, it just doesn't run some software I need to use, and most of the things that bugged the shit out of me about Windows have been fixed. The right tool for the right job; in my case, that's currently Windows.
It's official. Most of you are morons.
From the Article all this means that you get an extra 3 days notice before the monthly release of security bulletins. What is the point of that?
The problem with the new MS regime of patching cycle is that they did not release information as it became available to them. Microsoft should release patches as soon as they are available, not on a monthly cycle. The current MS situation means that you arr vulernable for up to a month (if not more).
Microsoft's initial assumtion that virus's & scripts are released only when the patch is release is largely flawed.
meh
more like form the open-doors-closed-windows dept.
Anyone who posts AC for any reason other than for reasons of confidentiality is to be despised.
If you post AC for any other reason you are not willing to stand by your comments, which is beneath contempt. I have never posted AC and will not do so unless under an NDA, or I am posting information that is otherwise confidential.
Tool.
meh
Does this mean i should be able to get a program/script soon to download updates automatically to a directory on my linux serveer for distribution at my pleasure? or can i get that already. Basically I'm just wanting a way to download the new updates for certain versions of windows, then maybe some form of notification that i have a new update sitting around. This is mostly to help with servicing alot of customer PCs
I have never posted AC and will not do so unless under an NDA, or I am posting information that is otherwise confidential.
Interesting. So your code of ethics allows you to break your word and reveal confidential information, but not to hide from Slashdot readers your nickname (dcam: email not shown publicly). Bravo.
...there's a vulnerability in Microsoft Vulnerability Notification that causes Microsoft Vulnerability Notification to send out spurious vulnerability notifications?
Gentoo Linux - another day, another USE flag.
No no no...
In vulnerability, Soviet Russia Accesses YOU!
For MS to open up Access to vulnerabilities? I mean, what gives? They did so well in opening Outlook to vulnerabilities years ago. I hope someone got fired for this blatant slacking off.
Oh wait...
In C++, friends can touch each others private parts.
"Windows XP Service Pack 2 can help. Download and evaluate it for free TODAY."
Sure, sure. And if you don't like it, you can fucking reformat your drive to get rid of it. That's like testing a rocket engine on your car, and you just run the thing into a brick wall to get it stopped. Awesome.
Anyway, I don't see how this is going to help anyone. Telling Goatse man that his anus is gaping wide open doesn't address the actual gaping anus. It just makes him aware of the gaping anus, and he's likely to tell you "Ok. Thanks!"
Shut up and take your identity theft like a man...
"Hasn't everyone moved on to OS X and Linux?"
I personally find an OS X/Windows XP Pro/Linux combination come in quite handy. Run Linux as the server (storage and security), Windows XP Pro as the desktop (gaming and multimedia) and OS X on a portable (basic apps). All of them can talk to each other just fine, and each excels at what it does.
I think you meant to type "daily," unless there is a pun here I'm missing. But if not, I completely understand being myself a product of the NC public schools system.
You are correct: all vendors should release fixes and patches as soon as they've been internally "blessed". The problem with Windows however is that patching is such a pain. Almost none of their server technology can be "conditionally restarted". Almost none of their kernel modifications are actually put "installed" until the reboot. What is just as bad is you have to reboot again to roll back.
I do realize the importance of getting fixes, especially vulnerability in a very timely manner but because of the way Windows is built its nearly impossible to implement such a "patch on the fly" plan that so many other systems seem to enjoy.
Those SCO guys were nice though, gave a me nice framable certificate.
He tried to kill me with a forklift!
Who handed you the damn hardware to run Windows?
;-)
Assuming that you don't use OS X because you can't afford the hardware, a cooler excuse would be that you are waiting for Apple to deliver the one you ordered
Amen Brother.
You just have to sign a non disclosure agreements to know about vulnerabilities first? Or pay some token fee??? *BOGGLE*
You mean, spammers and spyware makers get notified of vulnerabilities *first* and if they abuse the vulnerabilities while keeping their mouth shut they can get away with it?
That's worse than I thought... Microsoft is handing the malware people the backdoor of the week on a silvery plate *before we know it exists*.
I'm visualizing a malware server doing its evil job, and getting a "backdoor of the week abuser" plug-in for whatever it's doing. Not having to hack themselves, the spammers just suscribe to a hacker who gets advance warnings and makes backdoor abusers... so convenient... thank you Microsoft, I can update my spamware without even rebooting!
Kudos to microsoft for finally stopping that stupid selective early warning practice, something they should have done in the late 80's...
(too little too late, I'm on freeBSD now!)
P.S.: With so many spammers, they are a fraction of the market worth their own "representative costumer" at Microsoft. Microsoft has an issue of not turning down certain "costumers"...
Microsoft is pure dog-ma. FreeBSD is pure cat-ma.
It's very troubling that they haven't been disclosing these vulnerabilities all along.
MS clearly has a culture that encouraged secrecy (or semi-secrecy) for many years about this. A sudden change in policy does not mean that the underlying culture has changed. It just means that there's now a certain amout of internal grumbling within MS about this new "reckless policy of airing our dirty laundry in public".
The true problem at MS is a poisonous culture that places a premium on secrecy: Closed source. Closed bug lists. It's all part of the same basic cultural weakness.
Some people just don't take the agreements that they sign seriously anymore. In the line of work I am in I had to sign an NDA, and I would NEVER violate that under any circumstances.
If you are unwilling to abide by that CONTRACT you signed, then DON'T SIGN IT!!!!!
The company you work for, if they find out you were the person who broke that contract, can go after the person who broke said contract for among other things, breach of contract.
Other charges can include theft of information, and god forbid, Identity Theft charges. Those carry prison terms if convicted. Don't you realize that you are in a trusted position, otherwise they wouldn't have made you sign that piece of paper in the first place, now would they?
Read your NDA sometime, and see what the minimal punishment would be. Suffice to say, breaking the NDA can cause you to be terminated from your place of employment. And, possibly, charges pressed for theft, or worse...
Now, is posting such things here anonymously worth the risk?
No stop asking stupid questions.
WTF does that mean? He is to continue asking such questions?
I wish people would be more like you. Besides programming (I'm mainly a Windows programmer, and also do linux occasionaly), I don't really care about the platform I'm running for basic things (I used to, when I was, like, 17). I do recognize each platform's strengths and weaknesses, and mix n' match depending on what I want to do.
"I've personally used software costing hundreds of thousands of pounds."
Did you mean this literally? Hundreds (plural) OF thousands?
I presume you're not referring to something like "five thousand pounds per single-PC license, multiplied across 40+ seats" --
because, if that's what you meant, then it would be somewhat misleading.
Just out of curiosity, what PC-based software do you personally use which costs a minimum of 200K *GBP* for a SINGLE user?
I have read so many post whining and crying about not being able to get the patches and updates to THEIR local network at a central point, and other ignorant FUD.
1 - SUS
2 - Hfnetchk
3 - MOM
4 - SMS
5 - GFI
so many ways to centralizae the updates, and push them, yet the bashing-wagon can't remove the blinders, so they spread the FUD out of ignorance...
ohhhh for the whiners that want to point at the price, SUS is free. Ohhhhh but now they want to whine that it cost to buy the Server OS, well DUH!
MS is not a group of zealots working for free while whining they can't live off the part time money they make flipping burgers...get a clue. MS is a CORP, CORP's are there to MAKE MONEY...
remember your "it should be free" whine the next time you want to be paid for your code...
We already know about the Diebold issues, we're just to lethargic to demand a better democracy.
If you think
Compared to what? My PC cost ten times what I can buy XP Pro for.
You ever hear of something called 'bare-bones' or do you just like paying ten times more for your hardware then you need to?
Even then, a personal operating system should not cost the same amount as the hardware its running on.
Show me a complex piece of software that doesn't suffer from bugs. Linux distributors and Apple also release buggy software
They sure do. But at least when their users report bugs, they actually try to fix them.
Put it behind a firewall, keep it up to date with patches, and don't be an idiot about using it
Ahh, the good old 'its the users fault' for not running a fire wall. Guess what, if the OS was secure, it wouldnt need a firewall.
http://shit.slashdot.org/article.pl?sid=04/11/05/0 312254
instead of fixing the flaws that are made public by hackers faster they're goint to tell us and those who have malicious intent about more problems more often?
All the torrents you could want.