Microsoft to Offer Patches to U.S. Govt. First

Elitist_Phoenix writes "Reuters reports that 'Microsoft is to give the U.S. government priority in fixing security holes in Windows and other software, The Wall Street Journal reported on Friday. Under a plan to take effect later this year, Microsoft will give the U.S. Air Force versions of software 'patches' to fix serious security vulnerabilities up to a month before they are available to others.' Yet another attempt to fight off impending doom, by trying to keep the government away from open source?"

Comments

Haha

[26199]

So they're getting the government to beta-test their patches? Sweet.

Re:Haha

[fshalor]

I have to admit, it's been a long time since an automatically installed m$ patch has fried a box. (I remember it happening regularly around win2k sp4 days).

The fact that most of their code sits around for like 2 years before actually getting in the download hopper is sickly amusing.

Shure this will push things ahead *just* a touch.

My only worry, is; what if this was the plan all along. Slowly just sort of start sending out patches quicker, maybe push all those product releases that have been int the "2year" range to the 1"year " range, and viola! Instomagic improvment and it didn't cost them much if anything.

Arg...

Re:Haha

[danormsby]

What I find weird about this is that Microsoft write a patch to fix "serious security vulnerabilities", release to the US miliary but hold it back from the rest of the world for a month. Will this make the world a safer place?

Re:Haha

[smchris]

It isn't bad business psychology. You can just hear the salesmen saying, "Who's your daddy! Does linux offer priority access to security patches? I don't think so."

Sadly, the majority of poeple will answer back, "Well, gosh gee. You're right. Microsoft makes me feel special! Microsoft is so great."

Shiny thing catches the sunlight. Bargain. Today only. People are stupid.

Re:Haha

[TheSHAD0W]

If anything, it'll give the NSA a chance to write their own worms before the exploit is fixed.

Re:Haha

[marvin2k]

Sadly, the majority of poeple will answer back, "Well, gosh gee. You're right. Microsoft makes me feel special! Microsoft is so great."

No, the majority of people will say, "Well, gosh gee. You just handed out a security fix for a vulnerability to the government but you don't give it to me for another month so I my machines are now in grave danger even though they don't have to be. I think I'll try linux for a change, they don't have a "leave your customers hanging in the air" policy."

Re:Haha

[canwaf]

The average computer user would:

a) Not think that.
b) Not think of linux as a substitute for Windows.

Because the average computer user doesn't install security patches anyways!

Re:Haha

[The-Bus]

It looks like you want to: Land the Plane
1. Don't land the plane
2. Open an audio file.
3. Shoot the base,


"Oh crap."

Re:Haha

[Aeiri]

Really, would it be so much trouble to just release it on Windows Update and let the government download from there? I've never seen Microsoft's site go down, but if it really is that big of a bandwidth problem, they could just create a new page with a server dedicated to serving the government patches...

Re:Haha

[digitalchinky]

You are referring to active sigint, while some branches may take the short lived opportunity to diff the changes and work back to the exploit, this stunt is politically driven, not the stuff of conspiracy theory unfortunately.

NSA releasing a worm is not an option since it would, without question, infect allied systems. This is well beyond the mission statement - and the law.

Active sigint is not done lightly, or quickly.

Microsoft gets a nice tidy chunk of near free cash from the NSA each year, think money and applied pressure to key politicians.

Re:Haha

[h4rm0ny]

If anything, it'll give the NSA a chance to write their own worms before the exploit is fixed.

Which is an anti-selling point to governments in the rest of the world. If you were the Japanese government, would you want to know that the US were getting preferential treatment?

So either Microsoft is giving up on fighting OSS for other governments, or this program will shortly be extended to other nations.

And if it's extended to other nations, then all those posters who were worried about the USAF staff having advanced knowledge of vulnerabilities, can go into total panic now. ;)

Re:Haha

[tonsofpcs]

More like:

C:\SYSTEM\PLANE\CONTROLS>LANDNOW.EXE
Error reading altitude.
[A]bort, [R]etry, [I]gnore, [F]ail?

Re:Haha

[Total_Wimp]

If you were the Japanese government, would you want to know that the US were getting referential treatment?

If you were the Chinese government, would you want to know the US is getting free help from Microsoft to spy on you? Probably not.

If you were a concerned person living in another county who happens to find out about an exploit in Windows, would you want the US government getting a month-long head start on hacking/spying on the rest of the world, possibly even including the country you live in?

Microsoft has spent years trying to convince people who find exploits to "do the ethical thing" and tell them about it before letting the rest of the world know. If you happen to be a citizen of another country, this puts a very big question mark on whether giving MS the exploit is "the ethical thing" to do.

My best guess is that otherwise helpful security proffesionals who happen to live outside our borders will be posting more and more exploits directly to the web because of this policy. Ironically, that will end up making things _less_ secure for the Air Force in the long run.

TW

Re:Haha

[jaavaaguru]

What is the difference between Abort and Fail?

Re:Haha

[rsborg]

What is the difference between Abort and Fail?

In this case, mabye a parachute?

Re:Haha

[Fat Cow]

exactly. since the patch is new software, the only way the government is getting it early is if everyone else is getting it late.

it's also, bad on the government's part to be complicit in this witholding of security fixes - it makes the country less secure, not more secure.

Safety First

[DogDaySunrise]

Sounds a lot more like "Microsoft will delay patches for a month after availability, except to the US Govt". Surely it'd be a lot safer for the US Govt Ltd. for M$ to supply patches to *everyone*, governments included, instead of allowing vulnerabilities to lie unpatched for a few weeks...?!?

Re:Safety First

[Rangataua]

I wonder how long it will be before someone creates a virus based on knowledge found in a patch that has only been released to the government.

Re:Safety First

[drooling-dog]

That was my first thought. Now my network is going to be exposed for a month after Microsoft tells a select class of customers about a vulnerability. Oh, well, not to worry: I'm sure they'll all be trustworthy types, and that's 30 days of bliss before I have to do anything about it...

Re:Safety First

[thecwin]

Maybe it's so that the US Govt can patch their systems before hackers get their hands on the patch and reverse engineer it to exploit others.

Re:Safety First

[ctr2sprt]

Well, remember that MS's products are used on hundreds of millions of computers worldwide, and after the OS leaves the box Microsoft has no control over it. People install all sorts of programs and make all sorts of "adjustments" to their computers. This makes QA for patches hideously difficult, since MS has to test against such a wide array of third-party apps.

So the argument here is that because the USAF is using an NSA-designed build, they can guarantee a pretty stable environment. MS has a known quantity to test against, which lets them test faster (and presumably better), so they can afford to roll those patches out earlier. They then spend the next few weeks trying to make sure their patches work on Everything Else. One of the hopes cited in the article I read is that this will encourage other entities, like banks and such, to adopt the NSA's build (or at least model their own after it). That will, of course, enable Microsoft to expand its "early release" program, making them more money, but it may also lead to better security across the board. As we all know, a good sysadmin can secure anything, even a Windows box. Well, if you aren't a good sysadmin, maybe you can copy one and get similar effects, right?

That's their line. It does make sense, though I personally would rather see MS release all their patches after minimal QA, then a month (or so) later release "improved" versions. That way, if the patch breaks some third-party program, at least the folks who don't use that program can get the benefits. MS does this sometimes already. Of course, my expectation is that if they did this with every patch, that "month" wait would be closer to two or three months, and often the updated patch would never come out at all.

Re:Safety First

[Zocalo]

Actually, since the article says "up to a month" I guess that all it *really* means is that the US Government will get patches as soon as they are ready while every one else gets to wait for Patch Tuesday. The wording is also vague enough that this does not preclude a particularly critical patch being released to the world at large out of cycle either. I suspect selected other parties might be afforded a similar arrangement too such as large companies, those responsible for critical national infrastructure and "friendly" governments.

The obvious problem is, the wider this net is cast, then the more likely it is that one of these patches will fall into the hands of a black hat. I suspect that unless you are on Microsoft's new "A list" the chances of there being an exploit in the wild before there is a generally available patch releases just went up. I wouldn't at all be suprised to see this turn into something of an own goal for Microsoft in the long run. Especially so if more media coverage is given to unpatched and exploitable vulnerabilities since the media probably not know about the pending patches either.

Re:Safety First

[Znork]

"It does make sense"

It makes sense until you realize that the OSS crowds install even more sorts of programs and make even more adjustments to their computers, yet manage to get patches in a timely manner.

Which means that either Microsoft is terminally unable to create stable and clean APIs so everything affects everything else, causing an inordinate amount of breakage, or they're still not very serious about the patching thing.

Re:Safety First

[BeerMonkey]

What is more likely than MS delaying the patches is that the USAF (MS's largest customer) will be engaged in actively testing the patches at the same time MS is. MS has to test for regressions, compatibility all of their products, 3rd party products, drivers, etc, on W2K, XP, 2003, with SQL, Exchange, Oracle, Yahoo, AOL, without all of that, etc. That takes a loooooong time. Since the USAF has standard builds, they can get involved in the testing with MS and declare the patch safe for them (since they have a much much smaller set of scenarios to test against) before MS is able to declare it safe for most everyone else (remember, MS cannot possibly test every scenario). So this is probably not MS giving preferential treatment to the USAF and holding out on the rest of the world, it is more likely that the USAF is stepping up and test with MS and is simply able to declare their build to be safe with patches. I would expect to see more large customers of MS get involved like this now that the door is open.

Re:Safety First

[antiMStroll]

Right.... and this explains why my place of work is still struggling with the process for rolling out XP SP2 in our 100% MS OS shop because it breaks so many critical packages. I don't see Microsoft stepping up to our plate to assure compatibility.

Re:Safety First

[digidave]

Virus writers need to work somewhere, too.

I mean, if industry insiders can supply movies to release groups ahead of time, I don't see any reason why government employees can't do the same. There's a decent chance that they'll bring the patches home to use on their own computer and probably also give it to friends.

Security isn't as tight as you would like to believe.

What about firms that host their sites

[gelfling]

We host many Gubmint sites. I wonder if we'll get special treatment. Somehow I think not.

What if...

[0x461FAB0BD7D2]

the patches screw up the systems, as has happened in the past?

Also, how would other governments see this? Would they accept being 'second-class customers', no different in Microsoft's eyes to the Average Joe?

Re:What if...

[lxs]

What if the patches screw up the systems

Some general 'accidentally' orders an airstrike on Redmond and blames it on buggy software.

Re:What if...

[Misroi]

You're right, a big part of the testing a patch is releasing the beta version to the public. This might not seems as important for small security leak, but I can't imagine them releasing big patches that haven't been fully tested. I also fail to see how they can "get the patch up to a month before they are available to other". A month is more then enough time for a security leak to exploit many many windows users. If the patch is done, why don't they release it to the general public? Only so the Government is "happy" and buys microsoft products? Nice tradeoff, Make the government happy, and let all other windows users wait for the already done patch. This would most likely incourage "normal" users to seek an alternative...

Re:What if...

[flynns]

You say this.

But circa 1997, when my dad worked on Eglin Air Force Base, he threatened to call in an airstrike on a vendor. It went something like this:

Vendor: "You get to wait, sorry, screw you contractor guys."

Dad: "What does it take to get some service? Do I have to call in an airstrike on Memphis?"

Vendor: -silence- "We'll get right on that."

The phone call ends without incident.

Three hours later, the building's Security guy wanders up to my dad's cube. "...did you just threaten to call in an airstrike on in Memphis?"

Dad: "Um...possibly."

Security: "Funny. Don't do it again."

Smart idea by Microsoft

[aendeuryu]

People in power love the idea of others sucking up to them. Even if they can get security fixes quicker via opens source, the idea that Microsoft is effectively prioritizing them ought to be incentive enough. You could give them good practical and logical reasons for going open source anyway, and they'd MAKE UP their own reasons for not doing it, because they'd LIKE the idea of having a position like this over Microsoft, and would go along with whatever rationalizing they'd have to do to accept it.

What's more satisfying? The idea of having some small company like Red Hat at your beck and call? Or Microsoft?

This is obvious...

[sgant]

Prof. Frink: It's because the Government as the troops and the guns and the tanks and the fire falling from the sky with the burning people running amok in an orgy of blood and kicking and the biting with the metal teeth and the hurting and shoving...

That's why the Goverment is first.

Re:This is obvious...

[displaced80]

But what's Microsoft getting in return, that's what I'd like to know...

First 5 air-strikes a year for FREE!?

USAF endorsement of the Flight Simulator series?

A free G-Suit for Ballmer? (much more effective than that girdle he borrowed from Shatner, I bet).

We should be told...

Great idea.

[Mz6]

As a DoD Defense Contractor working on these systems, I think this will help tremendously. Currently, we only get patches when Microsoft posts them on their website. From there it needs to be thoroughly tested to ensure the patch will still allow critical software to continue functioning (the government can ill-afford downtime on some of these systems). Beyond that, it then needs to be applied to thousands of other machines on several differnet networks. Of course, we only have a small window to get this all completed. With an extra month to have this completed, we have a small advantage to have these systems patched.

Re:Great idea.

[jacksonj04]

Sorry, but just because you're a DoD contractor doesn't mean that there aren't hundreds of thousands of other businesses needing to test patches before deployment.

Re:Great idea.

[martinX]

A small advantage over whom?

During your month of testing, your systems are still vulnerable. MS can't make the patches any faster, therefore you having them a month earlier than everyone else can only mean that they are delayed to everyone else who needs them. How could that possibly be a good thing. Banks, powerstations, hospitals - they all can ill-afford downtime.

Finally, "released to the government" means what? They post them on their website? Like they do now...

As far as I can see, this helps no-one.

Please explain.

Re:Great idea.

[CdBee]

I find it a little disquieting that the USAF's primary systems may be running Windows. Windows is good for a lot of jobs, but the frontline defence of the world's most - well - controversial nation possibly ought to be on something a bit more resilient.

Crazy, no?

[Toby The Economist]

This seems crazy on a number of levels.

Is the airforce more important than say, nuclear power plant operators?

While it's concieveable there could sometimes be some advantage in releasing a beta version of a security fix, there is no advantage whatsoever in merely delaying the general release of a patch, so MS must have agreed to supply early versions of patches to the USAF.

This, I predict, will cause more problems than it will solve.

--
Toby

Re:Crazy, no?

[Eil]

Is the airforce more important than say, nuclear power plant operators?

While it's concieveable there could sometimes be some advantage in releasing a beta version of a security fix, there is no advantage whatsoever in merely delaying the general release of a patch, so MS must have agreed to supply early versions of patches to the USAF.

It's not that the USAF needs those early patches more than anyone else, it's that the Air Force has standardized on nothing but Microsoft software for almost everything it does. Trust me on this, I'm *in* the Air Force. Even the PDAs and systems which handle classified information run plain old Windows. They forbid you from using any software that isn't installed by an admin (even stuff as benign as Firefox), and go to great lengths these days to explain that piracy is bad and that you'll go to federal pound-me-in-the-ass prison for taking that copy of Word home with you.

No, it wouldn't surprise me at all if the USAF was indeed Microsoft's biggest customer, period. Getting open source software in there to replace any Microsoft offering is going to be like convincing conservatives that it would be a really great idea to hold state-sponsored orgies in all capitol buildings on Sunday afternoons. It could happen in theory, but never in practice.

So, who do they upset most?

[malkavian]

The Military for having to Beta test MS' latest patches (they'll be the one whose systems crash most by having patches applied that haven't met the real world before), or Commerce, who suddenly realise that they're going to be getting cracked hard, by something MS knows about, has a fix, and just can't be bothered to give them a cure for..

Article submitter biased? No, not on /.

[3770]

Yet another attempt to fight off impending doom, by trying to keep the government away from open source?

Man, people really want Microsoft to become a footnote in history.

Hostile take over attempt.

[jwcorder]

They are giving them the patches first, so when all their systems are down from a bad update, they have the ability to TAKE OVER THE WORLD!!

Exploits?

[slavemowgli]

So... the government will get an entire month where they can analyse the patches, see what vulnerabilities they fix, and develop exploits to use against those who haven't received the updates yet?

Not that they probably need much help to find holes in M$ software, but still, this stinks. If the government really was concerned about security, they wouldn't ask to get patches before everyone else; rather, they'd ask that patches be made available to *everyone* as soon as possible.

Re:Yet another attempt to fight off impending doom

[jackb_guppy]

So majority has to wait for another month for the patch. Another month of defenseless machines.

In the US, we are government. It is "by the people, for the people".

In other words.....

[galdur]

Microsoft announces officially that all security holes will be UNPATCHED FOR A MONTH (except for the U.S. Gov. systems)

Marketspeak

[NitsujTPU]

Ok, before /. gets all in an uproar. Lets go ahead and explain this.

This is marketspeak. Marketspeak is nonsense. There is no such thing as well thought out marketspeak.

I'm sure that when the programmers heard this idea, they sat in a room and just collectively went "duh?!?" to themselves, then realized that marketting execs get paid more than they do, and laughed about it later around the water cooler.

Great

[Pan T. Hose]

Another reason for the EU, China and Korea to finally abandon Micro$oft software altogether. Now it is not only a risk of ordinary corporate lock-in but actually a treat to national security and sovereignty of Asian and European States (excluding Middle East states which are hardly sovereign to begin with) because it means that the US government (CIA, NSA and other *AA) will be able to easily reverse engineer Micro$oft patches and exploit the patched vulnerabilities in the parts of the world where there are no patches available so not only stupid people will have vulnerable systems but actually everyone. We can only hope that our European and Asian brothers and sisters are wiser than their American counterparts who will hopefully jump on the bandwagon as well and stop using Micro$oft software. That should mean a great increase in Linux market share during the first quarters of 2006, 2007 (such a serious transition is never done overnight, there are no miracles, we have to be patient). So paradoxically this is actually a good news because it will inevitably hurt Micro$oft in the long run. Instead of overreacting we should stay calm, discuss its implications maturely, and see what it means and how the rest of the world reacts. The most important parts of the world to focus on are: Europe, Asia, Australia, Africa, South America and Canada. Only time will tell what that decision really means and which F/OSS O/S will benefit the most where the national security is the top priority.

Re:Great

[marcosdumay]

Yes, governmetn transition doesn't happen overnight. 2006 - 2007 is a very short time for that, you should increase that to 2007 - 2009 or something like that.

To cite a real case, Brazil started its transition in 2002. Today there has been no significant mode to Linux yet. Instead, almost al the public douments have been translated from M$ ofice to a more open format. A lot of time was spent discussing what is a 'open format' and generating policies. To make the long story short, 2 years after the decision, most of governments computers use Windows, but you have acces to the public services from a Linux computer.

Impending Doom?

[PepeGSay]

Let's have a modicum of sense here. We are all going to die sometime... Microsoft has all the earmarks of a company that will live to a ripe old age though.

Machiavelli

[bitswapper]

So, if you're a foreign government, the US government has one month to break into your unpatched systems. Or, if you're anyone the US government doesn't like, the CIA, FBI, HLS, etc., has a month to hack your unpatched systems.

I give Microsoft credit for possessing at least a basic understanding of Machiavelli.

Microsoft Liability ?

[Alain Williams]

Does this not open M$ to the charge of willfully withholding security patches from everyone else by a month ?

New Microsoft 'Buddy' called Patches

[CHESTER COPPERPOT]

Whoah slow down there people I think when Microsoft mean 'Patches' I think they mean their new cyber buddy aka 'Rambo-Clippy' but with new and improved PTBSD (Post Traumatic Blue Screen Disorder). Patches is gonna open up a whole lotta online whoop-ass on hackers and other terrorists.

'Patches' is a mean son'ova' gun who uses rattle snakes as condoms and pisses napalm. I for one am glad to have this online hero on our side.

BWAHAHAHAHAHA!!!!

[NanotechLobster]

I feel sorry for Uncle Sam. They get to experience the bugs of Microsoft's patches first and we'll probobly get less screwed up patches. Brilliant.

The logical conclusions

[TheIndividual]

So how will they or it?
A) They deliver beta-patches to the DoD
or
B) They deliver final patches to the DoD and delay them for a month before public release

Obviously both cases are a desaster:
A) We all know how buggy Microsoft's final software is, I can't imagine how someone can use their beta patches in a critical desaster.

B) Telling the government about security issues first and delaying patches for the general public is bound to cause an uproar. They are already quite slow when it comes to releasing patches.

This just sounds like a very bad decision either way...

Could 0wned admins sue MS?

[fuzzy12345]

I've wondered about the legality of such behaviour. At the point where a company knows its product has a vulnerability, has a fix for that vulnerability, and deliberately withholds the fix from customers, knowing that some of them are likely to be hacked and suffer losses, is it not negligent?

This would likely vary from jurisdiction to jurisdiction. Anyone got an amateur/professional legal opinion?

Re:Yet another attempt to fight off impending doom

[drooling-dog]

And I'm sorry if you have ego issues with the Air Force having a higher priority than your entertainment center.

You're assuming that anyone is going to enjoy greater security by delaying patches to most other users. I have to question this. And never mind about "entertainment centers"; what about the systems that process your credit cards or medical records?

The US Taxpayer will pay...

[awfar]

for patches that don't work, work properly, or goes "boing."

for doing Microsoft's work of verifying stability...

No small amount at Government charge-out rates, at some factor higher than "normal" copnstractor rates. Imagine the thousands of Gov. admins spending their time, your dollar, to do MS's work, for what they charge the Gov., us, a premium.

And I happen to be OK with Microsoft...

Natural evolution of thought

[RhettLivingston]

First everybody (really, mostly IT professionals trying to balance benefit of patching versus risk and cost of patching) berated Microsoft for releasing patches too often. So, Microsoft responds and releases them once a month. OF COURSE that means they are holding onto patches for up to a month. The number of ignorant posts here that seem to think that this is an announcement that they are going to START delaying patches is just unbelievable. The industry already made them do that.

This is just the natural next step in the social evolution of the situation. Now we've got the users who have a different benefit/risk equation demanding release of patches as soon as they are available. Its just the Air Force now, but it will eventually become a selectable option so that we can all choose our own poison.

Personally, I've never had a problem with applying a Microsoft patch despite having 100s of applications on my machines including several large suites and a large proportion of open source. The problems seem to come mostly to people using low quality drivers or applications from a few companies that have questionable SW design practices like replacing core DLLs. I'd like the Air Force's option and suspect I'll eventually get it.

Odd... WE don't have a problem :)

[DoofusOfDeath]

Hmmm...

My government computer runs Debian, and I don't recall having ANY problems like this :)

Actually, now that I think about it, I *did* need to train my spam filter to discard our security team's "Microsoft virus alert" messages ;)

delays

[Jesus IS the Devil]

The real deal isn't that they're offering these updates to the government first, but rather, that they're DELAYING it from everyone else.

This makes no sense, since a patch is a patch. Sure M$ might earn some brownie points from the government entities that get this priority, but the resulting backlash from everyone else will be worse.

Doublethink

[Doc Ruby]

How can MS possibly justify holding back the patches to anyone? What does letting the rest of the world twist in the wind gain them, or even the government? This is obviously a ploy to gain favor with some stupid bureaucrats who can't tell that this adds absolutely no security to anyone. Because its realities have no other possible redeeming value, and a great deal of cost.

The Chinese were right!

[jfb3]

This just plays right into the hands of the Chinese goverment who always said that Microsoft made special provisions for the US gov't in Windows.

This means either one of two things

[JeffTL]

Either Microsoft has been withholding patches from their paying customers and has decided to let a small segment (the federal government) go ahead and have them once they're ready, or they're foisting incomplete and buggy code onto the government, including the IRS.

If you get audited this year, blame Microsoft.

My first thought

[einhverfr]

My initial reaction to this was that it must have something to do with electronic warfare concerns. I.e. this is not about making the public safer, but rather about making the US military more competitive in the event of a conflict.

Imagine for example that there is a conflict with China over Taiwan--- say they decide on a naval blockade. The US military could have a full month of inside knowledge regarding Windows vulnerabilities that they could try to use in an electronic warfare environment.

THis move will do nothing except drive more governments around the world to Linux and open soruce. Thank you Microsoft :-D

Makes Sense to Me.

[MoronBob]

1. New patch is announced. 2. 14 months later govt worker checks for new patches. 3. submits form asking for approval to patch systems with new patch. 4. 28 months later receives approval letter authorizing patch installation. 5. goes on vacation. 6. comes back and puts it on his list. 7. 11 months later begins patch installation. Public has now had patch installed for 3.5 years.