Slashdot Mirror
Microsoft Opens Access to Vulnerability Notifications
joseph schmo writes "Microsoft has announced that it will throw open the floodgates of vulnerability notifications for everyone who wants them. Previously, it was only offering early notifications to 'Premier and other 'representative' customers,' or those customers who would sign a Non-disclosure statement."
A pre-emptive strike perhaps ?
Just set a Slashdot RSS up? Does the same thing!
About 5 years too late I think.
I guess this is their way of saying... "We don't understand these things either!"
You still won't be able to learn about vurnerabilities due to overflooded mailbox.
It was probably talking about this.
If this is indeed as open as it sounds, then it's a massive step forward. MS will be forcing itself not to become complacent and hide behind the obscurity of a vulnerability that may not be known, but instead will have to deal with the vulnerability in the correct way - fixing the thing.
Whether it's actually this open, and whether they do end up fixing more problems because of it still has to be seen. Past behaviour has me cynical.
Get your early warnings here:
Microsoft Security Bulletin Advance Notification
Another news story about it:
BitTorrent traffic down to 33% of all internet traffic.... 28%... 22%... ~BS
Home of the EULA shirt
Was anyone really waiting for this to happen?
I'm fine with the automatic Windows update!
Computer Weekly
Considering the high amount, this could be considered a new form of spam ;)
... because before I was having to use an unpatched backdoor in IIS in order to access the webpages detailing the latest vulnerabilities.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
What they will do is pre-announce the forecoming security bulletings 3 days in advance, and without details.
So, on saturdays, every 3 months, you'll get something like : Next tuesday, there will be 5 new vulnerabilities, 2 of them being critical.
#include "coucou.h"
Who The Hell Uses Microsoft Products Anymore?
About 90% of the world's home/office computer users. No stop asking stupid questions.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
"Microsoft has announced that it will throw open the floodgates of vulnerability notifications for everyone who wants them"
...and people thought spam was bad. Prepare to find mail-bombed by MS:-)
Anyways, yes, I'm being facetious. This is a good announcement for everyone. I could never understand what the logic was by trying to hide what vulnerabilities were fixed in an update. This should allow those in charge of admin to reasonably evaluate the state and impact of the updates and vulnerability.
Expensive
Compared to what? My PC cost ten times what I can buy XP Pro for. I've personally used software costing hundreds of thousands of pounds.
buggy
Show me a complex piece of software that doesn't suffer from bugs. Linux distributors and Apple also release buggy software (and no, pointing out that most of the software that comes with a Linux distro is written by third parties is not an excuse - the distributor has the source and chooses to include the app. They assume some responsibility for it)
insecure
Put it behind a firewall, keep it up to date with patches, and don't be an idiot about using it - just as you should be doing with any network-aware piece of software.
Hasn't everyone moved on to OS X and Linux?
Actuall, I've moved back to Windows having used Linux for a couple of years. No real complaints, it just doesn't run some software I need to use, and most of the things that bugged the shit out of me about Windows have been fixed. The right tool for the right job; in my case, that's currently Windows.
It's official. Most of you are morons.
From the Article all this means that you get an extra 3 days notice before the monthly release of security bulletins. What is the point of that?
The problem with the new MS regime of patching cycle is that they did not release information as it became available to them. Microsoft should release patches as soon as they are available, not on a monthly cycle. The current MS situation means that you arr vulernable for up to a month (if not more).
Microsoft's initial assumtion that virus's & scripts are released only when the patch is release is largely flawed.
meh
more like form the open-doors-closed-windows dept.
Assuming that's still the case and you can find out where they are, you could always use a program like wget on the BASH command-line to retrieve them (or any HTTP/FTP document or file).
Writing a script around that to determine what's available and what's been updated, as well as emailing you or a number of other people, should be fairly straightforward.
Gentoo Linux - another day, another USE flag.
PS. If you're new to shell-scripting or if you just want a collection of good useful scripts, you cannot IMHO do better than Wicked Cool Shell Scripts which has about 100 example scripts, a couple of which show how to do neat stuff with wget and the Lynx browser in command-line mode.
Gentoo Linux - another day, another USE flag.
...there's a vulnerability in Microsoft Vulnerability Notification that causes Microsoft Vulnerability Notification to send out spurious vulnerability notifications?
Gentoo Linux - another day, another USE flag.
"Windows XP Service Pack 2 can help. Download and evaluate it for free TODAY."
Sure, sure. And if you don't like it, you can fucking reformat your drive to get rid of it. That's like testing a rocket engine on your car, and you just run the thing into a brick wall to get it stopped. Awesome.
Anyway, I don't see how this is going to help anyone. Telling Goatse man that his anus is gaping wide open doesn't address the actual gaping anus. It just makes him aware of the gaping anus, and he's likely to tell you "Ok. Thanks!"
Shut up and take your identity theft like a man...
Those SCO guys were nice though, gave a me nice framable certificate.
He tried to kill me with a forklift!
You've been able to do this for a long time using SUS. It's a personal, configurable Windows Update server. Of course, you need a Windows server with IIS to use it.
Updates have always been available for download through http://support.microsoft.com, but they are not stored in any central area that you can get to programatically. But this is why Microsoft only releases updates once a month. You know exactly what day you'll get the security newsletter on, and all you have to do is follow the link and download what you need.
It's very troubling that they haven't been disclosing these vulnerabilities all along.
MS clearly has a culture that encouraged secrecy (or semi-secrecy) for many years about this. A sudden change in policy does not mean that the underlying culture has changed. It just means that there's now a certain amout of internal grumbling within MS about this new "reckless policy of airing our dirty laundry in public".
The true problem at MS is a poisonous culture that places a premium on secrecy: Closed source. Closed bug lists. It's all part of the same basic cultural weakness.