Microsoft to Offer Patches to U.S. Govt. First

Elitist_Phoenix writes "Reuters reports that 'Microsoft is to give the U.S. government priority in fixing security holes in Windows and other software, The Wall Street Journal reported on Friday. Under a plan to take effect later this year, Microsoft will give the U.S. Air Force versions of software 'patches' to fix serious security vulnerabilities up to a month before they are available to others.' Yet another attempt to fight off impending doom, by trying to keep the government away from open source?"

Comments

Safety First

[DogDaySunrise]

Sounds a lot more like "Microsoft will delay patches for a month after availability, except to the US Govt". Surely it'd be a lot safer for the US Govt Ltd. for M$ to supply patches to *everyone*, governments included, instead of allowing vulnerabilities to lie unpatched for a few weeks...?!?

Re:Safety First

[ctr2sprt]

Well, remember that MS's products are used on hundreds of millions of computers worldwide, and after the OS leaves the box Microsoft has no control over it. People install all sorts of programs and make all sorts of "adjustments" to their computers. This makes QA for patches hideously difficult, since MS has to test against such a wide array of third-party apps.

So the argument here is that because the USAF is using an NSA-designed build, they can guarantee a pretty stable environment. MS has a known quantity to test against, which lets them test faster (and presumably better), so they can afford to roll those patches out earlier. They then spend the next few weeks trying to make sure their patches work on Everything Else. One of the hopes cited in the article I read is that this will encourage other entities, like banks and such, to adopt the NSA's build (or at least model their own after it). That will, of course, enable Microsoft to expand its "early release" program, making them more money, but it may also lead to better security across the board. As we all know, a good sysadmin can secure anything, even a Windows box. Well, if you aren't a good sysadmin, maybe you can copy one and get similar effects, right?

That's their line. It does make sense, though I personally would rather see MS release all their patches after minimal QA, then a month (or so) later release "improved" versions. That way, if the patch breaks some third-party program, at least the folks who don't use that program can get the benefits. MS does this sometimes already. Of course, my expectation is that if they did this with every patch, that "month" wait would be closer to two or three months, and often the updated patch would never come out at all.

Re:Safety First

[Znork]

"It does make sense"

It makes sense until you realize that the OSS crowds install even more sorts of programs and make even more adjustments to their computers, yet manage to get patches in a timely manner.

Which means that either Microsoft is terminally unable to create stable and clean APIs so everything affects everything else, causing an inordinate amount of breakage, or they're still not very serious about the patching thing.

Re:Safety First

[antiMStroll]

Right.... and this explains why my place of work is still struggling with the process for rolling out XP SP2 in our 100% MS OS shop because it breaks so many critical packages. I don't see Microsoft stepping up to our plate to assure compatibility.

Smart idea by Microsoft

[aendeuryu]

People in power love the idea of others sucking up to them. Even if they can get security fixes quicker via opens source, the idea that Microsoft is effectively prioritizing them ought to be incentive enough. You could give them good practical and logical reasons for going open source anyway, and they'd MAKE UP their own reasons for not doing it, because they'd LIKE the idea of having a position like this over Microsoft, and would go along with whatever rationalizing they'd have to do to accept it.

What's more satisfying? The idea of having some small company like Red Hat at your beck and call? Or Microsoft?

So, who do they upset most?

[malkavian]

The Military for having to Beta test MS' latest patches (they'll be the one whose systems crash most by having patches applied that haven't met the real world before), or Commerce, who suddenly realise that they're going to be getting cracked hard, by something MS knows about, has a fix, and just can't be bothered to give them a cure for..

Great

[Pan T. Hose]

Another reason for the EU, China and Korea to finally abandon Micro$oft software altogether. Now it is not only a risk of ordinary corporate lock-in but actually a treat to national security and sovereignty of Asian and European States (excluding Middle East states which are hardly sovereign to begin with) because it means that the US government (CIA, NSA and other *AA) will be able to easily reverse engineer Micro$oft patches and exploit the patched vulnerabilities in the parts of the world where there are no patches available so not only stupid people will have vulnerable systems but actually everyone. We can only hope that our European and Asian brothers and sisters are wiser than their American counterparts who will hopefully jump on the bandwagon as well and stop using Micro$oft software. That should mean a great increase in Linux market share during the first quarters of 2006, 2007 (such a serious transition is never done overnight, there are no miracles, we have to be patient). So paradoxically this is actually a good news because it will inevitably hurt Micro$oft in the long run. Instead of overreacting we should stay calm, discuss its implications maturely, and see what it means and how the rest of the world reacts. The most important parts of the world to focus on are: Europe, Asia, Australia, Africa, South America and Canada. Only time will tell what that decision really means and which F/OSS O/S will benefit the most where the national security is the top priority.

Machiavelli

[bitswapper]

So, if you're a foreign government, the US government has one month to break into your unpatched systems. Or, if you're anyone the US government doesn't like, the CIA, FBI, HLS, etc., has a month to hack your unpatched systems.

I give Microsoft credit for possessing at least a basic understanding of Machiavelli.

Microsoft Liability ?

[Alain Williams]

Does this not open M$ to the charge of willfully withholding security patches from everyone else by a month ?

Re:Great idea.

[martinX]

A small advantage over whom?

During your month of testing, your systems are still vulnerable. MS can't make the patches any faster, therefore you having them a month earlier than everyone else can only mean that they are delayed to everyone else who needs them. How could that possibly be a good thing. Banks, powerstations, hospitals - they all can ill-afford downtime.

Finally, "released to the government" means what? They post them on their website? Like they do now...

As far as I can see, this helps no-one.

Please explain.

Re:Great idea.

[CdBee]

I find it a little disquieting that the USAF's primary systems may be running Windows. Windows is good for a lot of jobs, but the frontline defence of the world's most - well - controversial nation possibly ought to be on something a bit more resilient.

Re:Haha

[danormsby]

What I find weird about this is that Microsoft write a patch to fix "serious security vulnerabilities", release to the US miliary but hold it back from the rest of the world for a month. Will this make the world a safer place?

Re:Yet another attempt to fight off impending doom

[drooling-dog]

And I'm sorry if you have ego issues with the Air Force having a higher priority than your entertainment center.

You're assuming that anyone is going to enjoy greater security by delaying patches to most other users. I have to question this. And never mind about "entertainment centers"; what about the systems that process your credit cards or medical records?

Re:Haha

[marvin2k]

Sadly, the majority of poeple will answer back, "Well, gosh gee. You're right. Microsoft makes me feel special! Microsoft is so great."

No, the majority of people will say, "Well, gosh gee. You just handed out a security fix for a vulnerability to the government but you don't give it to me for another month so I my machines are now in grave danger even though they don't have to be. I think I'll try linux for a change, they don't have a "leave your customers hanging in the air" policy."

Re:Haha

[canwaf]

The average computer user would:

a) Not think that.
b) Not think of linux as a substitute for Windows.

Because the average computer user doesn't install security patches anyways!