Microsoft Releases Eight Security Updates

Phew! by teiresias · 2005-04-13 02:19 · Score: 4, Funny

Phew and here I was thinking hell had frozen over in March and Microsoft wouldn't have any new security updates. Thanks for reassuring me Microsoft. You had me nervous.

--
-Teiresias

Re:Phew! by Ubergrendle · 2005-04-13 02:38 · Score: 2, Insightful

Its not called "March Madness" for nothing! :)

I would be interested to compare how many operating systems updates were released for Solaris, AIX, HP-UX, and Linux over the past two months... without getting into an argument over impact/criticality, I'm willing to bet there's been more than 8 fixes for each of those OSes in that timeframe.

--
John Maynard Keynes: "When the facts change, I change my mind. What do you do?"
Re:Phew! by fostware · 2005-04-13 02:59 · Score: 2, Insightful

I don't think a real comparison will even come though...

There is *one* OS exploit here.
The others exploits target Exchange and Internet Explorer
It becomes so much harder when you try to look at Linux, GNU utils, and then the FOSS services and applications.
(and then you've got distribution specific exploits)

The closest realistic comparison I can get, is to ask those not-so-desirable aquaintences, which one's are faster and easier to exploit. Everybody else has agendas or ties to one party or another, as it affects their income.

--
"We know what happens to people who stay in the middle of the road. They get run over." - Aneurin Bevan
Re:Phew! by Anonymous Coward · 2005-04-13 03:10 · Score: 4, Insightful

I would be interested to compare how many operating systems updates were released for Solaris, AIX, HP-UX, and Linux over the past two months...
First, you have to carefully define exactly which software is part of the operating system. Windows includes almost no software out of the box, so security problems in widely-used Windows programs aren't considered to be OS vulnerabilities. On the other hand, Linux distributions tend to install lots and lots of extra software in addition to the base OS, and a vulnerability in any one of these extra packages is reported as a vulnerability in the distribution. For example, Debian had 11 security advisories for March 2005 (see http://www.debian.org/security/2005/), but none of them (with the possible exception of netkit-telnet and netkit-telnet-ssl) can really be considered problems with the OS. So you can't just compare the number of reported security problems in each OS, because the two numbers have vastly different scope.
Re:Phew! by Laura_DilDio · 2005-04-13 04:10 · Score: 5, Funny

No, this just evidence that Microsoft takes security seriously -- more seriously, in fact, than that pinko-commie-bastard operating system you all feel so drawn towards.

Also, I'll have you pigs know that I'm leaving my duties at the Yankee Group. I've accepted a position serving Lord William at Microsoft. I'm to be his new Groom of the Stool

Love,
Laura
Re:Phew! by Anonymous Coward · 2005-04-13 04:37 · Score: 0

Sun Solaris 9 looks to have 17 patches available although this does include applications for Solaris 9 too. I didn't check for security vs. bug problems to narrow it down even more so the list of critical security is probably pretty small.

Jim
Re:Phew! by Anonymous Coward · 2005-04-13 06:39 · Score: 0

yeah.. it would ruin our "frequent Linux patches good - frequent MS patches bad" mantra ;-)
Re:Phew! by Anonymous Coward · 2005-04-13 06:46 · Score: 1, Insightful

First, you have to carefully define exactly which software is part of the operating system. Windows includes almost no software out of the box, so security problems in widely-used Windows programs aren't considered to be OS vulnerabilities.

well, even the Slashdot blurb clearly lists many applications as included in this MS fixlist even if you debate the browser status (Word, Exchange, MSN Messenger (separate download app, != Windows Messenger)). Of the critical ones actually only one is OS (TCP/IP), two if you count IE.
Re:Phew! by BrainSurgeon · 2005-04-13 06:56 · Score: 3, Insightful

We all know that they have had their issues with security in the past. But over the last three years they have taken some great strides to improve it.

I applaud them for doing their own proactive penetration testing on their software, as well as enlisting the help third-party companies to do the same. This is far better than the "we'll see what happens" approach of years past. By doing this proactive approach it cuts down on zero-day exploits (granted their still will be a few), teaches them to learn from their mistakes and well as provide the education to the software dev community on those mistakes.

So, instead of ranting and complaining about these patches, I think people should take a moment to reflect and see the bigger picture of what's being accomplished here.

--
"It's not rocket science, Smithers! It's only brain surgery!" --Mr. Burns
Re:Phew! by BrainSurgeon · 2005-04-13 08:28 · Score: 1

Just remember not to shake Laura's hand.

As for the security part, I totally agree. It's clear to see that MS would rather take a hit now and invest the time to make their software more secure then to continue to string consumers along.

--
"It's not rocket science, Smithers! It's only brain surgery!" --Mr. Burns

yep - move on by nighty5 · 2005-04-13 02:20 · Score: 4, Insightful

This is not the first time when there was something to fix at Shell32.dll

yep, and like every operating system - it won't be the last...

Re:yep - move on by mikaelhg · 2005-04-13 03:08 · Score: 0, Flamebait

This is not the first time when there was something to fix at Shell32.dll

yep, and like every operating system - it won't be the last...

Hitler did some bad things - but don't we all from time to time?

Wait, you're saying this argument is fallacious?
Re:yep - move on by Anonymous Coward · 2005-04-13 04:08 · Score: 0

Hm, my MacOS X box has never had a security hole in Shell32.dll.
Re:yep - move on by Anonymous Coward · 2005-04-13 04:49 · Score: 0

Who said it was an argument? And for what?
Re:yep - move on by quarkscat · 2005-04-13 05:18 · Score: 1

Yet another coat of shellac on the electro-gold-
plated turd that is MSFT's OS. Time to pay another
visit to MSFT's update website. It's a damn good
thing that MSFT doesn't (yet) charge for these
security updates, because they aren't getting
another plugged nickel from me. (I'm saving my
seat cushion change for a really secure OS I heard
about, called "LINUSX".)

Slightly OT, but I wonder exactly which TCO study
accounted for the constant "patch/clean/patch"
cycle that is MSFT's "security" paradigm. My anti-
virus software used to be updated weekly, but now
it seems like 4 - 5 times per week. That, my friends,
is a whole lot of scanning...
Re:yep - move on by m50d · 2005-04-13 07:00 · Score: 1

Am I the only one wondering why this is an accepted state of affairs? There is not *so* much code in that library, and it's very important, would it be so hard to run a few audits of it?

--
I am trolling
Re:yep - move on by Anonymous Coward · 2005-04-13 11:07 · Score: 0

Stop making all us other Mac users look bad by being a dickhead. You know what he meant.

Re:I wonder . . . by elid · 2005-04-13 02:20 · Score: 1

Huh? These are patches, not new features being added.

Woohoo! by djinn2020 · 2005-04-13 02:20 · Score: 4, Funny

Yay, Microsoft Windows XP is now completely invulnerable

Thanks, Bill.

--
Mens et Manus

Re:Woohoo! by LurkerXXX · 2005-04-13 02:29 · Score: 4, Insightful

Are you trying to say whatever OS you use is?
Right.
Every OS releases security patches. MS might need more than others, but the ALL need them.
Security is a process, not an endpoint.
Re:Woohoo! by 0x461FAB0BD7D2 · 2005-04-13 02:32 · Score: 5, Funny

Contrarily, a punchline is an endpoint, and not a process.
Re:Woohoo! by Anonymous Coward · 2005-04-13 02:48 · Score: 0

Maybe he uses VMS. Yeah, I'd like to see you try to hack it.
Re:Woohoo! by Plaid+Phantom · 2005-04-13 02:55 · Score: 2, Funny

I think of it as more of a process: 1. Joke 2. Punchline 3. ????? 4. Profit!

--
All comments are properties and trademarks of the voices in my head. Not like I'm gonna claim them.
Re:Woohoo! by Anonymous Coward · 2005-04-13 03:19 · Score: 1, Funny

What if security does reach an endpoint one day?

"Well, that takes care of that. What do you guys want to do for work now?"

"Uhm... Chef?"
Re:Woohoo! by Anonymous Coward · 2005-04-13 03:28 · Score: 0

Yay, Microsoft Windows XP is now completely invulnerable

Correction:
Yay, Microsoft Windows XP is now completely invulnerable until the next update.
Re:Woohoo! by Anonymous Coward · 2005-04-13 07:30 · Score: 0

"Every OS releases security patches. MS might need more than others, but the ALL need them."

OK, so rewrite it as "8 more security holes discovered, which have been present since the release of the OS. Millions of customers have been vulnerable all this time. Many will continue to be vulnerable to these newly-discovered errors"

Not every OS needs kernel updates to fix security problems. Some do the right thing, and publish systems which are secure (don't do anything unexpected, don't have bugs in a piece of software that you know that millions of people will install and depend-upon for their computer-security)

More updates by nenolod · 2005-04-13 02:21 · Score: 5, Insightful

And yet they are less vague than the ones which have recently come out of OpenBSD. That's scary.

Re:More updates by Anonymous Coward · 2005-04-13 04:32 · Score: 0

Sure, but there are two very important differences:

1) All the MSFT vulnerabilities were reported, if not fixed, by 3rd party researchers. Not sure how much of this is true in the case of the OpenBSD errata you linked to, but I would hazard a guess the the OpenBSD team found most of the vulnerabilities themselves (rigorous code auditing and all).

2) The source code for the patch is linked right next to the vulnerability description! What more could you want? I don't think there could be a more specific "description" of the vulnerability. You've got the freely available original source code and the patch. Pretty exact, if you ask me.
Re:More updates by Anonymous Coward · 2005-04-13 06:49 · Score: 0

MS have technical and non-technical versions of their security bulletins. Are you reading the right one?

In any case, they don't *need* to give full details. All you need to know is that it's fixed.
Re:More updates by nenolod · 2005-04-14 01:39 · Score: 1

1) All the MSFT vulnerabilities were reported, if not fixed, by 3rd party researchers. Not sure how much of this is true in the case of the OpenBSD errata you linked to, but I would hazard a guess the the OpenBSD team found most of the vulnerabilities themselves (rigorous code auditing and all).

Incorrect, most OpenBSD vulnerabilities are found in other operating systems and reported to OpenBSD by CERT.

2) The source code for the patch is linked right next to the vulnerability description! What more could you want? I don't think there could be a more specific "description" of the vulnerability. You've got the freely available original source code and the patch. Pretty exact, if you ask me.

The latest patch against tcp(4) is vague and non-specific.

WS2K3 SP1 by koh · 2005-04-13 02:21 · Score: 4, Informative

Windows Server 2003 SP1 is also available. Apparently it's a kind of XP SP2 but for Server 2003. With the firewall, security center, IE "enhanced security", spyware removal tool that doesn't run, etc.

I just hope it doesn't break as many apps...

--
Karma cannot be described by words alone.

Re:WS2K3 SP1 by TripMaster+Monkey · 2005-04-13 02:24 · Score: 1

I just hope it doesn't break as many apps...

I hear that...I'n in the unenviable position of testing this SP to see if it works or not...has anyone had any negative experiences with this Service Pack? Any feedback would be greatly appreciated.

Thanks,

--
____
~ |rip/\/\aster /\/\onkey
Re:WS2K3 SP1 by LurkerXXX · 2005-04-13 02:31 · Score: 2, Informative

Read up on bugtrack. Apparently Dell OpenManage software has bad issues with it (fixed in version 4.4 that they *just* released, if I recall)
Re:WS2K3 SP1 by Kimos · 2005-04-13 02:33 · Score: 5, Informative

I've been applying 2k3 SP1 to servers at my office all week. MS did a good job of designing the patch so that it adds lots of security lockdowns without limiting applications. They add the firewall but it defaults to off for upgrades. The only part that seems scary is the stronger authentication for DCOM. It's secure, but has potential to break some apps. Details on SP1 here.

Five servers so far, and all of them have worked after the update. I'm far from a MS fan, but I have no problem admitting when they've done a good job...
Re:WS2K3 SP1 by koh · 2005-04-13 02:36 · Score: 4, Informative

After 1 day of use :

IIS (HTTP, FTP) works (after tweaking the firewall of course), at least for the minimal use I have of it.

Exceed works too after registering it with the firewall.

IE's "enhanced security" makes it _really_ paranoid, but I use it only for updates so I couldn't care less (had to add Office Update to the trusted sites though).

IMHO the real thing here is to check how in-house developped server components will behave under SP1... since we don't have that many customers using it, bug reports won't come until a few weeks I hope.

--
Karma cannot be described by words alone.
Re:WS2K3 SP1 by Reducer2001 · 2005-04-13 02:43 · Score: 1

IE's "enhanced security" makes it _really_ paranoid, but I use it only for updates so I couldn't care less (had to add Office Update to the trusted sites though).
Isn't this what the Slashdot crowd wanted?

--
When you get to hell -- tell 'em Itchy sent ya!
Re:WS2K3 SP1 by ookaze · 2005-04-13 02:55 · Score: 4, Interesting

Five servers so far, and all of them have worked after the update. I'm far from a MS fan, but I have no problem admitting when they've done a good job.

The scary thing is that this fact is worthy of a post, and is informative.
Patches that do not break anything should be the rule, not the exception.
Re:WS2K3 SP1 by arete · 2005-04-13 03:06 · Score: 5, Insightful

You misunderstood. /. wants everything. Especially because different people want different things...)

They quite literally want to build a automatic cake making machine so they can have lots of cake while they're eating their cake : )

They want a blindingly fast machine with a 90 inch display that fits on their keychain and uses no power. They want this machine to be completely secure while allowing random applications to do whatever necessary to squeeze their hardware. They want it to use an OS that is unpopular enough instill geek pride but is somehow the primary development platform of all cool games.

Oh, and it should be Free as in speech, Free as in beer, and produced by a trusted public company that somehow makes money off this without doing anything that would make them unloved.

And they want cute little penguins to somehow get them laid by actual women, generally without them having to go anywhere they might actually meet women.

I'm not saying any of these individual goals are bad ideas, I'm just saying you can't always have everything you want.

(Incidentally, I'm in favor of really paranoid IE settings, but since by using it you're implicitly trusting MS, the Office update site could probably have been automatically added to that list. I think that's why the gp noted it.)

--
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
Re:WS2K3 SP1 by IdleTime · 2005-04-13 03:15 · Score: 1, Redundant

Mod-points? Mod-points?? Oh, Mod-points! Where areth thou in the hour of need?

--
If you mod me down, I *will* introduce you to my sister!
Re:WS2K3 SP1 by 4of12 · 2005-04-13 03:21 · Score: 1

The scary thing is that this fact is worthy of a post, and is informative. Patches that do not break anything should be the rule, not the exception.

You'd think. You'd hope. But it's not to be.

Realistically, there are too many nonlinear interactions between the universe of Windows applications and the OS for even Microsoft, with all its resources, to test exhaustively. [I know, clean interface design would cure or substantially reduce those side effects, but there's too much water under the bridge now.]

That's why there's outfits that specifically try to pull apart and find out what happenned each month that Patch Tuesday occurs.

--
"Provided by the management for your protection."
Re:WS2K3 SP1 by arete · 2005-04-13 03:22 · Score: 4, Funny

(to the parent - not the gp, who is me : )

if it were up to me, I'd mod up your post before mine - that was witty AND concise.

Naturally, I try to write something funny, and I get insightful. The only time I can remember getting a funny mod was when I complained about only getting insightful mods - like this - which is a pretty perfect example of something that shouldn't be modded funny, so it was one of my least deserving moments.

*sigh*

What's worse is I was proud of it anyway ; )

--
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
Re:WS2K3 SP1 by mopslik · 2005-04-13 03:28 · Score: 5, Funny

They want a blindingly fast machine with a 90 inch display that fits on their keychain and uses no power.

Now that's not true at all. I want my machine to generate power, which I can then use to run the cake machine.
Re:WS2K3 SP1 by jacksonj04 · 2005-04-13 03:32 · Score: 1

It plays merry hell with any kind of shared networking (Bridges, ICS etc.) which prompted me to go out and buy a load of networking kit to just bypass the domain controller.

Aside from that, it seems fairly solid. I haven't noticed anything abruptly stop working.

On a side note - the Security Wizard it ships with is a load of balls, touch it not!

--
How many people can read hex if only you and dead people can read hex?
Re:WS2K3 SP1 by koh · 2005-04-13 03:33 · Score: 4, Informative

(Incidentally, I'm in favor of really paranoid IE settings, but since by using it you're implicitly trusting MS, the Office update site could probably have been automatically added to that list. I think that's why the gp noted it.)

Indeed.

Amusingly, I tried the Acid2 Test on IE with "enhanced security" turned on and it warned me the page may not render correctly because it "required an ActiveX control" that "was being blocked".

An ActiveX control ? On the Acid test page ? Turns out the page contains 3 <object> tags used to check cascaded content... Of course we all know an <object> tag always is an ActiveX control, do we ?

That's what I meant by "paranoid" :)

--
Karma cannot be described by words alone.
Re:WS2K3 SP1 by DJStealth · 2005-04-13 03:40 · Score: 1

SP1 has been out for about a month. What's news is that there were a few Updates ontop of SP1 released yesterday.
Re:WS2K3 SP1 by andreMA · 2005-04-13 03:41 · Score: 1, Funny

They want a blindingly fast machine with a 90 inch display that fits on their keychain and uses no power. They want this machine to be completely secure while allowing random applications to do whatever necessary to squeeze their hardware. They want it to use an OS that is unpopular enough instill geek pride but is somehow the primary development platform of all cool games.
Oh, and it should be Free as in speech, Free as in beer, and produced by a trusted public company that somehow makes money off this without doing anything that would make them unloved.
And they want cute little penguins to somehow get them laid by actual women, generally without them having to go anywhere they might actually meet women.

And a pony. I can't believe you forgot the pony.
Re:WS2K3 SP1 by bonk · 2005-04-13 03:47 · Score: 1

Not just a pony. A beowulf cluster of ponies.

--
I hope to die peacefully in my sleep like grandpa, not screaming like his passengers.
Re:WS2K3 SP1 by vadim_t · 2005-04-13 03:53 · Score: 1

Bah, what modpoints?

Grandparent is just yet another guy who can't seem to understand the concept of 'lots of different people post on slashdot'. You know, some people want everything to be tiny, others want everything to be GPLd, etc. Of course if you put all of that together you get insane requirements.
Re:WS2K3 SP1 by Short+Circuit · 2005-04-13 04:03 · Score: 0

And they want cute little penguins to somehow get them laid by actual women, generally without them having to go anywhere they might actually meet women.

Forget the rest of it. I'll settle for this one. :)

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:WS2K3 SP1 by Isao · 2005-04-13 04:09 · Score: 1

Now that's not true at all. I want my machine to generate power, which I can then use to run the cake machine.
And the cake machine needs to assemble itself. Preferrably from other cakes.
Re:WS2K3 SP1 by Anonymous Coward · 2005-04-13 04:14 · Score: 0

The wonderful thing about ponies is that as herd animals, they are self-clustering
Re:WS2K3 SP1 by Anonymous Coward · 2005-04-13 04:20 · Score: 0

However-- SP1 for Windows Small Business Server 2003 is not yet available. Don't install the Server 2003 SP1 on SBS 2003, even though it will let you.
Re:WS2K3 SP1 by WhiplashII · 2005-04-13 04:20 · Score: 1

Hm. So you seem to be saying that it is impossible for Microsoft to accomplish the job that "outfits that specifically try to pull apart and find out what happenned" can do without even seeing any code?

Interesting.

--
while (sig==sig) sig=!sig;
Re:WS2K3 SP1 by kmeister62 · 2005-04-13 04:32 · Score: 1

I had al sorts of problems with AD replication that this SP seems to have fixed.
Re:WS2K3 SP1 by masklinn · 2005-04-13 04:33 · Score: 1

It actually is, under MSIE at least. doesn't have any kind of native implementation in MSIE, it's always emulated through ActiveX...
(yes, that is stupid, and nonetheless how it works... or fails)

--
"The way we can tell it's C# instead of Haskell is because it's nine lines instead of two." -- wadler
Re:WS2K3 SP1 by 4of12 · 2005-04-13 04:40 · Score: 1

So you seem to be saying that it is impossible for Microsoft to accomplish the job

The complete job, yes.

Specific jobs for specific applications and environments, then, yes, MS could easily do it. I stand corrected.

They probably would do it if made business sense for them to do this kind of niche work. Since they're always looking for ways to grow their business, maybe some day they'll do it - but probably by just buying out one or more of the little outfits.

--
"Provided by the management for your protection."
Re:WS2K3 SP1 by NatasRevol · 2005-04-13 04:44 · Score: 1

Now that's not true at all. I want my machine to generate power, which I can then use to run the cake machine.

And the cake machine needs to assemble itself. Preferrably from other cakes.

Keep your hands off my cakes!!

--
There are two types of people in the world: Those who crave closure
Re:WS2K3 SP1 by Anonymous Coward · 2005-04-13 04:46 · Score: 0

No time to log in. It has been quite some time since I posted to Slashdot.

Firefox does not render this page correctly either. It doesn't seem to have the somewhat fatal error that IE does, but nonetheless both do not look like the reference render.
Re:WS2K3 SP1 by geekoid · 2005-04-13 06:53 · Score: 1

But it was funny to mod it as funny.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:WS2K3 SP1 by Marwin · 2005-04-13 09:27 · Score: 1

I'd say your post was funny AND had a good point, i don't see that your post have to be put into one category alone...that's my few cents anyway!

Have a nice day/night!
Re:WS2K3 SP1 by cob666 · 2005-04-13 11:04 · Score: 1

Patches that do not break anything should be the rule, not the exception.

I generally have pretty good luck installing service packs from Microsoft and I find that in MOST cases, when an application doesn't function properly after the installation of said service pack, it's because the application either isn't doing something properly or it's an obscure application that wasn't tested against the service pack.

Two Instances:

1 - Quickbooks (several versions ago). You must be administrator to run this application and all the forms were using the IE engine to display. MS release an SP that bumped up the security on IE and caused most of the Quickbooks forms to not display properly. It took Intuit a couple of weeks to get a fix out.

2 - The Master Genealogist (Obscure but INCREDIBLE Genealogy Program). When this product went from 16 to 32 bit it was released RIGHT after an MS service pack and some of the database functionality didn't work properly. The developers at Wholly Genes had the problem fixed within 24 hours.

My point is that most of the problems with MS service packs are caused by poorly written applications. And yes, I will concede that some of those poorly written programs may actually be Microsoft products!

--
Do what thou wilt shall be the whole of the Law - Aleister Crowley

Re:I wonder . . . by Anonymous Coward · 2005-04-13 02:23 · Score: 5, Funny

Huh? These are patches, not new features being added.

Technically, they are feautures being removed. Microsoft should pay us to install them. :(

Unscientific Results So Far... by ScentCone · 2005-04-13 02:23 · Score: 4, Informative

I've applied these to about 15 servers this morning - boxes running IIS, SQL, Exchange, and so far nothing has blown up. What really gets me is the bandwidth they must be putting into the distribution. The 8 or so MB that the servers are downloading is coming across much more quickly than I've seen it in the past. Could just be an abberation, but usually the feeding frenzy is pretty intense.

--
Don't disappoint your bird dog. Go to the range.

Re:Unscientific Results So Far... by Leadhyena · 2005-04-13 02:33 · Score: 1

I imagine a lot of businesses either have a central server that downloads the patch or have automatic updates set up at different times so that the load on their internet servers is load-balanced, especially with Microsoft suggesting Automatic Updates for everyone. This'd mean that the pull on the servers would be more load-balanced than normal.
Either that or Microsoft forcing everyone on SP2 last month has stopped a lot of people from updating.
Re:Unscientific Results So Far... by Anonymous Coward · 2005-04-13 02:35 · Score: 1, Funny

your the only person brave enough to download them
Re:Unscientific Results So Far... by Anonymous Coward · 2005-04-13 02:41 · Score: 0

I bet you downloaded the 6 updates (7 MB on my machine) 15 times. Ah, if only Microsoft could learn...
Re:Unscientific Results So Far... by ScentCone · 2005-04-13 02:45 · Score: 1

I bet you downloaded the 6 updates (7 MB on my machine) 15 times

Thanks for that vote of confidence in my admin skills. These were 15 machines on 15 different networks under 15 different security and access models, so it's a little academic. Did it all remotely, of course, so it's not like I could run around with a CD or do something on a network share. If this was a major SP, I'd have approached it differently.

FWIW, I do have to visit another datacenter tonight, and hit a dozen machines on the same LAN. Different situation, there, but for me more the exception than the rule.

--
Don't disappoint your bird dog. Go to the range.
Re:Unscientific Results So Far... by aspx · 2005-04-13 02:49 · Score: 1

There are far fewer users of Windows Server 2003 than Windows XP. That's why the download is so fast.
Re:Unscientific Results So Far... by LurkerXXX · 2005-04-13 03:13 · Score: 1

You mean like:
http://www.microsoft.com/technet/security/prodtech /sus/secmod198.mspx
or
http://www.microsoft.com/windowsserversystem/updat eservices/default.mspx
Re:Unscientific Results So Far... by Amoeba · 2005-04-13 05:13 · Score: 1

The 8 or so MB that the servers are downloading is coming across much more quickly than I've seen it in the past. Could just be an abberation, but usually the feeding frenzy is pretty intense.
Probably because there is a brand new cluster of like 48 update servers that were deployed for SP2 late last year (in one datacenter alone) that have been recommissioned for general windows updates. Additionally, they upgraded the network infrastructure a tad as well (better border routers, streamlined some BGP etc.)
I would know since I racked, stacked, and imaged the damned things when I was still at MS. However, now that I'm at Sun I don't care about being all secretive.
(note to ms-attack lawyers: None of the contents of this post have enough specific detail for you to sue me for NDA breach. Nyah Nyah! Eat it!)

--
Do not taunt Happy-Fun Ball
Re:Unscientific Results So Far... by drsmithy · 2005-04-13 11:45 · Score: 1

Ah, if only Microsoft could learn...
Something like this, or this, you mean ? Or maybe this, or one of these ?

maybe it's me ... by icebrrrg · 2005-04-13 02:24 · Score: 5, Interesting

... but after using the "windows update" utility in XP and 2000/2003 server for some time, and being a newbie to fedora (new servers in my home lab), i find the MS utilities muuuuuch easier to use than the fedora update manager. once i say no to an update, that choice stays "no" ... i have to always say no to unwanted updates in fedora (even tho they're on my ignore list). am i a feeble n00b, or could the linux distros learn a thing or two from MSFT?

--
nothing worth possessing isn't possessed. or something.

Re:maybe it's me ... by Byzantine · 2005-04-13 02:33 · Score: 1

Out of curiousity, why are you saying no to an update? I am given to understand (I'm operating mostly on hearsay; I haven't owned or had control of a box running Windows since just after WinXP came out) that some Windows updates (SP2 in particular) broke some poorly-designed applications. However, I've never heard much about updates breaking Linux apps.
Re:maybe it's me ... by Short+Circuit · 2005-04-13 02:41 · Score: 1

There was one time, years ago, when an update to Debian/unstable's Perl packages led to a version mismatch between the Perl binaries and the modules that Perl apps depended on. The end result was that anything that depended on Perl broke, including Debian's package management process.

IIRC, that was one of the few times I had to reinstall Debian from scratch due to not knowing how to fix the problem. (In hindsight, dropping a fresh version of perl into /usr/local probably would have let me update to the fixed packages.)

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:maybe it's me ... by NetNifty · 2005-04-13 02:41 · Score: 1

Only problem I have with updates in windows is that if you choose to "Restart later" after installing the updates, it will pop up every 15 mins or so asking if you want to restart now (as well as having a yellow shield in the task bar). Not much of a big deal, just irritating when you know you'll restart the machine later anyway so theres no point in restarting it now.

--
Linux Wireless Hardware in the UK
Re:maybe it's me ... by tehshen · 2005-04-13 02:42 · Score: 2, Informative

If you want the red flashing ! thing on the panel to go away, right click -> Configuration -> remove from panel. Then you can do yum updates when you want without being distracted.

I've found that with the update manager you always have to say yes to wanted updates, not no to unwanted ones. The ignore list seems to not do anything, though.

--
Guy asked me for a quarter for a cup of coffee. So I bit him.
Re:maybe it's me ... by LnxAddct · 2005-04-13 02:46 · Score: 5, Informative

Keep in mind that the Fedora update utility is updating up to 10,000 applications, not just core system software like MS's update utility, so expect some increased complexity (although once you set up your ignore list, its usually just as easy as clicking "select all", click next, click next, all done and updated). Using the ignore funtionality works great for me under FC3 so I'm not too sure what you are referring to as far as problems go. Maybe if you supply more information someone can help you, or go to #fedora on irc.freenode.net and someone there is always willing to help. On a side note, if you are a noob you most likely dont want to be disabling any updates. Fedora by default puts new kernels on your ignore list but other then that, updating is usually a good thing (If you used something like debian testing or unstable prior to fedora I can see the basis for your paranoia as I still have one server left running debian testing and updating breaks it monthly at a minimum, but the situation is completely different in fedora and I have yet to see anything similar happen).
Regards,
Steve
Re:maybe it's me ... by Short+Circuit · 2005-04-13 02:46 · Score: 1

Dunno how to do it in Fedora, but in Debian you mark the package as "held" in aptitude, dselect, kpackage, or synaptic.

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:maybe it's me ... by tehshen · 2005-04-13 02:46 · Score: 1

Well it does have a point - if the updates you've just installed don't work or break your system in some way, it's best to find that out sooner rather than later when you've no time to fix them.

The Red Hat update manager mentions this, but doesn't enforce it: "Hey, you just installed a new kernel! Please try it out to see if it works!".

--
Guy asked me for a quarter for a cup of coffee. So I bit him.
Re:maybe it's me ... by Anonymous Coward · 2005-04-13 02:47 · Score: 1, Interesting

That's a bad thing, isn't it? If you say no to a 20MB download because you are on dialup, and when you get home and plug into your broadband, the right thing to do would be to ask you again, wouldn't it?

Not honouring something you have specifically chosen to ignore sounds like a bug though.
Re:maybe it's me ... by ostiguy · 2005-04-13 02:48 · Score: 1

There have been some patches were if you do not reboot immediately, the box will start behaving erratically at best. This can occur because some files are immediately replaced, and others queued for later replacement as they are locked open.

ostiguy
Re:maybe it's me ... by B3ryllium · 2005-04-13 02:51 · Score: 1

I've never seen that before.
Re:maybe it's me ... by NetNifty · 2005-04-13 02:51 · Score: 1

Oh yeah it definatly has a point, but it kind of loses it's point after the fifth or sixth time it's came up, especially when it's a patch for WMP (why does it need to restart anyway? It should just be an isolated application). Anyway on the bright side my XP SP2 machine hasn't asked me to restart yet!

--
Linux Wireless Hardware in the UK
Re:maybe it's me ... by foobsr · 2005-04-13 02:51 · Score: 1

However, I've never heard much about updates breaking Linux apps.

Hmm, "apt-get" or "emerge" are good candidates; also, I recall difficulties (e.g.) moving from 2.4 to 2.6. Or is this just me?

CC.

--
TaijiQuan (Huang, 5 loosenings)
Re:maybe it's me ... by NetNifty · 2005-04-13 02:53 · Score: 2, Funny

"Anyway on the bright side my XP SP2 machine hasn't asked me to restart yet!"

Ok it JUST popped up after I typed that for the first time. Spooky.

--
Linux Wireless Hardware in the UK
Re:maybe it's me ... by Anonymous Coward · 2005-04-13 02:56 · Score: 0

And that, kids, is why you don't run unstable even if 90% of the time it is stable, it just keeps on changing all the time.
Re:maybe it's me ... by Alan · 2005-04-13 02:59 · Score: 1

More annoying than that is that if you just leave it (say, overnight), it'll helpfully reboot for you anyway! Isn't that a nice thing that they do? No idea how it deals with unsaved documents or whatnot, but I know it plays havoc on servers when this happens on w2k3 if you're not expecting it (more from the admin side than the actual server, generally admins don't expect their servers to randomly reboot without being explicitly told to, and no, I wasn't the admin :)
Re:maybe it's me ... by Tim+C · 2005-04-13 03:00 · Score: 1

Updating from libc5 to glibc broke a few things for me, too (and yes, I am going back a few years now...)

--
It's official. Most of you are morons.
Re:maybe it's me ... by Alan · 2005-04-13 03:02 · Score: 1

But debian unstable doesn't (afaik) have a flashing 'update me now' button. This is something restricted to the more user-oriented (redhat, suse, etc) distros.
Re:maybe it's me ... by Byzantine · 2005-04-13 03:05 · Score: 1

Having used three distributions which use apt-get, (Debian, Libranet, and Ubuntu, for the record) I can say that only once did I run into a problem updating--and then it was my fault, because I had inadvertantly mixed stable and unstable repositories. Though I'm not quite sure what you're trying to say as neither apt-get nor emerge are actual updates; they're the update managers, analogous to the Windows Update site.

As for 2.4 to 2.6, that's an incorrect comparison. These updates (and Windows Updates in general) are like moving from 2.4 to 2.4.1; 2.4 to 2.6 is like moving from Win2K to WinXP.
Re:maybe it's me ... by TripMaster+Monkey · 2005-04-13 03:06 · Score: 1

...some Windows updates (SP2 in particular) broke some poorly-designed applications.

Windows SP2 will break WinFax host sharing, since the mechanism uses anonymous calls to DCOM, which is no longer allowed.

--
____
~ |rip/\/\aster /\/\onkey
Re:maybe it's me ... by TripMaster+Monkey · 2005-04-13 03:10 · Score: 1

Yeah, I install the new kernels when they come out...just got 2.6.11-1.14_FC3, and now I have to reinstall NTFS support :(

--
____
~ |rip/\/\aster /\/\onkey
Re:maybe it's me ... by bogado · 2005-04-13 03:24 · Score: 1

Kernel modules and kernel bundling and updates are one thing that I don't like in fedora. Also I think the grand-parent meant that if you add a package to ignore list in the applet, this action does not appear in the system-wide ignore list fo updates.

--
[]'s Victor Bogado da Silva Lins
^[:wq
Re:maybe it's me ... by Short+Circuit · 2005-04-13 03:30 · Score: 1

And that, kids, is why you don't run unstable even if 90% of the time it is stable, it just keeps on changing all the time.

Oh, please. I've been running Debian for six years, about half of that while running unstable. Only once did an otherwise normal update process hose my system. That's a damn good track record.

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:maybe it's me ... by slide-rule · 2005-04-13 04:15 · Score: 1

Maybe you should point it how it hasn't started minting $20 bills yet either...
Re:maybe it's me ... by digidave · 2005-04-13 04:21 · Score: 1

There are large swarms of people who will tell you that the Red Hat update manager is mediocre at best and that Red Hat lives on reputation alone.

Ubuntu's update manager correctly ignores packages that you have selected to not upgrade. It's much easier to use that either Red Hat's or Windows'.

--
The global economy is a great thing until you feel it locally.
Re:maybe it's me ... by swillden · 2005-04-13 04:28 · Score: 1

If you used something like debian testing or unstable prior to fedora I can see the basis for your paranoia as I still have one server left running debian testing and updating breaks it monthly at a minimum
What are you running that breaks? I have four machines running unstable and two running testing and it's been over two years since the last time an unstable update broke anything (that was an update that broke XFree86 on unstable) and I've never had a testing update break anything.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:maybe it's me ... by GNUALMAFUERTE · 2005-04-13 04:35 · Score: 1

GNU/Linux is UNIX. It's a real operating system, not a toy OS like micro$oft's one. Unix doesn't need automated update tools, it needs a qualified sysadmin. If you are not, hire one.

--
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Re:maybe it's me ... by stratjakt · 2005-04-13 04:35 · Score: 1

It wont reboot if you have anything running, or if there has been keyboard or mouse activity in the last XX minutes (can't remember the timeframe).

As for the parent, you can choose "remind me tomorrow", and it won't prompt every 15 minutes.

--
I don't need no instructions to know how to rock!!!!
Re:maybe it's me ... by Anonymous Coward · 2005-04-13 04:44 · Score: 0

I have to say I've never encountered this on a home machine but in a networked environment this only happens if there's a policy set up to manage it. Of course, you then have to make sure that your servers are excluded from such a policy....!
Re:maybe it's me ... by NetNifty · 2005-04-13 05:45 · Score: 1

" As for the parent, you can choose "remind me tomorrow", and it won't prompt every 15 minutes. "

I think you're thinking of something else, when it asks to reboot it only has two options - "Reboot now" and "Reboot later" (which brings up the prompt every 15 mins), at least on XP SP2 anyway.

--
Linux Wireless Hardware in the UK
Re:maybe it's me ... by PsychicX · 2005-04-13 05:49 · Score: 0

It's nice that occasionally people show up and remind us of everything that's still wrong with the Linux community. Helps us improve.
Re:maybe it's me ... by foobsr · 2005-04-13 07:46 · Score: 1

Though I'm not quite sure what you're trying to say ...

That the update managers not always worked for me as expected (I am especially considering gentoo which I installed about a year ago on an AMD64). This might have been my fault, and the same holds (of course) for Debian.

I am not so sure, however, with regard to kernel updates, but I suspect the problem here is too broad semantics of update.

CC.

P.S.: The bottom line is that I should have obeyed the imperative of my current sig.

--
TaijiQuan (Huang, 5 loosenings)
Re:maybe it's me ... by Anonymous Coward · 2005-04-13 08:28 · Score: 0

So... what a minute... I installed FC1 as my first Linux distribution. Are you saying that, since I didn't have any experience running Linux, I should have hired a sysadmin? Interesting. I don't like anything running automatically. At all. If I put a CD in, I don't want anything to happen. I don't want autorun.exe to run. I don't want iexplore.exe to be pre-loaded. However, there should be a system in place to automatically update the system's applications if and only if the user chooses to have it run automatically. Advances like these will bring Linux out of the geek-only sphere into the general public's use.
Re:maybe it's me ... by GNUALMAFUERTE · 2005-04-13 10:27 · Score: 1

First of all, it's GNU/Linux.
Second, you should download the source and compile your upgrades.

--
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Re:maybe it's me ... by snuf23 · 2005-04-13 14:57 · Score: 1

Buahahaha! Please, pretty please can you stop by the next Apple fanboy article post and liven up the discussion?
I've been so depressed since the old fashioned GNU/Linux fanatic have been surpassed in number by the legion of Jobs here on Slashdot.

--
Sometimes my arms bend back.
Re:maybe it's me ... by Toby_Tyke · 2005-04-13 15:34 · Score: 1

Out of curiousity, why are you saying no to an update?

Well, I'm running Fedora too, and I have 39 updates on my ignore list at the moment. Just to give you an example, one is kde-i18n-Icelandic. I really don't think I'm likely to need that in the near future.

--
"I realise this is not a very popular opinion but it's the truth, and there for needs to be said" -Bill Hicks

And of course.... by Killer+Instinct · 2005-04-13 02:24 · Score: 0, Troll

...now you must have a licensed registered copy on winders or else you are SOL, nice they waited until now to release them...btw...when you upgrade to the new winders update stuff, which checks to make sure you dont have a pirated/illegal copy (whatever THAT means), and you try to do it through Firefox, you have to reboot, and guess what, IE is now your default browser....

--
#include bier;

Re:And of course.... by xrobertcmx · 2005-04-13 02:27 · Score: 1

I have never managed to get update to work through Firefox at all. Time to go back and try.
Re:And of course.... by danheskett · 2005-04-13 02:34 · Score: 3, Insightful

pirated/illegal copy (whatever THAT means
What do you mean? Are you seriously saying you don't know the difference between legit software you are entitled to use, and software that you downloaded and/or cracked from various backchannel methods?

Are you for real?
Re:And of course.... by Anonymous Coward · 2005-04-13 02:34 · Score: 0, Flamebait

1) Wait until enough trojans and worms are exploiting security hole
2) Watch ISPs disconnect users that are infected and only allowing them back on after problem is fixed
3) Change updates to only work for non-pirated versions of software
4) Profit!!!
Re:And of course.... by ScentCone · 2005-04-13 02:41 · Score: 2, Insightful

or else you are SOL

That should read, "or else you are too cheap to buy your operating system, or too dumb to use one that you're allowed to license for free."

You're not SOL when you're stolen thing can't be upgraded, you're exactly where you deserve to be.

--
Don't disappoint your bird dog. Go to the range.
Re:And of course.... by Anonymous Coward · 2005-04-13 02:42 · Score: 1, Informative

As far as I know, Windows Update requires ActiveX support in the browser, so IE is the only browser that will work.

--
Jonathan the Nerd (user 98459)
(Posted anonymously because I'm using an unencrypted wireless network, and I'm not going to transmit my password in the clear.)
Re:And of course.... by Jakeypants · 2005-04-13 02:47 · Score: 1

"which checks to make sure you dont have a pirated/illegal copy (whatever THAT means)"

Uh, is it really that vague?
Re:And of course.... by Jarnis · 2005-04-13 02:50 · Score: 1

Only stupid people with broken warez copies can't update. If you know what you are doing, you can still update using Windows Update, no problem.

(I use licensed legal copies myself, but at work I get to repair all kinds of crap, including PCs with warezed OSes. Many of them are quite updateable - depends greatly on which key and which install media was used)

But yeah, MS is tightening the noose...
Re:And of course.... by Anonymous Coward · 2005-04-13 03:40 · Score: 0

And the original poster should have enough sense to realize that. I suspect they're just bitching. It's always required IE. The site makes it clear that this is the case.
Re:And of course.... by ElyseMyers · 2005-04-13 04:00 · Score: 1

Really? What issue are you encountering?? I updated mine several weeks ago with no problem. Since I've been trying to phase Microsoft out of my life as much as possible, I have a hard time keeping up w/ all of their updates, patches, etc. At least they're free -- I refuse to buy an Apple because of the issues that they've had with their updates.
Re:And of course.... by m50d · 2005-04-13 07:59 · Score: 1

If you've VNCed to it from a linux box, you no longer have a valid XP license, for example

--
I am trolling
Re:And of course.... by strikethree · 2005-04-13 10:18 · Score: 1

something to think about:

you own an xp pro cd. your friend gives you a burned copy of xp pro with a cd key that is not the same as the one you have. you do not use your copy of xp anywhere. you install from the burned cd.

is what you have done illegal?
what if you used your cd key instead?
what if you installed from your cd but used the cd key from the burned disk (but not the software)?

i am thinking ALL of those scenarios are against the License and could therefore be deemed illegal. what reasonable person would think any of the above situations are illegal or unethical?

what do you get when you pay for software?

strike

--
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen

Critical Updates Plus Bonus Junk by pycnanthemum · 2005-04-13 02:24 · Score: 5, Interesting

Glad I don't do "Auto Install"...hidden way at the bottom of the list of things Windows wanted to update was...

Update for Background Intelligent Transfer Service (BITS) 2.0 and WinHTTP 5.1 (KB842773)
Download size: 694 KB, 1 minute
This software updates the Background Intelligent Transfer Service (BITS) to v2.0 and updates WinHTTP. These updates help ensure an optimal download experience with new versions of Automatic Updates, Windows Update, and other programs that rely on BITS to transfer files using idle network bandwidth.

How is this critical?

Re:Critical Updates Plus Bonus Junk by Neopoleon · 2005-04-13 02:32 · Score: 5, Informative

An update to BITS is critical because it's part of the mechanism that should be keeping your average user's Windows machine clean by downloading updates in the background without disturbing their usual browsing activities (it uses opportune moments to grab chunks of updates - once all the pieces are down, it lets you know).

One of the reasons we have so many problems with security vulnerabilities is that users don't make use of Automatic Updates, and they wind up running unpatched systems for days... weeks... months... ...years.

Sometimes there's a good reason for this, but I suspect that, more often than not, it's a lack of understanding about *why* Automatic Windows Updates is important.

So, in that context, although I can see why you might not think it's an important update, BITS is actually something you want updated with everything else unless you're *really* on top of patching your system manually.

--
- Rory [Microsoft Employee] | Free dirt: neopoleon.com
Re:Critical Updates Plus Bonus Junk by MSFanBoi · 2005-04-13 02:33 · Score: 2, Informative

Because Microsoft is changing the distribution method for WindowsUpdate very shortly. Microsoft Update. Google it.
Re:Critical Updates Plus Bonus Junk by Anonymous Coward · 2005-04-13 02:35 · Score: 0

If, hypothetically, there's some stupid bug in one of those that could possibly corrupt downloads (and MS just 'forgets' to mention that), then it is rather critical.
Re:Critical Updates Plus Bonus Junk by stinerman · 2005-04-13 02:36 · Score: 4, Interesting

If I'm not mistaken, it allows the auto-update feature to only use idle bandwidth when downloading new updates.

This is good for Joe User who is trying to surf on a 56k modem while downloading 10MB of updates. ISPs probably got calls of "the internet being slow", likely due to auto-update running while they were trying to surf.

Is it critical? No. Helpful? Probably.
Re:Critical Updates Plus Bonus Junk by Anonymous Coward · 2005-04-13 02:37 · Score: 0

It is critical in the sense that it will allow for the better patching of flaws that are to come. If this update allows the patch for the next big worm to download five min faster ... thats five more min that i don't have to worry about my system being "safe"
Re:Critical Updates Plus Bonus Junk by Nimloth · 2005-04-13 02:37 · Score: 0

It's not. It's been available for months, you just haven't installed it yet.

If you had, you'd have noticed it's nothing to worry about, and it's actually quite nice to be able to do something else while I'm Windows Updating. This window can be minimized, whereas the previous version couldn't.

It's also more detailed of what it's doing at any given moment, and the progress bar seems a little more accurate in its proportions.

Try it sometime, and take the tinfoil hat off.
Re:Critical Updates Plus Bonus Junk by Anonymous Coward · 2005-04-13 02:38 · Score: 0

Meanwhile in Linuxland, you are staring at a Python stacktrace from up2date if there's poor network connectivity. :P
Re:Critical Updates Plus Bonus Junk by clinko · 2005-04-13 02:52 · Score: 2, Funny

BITS is the download component of windows update...

It's also used for software deployment in corporate offices.

It's also Needed for SP2... Judging by the fact you said no to this, I only have 1 question: What is your IP? :)
Re:Critical Updates Plus Bonus Junk by Theaetetus · 2005-04-13 03:42 · Score: 2, Interesting

If I'm not mistaken, it allows the auto-update feature to only use idle bandwidth when downloading new updates.
This is good for Joe User who is trying to surf on a 56k modem while downloading 10MB of updates. ISPs probably got calls of "the internet being slow", likely due to auto-update running while they were trying to surf.
Is it critical? No. Helpful? Probably.
So, theoretically, while attempting to attack Joe User's new machine, you could simultaneously DoS him so that his machine doesn't have any idle bandwidth, and won't download any patches until you've completed your attack?
Re:Critical Updates Plus Bonus Junk by strider44 · 2005-04-13 04:00 · Score: 1

I don't know, but there's something a bit chilling about automatic updates when it doesn't say explicitly what you're downloading before you download it (and when I say that I don't mean "patch 123A314"), even if I'm already trusting Microsoft by using their operating system. I just plain don't like it when I'm downloading and installing new stuff but I don't know what I'm downloading, whoever it's from. Perhaps I'm just too used to the symantics of apt-get and synaptic.
Re:Critical Updates Plus Bonus Junk by stinerman · 2005-04-13 04:09 · Score: 1

Yes, in theory, that would work. I think auto-update uses at least x% of bandwidth when downloading updates, so you could at least slow it down using a DoS
Re:Critical Updates Plus Bonus Junk by WhiplashII · 2005-04-13 04:31 · Score: 1

I got it! It's 127.43.52.36 - but your too late, I have already fried his machine - heh!

Now let me find out what this File not Found prompt was about, anyway...

--
while (sig==sig) sig=!sig;
Re:Critical Updates Plus Bonus Junk by Anonymous Coward · 2005-04-13 05:12 · Score: 0

The critical improvement seems to be to better identify the user requesting the data. Maybe to lockout illegal installations of Windows?
Re:Critical Updates Plus Bonus Junk by Duhavid · 2005-04-13 05:43 · Score: 1

I'm not used to the either of the tools you mention, I am a long time Windows ( longer term Unix, just jumped into the Linux pool ) user, and I, too, like to know what I am getting in the download. I will not use autoupdate. I also want to know *when* things are updated. If I know that updates have occured, I can check out the basic functionality right after and ensure that I dont get a frantic call from the wife screaming about how she absolutely has to have functionality X, but doesnt. I do the updates by hand, then, on the wife's machine, I check out the apps that she uses (-: nominally and usually... :-). If there is a problem, I can correct it, or make sure she doesnt need that app until I can fix it.

--
emt 377 emt 4
Re:Critical Updates Plus Bonus Junk by Mancat · 2005-04-13 07:17 · Score: 1

So? Turn on Update Notification. When you're notified of available patches, you can reference the patch ID to Microsoft Knowledge Base before you decide to install it.

--
hello dear sirs my name is jamesh i are india (bihar) can u guide me install red had linux 9?
Re:Critical Updates Plus Bonus Junk by drsmithy · 2005-04-13 11:53 · Score: 1

don't know, but there's something a bit chilling about automatic updates when it doesn't say explicitly what you're downloading before you download it [...]
It does - if you bother to actually look.

One wonders... by Moggie68 · 2005-04-13 02:26 · Score: 4, Insightful

..just how long these security holes have existed? It's a nifty trick to publish security holes only after patching them. Makes you look good, except in the eyes of those whose PC has already been "pwned" because of said holes...

Re:One wonders... by Nevo · 2005-04-13 02:33 · Score: 4, Informative

Read the bulletins. Each security bulletin has a section in which Microsoft says whether or not the vulnerability was publicly reported, and whether or not Microsoft was aware of public exploits at the time the bulletin was published. My understanding is that none of this month's vulnerabilities were publicly known. Granted, you won't know how long Microsoft knew of the hole (which is useless information), but you'll know if it was a zero-day exploit (which is marginally more useful information).
Re:One wonders... by Neopoleon · 2005-04-13 02:37 · Score: 5, Insightful

You have to keep things in perspective - Windows isn't open source, so publishing the vulnerabilities ahead of time, in many cases, wouldn't actually do much good.

As you know, with OSS, announcing a vulnerability is like a call to arms, getting devs out of bed and coding fixes. With a closed source product, it's like saying "Cooooooooooooome 'n get it!"

If users could plug these holes with their fingers, then telling them would help. As things are, though, this is probably the safer way to do it for our product.

--
- Rory [Microsoft Employee] | Free dirt: neopoleon.com
Re:One wonders... by Moggie68 · 2005-04-13 02:37 · Score: 1

A valid point, but I'm inclined not to trust Microsoft when they claim non-awareness of public exploits. I would imagine they do not look for them very vicariously...
Re:One wonders... by Malc · 2005-04-13 02:44 · Score: 2, Informative

You are aware that normally Windows' exploits only occur after the security hole has been announced, right?
Re:One wonders... by Moggie68 · 2005-04-13 02:52 · Score: 0

*giggle*
Re:One wonders... by curufinwe741 · 2005-04-13 02:57 · Score: 2, Interesting

Keep in mind the fact that Windows XP consists of roughly 45 million lines of code. Considering this, I think it puts into perspective what a gargantuan task testing and patching truly is, and gives me a little more understanding of holes in the OS.
Re:One wonders... by freshman_a · 2005-04-13 03:13 · Score: 2, Insightful

While I see your point...

I'd rather MS publish vulnerabilities ahead of time. 2 of the servers I maintain run Windows Server. If they are vulnerable, I'd like to know about it, even if MS hasn't released a fix. At least if I know about it, I can monitor traffic more closely on those servers or do something to at least help those servers from being "pwned". I'd rather spend my time playing defense instead of wondering whether or not my servers are vulnerable and if so, why?

I think if MS kept people more informed of vulnerabilities and released fixes when the vulnerabilites were found, as opposed to not announcing them and hoping no one discovers them until the next monthly security update, it would greatly help their image in terms of security.

But that's just my 2 cents...

--
Slackware
Re:One wonders... by dioscaido · 2005-04-13 03:37 · Score: 1

How often are details to critical vulnerabilities in linux released for mass consumption before a fix exists?
Re:One wonders... by LurkerXXX · 2005-04-13 03:47 · Score: 2, Insightful

I understand your reasoning, but I disagree with your point.
Posting an expolit with no patch is a dream come true for the script-kiddies, spammers, zombie-makers of the world. They will jump on it in a heartbeat.
While you may diligently monitor your severs for the new potential exploint (even though there may be nothing you can do to avoid it except switch the service to a non-MS box temporarily), most wouldn't.
There are a LOT of windows servers out there admin'd by folks who think they know what they are doing, but are really not that good, and there are a LOT of other windows servers out there that were set up once, the admin/consulting-company/whatever left with instructions for the local folks to run windows update regularly or set to download and install updates automatically.
Those boxes will be owned in no time. Bad for them, and bad for all the internet traffic they will generate. And we are talking about servers here, not all the random desktop/workstation machines that also will get hit by exploits. that would be much much worse.
MS knows the customer base. Most of it is fairly clueless. Although the well monitored machines (the vast minority) might be ok, the vast majority of their customers would probably take it in the shorts. Very very bad for MS's security image. Hence they don't report the holes till they have a patch ready to roll out. A much better thing for the internet overall.
Re:One wonders... by Anonymous Coward · 2005-04-13 04:00 · Score: 0

You're one of those people who get the question "what was the largest island on Earth before Australia was discovered?" wrong, aren't you?

Just because Microsoft or the public don't know about a vulnerability, doesn't mean it doesn't exist (and it doesn't mean there aren't black hats that aren't exploiting it).
Re:One wonders... by Anonymous Coward · 2005-04-13 06:41 · Score: 0

Workarounds are equivalent to plugging holes with your fingers. Releasing the advisories earlier helps vigilant administrators disable services or create contingency plans to prevent or mitigate compromises. Of course, in the best case not publishing the advisories earlier means nobody has to worry about it yet, but it's definitely a non-zero risk.
Re:One wonders... by iluvcapra · 2005-04-13 09:45 · Score: 1

As you know, with OSS, announcing a vulnerability is like a call to arms, getting devs out of bed and coding fixes. With a closed source product, it's like saying "Cooooooooooooome 'n get it!"

Good point, but the implication is that Microsoft is less responsive to vulnerabilities (regardless of how they're discovered) than OSS developers. If MS were able to turn fixes around as quickly as OSS developers, there would be no "Come'n get it," or at least none more so than in the competition.
That recent RSA presentation that asserted Windows 2003+IIS was more secure than Linux+Apache used "number of days with unpatched vulnerabilites" as its criteria for security. Of course, left unsaid, is that this is the count of number of days the public was aware of the exploit. The real issue is how many days the black hats are knowledgeable of it.
Gedankenexperiment: You have two script kiddies on a mesage board posting a security exploit at the same moment. One posts a "7o74ly 0wn a11 windoz!" crack, and the other posts a "7o74ly 0wn a11 1inux 1u5er5!" crack. Both exploits are effective and cause equivalent grief to the individual user. Which exploit will get patched first, and does this matter?
I suspect that the linux one wil get fixed first, and that this delay does matter (As a mac fanboy I will not speculate on how long an OS X patch would take...). I can't be sure, since no one collects such numbers on the number of days black hats know things.

--
Don't blame me, I voted for Baltar.

Patches by johndou1 · 2005-04-13 02:26 · Score: 5, Informative

Auto update applied the patched and then I could not boot.

Had to run chkdsk, then it came back to life.

Re:Patches by saddino · 2005-04-13 02:31 · Score: 4, Informative

Same here. On restart I went into some funky graphics mode (looked like a crash on an old C64) alternating between a light blue screen, a light green screen and some multicolored vertical lines. This is a brand new machines with XP Pro and basically only Visual Studio installed.

I almost had a heart attack because I didn't back up code I wrote last night (dumb to apply updates without backing up, yes I know).

A hard reboot fixed it for me, but I'm still a little nervous.
Re:Patches by DigitumDei · 2005-04-13 02:34 · Score: 1

I had that too on one of the 3 XP boxes I updated.

Though everything seemed fine after chkdsk did its thing.

--
East Coast Brewers
Re:Patches by c0ldfusi0n · 2005-04-13 02:47 · Score: 1

Was fine for me. I even remotely installed them on my home computer from work.

--
A computer makes it possible to do, in half an hour, tasks which were completely unnecessary to do before.
Re:Patches by Kobold+Curry+Chef · 2005-04-13 04:00 · Score: 1

This is why I turned off Automatic Updates on every desktop in my company...never trust that a Windows patch won't break your PC. Of course, home users have no chance to test, in most cases.
Re:Patches by nordicfrost · 2005-04-13 06:39 · Score: 1

A hard reboot fixed it for me, but I'm still a little nervous.

So, have you backed up now or are you a man? ;) Just kidding. I know you are a man, man.
Re:Patches by Anonymous Coward · 2005-04-13 06:43 · Score: 0

My el cheapo ATI-based card loved to do this. I replaced it with a nVidia 5700LE, and things have been fine so far. Your problem might be more hardware/driver-related than Microsoft's fault.
Re:Patches by Anonymous Coward · 2005-04-13 16:26 · Score: 0

Same here. On restart I went into some funky graphics mode (looked like a crash on an old C64) alternating between a light blue screen, a light green screen and some multicolored vertical lines.
If that happens, try
SYS 64738
Then, reload the patch with
LOAD "*", 8, 1
Re:Patches by menscher · 2005-04-13 18:18 · Score: 1

You should also be able to get back to a nice-looking screen with
poke 53281,8

poke 53280,5

poke 646,4

Well, at least the codes are right... not sure about the colors, though. It's been a few years. :P

The Big Three by Rhaythe · 2005-04-13 02:26 · Score: 4, Informative

The most worrisome are (from least to most)
MS05-019 Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service.
Remotely Exploitable. Good potential for the next superworm.
IP Validation Vulnerability (CAN-2005-0048 ) - "Incomplete validation of IP Network Packets" is how Microsoft describes this vulnerability.

MS05-021 - Vulnerability in Exchange Server Could Allow Remote Code Execution.
Remotely Exploitable Buffer Overflow
Exchange Server Vulnerability (CAN-2005-0560) - The service fails to handle SMTP extended verb requests. On Exchange 2000, if an attacker connects to an SMTP port (unauthenticated users will work) and issues a specially crafted extended verb request, this would allow an attacker to run the code of their choice as the SMTP service runs as Local System.

MS05-020: Cumulative Security Update for Internet Explorer (890923)
Remotely exploitable.

All three problems fixed would require a user to browse a malicious website or click on a link... but then there is a HIGH probability that THAT will happen. Again proof of concept exploit code has been released for this flaw.

Re:The Big Three by Anonymous Coward · 2005-04-13 11:56 · Score: 0

But sample code exists for TCP and IP in the standards and they can't get it right! Bullshit!

Shell32.dll? by Anonymous Coward · 2005-04-13 02:26 · Score: 0, Troll

This is not the first time when there was something to fix at Shell32.dll
yep, and like every operating system - it won't be the last...

That's funny. I just did an ls for Shell32.dll, but didn't find it on my SuSE box. Should I download and install the file anyway?

Re:Shell32.dll? by 0x461FAB0BD7D2 · 2005-04-13 02:29 · Score: 1

You probably didn't find it because you forgot to pipe it to grep :P
Re:Shell32.dll? by tehshen · 2005-04-13 02:38 · Score: 1

Try lowercase. /usr/lib/wine/shell32.dll.so

--
Guy asked me for a quarter for a cup of coffee. So I bit him.

Thank you MS! by Reignking · 2005-04-13 02:28 · Score: 3, Funny

I would like to thank MS for being so diligent in protecting the everyday computer user from malicious attacks from evil-doers. Keep the patches coming!

--
One man's Funny is another man's Offtopic.

Re:Thank you MS! by xocp · 2005-04-13 02:34 · Score: 5, Informative

Not to mention, I appreciated that Microsoft thanks those that reported the vulnerabilities:

Mark Dowd and Ben Layer of ISS X-Force for reporting the Exchange Server Vulnerability (CAN-2005-0560).

Alex Li for reporting the Word vulnerability (CAN-2005-0558).

Hongzhen Zhou for reporting the MSN Messenger Vulnerability (CAN-2005-0562).

Song Liu, Hongzhen Zhou, and Neel Mehta of ISS X-Force for reporting the IP Validation Vulnerability (CAN-2005-0048).

Fernando Gont of Argentina's Universidad Tecnologica Nacional/Facultad Regional Haedo, for working with us responsibly on the ICMP Connection Reset Vulnerability (CAN-2004-0790) and the ICMP Path MTU Vulnerability (CAN-2004-1060).

Qualys for reporting the ICMP Path MTU Vulnerability (CAN-2004-1060).

Berend-Jan Wever working with iDEFENSE for reporting the DHTML Object Memory Corruption Vulnerability (CAN-2005-0553).

3APA3A and axle@bytefall working with iDEFENSE for reporting the URL Parsing Memory Corruption Vulnerability (CAN-2005-0554).

Andres Tarasco of SIA Group for reporting the Content Advisor Memory Corruption Vulnerability (CAN-2005-0555).

iDEFENSE for reporting the Windows Shell Vulnerability (CAN-2005-0063).

Kostya Kortchinsky with CERT RENATER for reporting the Message Queuing Vulnerability (CAN-2005-0059).

John Heasman with Next Generation Security Software Ltd. for reporting the Font Vulnerability (CAN-2005-0060).

Sanjeev Radhakrishnan, Amit Joshi, and Ananta Iyengar with GreenBorder Technologies for reporting the Windows Kernel Vulnerability (CAN-2005-0061).

David Fritz working with iDEFENSE for reporting the CSRSS Vulnerability (CAN-2005-0551).
Re:Thank you MS! by Anonymous Coward · 2005-04-13 09:02 · Score: 1

Mark Dowd and Ben Layer of ISS X-Force for reporting the Exchange Server Vulnerability (CAN-2005-0560).

Song Liu, Hongzhen Zhou, and Neel Mehta of ISS X-Force for reporting the IP Validation Vulnerability (CAN-2005-0048).

Chris Klaus, Joe Kleinwaechter, and some fuck in a wheelchair of ISS for closing the Mountain View office last year. Assholes.
Re:Thank you MS! by overbom · 2005-04-13 09:06 · Score: 1

You get cred for the vulnerability if you don't practice full disclosure, and wait until after the patch is released to disclose... that's been standard operating procedure at MS for a few years now, I think.

Feel safer now? by 3770 · 2005-04-13 02:33 · Score: 4, Insightful

I don't know if I'm feeling safer or less safe after seeing these patches.

Scenario 1)
Yay!!! There are now fewer security holes.

Scenario 2)
Oh noo!!! If they still are finding problems of this type then there must be many many more.

Are you a scenario type 1 or type 2 guy?

--
The Internet is full. Go Away!!!

Re:Feel safer now? by Anonymous Coward · 2005-04-13 02:44 · Score: 1, Interesting

I'm more of a scenario 3 guy.

3) Ah, so this is how I've been vunerable for the last month...

At least it's only one month max, but still, we have to wait that long for completed fixes to be released just to make the process seem regular.

I know some people like the regular thing, I would prefer the choice however.
Re:Feel safer now? by mccalli · 2005-04-13 02:49 · Score: 2, Insightful

Are you a scenario type 1 or type 2 guy?
Yes. The two scenarios aren't mutually exclusive.
Cheers,
Ian
(who is actually a scenario 3 type of guy - when will the first patches for Tiger come out...?)
Re:Feel safer now? by Otter · 2005-04-13 02:50 · Score: 1

Normally these are phrased as:

Scenario 1)
Yay!!! Finding these holes in [open-source project] shows that with enough eyes, all bugs are shallow!

Scenario 2)
These vulnerabilities in [proprietary product] are proof of the superiority of open-source.

There's also a rarer Scenario 3 where the Microsoft hole is the result of their use of an open-source codebase or library. At that point, all bets are off.

--
What I'm listening to now on Pandora...
Re:Feel safer now? by hcob$ · 2005-04-13 03:16 · Score: 1

I'm a type 3 guy. I get what I think is important, and leave the rest. Also,(not saying it's perfect) but I'll soon be buying an apple now that they are cheap enough to really afford.

--
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
Re:Feel safer now? by digidave · 2005-04-13 04:23 · Score: 1

"There's also a rarer Scenario 3 where the Microsoft hole is the result of their use of an open-source codebase or library. At that point, all bets are off."

No, that just means Microsoft is evil for not contributing a security fix back to the project.

--
The global economy is a great thing until you feel it locally.
Re:Feel safer now? by pg110404 · 2005-04-13 04:48 · Score: 1

Are you a 'glass is half full' or 'glass is half empty'?

This kind of situation is a perfect example of an expression whose origin I can't remeber.

No matter how bad things are, things can always get worse.

I applaud microsoft for putting that kind of effort into fixing their OS. I really do. They've taken a bad design, implemented it poorly, then kludged it to work. Now they have this mess which thankfully they are finally cleaning up.

When bill and his cronies stol^H^H^H^Hcame up with MS-DOS out of that garage, the bureaucracy of any large corporation did not exist and when problems were discovered, they got fixed.

As any company gets larger, psychosis sets in and the peons do what the bosses wants and the bosses think all is well. The end result is shortcuts get taken, work is rushed and product is shoved onto the market before it's ready. Many years later, you have the mess that is present today. XP flaws that go back to the early days of NT, buffer overflows, etc.

Even if microsoft halted development and put their entire software development resources to fix the flaws in XP, it would still be years before that work was completed. And even then, it would not be guaranteed to be fully flawless, not to mention it would likely break everything.

So perhaps the glass only contains half of what it could contain, but the fact that they are recognizing and making a concerted effort to fix the many gaping security flaws in their product, only suggests that things could actually be far worse than they currently are.
Re:Feel safer now? by Anonymous Coward · 2005-04-13 06:01 · Score: 0

I'm a little of both, but also:

3) Oh great, another bunch of patches that are going to break things again and maybe introduce NEW security holes.

You see, I simply don't trust Microsoft to get anything right.
Re:Feel safer now? by Anonymous Coward · 2005-04-13 06:04 · Score: 0

I'm the Type 4 kind of guy:

4) I am sooo glad I am not running Windows!
Re:Feel safer now? by Mancat · 2005-04-13 07:22 · Score: 1

The glass is either half full or half empty, depending on the last action taken upon the glass. If the last action consisted of consuming liquid, then the glass is half empty. Likewise, if the last action consisted of the addition of liquid, the glass is half full.

I'm glad we finally worked this out.

--
hello dear sirs my name is jamesh i are india (bihar) can u guide me install red had linux 9?

I always download updates ASAP by Anonymous Coward · 2005-04-13 02:34 · Score: 4, Funny

That way I can be the first to break something. It's no fun having a solution already up on Google.

Re:I always download updates ASAP by SmokeHalo · 2005-04-13 03:52 · Score: 1

If you can't get first post, get first bork, eh?

--
I'm not good in groups. It's difficult to work in a group when you're omnipotent. - Q

So... by bl4nk · 2005-04-13 02:35 · Score: 5, Insightful

Can we expect a news article every month blasting Microsoft for releasing security updates? Christ, where are the news articles when updates come out for other OS's? Or is it only a bad thing when Microsoft does it?

Re:So... by izomiac · 2005-04-13 02:48 · Score: 1

I'm running BeOS, and I can't remember the last time I needed a security update for it.
Re:So... by Anonymous Coward · 2005-04-13 02:49 · Score: 0

Where was the blast?
The submision just gave details on the patch. Quite tame, really.
No mention of Linux either. Debian!!
Re:So... by sagekoala06 · 2005-04-13 02:49 · Score: 2, Interesting

I always seem to have at least one windows box at home ... and quite frankly I'm glad slashdot gives me the heads up for updates. Its because of this that i was able to completly avoid the whole sasser etc aound of worms on my machine. I see the heads up, and in a few weeks i see the havoc that they unleashed on the net. then i have to go to my girlfriends place and fix her machine because she doesn't read slashdot and god only knows she isn't going to listen to me!
Re:So... by DogDude · 2005-04-13 02:50 · Score: 1, Flamebait

It's only bad when MS does it. When Apple releases a new version that you have to buy every 6 months to a year, then that's a good thing. Bizarre, I know.

--
I don't respond to AC's.
Re:So... by Anonymous Coward · 2005-04-13 02:53 · Score: 1, Interesting

I'm wondering too. Every month they have security updates for all their OS'es. It's known that it takes them time to patch things, but here they're actually doing it, so you can't blame them.

There's thousands of security updates to thousands of apps every month. It's a normal part of software development to fix bugs and problems and push patches. But we don't hear about those...

This is not newsworthy whatsoever. Just download and apply the patches. Nothing to see here.
Re:So... by Rudeboy777 · 2005-04-13 02:54 · Score: 2, Insightful

I recall a few examples of front page attention for Firefox releases that address security problems. Same for the occasional security issue in Sendmail or MySQL or Samba or the kernel, or ...

--
From hell's heart I fstab at /dev/hdc
Re:So... by Anonymous Coward · 2005-04-13 02:58 · Score: 2, Insightful

I think you're exactly right. Others OSs have problems and get updated all the time. Whenever a vulnerability comes out that Microsoft hasn't issued a patch for, people bitch because they're neglecting their customers. Whenever Microsoft releases a patch, people bash them for security problems. However, when a vulnerability in the linux kernel comes around, then people still bash Microsoft. I don't know why people care so much, but it's getting to be childish.
Re:So... by Threni · 2005-04-13 03:00 · Score: 1

What's the point in attempting to hack someone using BeOS? Talk about kicking someone when they're down...
Re:So... by elrous0 · 2005-04-13 03:06 · Score: 1

What's the point in attempting to hack someone using BeOS? Talk about kicking someone when they're down...
Yeah, it's the same with Linux and other non-Windows operating systems. They reason you don't see as many patches is because no one bothers to hack or write viruses for other OS's when 95% of the computers out there use Windows.
-Eric

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:So... by rpozz · 2005-04-13 03:09 · Score: 3, Informative

There have definitely been articles relating to OpenSSH et all, and getting exactly the same amount of critism.

Note that "Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service (893066)" is pretty damn serious though.
Re:So... by EddWo · 2005-04-13 03:47 · Score: 1

Who would you expect to write one if an exploit was found that did need an update? BeOS is unsupported.

How many security researchers do you think are still actively trying to pick holes in it?
How can you be sure there isn't a buffer overrun in an image processing library used by NetPositive that no one has bothered to find.

--
"Taligent is still pure vapor. Maybe they'll be the last who jumps up on Openstep... "
Re:So... by smallguy78 · 2005-04-13 04:01 · Score: 1

I'm running an Amstrad CPC 128, and I can't remember the last time I needed a security update for it.

--
Nothing costs nothing
Re:So... by izomiac · 2005-04-13 04:30 · Score: 1

True, I'm sure there are vunrablilities, but since Firefox is fairly secure, and I would think the BONE network layer is more secure than netserver was I figure it's a reasonably secure OS from a network standpoint. Nobody's really tested it, but I doubt that there's much of a chance of the system being exploited at this point in time. My point is, mostly in jest, that it's mostly just Microsoft, Linux, and (I assume) Apple that regularly release security updates.
Re:So... by Anonymous Coward · 2005-04-13 05:04 · Score: 0

No one here seems to have noted that the vulnerability is not limited to Windows.... According to The Reg, "Qualys, the firm credited with finding the TCP/IP stack flaw, warns that the problem is not limited to Microsoft. The vulnerability in Internet Control Message Protocol (ICMP) messages makes it possible to reset or slow an established connection as explained in a UK National Information Security Co-ordination Centre UNIRAS alert here: http://www.niscc.gov.uk/niscc/docs/al-20050412-003 08.html?lang=en."

So yes it is damn serious, and not just for people running Windows.
Re:So... by Anonymous Coward · 2005-04-13 06:46 · Score: 0

Having a few TCP connections reset is nothing compared to the possibility of remote code execution. Basically, it seems that yes, Microsoft has buffer overflows even in the TCP/IP stack, which will probably let you remotely get administrator/system access. Gee, thanks, Microshaft.

Re:I wonder . . . by pacroon · 2005-04-13 02:35 · Score: 2, Funny

At least they're not calling MSN Messenger an important update anymore :)

--
It's all fun & games until someone loses the game.

something to fix at Shell32.dll by Anonymous Coward · 2005-04-13 02:36 · Score: 0

"something to fix at Shell32.dll"

WTF kind of English is this?

Re:something to fix at Shell32.dll by Anonymous Coward · 2005-04-13 02:43 · Score: 0

WTF kind of English is this?

Jargonese.
Re:something to fix at Shell32.dll by ShamanDave · 2005-04-13 06:20 · Score: 1

WTF kind of English is this?

It's a step above "WTF."

"Critical" patches every month. Sure, we can wait! by TheStick · 2005-04-13 02:37 · Score: 5, Insightful

I never understood why Microsoft released "critical updates" only every month. If they're critical, you're supposed to release a patch as soon as you hear about them. 48 hours is already too much, and a month represents a century in the IT universe...

Windows 2003 SP1 by BladeMelbourne · 2005-04-13 02:40 · Score: 2, Funny

I just went to update Win2003 SP1 and all they offered was the Windows Malicious Software Removal Tool - April 2005. I'm disappointed at missing my patch fix for this month :-(

Re:Windows 2003 SP1 by Kobold+Curry+Chef · 2005-04-13 03:51 · Score: 1

All of this month's patches are already included in Windows 2003 Service Pack 1. If you haven't finished testing and rolling out SP1, like us, then you still get to test and install this month's patches too.
Re:Windows 2003 SP1 by LittleGuy · 2005-04-13 13:45 · Score: 1

I just went to update Win2003 SP1 and all they offered was the Windows Malicious Software Removal Tool - April 2005.

Someone want to go to Cafepress and have a T-Shirt made with this printed up?

--
Mod Karma -1: I sed bad wurds. If I cep my mouf shut, I wud be at riyses.

Worse than you think... by tweakt · 2005-04-13 02:40 · Score: 3, Informative

All three problems fixed would require a user to browse a malicious website or click on a link... but then there is a HIGH probability that THAT will happen. Again proof of concept exploit code has been released for this flaw.

Wrong. Based on those summaries, I'd say the first two are exploitable by the attacking system connecting TO the target. No action is required by the victim. Only the third I would guess involves web-related malware.

silent install by unk1911 · 2005-04-13 02:41 · Score: 4, Interesting

last night, i got a popup message saying "updates were applied to your system and it will be rebooted in 5 minutes" - i tried to kill that process but it kept respawning. is that related to these patches? weird, i thought i had autoupdate disabled..

--
http://unk1911.blogspot.com

Re:silent install by mr_z_beeblebrox · 2005-04-13 03:14 · Score: 4, Funny

is that related to these patches? weird, i thought i had autoupdate disabled.

Nope. That was me, sorry.
Re:silent install by Craster · 2005-04-13 03:32 · Score: 1

That was most likely XP SP2, if you're running XP and don't already have it.
Re:silent install by pg110404 · 2005-04-13 05:01 · Score: 1

and it will be rebooted in 5 minutes... is that related to these patches?

Nope, that's the windows starter edition of the MSBlaster virus.... It gives you a 5 minute shutdown warning instead of the standard 1 minute.

If you wanted the standard 1 minute shutdown notice, you'd have to pay more for it.

Re:"Critical" patches every month. Sure, we can wa by TummyX · 2005-04-13 02:49 · Score: 1

48 hours is already too much, and a month represents a century in the IT universe...

So you're telling me I have to wait an eon for Longhorn to come out?

Re:"Critical" patches every month. Sure, we can wa by Malc · 2005-04-13 02:49 · Score: 3, Insightful

People don't want to be updating every five minutes. Every patch goes through a complete testing cycling at some businesses, which is very expensive. This lowers the time and expense by restricting it to once a month. Furthermore, if the security hole hasn't been publicly announced, there isn't normally something exploiting it. I think this is a matter of risk management - maybe they will get burnt by this one day, but experience has shown that this approach is acceptable.

Right... by Anonymous Coward · 2005-04-13 02:50 · Score: 0

Because people buy a 800$+ server OS to browse the web with it...

The only pages my 2003 boxes have ever visited is windows update. If I want to browse the web, I've got workstations.

Re:Emerge! Emerge! by tajmorton · 2005-04-13 02:50 · Score: 0, Offtopic

as well as legislation outlawing RPMs...

What is the problem with RPMs...care to elaborate?

--
Tell the truth and you won't have so much to remember.

MS update KB891711 Rerelease for Windows 98 & by antdude · 2005-04-13 02:53 · Score: 2, Informative

Read Broadband Reports security forum thread about this. It appears the rerelease patch fixed the blue screen problems, proxy, etc.

--
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).

Do we really need to know by Patrick+Mannion · 2005-04-13 02:54 · Score: 0

It's stupid to cover security updates from Microsoft, we all know as soon as they relase more problems just sprout up and then they release more updates.

--
In America, you spam computers In Soviet Russia, computers spam you!

Slashdot doubling as a calendar by hackstraw · 2005-04-13 02:55 · Score: 2, Funny

Hmm, Microsoft security updates. Must be the 2nd Tuesday of the month.

I don't even use MS products and I know about their update schedule, yet every 2nd Tuesday of the month /. puts up and article about it.

Re:Slashdot doubling as a calendar by dumpsterKEEPER · 2005-04-13 03:36 · Score: 1

For people who use MS products as a regular part of their work, this is very useful. I can come here and skim the thread to see if people are having specific problems with a patch, or just check to see if there are any reasons why I should wait on applying them. This kind of community is what makes Slashdot useful.

If you don't use MS products, just skip the article.
Re:Slashdot doubling as a calendar by Ford+Prefect · 2005-04-13 03:41 · Score: 2, Funny

Hmm, Microsoft security updates. Must be the 2nd Tuesday of the month.

(Double-check...)

(Triple-check...)

But it's Wednesday!

--
Tedious Bloggy Stuff - hooray?
Re:Slashdot doubling as a calendar by SmokeHalo · 2005-04-13 03:49 · Score: 1

Hmm, Microsoft security updates. Must be the 2nd Tuesday of the month.

Ooo, thanks for reminding me. It's shower day.

--
I'm not good in groups. It's difficult to work in a group when you're omnipotent. - Q
Re:Slashdot doubling as a calendar by hackstraw · 2005-04-13 03:52 · Score: 1

That is fine and useful I would imagine for many to share their thoughts about these patches. I just really have objection to the way slashdot tries to start a flamewar by titling the articles similar to "Microsoft releases eight security updates", and then the anti MS people post "yeah, MS is insecure", when this is merely a regular responsible update that is supplied by MS every second tuesday of every month.
Re:Slashdot doubling as a calendar by dumpsterKEEPER · 2005-04-13 03:59 · Score: 1

Oh I see what you were saying. I agree with you completely about starting OS flamewars, I guess that was just not how I took the article.
Re:Slashdot doubling as a calendar by AceCaseOR · 2005-04-13 04:53 · Score: 1

Must be the 2nd Tuesday of the month.

I never could get the hang of Tuesdays.

--
Zagreus sits inside your head, Zagreus lives among the dead, Zagreus sees you in your bed and eats you in your sleep.

Not again! by spitefulcrow · 2005-04-13 02:57 · Score: 1

I spent several hours yesterday cleaning viruses and spyware off of my mom's laptop, then installing patches, SP2, and AVG Antivirus. Now I have to go patch it some more?

--
Sorry, my karma just ran over your dogma.

Re:Not again! by NetCow · 2005-04-13 04:00 · Score: 2

Then don't patch it. Nobody's forcing you to, since you can just not go to the Windows Update site, and can turn off Automatic Updates.
Just don't be surprised if things break later :).
Patching systems is a fact of life, under any operating system under the sun.
Re:Not again! by spitefulcrow · 2005-04-13 05:21 · Score: 1

Patching systems is a fact of life. It's just that other systems generally take less effort to maintain than that virus-infested bug-ridden hack they call Windows.

--
Sorry, my karma just ran over your dogma.

There goes my day... by papastout · 2005-04-13 02:57 · Score: 1, Funny

My routine today: login, update, restart... 335 times. It's not like I had BETTER THINGS TO DO! heh, even our management staff is bent out of shape over this.

The plus side: sysadmin day comes but once a year, and if I can thank the manufacturer of windows OS for anything it would be the highly visible justification they provide for our management to kick down some goods and buy us some chocolate cake...

...mmmm cake!

Re:There goes my day... by limabone · 2005-04-13 03:30 · Score: 2, Informative

I am installing patches on 250+ systems right now while I read slashdot. Try using SUS server or GFI Languard (which is what I am using). This thing pays for itself easily in the first month if you are doing 300+ systems by hand like your message says.
Re:There goes my day... by DavidTC · 2005-04-13 03:49 · Score: 1

Well, it's not like you didn't know in advance.

--
If corporations are people, aren't stockholders guilty of slavery?
Re:There goes my day... by EXrider · 2005-04-13 08:21 · Score: 1

I haven't had good luck with SUS. Seems even though I have all the updates I want approved, machines still don't get them all, or get them on a completely random interval.

I have three different OU's set up with different policies, the machines that get them forced down their throat all seem to get updated within 2 days of approval. The other two OU's are servers and power users/workstations, they get to decide when the updates are installed, or downloaded and installed. When you log onto a machine via RDP the SUS globe rarely shows up (It usually only shows up on the console), and even when it does there'll be like only 3 of the 7 necessary updates showing up in there (this behavior is the same on RDP or the console). I install the updates, reboot and the globe doesn't show up again 'till days later, if I go to the Windows Update site manually, the missing ones show up there.

I've used GFI's stuff before and it worked real well, but it's not free like SUS is, when the demo ran out I moved to SUS. I wish there was a way to host your own Windows Update site using the SUS repository of updates, so you could install them when you want instantly, not have to wait for BITS, SUS, etc. to get it's shit together.

--
grep -iw skynet /etc/services

Can pirates download.? by earthstar · 2005-04-13 02:58 · Score: 1

Can those users with pirated windows [ Common serial ] downlaod these updates?

--

Why does yahoo do this

Re:Can pirates download.? by displaced80 · 2005-04-13 03:06 · Score: 1

Avat me hearties!

Brace the mainsail! I be downloadin' patches!

Arrrgh.

--

Umm. I don't know. To be honest, the whole 'using Windows' thing became too much of a hassle for me to bother after Windows 2000 SP4.

--
What's the frequency, Kenneth?
Re:Can pirates download.? by Anonymous Coward · 2005-04-13 03:36 · Score: 0

Yes. I got mine about 7am EST.
Re:Can pirates download.? by shahken · 2005-04-13 09:55 · Score: 1

Absolutely not!! Microsoft actually sends them tons of spyware alongwith a small microsoft utility.
One month later, the microsoft utility pops up every 5 minutes saying - "Screw with micro$oft, you pirates, and we screw you....all your base are belong to us"
it then crashes the pc, with all restart attempts leading to the new startup screen showing the finger..

those bastards!

Re:Will there be another spate of worms? by lpangelrob2 · 2005-04-13 03:00 · Score: 4, Insightful

No... in fact, after all the flak that was thrown in the uproar over when MS starting saying, "We're not announcing security leaks until we've patched them," I don't recall hearing anything about self-propogating, bandwidth-sucking worms anymore. Heck, not even anything like Melissa or "I love you" lately. No zero-day exploits. Nothing.

Maybe it wasn't such a bad idea after all... or maybe users are learning how to be halfway competent?

--
-Rob
Marriage doesn't have to suck!

Re:Will there be another spate of worms? by ergo98 · 2005-04-13 03:01 · Score: 2, Insightful

No (or at least not to the same scale).

The firewall added by SP2 significantly reduces the threat profile, especially for those people connected to the net bare. Even if a lot of local services are vulnerable, it's less of a threat if external probes can't reach them.

Moved development to Debian by Anonymous Coward · 2005-04-13 03:03 · Score: 0

Our company moved all developers to Debian workstations. Productivity increased (we deploy on Debian as well) and security too.

Some users were also moved to Debian workstations and the plan is for the whole company to be running Linux withing 2 years.

WinXPsp2 isn't revolutionary at all then? by erroneus · 2005-04-13 03:05 · Score: 3, Insightful

I don't know where or how I got it stuck in my head that WindowsXP SP2 was supposed to have fundamentally changed something about the way code ran... maybe it was just a dream. But I thought some of those critical components of the OS had gone through intensive scrutiny and all that when they were compiling updates to build SP2. But, again, I must have been dreaming since these new ones have managed to stick around.

I applied these yesterday and my fax software suddenly lost DLLs that were required for it to function. I haven't been able to determine %100 if there is a connection, but in my mind, that was the only major change to the system preceding the discovery of the problem.

Weird weird weird...

Re:WinXPsp2 isn't revolutionary at all then? by Senzei · 2005-04-13 03:51 · Score: 1

Maybe you should browser through some of the updates to XP between now and sp2 release. If you did (this is slashdot, so that is a huge if) you would notice that there are a significant number of updates that do not affect sp2.

Fundamental changes about the way code runs will fix some of the bugs. Built in buffer overflow checking can do a lot, but there are other ways that code can be broken. Hell if that was the only protection required it would have been done YEARS ago.

New bugfixes do not say anything about the effectiveness of sp2. These bugs are different from what sp2 was intended to fix.

--
Slashdot: Where anecdotes and generalizations can be freely substituted for facts, logic, or intelligence
Re:WinXPsp2 isn't revolutionary at all then? by Anonymous Coward · 2005-04-13 06:28 · Score: 0

I use win XP on IBM x40. Everything from the factory. It is supposed to work fine. All I ask is let me use the VPN connection. Surf the net. Play DVD. Edit files. No office on my system. One more thing, a printer.

It shows me hell. Now and then it gets stuck. It wont respond when I try to remove the USB connected devices.

Funny thing is when I try to shutdown the system it gets stuck for no reason.

I spent 1.25 lakh INR on this. I spent 43 GBP on my triathlon watch. It works great. No problems what so ever. I never need to take it to a service station.

I wish I could go with MAC, but the Sonic Wall VPN client I use is not available for MAC.

Because MS "Painted Themselves Into A Corner" by EXTomar · 2005-04-13 03:07 · Score: 5, Insightful

Why wait a month? Because their patching system blows. They didn't learn lessons learned decades ago about how to patch core components and kernel services and now we live with this every day (or month as the case maybe).

Patching a single Windows machine is difficult especially if you are a novice (many still don't understand why computers "just don't work"). Patching many Windows machines is hard. Patching a live server is hard. Considering how hard some of the patching is on some machines you might even want to consider waiting a few more days to the weekend to apply this patch to patch them especially since one of the patches fixes exploits that are mitigated by using firewalls. Reguardless Windows is so hard to patch you can't have the "on the fly" patching other platforms feature.

It is really lesser of two evils. You can either spend almost all of your time patching or you can lump the difficult time in one large shot. If MS dropped patches when ever they felt it was complete (which is good for security!) you finished updating the entire enterprise (this might take a weeks if not a month with serious stuff like SP 2) you'd have to start over and do it again for a brand new one. So on and so forth.

The real problem is "patching Windows is hard". The "fix" right now to this is pushing patches once a month. As long as Windows is hard to patch then there is no other real solution to this horrible situation MS sold us on.

Re:Because MS "Painted Themselves Into A Corner" by Anonymous Coward · 2005-04-13 03:16 · Score: 0, Flamebait

How is this modded up?

Patching a single Windows machine is difficult especially if you are a novice (many still don't understand why computers "just don't work"). Patching many Windows machines is hard. Patching a live server is hard

I'm sorry but automatic updates is one of the easiest things to use, even my 72 year old grandmother keeps hers up to date (ohhh damn i want to go out to grannys buffet but there is this window that popped up that i must click install to .. ok). Patching many windows machines is hard ? set them to just install the damn things and reboot if needed. Patching a live server or MANY MANY machines, use SUS .. allows you to keep thousands of machines patched easily and verify easily that they are all running the right versions.

blah people need to take a quiz about whatever they are going to post about to ensure that they have enough knowledge in that subject that allows them to post :)
Re:Because MS "Painted Themselves Into A Corner" by Malc · 2005-04-13 03:35 · Score: 1

What are you whittering on about? Patching a Windows machine couldn't be much easier.

Are you referring to the fact that it often requires a reboot, whilst other platforms don't? IMHO opinion there is a major problem with platforms where currently running processes are allowed to continue running even though their libraries have been updated. In effect some platforms allow a process to run indefinitely with security holes even though a patch has been applied. Yes, I'm sure Microsoft could do more to shutdown relevant process to release the file locks, etc, apply the patch and then restart the processes and have them reload their possibly new configs. Rebooting is definitely easier. I think it's a good thing that Windows locks that are in use so that they can't be replaced.
Re:Because MS "Painted Themselves Into A Corner" by Anonymous Coward · 2005-04-13 03:58 · Score: 0

Yes, I'm sure Microsoft could do more to shutdown relevant process to release the file locks, etc

Properly designed filesystems can update files without shutting down processes to release file locks. Just because a file is open, it doesn't mean it has to correspond to an entry in a directory.
Re:Because MS "Painted Themselves Into A Corner" by LurkerXXX · 2005-04-13 03:58 · Score: 1

Dear clueless coward,
Many times patches break things. Either because the patch is bad, or because some application you relied on explited some hole that it shouldn't have that is now fixed by the patch.
Many of those badly written applications are 3rd party vendors. Many others are custom software written/run in-house in corporate environments. When applications all across a corporate network stop working because of this, it is bad. That's why any reasonable corporate network runs patches on test boxes and confirms that everything still functions properly after being patched, before they roll out the patches to the desktops.
AutoUpdates are fine for grandma, but not for everyone.
Re:Because MS "Painted Themselves Into A Corner" by CaymanIslandCarpedie · 2005-04-13 04:01 · Score: 1

|sarcasm|
Dude, I completly agree!!! The first time I saw this windowy thingy pop up saying I had updates and asking if I wanted to apply them it took me over three hours to apply them. I kept clicking on the button but nothing was happening. After a couple hours of reading manuals and doing research on the web the stupid thing just wouldn't work!!! Finally I had to call MS support and they explained I had to click using the "left" mouse button. HOW THE HELL DID THEY EXPECT ME TO KNOW THAT!!!! Since then though its been pretty easy.
|/sarcasm|

Seriously, people used to bitch about having updates happening throughout the month. They didn't like not being able to plan their patching at all. So MS listend to thier customers and have tried to make this a once-a-month process. This works fine since the majority of the issues (at least for the last year) have been found in-house and no public knowledge of them existed. |sarcasm| Still don't know how in the hell they find this in-house. Since its not open-source with thousands of eyes looking through this how could they possbily find this issues in-house? |/sarcasm|

Now if there is a publicly announced issue, MS will fix that and release it ASAP (not always part of montly cycle). This mix of trying to follow a monthly cycle, but releasing publicly announed issues ASAP has sure made my life easier (and more predictable). Some nuts will always find something to complain about and you are free to hold that opionion, but I'm guessing you aren't an admin for a MS environment.

--
"reality has a well-known liberal bias" - Steven Colbert
Re:Because MS "Painted Themselves Into A Corner" by CaymanIslandCarpedie · 2005-04-13 04:12 · Score: 1

Exactly true, but this is why MS policy is good. The grand-parent post made zero sense to me and I also wondered how it got moded up.

The points you make above is exactly why the montly release cycle is good. If they just tossed these out one at a time as they were done you'd have to do all your testing 8 times (in this months case). By grouping them into monthly updates you've cut your work by 1/8th. This is a VERY good thing. MS used to release these updates very willy-nilly but customers complained for the above reasons.

Now if MS has a patch for a known issue then they still will release it as soon as it is ready (not always part of monthly cycle), but as is normally the case these issues aren't known publicly so they release them in an orderly fasion to make everyones life easier.

I'm not sure if you are trying to agree with the stupid grand-parent post, but if so your logic for agreeing is excatly why the post is stupid!

--
"reality has a well-known liberal bias" - Steven Colbert
Re:Because MS "Painted Themselves Into A Corner" by g0at · 2005-04-13 04:52 · Score: 1

So why does Apple have no problem doing this correctly?

-b

--
myselfmusic
Re:Because MS "Painted Themselves Into A Corner" by Anonymous Coward · 2005-04-13 05:37 · Score: 0

Yes, and NTFS allows this too. What's your point?

I don't want my binaries being replaced when it's in use by a process. That's just dumb.
Re:Because MS "Painted Themselves Into A Corner" by Blakey+Rat · 2005-04-13 05:46 · Score: 1

Apple's patching system is the same as Microsoft's, and requires reboots just as often... I don't get how Apple's is "better" than Microsoft, it seems to me that it's the exact same.

--
Comment of the year
Re:Because MS "Painted Themselves Into A Corner" by LurkerXXX · 2005-04-13 05:51 · Score: 1

Calling him clueless was a good hint that I was not agreeing with him.
Re:Because MS "Painted Themselves Into A Corner" by g0at · 2005-04-13 05:52 · Score: 1

That's more or less what I thought, too. The poster seemed to suggest that MS was bound to hold off on patches and lump them together in monthlies because of some inherent problem with the patch system; the implication was that companies like Apple has no such need. Maybe I'm reading too much into that, and the simple truth is that Apple doesn't need to release patches all that often (due to good design, secure products or whatever), so accumulating them monthly is a non-issue.

-b

--
myselfmusic

MS05-019 breaks raw socket sends (again!) by Eyeball97 · 2005-04-13 03:13 · Score: 5, Informative

It seems MS are determined to have XP users disabled from using raw sockets - in itself not such a bad idea for 99.9% of XP users but those of you who avoided SP2 (or disabled firewall/ICS atfer installing it to get round this problem) please note - it's back! and there's no known way do disable it (yet).

Re:MS05-019 breaks raw socket sends (again!) by legirons · 2005-04-13 07:55 · Score: 1

"It seems MS are determined to have XP users disabled from using raw sockets"

Does that mean that network sniffers won't work on an XP machine?
Re:MS05-019 breaks raw socket sends (again!) by Anonymous Coward · 2005-04-13 08:07 · Score: 0

Wasn't Steve Gibson mentioning that raw sockets in XP was a bad idea?
Raw sockets let the application create an IP packet by specifying every part of the packet -- source and destination MAC address, source and destination IP address, and the packet data.
If your machine can pretend to be another machine (not even on your network), tracing who's responsible for sending Denial of Service or Flood attacks is made rather difficult.
Re:MS05-019 breaks raw socket sends (again!) by Eyeball97 · 2005-04-13 08:34 · Score: 1

No, sniffers should still work...
What'll be affected are some of the security tools, e.g. nmap (patch already released) Some Rants about raw sockets here.

Um...Are We In The Same Universe? by EXTomar · 2005-04-13 03:19 · Score: 1

To do an "nightly update" on a Fedora machine you do this:

% yum -y update

Works great, scales well (throttled by network bandwidth). I don't even have to be there to do it. A regular user can continue to use the machine happily. If it requires a reboot then that can be done much later unless flakiness arrises. The point is it doesn't interrupt my work nor the user's work.

To do a "nightly update" on Windows you have to:

- Go physically find the machine if you have no deployment tools or remote desktop.
- Login if no one is there. If someone is there, remind them to click on the icon on the try to patch their machine ("Please, sooner than later"). The worst: boot someone off the machine who locked their desktop. Whatever they were working on is gone.
- If you are lucky, the patch itself requires no real user interaction. If you are unluck, be prepared to get a lot of calls on the help line asking "Should I click 'I accept'? What is this?".
- If you are lucky, you don't have to reboot. More often than not you have too. Not so bad for desktops although many will wait for their Lunch break to do it. So very bad for live servers because you have actually schedule time to do it.
- If you are really lucky, nothing else goes wrong. People go back to work. Reading around it appears on some configurations that one of the patches makes the system unbootable. If you are slighly less luck it is just booting into the Admin console and fixing the problem. The alternative is well....unpleasant. I don't have time to monkey with an individual workstation since there are several more people having problems. Reformat/restore from the stock image if the simple fixes don't work.

I can't say I want any of the Linux machines to behave like how Microsoft does Windows update. Yum and apt-get are infinitely more pleasant to work with. The problem isn't with Window's Update though...it is with the fact that patching Windows sucks.

Re:Um...Are We In The Same Universe? by Kobold+Curry+Chef · 2005-04-13 04:04 · Score: 1

Patching Windows can be made easier. I use UpdateEXPERT by St. Bernard Software to roll out patches and service packs for Windows, Office, and Internet Exploder. I don't ever have to leave my desk, and I can schedule the reboots for the middle of the night. I couldn't run a Windows network without UpdateEXPERT. But I still don't trust Microsoft. Linux patches I never have to worry about.
Re:Um...Are We In The Same Universe? by Anonymous Coward · 2005-04-13 05:33 · Score: 0

Just use Windows Group Policy to specify the Automatic Update installation time and machines will automatically install at that time. You can choose to have the reboot (if necessary) be delayed until the user is actually there to confirm.
Re:Um...Are We In The Same Universe? by drsmithy · 2005-04-13 11:50 · Score: 1

To do a "nightly update" on Windows you have to:
Your lack of knowledge in how to admin Windows machines does not mean the task you want to perform is as arduous as you believe.
So very bad for live servers because you have actually schedule time to do it.
You work in an environment that *doesn't* have scheduled downtime windows ? 8-O
The problem isn't with Window's Update though...it is with the fact that patching Windows sucks.
I suggest you either a) hire someone who knows what they're doing or b) start learning yourself (although I imagine your bias precludes that option). For simple automation of patching, use this.
Re:Um...Are We In The Same Universe? by Anonymous Coward · 2005-04-13 14:31 · Score: 0

No, we are not inhabiting the same universe. You obviously have not heard of Active Directory, Group Polices or even SUS.

Look them up, so your arduous Windows experience can abate and your knowledge will increase appreciably.

Or just hire someone that knows what they are doing.

So, My Fedora Core 3 Install just got 30+ by MerlynEmrys67 · 2005-04-13 03:20 · Score: 3, Interesting

Why is this news at all ?
Patches up

--
I have mod points and I am not afraid to use them

Re:So, My Fedora Core 3 Install just got 30+ by bach37 · 2005-04-13 04:43 · Score: 4, Insightful

Patches for Fedora are regular bug fixes for the 10,000+ Linux packages available. These Windows critial updates are fixes for vunerablilities in the operating system itself, which could be compromised by 'hackers' out there. Totally different from those updates you are installing with Fedora. This is crazy b/c huge holes in Windows are found on a monthly basis. This is not true for any other OS.
Re:So, My Fedora Core 3 Install just got 30+ by legirons · 2005-04-13 07:49 · Score: 1

MandrakeUpdate:
[X] Security updates
[X] Select all
Selected size: 1018MB

Now I remember the reason why I don't apply security-patches on Linux machines. On my modem, that would take 2.5 days of constant downloading just to get security updates (although since UK modems get cut-off after every 2 hours, it would be more like 30 sessions of 2 hours each to get a Mandrake 10.1 machine secure)
Re:So, My Fedora Core 3 Install just got 30+ by Anonymous Coward · 2005-04-13 09:51 · Score: 0

Those are patches for the programs of your current installation. Not for the Linux operating system.
Re:So, My Fedora Core 3 Install just got 30+ by legirons · 2005-04-14 05:54 · Score: 1

"Those [the 1GB of Mandrake updates] are patches for the programs of your current installation. Not for the Linux operating system."

What? Are you suggesting they shouldn't be updated?

In fact, I'm pretty sure they are part of the GNU operating system. Things like SSH, lib-JPEG, lib-PNG, lib-SSL, kde-multimedia, kde-base, etc.

IP Settings by Anonymous Coward · 2005-04-13 03:21 · Score: 0

The latest patches took the liberty to remove all of my IP information. Thanks for nothing.

Re:hey by inertia187 · 2005-04-13 03:22 · Score: 0

That wasn't an OS login. That was a Workgroup/Domain login, albeit misleading.

--
A programmer is a machine for converting coffee into code.

Are you new? by Luscious868 · 2005-04-13 03:28 · Score: 1

Can we expect a news article every month blasting Microsoft for releasing security updates? Christ, where are the news articles when updates come out for other OS's? Or is it only a bad thing when Microsoft does it?

You must be new here ....

Two words: Akamai Ghost by Anonymous Coward · 2005-04-13 03:39 · Score: 0

if you are unfamiliar with akamai's distributed replication service, then you are obviously stunned that microsoft pays big cash for their service so that the microsoft update services WONT go down like a whitehouse intern.

Re:Two words: Akamai Ghost by ScentCone · 2005-04-13 03:45 · Score: 1

if you are unfamiliar with akamai's distributed replication service

Actually, I put up content through Akamai, so I do know about it (and like it, when they aren't getting DNS DDOS attacks!). I'm comparing apparent post-Patch-Tuesday download rates today, as opposed to, say a couple months ago. It's anecdotal, but I'm just saying it feels a lot quicker than it has in the past. No biggee, just warm and fuzzy.

--
Don't disappoint your bird dog. Go to the range.

mod parent up!! by Anonymous Coward · 2005-04-13 03:40 · Score: 0

And your post was modded "flamebait", which proves your point.

Re:"Critical" patches every month. Sure, we can wa by Peldor · 2005-04-13 03:41 · Score: 1

MS went to a 'regular' monthly schedule to pacify the sysadmins out there who were tired of wondering when they were going to have to push a new update out. It's easier to schedule your work when you know there will be a monthly patch.

If a /. user ever starts dating a girl, maybe they can better explain the appreciation of foreknowledge of the monthly cycle.

Not that big of a deal for desktop users by owdi · 2005-04-13 03:43 · Score: 2, Insightful

I'm going to pass on this patch, these vulnerabilities are hardly what I would call 'critical' for an xp sp2 home desktop user.

If you have XP Service Pack 2, and are behind a router, the ICMP vulernability is a non-issue. Your router responds to pings, not your computer.
If you use Mozilla Firefox, the IE vulnerability is a non-issue as well.
The Exchange vulnerability is a non-issue for desktop users.
If you use MSN messanger, update. I don't.
If you open other peoples word documents, update. I use Abiword, or let google translate them to html.

-Dan

Re:Not that big of a deal for desktop users by NetCow · 2005-04-13 04:05 · Score: 1

If you have XP Service Pack 2, and are behind a router, the ICMP vulernability is a non-issue. Your router responds to pings, not your computer.
You probably mean "behind a NAT gateway using an IP number fom the Private Address range". If you're using a publicly routable IP number your host may happily respond to ICMP echo requests.
If you use Mozilla Firefox, the IE vulnerability is a non-issue as well.
You probably mean "if you use Mozilla Firefox and unless you're absolutely sure you don't and won't, ever, use the zillion other applications that embed mshtml.dll".

Generally though - patching is important even if you don't actively use the affected components. Security is not an on/off thing, it's about minimizing risk exposure. Why leave a potential hole unpatched? You never know when the existence of that hole may come back later and bite you in the ass when you least suspect it. Take it from someone who's been there :).
Re:Not that big of a deal for desktop users by Anonymous Coward · 2005-04-13 05:31 · Score: 0

Maybe you should switch to Microsoft products. Then maybe your spelling wouldn't be so damn sucky. Fucking LinSux Zealots everywhere!
Re:Not that big of a deal for desktop users by kybred · 2005-04-13 05:32 · Score: 2, Informative

If you have XP Service Pack 2, and are behind a router, the ICMP vulernability is a non-issue. Your router responds to pings, not your computer.

You do know that ICMP is more than just pings, right?
http://www.ietf.org/internet-drafts/draft-gont-tcp m-icmp-attacks-03.txt
kybred

Re:"Critical" patches every month. Sure, we can wa by Anonymous Coward · 2005-04-13 03:49 · Score: 2, Insightful

People don't want to be updating every five minutes.

Microsoft don't force these updates on people. If they release the patches when they are ready, you can still only update once a month if you want to.

Furthermore, if the security hole hasn't been publicly announced, there isn't normally something exploiting it.

I think you mean "if the security hole hasn't been publically announced, people have no clue whether there are things exploiting it or not."

Or do you think that black hats make formal announcements when they discoever vulnerabilities?

I think this is a matter of risk management

Indeed it is. By releasing patches on a regular basis rather than when the patches are finished, Microsoft force their customers to go from a known, quantifiable risk (the cost of testing and patching) to a completely unknown risk (the possibility of being compromised, unknown severity).

So yes, it's a matter of risk management - Microsoft are taking away your ability to manage your risks effectively.

why is this newsworthy? by jbltgz · 2005-04-13 03:51 · Score: 1

Would someone do me a favor and tell me why this is newsworthy? Alright so Microsoft announces eight security fixes. Fantastic. They've announced five thousand before this, and they're gonna release five thousand more. Do yourself a favor and setup your box for auto-update, install a good AV program, use Firefox instead of IE and make sure you're running XP SP2, and just consider yourself relatively safe. It's a windows desktop for christ's sake. Who cares if it gets owned. You're an idiot if you have anything important on there in the first place. ;-)

Re:"Critical" patches every month. Sure, we can wa by Anonymous Coward · 2005-04-13 03:52 · Score: 0

MS went to a 'regular' monthly schedule to pacify the sysadmins out there who were tired of wondering when they were going to have to push a new update out.

What wondering? Tuesdays, Thursdays and Fridays, regular as clockwork. It became a running joke on Slashdot it was that regular.

Patchfest 500 by zx-6e · 2005-04-13 03:53 · Score: 0

Geeks... start you patches!

Re:"Critical" patches every month. Sure, we can wa by Kobold+Curry+Chef · 2005-04-13 03:55 · Score: 1

Microsoft should really have a category higher than "critical." They still do occasionally release a bulletin out of cycle when it's a huge, gasping, oh-my-god-the-dam's-breaking issue. Otherwise, they stick to this schedule because it makes Windows sysadmins' lives much easier. Since you can't trust Microsoft patches not to break your systems, you have to spend a lot more time testing, testing and retesting before deploying the patches. It's easier to do that with a batch of 8 patches monthly, than with individual patches on an irregular schedule.

Re:"Critical" patches every month. Sure, we can wa by GigsVT · 2005-04-13 04:00 · Score: 1

It's just an example of CYA bullshit that actually causes more risk of something bad happening. If something breaks you can fix it.

"Complete testing cycles" are used because if something breaks, the IT guy can shift blame instead of taking responsibility for the systems they maintain.

--
I've had enough abrasive sigs. Kittens are cute and fuzzy.

Re:WS2K3 SP1 -- INCORRECT by Kobold+Curry+Chef · 2005-04-13 04:12 · Score: 1

All of the patches in yesterday's release were already included in Windows Server 2003 Service Pack 1, or do not affect that platform.

Exploits by Anonymous Coward · 2005-04-13 04:21 · Score: 2, Informative

As part of my job I've been tracking exploits for these as they pop up on the usual lists and public exploit archives. So far there's an instant root shell using a single HTML file opened in IE; ditto for "windows shell remote code execution"; and a couple for Access (tho' I don't believe those were actually part of the Patch Tuesday frenzy.) Fun times! Who's running the book on whether someone will wormify one of these? My betting is NOT; I think MS have managed to do just enough to get back ahead of the skiddies (well, worm-author skiddies anyway) for the next few months at least. XPSP2 is taking all the fun out of incident response ;)

Hah! So's Win98 by Tackhead · 2005-04-13 04:24 · Score: 1

> Yay, Microsoft Windows XP is now completely invulnerable
> Thanks, Bill.

So? 98 and 98 SE haven't had a "critical" vulnerability in years!

On a more serious note -- I'd love to see a better explanation of why 98 and 98SE are never critically affected by some of these holes.

Sometimes (most of the time, these days), a Win98 box really isn't vulnerable. If it's a hole in some stupid SYSTEM-level background process that listens to port XYZ on XP, and the process doesn't exist on 9x, then the 9x box simply. isn't. vulnerable.

Other times, you really have to wonder if "contains the affected component but is not critically affected" simply means "we never bothered to check".

Sure, 9x doesn't have any security model to speak of, but when was the last time a 9x box got owned by simply installing it out of the box and plugging it into a network? (All the holes that rely on 9x's lack of a security model require some form of user intervention, even if that intervention is as innocent as "using IE", "running Outlook", and anything to do with filesharing over NetBIOS or running IIS as "user intervention". But I don't think IIS was turned on by default on 9x, nor was filesharing over NetBIOS. I could be wrong; it's been a long time. What'd I forget? There's still a part of me that would bet on an unpatched 9x box and an enclued user to outlive an XP box, even with autoupdate turned on.)

Windows... when will the bugs get squashed?! by rice_burners_suck · 2005-04-13 04:27 · Score: 0, Offtopic

Time to stop running Windows, which I use under QEMU... XP is too darn slow under QEMU anyway. That's why I'm waiting for Darwine!

I just don't understand why an entire computer's hardware has to be emulated in software, and then the operating system, with all its polling and processing loops, interrupt handling, and background crap that it does, has to be emulated as well.

Darwine is going to eliminate that. It's going to have an application loader, so when you click a Windows .EXE in Mac OS, it will open it in a loader. QEMU will then run the executable, emulating only the processor. All system calls will convert data structures to Mac format and then call Wine functions, which will be compiled natively under Mac OS. I think this will bring about a tremendous speedup, as only the application will be running, and applications spend nearly all of their time just waiting for input, so it won't take hardly any processor resources; and finally, only the program's inner workings will run under emulation. This is exciting!

And screw Windows, SP2 and all... That OS is so full of vulnerabilities and bugs that it's not even funny anymore. Microsoft just patches upon fix forever. Their code probably contains functions 1000 lines long that have indents going so far to the right that they're voting Republican and attacking the Middle East for cheap oil, which keeps going up anyway. (Proof, as much as I hate to admit it, that Bush didn't lie about Iraq, 'cuz if he did, Gas would cost fifty cents a gallon by now. I hate to admit it, but I was wrong about him.)

Yeah. Windows sucks.

Re:Windows... when will the bugs get squashed?! by Anonymous Coward · 2005-04-13 05:20 · Score: 0

And when the hell will the Linux bugs stop?!?!?

Mac?!?!? Every THREE months they realeas a package of 15-20 security fixes!

Hell FireFix has joined IE with monthly security fixes.

Geeze, open your eyes and close your mouth till you have managed to obtain an objective view of the universe.

Re:Will there be another spate of worms? by masklinn · 2005-04-13 04:27 · Score: 1

Even though NVidia's NForce now provides you with a free hardware FW running on every windows box (and probably with linux too)...

And now starts the joy of wondering why you can't sur the pr0n websites when you've got your router's firewall + your MB's firewall + XPSP2's firewall activated at once

--
"The way we can tell it's C# instead of Haskell is because it's nine lines instead of two." -- wadler

Literal Police by Just+Some+Guy · 2005-04-13 04:28 · Score: 1

They quite literally want to build a automatic cake making machine so they can have lots of cake while they're eating their cake : )

No, we literally do not. We do literally want to ban all nonstandard language usage, figuratively speaking.

--
Dewey, what part of this looks like authorities should be involved?

Re:Literal Police by arete · 2005-04-13 13:25 · Score: 1

If you followed the other replies, plenty of them seemed to want literal cakes, lots of literal cakes. In addition to the other machine : )

If you don't want lots of literal cakes, maybe you haven't tried the right cake? I'm partial to angel food - beautiful, light, and cholesterol free.

--
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot

Did they wait for forced SP2? by 99bottles · 2005-04-13 04:33 · Score: 0

Someone has probably already mentioned this, but doesn't it seem very suspicious that this occurred just as the block on SP2 was removed? Did they just hold on to these until they could force SP2 out with some patches that would be in demand?

Vague? Those are _source_ patches! by Saucepan · 2005-04-13 04:38 · Score: 1

And yet they are less vague than the ones which have recently come out of OpenBSD. That's scary.

All of the OpenBSD updates on the page you linked to are in the form of source patches. If those are vague, what exactly would you consider precise?

Have a look at 014: SECURITY FIX: March 30, 2005, for example:

Due to buffer overflows in telnet(1), a malicious server or man-in-the-middle attack could allow execution of arbitrary code with the privileges of the user invoking telnet(1). Noone should use telnet anymore. Please use ssh(1).

Where the patch adds, among a couple of other things, the ability to ignore certain kinds of environment variables:

- if ((ep = env_find(var))) + if ((ep = env_find(var))&&(!exported_only || ep->export))

It seems to me that this is about as detailed information as anyone could possibly ask for.

First one, then the other. (n/t) by Rhinobird · 2005-04-13 04:49 · Score: 1

(n/t)

--
If Mr. Edison had thought smarter he wouldn't sweat as much. --Nikola Tesla

VB Coders... by Anonymous Coward · 2005-04-13 05:00 · Score: 0

Not using option explicit, Not declaring (Dim'ing) vars; Bad indentation, LOTS of errors (like strSQL = without quotes), Typos (isMicrosoft and isMicorsoft ), Sloppy coding, No error handling, no use of anything OOP (too "complicated")... The code is buggy at best and does nothing useful. Typical VB code :)

See, I told you so... by Anonymous Coward · 2005-04-13 05:04 · Score: 0

This proves definitively that Linux is WAY more secure than Windows and that Open Source is the only way to go. When will the Windows sheeple wake up and fight "Da Man". Only complete losers that don't truly understand computers use Windows. M$ intentionally delays patches to hurt their users.

Re:See, I told you so... by Anonymous Coward · 2005-04-13 08:10 · Score: 0

What an insane troll.

During the last two months there have been 50 patches for redhat, and a lot more than 8 of them were core OS security problems!

This just proves that Linux is completely useless and should only be used by retarded trolls that live in their parents basments I guess...

Wrong by jmulvey · 2005-04-13 05:07 · Score: 1

I guess you haven't seen Group Policies Microsoft included to control automatic updates.

From your desk, you can simply go to the root of your Active Directory, and apply the "Auto download and schedule the install" Group Policy object.

http://support.microsoft.com/kb/328010/EN-US/

If you only want some of your clients to apply updates, you can filter the policy appropriately.

Hooray! by ErZo · 2005-04-13 05:08 · Score: 2, Funny

"Microsoft Releases Eight Security Updates" - And twentyfour new ones! Yay!

--
In the Soviet Union, signatures writes you!

Blast of patches by TripHammer · 2005-04-13 05:20 · Score: 1

I don't understand why they like to wait and release 8 patches at once. Why don't they just release each patch as it's ready? Anybody who's got a large network is probably using beta Windows Update Service or Software Update Service by now, which can pull updates daily, so it really wouldn't be an inconvenience to release them separatly. I just don't see why they sit on 'crittical' patches.

Re:Blast of patches by Anonymous Coward · 2005-04-13 08:08 · Score: 0

Good question.

But why does Apple wait THREE months before releaseing 16 updates at once?

Though on the other hand, having Redhat's update manager send out new update notices at a rate of about one every two hours gets to be extremely tiresome...

It's a strange world.

Not quite. by SatanicPuppy · 2005-04-13 05:20 · Score: 3, Informative

Explorer is part of the operating system, remember? So explorer exploits count as OS exploits, especially because a lot of the explorer exploits are arbitrary code execution exploits, which are beyond critical.

--
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.

Re:"Critical" patches every month. Sure, we can wa by DodgyGeezer · 2005-04-13 05:35 · Score: 0, Troll

Care to back up your statements with some links to stories of problems caused by exploits occuring before the announcement? No of course not - you can't. You should be moderated troll, not insightful.

Re:"Critical" patches every month. Sure, we can wa by Keeper · 2005-04-13 05:47 · Score: 1

Microsoft don't force these updates on people. If they release the patches when they are ready, you can still only update once a month if you want to.

Actually you can't. Once the patch is released, the vulnerability is exposed. After that point, it is a race between the people trying to figure out what changed in the patch to exploit that vulnerability and the people patching it.

BSD TROLL MOD PARENT DOWN by Anonymous Coward · 2005-04-13 06:01 · Score: 0

LOSER

Install SP2 by km790816 · 2005-04-13 06:11 · Score: 2, Informative

Take a look at Microsoft Security Bulletin MS05-019.

If you are running SP2, none of the flaws is considered worse that "moderate".

1) The criticality of a fix depends on the OS. A critical bug is Win2k may be only moderate in XPSP2, but it's always advertised as just "critical".

2) This is good proof that (at least my Microsoft's analysis of criticality) XPSP2 does improve security dramatically, even in the face of defects.

--
A speech...

wow, you can't read by arete · 2005-04-13 06:28 · Score: 1

That's a record for me - your entire post rebutted by the very first line of the post I ALREADY made. woot!!!!

" You misunderstood. /. wants everything. Especially because different people want different things...)"

The rest was, naturally, a joke. Which is why, naturally, it was modded insightful. But that's not my fault (unless I really do have superpowers I haven't confirmed).

At this moment apparently it's an insightful funny troll - I think 4/1/1) And my other reply (which was, in my opinion, much less funny) is a +2 funny -1 offtopic. So naturally the less funny one is marked more funny. Which I find funny, Karma about talking about mods be damned.

PS. At this moment the ggp is modded +4, 70% insightful, 20% Funny, 10% Troll. Which adds up to 100, but implies that it's more funny than troll, and I can't make the math work out, even with significant rounding, unless it's +1/-1 Funny/Troll, which would imply that they should be the same, however you're rounding. Does it just give whatever is left to the last category? Did somebody complain too much about it not adding up to 100%? It rounding to the nearest 10% saving cycles somewhere?

PPS fnord

--
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot

Already had to reboot thanks to updates by WillAffleckUW · 2005-04-13 06:28 · Score: 1

because of all the updates, which have bogged down the networks, and then it blew our Firefox when Adobe tried to self-download a patch caused by the Microsoft patches.

Cascade failure.

It always sounds easy to bug fix, but the problem is each fix can cause more fixes, and everyone assumes only their fix is occurring at any one time, while in the real world they all happen at the same time, since people being human put off things on Monday and do them Tuesday "when it's not so busy" ...

The funny thing is Microsoft will get this error report of my PC locking up as if it was Firefox, when the reason the CPU overbooked was Adobe and Microsoft ...

--
-- Tigger warning: This post may contain tiggers! --

Re:Already had to reboot thanks to updates by exKingZog · 2005-04-13 07:57 · Score: 1

Had exactly the same problem with with Firefox/Acrobat Viewer today. Log off/on cleared it.

--
"If he were a plant, people would roll him up and smoke him."
Re:Already had to reboot thanks to updates by WillAffleckUW · 2005-04-13 08:29 · Score: 1

Had exactly the same problem with with Firefox/Acrobat Viewer today. Log off/on cleared it.

Kind of hard to do when the CPU is running at 100 percent. After I killed the Firefox.exe process, I did a full shutdown and reboot, once I had the Adobe Acrobat Viewer update completed.

Sigh.

--
-- Tigger warning: This post may contain tiggers! --
Re:Already had to reboot thanks to updates by exKingZog · 2005-04-13 08:45 · Score: 1

Rule The First: PCs will always slow down / hang / crash / just plain not respond when ($time == ($home_time - 10minutes) && !empty($workload) ). At least, that's what always seems to happen to me...

--
"If he were a plant, people would roll him up and smoke him."

WS2K3 SP1 killed my Dell PowerEdge 1750 by today · 2005-04-13 06:32 · Score: 1

Apparently, the 1750 running as Domain Controller gets killed after SP1 application. It bluescreens "BAD_REGISTRY". Lucky for me, someone else had this problem on USENET. The solution is to contact Dell and get this regprep.iso image that you burn onto a CD, boot the 1750 onto it, and it fixes the problem by booting tiny WinXP and changing the registry. After that, everything is okay.

Dell is recommending not applying SP1 until they've had a good crack at it. Looks like June.

But by geekoid · 2005-04-13 06:56 · Score: 1

all the people who did buy there copy are SOL becasue they will still be getting hit from these machines when they get exploited.

And it was not theft, it's copyright infringement.
yes it's wrong, but they're different for a reason.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

Uhh.... by ekwhite · 2005-04-13 07:10 · Score: 1

Would one of those security updates be Linux? That seems to be the only way M$ can be secure.

Re:Uhh.... by Anonymous Coward · 2005-04-13 07:13 · Score: 0

Amen Brutha.
Re:Uhh.... by Anonymous Coward · 2005-04-13 08:06 · Score: 0

Uh... Considering that Linux is riddled with security problems, with new ones monthly, how is it any better?

Have you updated your FireFox twice since 1.0? No? Then you are vunerable to attack!

Even OSX has had an average of about 5 security problems a month (patches in bundles of 15 every three months) since it's release. Do you actually think that since the Apple patches come every three months that they are more secure than Microsoft's that come every month?

I mean come on now, you don't actually believe the /. FUD that Linux is 100% safe and secure out of the box, now and forever do you?

Ghod help us all if you do :(

And do yourself a favor, read and stay current with Security Focus before making any more blindly ignorant statements like this in the future.

That's why I stuck with windows 3.1 by Timmy+D+Programmer · 2005-04-13 08:11 · Score: 1

I think they "almost" got it sorta secure.

--

(If at first you don't succeed, do it different next time!)

Before we bitch... by rainman_bc · 2005-04-13 08:33 · Score: 1

up2date in my FC3 installation had 37 updates last I checked. I'm sick of the amount of updates that come out for that... It's started to get annoying.

That's JMO, YMMV

--
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

obligatory Trustworth Computing comment by stryc9 · 2005-04-13 08:39 · Score: 1

8 new bullitens, 3 revised, 21 Vulnerabilities...

*This* is 'Trustworthy computing?'

--
www.madeofwinandawesome.com

Why are people STILL surprised by Anonymous Coward · 2005-04-13 08:48 · Score: 0

...by MS bashing in this forum? And why do the type of people who feel sorry for Gates and think they have to defend MS hang out here? Are you people brainless or just lost? How many clues do you need that this an anti-MS site? Here let me help you http://www.microsoft.com

DAMN RETARDS by Anonymous Coward · 2005-04-13 09:04 · Score: 0

How stupid you have to be wrtie that comment, and how stupid mods are is quite impressive.....

Only eight? by DJBigShow · 2005-04-13 09:40 · Score: 1

Geez. You know it's scary when you read this, and think to yourself 'Only eight?'

-DJBS

Who's the "retard?" (Re:DAMN RETARDS) by lord+sibn · 2005-04-13 10:38 · Score: 1

It really isn't that complicated. A vulnerability is one issue. A "critical" vulnerability is something which could immediately compromise the system if uncorrected. Yet if a "critical" vulnerability shows up the day after the monthly patch cycle, Microsoft does not issue the patch for another ~29 days.

I do not run any "mission-critical" applications, but to me, a 29 day head-start for the ill-intentioned is 29 days too much. I, like any reasonable person, would like to have my patches on the same day. if not available on the same day, then as soon as possible. 29 days later is flagrantly irresponsible.

But I forgot the windows mantra. Is it not "Reboot, Reformat, Reinstall?" Hey, a lot can happen in 29 days. Am I just supposed to sit, vulnerable, on an untrusted network? No thanks. If you want to... Please give me your IP address. (;

Re:Emerge! Emerge! by drsmithy · 2005-04-13 11:57 · Score: 1

Can you easily roll back an emerge ?

IE, strictly speaking, isn't part of the OS by fostware · 2005-04-13 14:17 · Score: 1

IE is part of Explorer - the GUI of Windows...

The fact it automatically runs somewhere between Administrator and User level just means it's exploits are more critical and harder to stop but it doesn't make IE part of the OS itself.

This illustrates the point that it's too hard to compare apples to apples in a purely objective way, as the choice of where to draw the line depends on what the reviewer is expecting to get out of the comparison. (or what his advertisers / income source do)

(IE integration can be argued to death, and I am sure there are some links to the OS beyond the GUI, but you've got to draw the line somewhere)

--
"We know what happens to people who stay in the middle of the road. They get run over." - Aneurin Bevan

Re:IE, strictly speaking, isn't part of the OS by JadeNB · 2005-04-14 03:59 · Score: 1

This illustrates the point that it's too hard to compare apples to apples in a purely objective way
I understood the suggestion to be to compare Solaris, Linux, &c. to Microsoft. Comparing to Apples is a different matter.

Why couldn't Bill consolidate the patches into 1? by Anonymous Coward · 2005-04-13 17:09 · Score: 0

With MS Marketing (TM) second only to MS Legal (TM) in the success of the company (MS Software design comes in somewhere between 5 and 6), I'm surprised they didn't try to bundle everything into one patch.

As we all know after carefully reading the "get the facts" campaign, security is not defined by responsiveness of the vendor. If that were the case, MS really has pulled a boner on keeping its systems secure.

But, according to marketing, and highly influential and well-paid "in-your-pocket" consultants, vulnerability is measured in the number of distinct security fixes provided.

Maybe MS could reduce the number of security updates to 1 roll-up patch per year, proving once and for all its security is superior to all those OS's that provide security update as needed without concern for artificial metrics. Maybe they should provide updates only once per every five years. Hell, why not go for once per decade? The marketing boys and girls would love that.

Of course, if your analytical ability is so pathetically shallow as to agree with the above, you should really quit your IT position and apply for a lucrative position with the Yankee Group immediately.

Right by Anonymous Coward · 2005-04-13 20:20 · Score: 0

I work at MS, and you're insane if you think most of the security patches are found in-house. Active testing on already-released software is close to NIL, except for tests of security patches of course.

Most vulnerabilities are reported by external sources or are backported from newer versions. You'd think that the latter would happen often, but actually hitting that bar for backporting is not as high as I would like.

Re:Vague? Those are _source_ patches! by nenolod · 2005-04-14 01:35 · Score: 1

While I am fully capable of reading a patch, most people are not, and thus a detailed explanation of what the patch provides must be provided. It is imperative. Also, look at the latest patch against TCP... there is no explanation as into why that was necessary, and the patch provides no explanation even in the source, it just changes some timestamping logic around and does not say why.

As an OpenBSD user, I'd much prefer that they disclose more information about their patches before they release them.

cute little magic penguin by arete · 2005-04-14 01:53 · Score: 1

I just now got this vision of commercializing the cute little penguin with magic powers, but with this backdrop of being in a cheesy clown horror movie.

The penguin sold in the supernatural equivalent of ThinkGeek or the like... advertised as helping with "the one area of life we couldn't help you with before"... having to sacrfice something to the little penguin with a knowing smirk on it's face.

Sold in a bunch of varieties based on what sort of partner you're trying to attract...

Let's just hope nobody gets a defective one!

--
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot

Re:cute little magic penguin by Short+Circuit · 2005-04-14 05:00 · Score: 1

Hm. I can see it manifesting itself in an RPG. An enchanted stuffed penguin that improves the charisma of whoever is holding it.

--
tasks(723) drafts(105) languages(484) examples(29106)

NT4SP6 by Strider_Hiryu · 2005-04-14 03:43 · Score: 1

IT did the patch overnight here in the office. Half the computer either couldn't get their monitors to work afterwards, or the NTLDR jumped ship.. did anyone see anythign like this?

--
You steal men's souls.. and make them your slaves...

Microsoft update...again. by pearce25 · 2005-04-14 05:03 · Score: 1

Oh lions, tigers, and bears oh my. Another round a patchware from crapware land. When will we ever learn?

Re:Will there be another spate of worms? by Anonymous Coward · 2005-04-15 04:33 · Score: 0

Worst. Sig. Evar.

Slashdot Mirror

Microsoft Releases Eight Security Updates

344 comments