Slashdot Mirror
Security Patch Creation at Microsoft
devonshire writes "Officials at the Microsoft Security Response Center have provided a detailed look at the process used to create security patches. From the time the first vulnerability data is received from grey hats to the time a bulletin is shipped, it's a pretty interesting look at how they handle the information flow and patch testing and why it takes so darn long to release an IE update."
New Windows worm circumvents Microsoft patching process
Windows and IE being no exception. The very fact that users have neither access to the source code nor the ability to build the application sources means that any testing must be done "in-house". This is going to slow down the release cycle by exactly the amount of time it would take to run all the regression tests.
With Open Source, a patch can be released right away and users can compile in the new sources themselves. Any issues can be immediately identified and reported back to the maintainers, often with both the offending source code and potential fixes to the patch. Without the lengthy QA cycle, Open Source patches are much more immediate than any Closed Source shop could ever hope to achieve.
With Open Source, a patch can be released right away and users can compile in the new sources themselves. Any issues can be immediately identified and reported back to the maintainers, often with both the offending source code and potential fixes to the patch. Without the lengthy QA cycle, Open Source patches are much more immediate than any Closed Source shop could ever hope to achieve.
Or, in other words, with OSS, everyone is a tester!
Instead of just believing the people that there is a problem, they have to test it out and develop a plan and then reprogram the piece. I hate that. In my company they have implemented such system too and if you have a problem you have to wait a month before it is planned in (if it is accepted by a group of non-technical managers) and then another month before it is fixed making a problem sometimes last for over 6 months and after an endless amount of pointless meetings there is finally some kind of fix. Programmers in corporation are under a lot of (time) pressure and that is not good as it makes them make mistakes. But they have to be able to make quick fixes (as is with most Linux projects) without any corporate meetings or managers.
Custom electronics and digital signage for your business: www.evcircuits.com
I don't think there's a single service on a windows box that can withstand a UDP flood. This has been known to be an effective DoS method for years...roommate using all the bandwidth with bittorrent? Playing Doom3 in the middle of the night with the volume jacked up?
Send a UDP flood to ANY of the services which are actively listening by default, problem solved. Where's the triage team on that one? I guess 99.9% resource consumption isn't a vulnerability in their eyes.
are you seriously suggesting you'd just release a brand new patch into the wild without even cursory testing?
who's going to want to install it? when everyone is a guinea pig, a certain reluctance to jump in first may manifest itself.
Screw you all! I'm off to the pub
so, after all we've been led to believe, Windaz patches aren't being written by one-million monkeys?
Mongrel News all the news that fits and froths
This is only true for big-name projects. Small opensource projects are probably less well supported than their small corperate counterparts. As a lone developer without the hardware and backing of a company I can't patch and identify issues as I would like. As to users giving you feed back. HA! The best I get is once in a while someone tells me that something crashes. I might die of shock if someone sent me fixed source code.
Philosophy.
Microsoft's non-security is well organised. :-)
real OSS projects actually have an organizational structure.. a closer knit group of users associated with the project will test and comment (or fix) problems they see with code. when the code seems to be good, it is released to the public as an actual release.
It's not easy to test an IE update. There are six or seven supported versions and then we're dealing with all the different languages. Our commitment is to protect all customers in all languages on all supported products at the same time, so it becomes a huge undertaking. 1: languages shouldn't be a problem, that is (hopefully) not completely split up throughout the source code is it? aargh!!!! 2: I know only a 3 SUPPORTED IE versions (IE 5, IE 6 and IE 7)
Custom electronics and digital signage for your business: www.evcircuits.com
"This is exactly why it can take a long time to ship an IE patch. We're dealing with about 440 different updates that have to be tested [for different versions]. We have to test thoroughly to make sure it doesn't introduce a new problem. We have to make sure it doesn't break the Internet."
? ? ? ? ? ?
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
I know the process!
1. Identify holes in current software
2. Release patches that only fix some of the holes
3. Start charging for tools to take care of the rest of the holes
4. Profit!
(If you're from Indonesia, no problem, the software will only cost $1 anyways)
Well, Microsoft does have Automatic Update working for them. They may have slower patch creation times, but they can push the created patch to you much more quickly. If you were a corporate executive, would you say that you'd rather immediately install an externally verified patch, or take your own company's time and resources to verify the patch? Sure, for large, computer-intensive operations like air traffic control or medical care, you'd need to verify the patch either way. But if it just means that a secretary wouldn't be able to play Solitare, and especially if your company doesn't have any individually-designated "Computer Security" positions, I think you'd install the patch right away. Also, it'd be ill-advised for an open-source shop to not regression-test patches before release anyway. I don't want to see the size of your Bugzilla database.
I mod down pathetic posts.
Microsoft makes security patches? And tests them too?
unable to resolve function slashdot.sig(), aborting...
Microsoft is adding a patch to a pair of jeans, but it's difficult because after all the previous patches the pair of jeans looks like a spherical ball of patches 10 feet in diameter.
why it takes so long to issue a patch is because it takes 8 days a week for them to get off their ass .
Jonathanjk.com
Again, you keep saying how good OSS is compared to CSS. Now tell me, honest, if you write an application and someone tells you they can sell it for $100/copy and give you 50% of each. Would you still make it open-source? What you said is true, but I'm tired of everyone bragging about how "cool" OSS is. Yes, it's cool, but writing it isn't...
We have to make sure it doesn't break the Internet.
Don't worry, guys, no matter how badly you screw up it won't hurt the Internet - because the Internet doesn't run on Microsoft boxes. Hard to imagine, I know, but true.
Isn't the writing of Open Source software the whole point?
If no one wanted to write it, OSS wouldn't even exist.
Remember what ESR wrote about this? "If you treat your users as if they were your most valuable resource, they will respond by becoming your most valuable resource."
In other words, I think this is all about community-building, and I grant you that this may be beyond what you can do as a single developer who simply shares some code with the world. Still, I have found ESR's statement to be quite true in my own projects, and it only takes a small effort to express this attitude in the e-mails you send to your bug reporters.
Linux distro's have automatic updates too and the distro maintainer assumes the role of testing the application with the new patch applied.
The GP was only half-right by saying that 'a patch can be released right away and users can compile in the new sources themselves' is a strength of OSS. In reality only small numbers of users do this themselves, most simply get it through their distro's auto update feature after its been tested and qa'd by the distro maintainers.
Pre-canned Evolution Links for all those Slashdot holy wars.
real OSS projects actually have an organizational structure.. a closer knit group of users associated with the project will test and comment (or fix) problems they see with code. when the code seems to be good, it is released to the public as an actual release.
So what's different about that compared to the pre-release testers employed by Microsoft? not a lot, it may seem. Besides, my reading of the OP's post didn't indicate this was the meaning at all.
The fact is, going back to the OP's harebrained scheme, that no-one is going to apply a patch to a critical environment unless it's been through major testing. Sure, your l33t box under your desk which you rebuild every week anyway? patch it with whatever you like, but a production database server pushing out data to thousands of clients? I want that bastard tested thoroughly before the patch ever hits the net.
Screw you all! I'm off to the pub
I find it strange that open-source application authors never, themselves, sell their product as well. Why wasn't the creator of WINE the founder of TransGaming or CrossOver Office?
Well, there are major sub-versions, too, like IE5.5SP2, etc.
Several times over the years I've discovered multiple code paths in Windows which apparently perform the same function. I discover them because performing what is ostensibly the same act via more than one of the typically myriad interface controls to initiate the given desired action sometimes differ ever so slightly (note the sarcasm in my voice) in result. I've seen these sorts of artifacts all the way up through Windows 2000. This problem exists without looking at multiple languages and how functions may vary on that axis -- who knows.
It's clear that the design of Windows contributes to the difficulty of patching and testing it. Given that, it's impressive that they can deliver interim security patches at all. The track record of not breaking random other stuff when they fix a buffer overflow vulnerability has been pretty good lately.
If you mod me down, I shall become more powerful than you could possibly imagine.
We have to make sure it doesn't break the Internet [web access provided by IE, which as far as our customers go means breaking the Internet]
The Internet wouldn't be broken as such, but I doubt the users would see it that way. To them, it doesn't matter if it is the browser, the connection or the servers (massive worm?) that is broken. They can't do what they want, hence it is broken. It is as simple as that.
Kjella
Live today, because you never know what tomorrow brings
Which is basically a fancy way of saying you're going to treat your user base as guinea pigs and let them test your patch for you.
Hopefully any "issues" they have will not have been fatal...
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
I don't think that the biggest point behind the OSS movement is necessarily the cost of the software, but rather access to the source code. In a business environment, a lot more money goes into support for the software, than the actual software. I feel that a lot of applications could quite easily be sold for a profit, even though they are open source.
"Why it take so long" ... because MS does not want to stuff-up the IE team as it is not a immediate profit source.
....
...
... we will (not!) miss you.
I am not blaming them, it is a normal enterprise goal : cut cost, increase margin
But as we all know MS do not care about IE (anticipated IE7 will be a small improvement only, nothing comparable to Dean Edwards's IE7 fix, by the way), there is no reason for any of us to use their tool.
After having dominated the browser world, Netscape has sunk because they did not care of improving the quelity of the standard support, binging new functionalities and making their product fast&stable. Now it is MS turn to fall in the trap
Bye,bye IE
It's a big publicity stunt - but a needed one at that.
"With Open Source, a patch can be released right away and users can compile in the new sources themselves. Any issues can be immediately identified and reported back to the maintainers, often with both the offending source code and potential fixes to the patch."
That might work for your basment project with 3 users, but wont work if you roll out something that companies actually use and rely on, and I bet its more expensive having someone sitting and testing your "Open source patches" then actually pay for it in the first place.
"It's not easy to test an IE update .... We have to make sure it doesn't break the Internet."
Sometime a joke doesn't need a punch line.
As an Open Source developer, I'm not in this for the money. If I were, you can bet the project would be Closed Source.
Rather, I want this project to be open and usable for all. To that end, I license it under the GPL and anyone is free to use it.
So my users are partners with me. They are not my guinea pigs. Though I maintain control over the project, there is no set-in-stone law that no one else may fork the project. In fact, they are encouraged to, if they feel it necessary.
I release the patches, and they accept them or reject them, depending on their own circumstances. I don't rule them with an iron fist. I consider them my Knights of the Round Table where they all have the right to say what they want and none is any greater than the other.
So maybe you think that users are passive slugs, but I'd rather give them the benefit of the doubt.
You may want to learn other people's experiences.
I write Free Software, have PLEASURE doing so, and sell it as well.
All this without any third party keeping 50% of it (modulo the PayPal fees).
Granted this doesn't amount to millions, but it is just a side job, since I've already got a full time job. This works just fine anyway.
The proof here.
Votez ecolo : Chiez dans l'urne !
The fact isthat no-one is going to apply a patch to a critical environment unless it's been through major testing
At the risk of staying on topic:
The fact is that no-one is going to have a critical environment that uses IE. If you're using wininet or winhttp for your mission critical apps, shame on you.
BBH
"It's not easy to test an IE update .... We have to make sure it doesn't break the Internet."
.... We have to make sure it breaks Firefox and Opera."
Here I fixed it for you.
"It's not easy to test an IE update
Better
Was I talking about IE? Was the OP? Surely we were debating the patch process in general, not specifically IE?
Besides which, a hell of a lot of corporates consider their intranet (extranet/web) apps 'critical'. IE (or other browser) is a major component in that mission-critical situation, wouldn't you say?
Screw you all! I'm off to the pub
I haven't RTFA, but I'm guessing there will be mention of lots of monkeys banging away at keyboards and one big balding monkey boss who is able to speak one word of English starting with the letter 'D'.
...of the phrase "the Internet" are you having trouble understanding?
Hint: Internet != WWW
Customers Complain About a New Security Hole. The number of complaints reaches Management's "Action Threshold". The Patch Process is started.
1. First, blame the customers' other software packages for the insecurity.
2. Then, blame the customers' for failing to apply services and hot fixes in a timely fashion.
3. Security Focus (or another of the Sec/Priv sites) calls up and threatens to "out" the hole if it isn't fixed.
4. Accuse the complaining entity of having a "partisan" agenda against your company, initiate "Four Corners" Stall -- while you try to figure out if you actually CAN patch the damn thing
5. As the news of the new exploit makes it into IRC and the UGs' Forums you issue an indignant press release stating that it has never been proven that the new exploit has even been used and is principly "theoretical".
6. As your Patch Team frantically works to get the patch out, explain that even though the chances of this exploit being used WERE previously slender or non-existent, now that some details of the exploit have been malicously leaked, HEAVY SIGH, you'll now go ahead and fix it.
7. Issue the patch, take credit for being "Right on Top" of security issues, explain how much money and time you are spending to counter the effects of the "Few Bad People" on the Internet.
8. News start to come in that your patch has broken a number of somewhat older apps -- explain that Users have a responsiblity to use "current" software products and refer them to Sales.
9. News of another exploit comes in --GOTO 1
BTW, this is pretty much AN INDUSTRY STANDARD APPROACH
In Commerical Software, it's the FEW companies that DON'T do some version of this that are the (delightful) and unfortunately RARE exception.
Ten quid, she's so easy to blind. And not a word is spoken...
My experience directly contradicts this on all points.
When I reported the hyperthreading security flaw to Microsoft, I was provided with the first name of the person who was responsible for dealing with it ("Christopher"), but I was not provided with his last name, phone number, or any e-mail address (apart from the generic secure@microsoft.com address which I used to report the problem). Later the issue was transferred to "Brian" -- again, no last name, no email address, and no phone number.
Over the following two months, I heard from three independent third parties that Microsoft was "very concerned" about this issue, and had "several people" looking at it; but they never made it clear that they wanted to work closely with me -- in fact, they ignored all my attempts at co-operation.
Finally, prior to releasing my paper, I sent several emails to Microsoft asking about their progress and asking for a vendor statement for my web site; again, they did not respond.
Tarsnap: Online backups for the truly paranoid
so what ?
I have a Win95 OSR2 net connected box here that has never been owned either
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
OMG! IE is not teh internet. AOL is!! every1 noes that d00d! ROFL!!!11
...purely political.
Microsoft wants to give you one "bad news" per month. Predictable, patch time is "low" meaning the time between release and installation is low. It is easy for IT staff to work that way, you can schedule it.
OSS will give you a patch per issue, patch time is near instant, but they keep coming at you all the time, whenever you can't afford to waste time installing them. That is why you need a distro to keep you patched at all times.
The rest? Bullcrap. The security patches for Linux don't cause more regression issues than Windows. Like Microsoft, they do audits but instead of one "catch 'em all" release, they do several. In short, it is to make Windows look good.
Kjella
Live today, because you never know what tomorrow brings
You can sell OSS.
Thanks for mentioning the pros of Open Source. I agree, but that's not the point.
Even OSS developers do some testing before they release their code. At least for the larger (multi-developer) code bases. Quality is essential if you don't want to scare your users/co-developers away. And quality is only partially a result of programming skills.
Now you may point at the difference in emphasis between informal release-testing and formal QA in the legal sense. But it's just rediculous to assume that OSS solves everithing to the point where you just merge & release everthing you type and/or every patch submitted to you without even looking at it.
--
It is impossible to make anything foolproof because fools are so
ingenious.
If Debian isn't the epitome of an Open Source project that's overly obsessed with quality releases, at the expense of frequent releases, I don't know what is.
I write code to accomplish what I intend, and I succeed. I don't need to test. What needs testing is other peoples' crappy code that my code depends on. I'm looking at you, GW BASIC maintainers!
For 90% of people, the web is the internet.
For 88% of them, the internet is IE.
Which means that 79.2% of people think that the internet is IE.
My Journal
are you seriously suggesting you'd just release a brand new patch into the wild without even cursory testing?
:)
You can always release a patch to the patch if any problems are found with it
But seriously, it makes most sense to correct most bugs (that will be caught in the short-term) before a wide release, where there is a single copy of the source, rather than after release, where there are as many copies as there are users.
With open-source anybody is free to provide this service. If the author only has the time/motivation to do barely-tested releases, why reject his code? Someone else with the desire can do testing and make releases to a wider audience that are more stable, and users can choose between the two options (or more). These can even form without any direct arrangement between the various parties.
Thanks for posting that, I'd mod you up if I had points. Which, typically, I don't.
Open source doesn't eliminate the need for testing, but it can make it easier, and specifically make it easier for knowledgable users to fix bugs themselves and contribute back. As for the testing release issues, it wouldn't be much more trouble for closed-source systems to release nightly builds to the world to test, just less tempting to test.
The fact that users can fix bugs themselves, though, is not an excuse for releasing buggy software. By all means give users who want a bleeding-edge release access to your newest and greatest (but maybe not quite fully-tested) code, but don't go around releasing such code as your official version. Give it some time, test it a bit, before putting that out. Just because people can bug test and fix their own software doesn't mean that they should be made to.
OSS can make testing easier, but it does not, as you point out, remove the need for it. For anything above a "hobby" project, for things you actually expect people to use, it's just irresponsible not to undergo at least some testing. Overuse of "caveat emptor" just makes OSS look unprofessional -- which is fine, but it could cause problems when trying to break into more corporate grounds. The people who say both that companies should use more OSS, and that OSS doesn't need to be tested, really need to re-evaluate at least one of those viewpoints.
I sense I'm ranting, so I'll stop.
note to
clearly, there are many different types of software users... from those that actively contribute to it's code, to those that test out the latest versions and report bugs, to pure users that just want to use your tool to get their own stuff done.
most users fall in the last category and they'll quickly jump ships if your stuff is too buggy/unusable and/or there's something better out there user-wise... case in point, firefox, where the majority of the 30+ million downloaders were not open-source contributers but rather software users that found something better.
but hey, if you're just interested in chucking untested code out there for your "partners" then more power to you... this "passive slug" will be supporting more serious projects.
You mod this troll, but it's absolutely correct. The main benefit of subscribing is to view the site mentioned in the article, before it is 'slashdotted'.
Syntax error: you made statements where you obviously intended to ask confirmation about some random thoughts you had. Next time, try using the question-mark construction. E.g:
"Isn't it true that testing is only a priority on closed source apps?".
Which would of course have been answered with "no". Recommended reading available on request.
Although teorethicaly it is possible to sell OSS, it is not proffitable.
Why would someone want to buy something he can download for free in other place?, if people tend to "download for free" something that they CAN NOT (by law) use for free??
Of course, now you will tell me that RedHat, Mandrake, etc etc are making buisness with OSS, but the truth is they are making buisness SELLING SERVICES, not the software.
Now, I am a programmer (well, I was a programmer before I started my PhD), I really like to program, when I was in the University I was a Linux advocate (although when I was in High School I was a FreeBSD advocate... can you imagine I bought FreeBSD without really knowing what was it... then when it arrived I spent like 3 weeks installing it, I was like 13 or something).
But, after I finished the University I had written some programs which I wanted to sell, hell I DO know how to program...
I put them like shareware on the internet, it was cool, but I also wanted to "contribute" to the OSS, in the "real world" (i.e. outside the net in my life) I was trying to get a job, As I lived in Mexico that was no easy task, so all my income was from my shareware programs and some money my parents gave me.
But I WANT to program for a living, and that is NOT possible with OSS, only people who have a name and are at the top position in this "OSS" power hierarchy can do it.
There where possibilites of open sourcing my programs and then proffiting with the "customer" services, of course the money I would get there was going to be a hell less than the money I won with my shareware (which was not a lot of course) and besides I DID NOT studied any kind of administration or client service degree I AM A FUCKING PROGRAMER and I want to program because THAT IS WHAT I KNOW HOW TO DO!!
So no, it is not possible to live selling OSS, it MAY be possible to live selling a service but not by pure development.
And of course it is possible to get hired in a company which develop open source as a branch (IBM, Sun, Mandrake, etc) and you could say that you earn your living with OSS... but the one that is paying you is the company.
Nowadays I am making my PhD outside Mexico (no, not in the US, in Europe). I have a wider view of this OSS, and althouh I understand it is great for acadamey (in fact I OSS it every day) It is NOT right for the commercial developer... And now as I have seen the Programming buisness is very crowded I have decided to enter the academy buisness, that way when I return to my country with a Europe degree I would be able to enter and teach somewhere at least...
And, I will be able to use and create OSS (of course as a side project JUST FOR FUN). At the end, that is why the OSS projects propsere, people do them JUST. FOR. FUN.
Ubuntu is an African word meaning 'I can't configure Debian'
not everyone. but if you got, say 30 people in the inner testing circle.
you know, that would be the "in house" testing, and if it's a trivial fix, adding of one length check or whatever, it wouldn't matter.
world was created 5 seconds before this post as it is.
note to /. editors: Some of these "I am a human script" images are, as far as I can work out, impossible for mere humans to read....
So log in, earn your karma bonus and they'll go away. And you can still post anonymous, like meeeee!
hence the buzzwords alpha,beta,testing,stable,unstable?
"Oh, it's ok, we'll release a patch instantly and the users can review/compile it themselves."
I don't know about you, but I have things I actually want to _use_ my computer for - I don't want to have to review any code changes for patches/upgrades/new versions and check them before I do an install.
Not that I even have the technical know-how to do that for the vast numbers of programs out there.
My Journal
If you don't test the error, how do you know that (a) there really is an error and (b) where/what the error actually is?
Sure, the process should be streamlined so that you don't take months to do that, but then the process described in the article _doesn't_ take months if it's handled properly.
My Journal
Have you ever heard of Linus Torvalds?
Sometimes (at least once) he submits patches without even compiling them!
Um, open source has little to do with charging money for the product.
Yeah, I know.
BTW nice photos from your last party.
Grundgesetz * 23. Mai 1949 - 30. November 2007 - http://www.vorratsdatenspeicherung.de/
+3, Funny
Come on, we don't have to take it seriously.
It's closed source; Closed architecture; Closed development processes. They could be throwing code together like monkeys and making all this stuff up for the PR value. Who knows?
I'm not trying to flame-bait here, either. These are the simple facts. Flame-baiting would be saying something like: Haven't they always boosted their value via PR and under-delivered? Or: Doesn't Microsoft lie like sacks enough for you to notice?
That would be flame-baiting. But I'm not flame-baiting.
and Microsoft doesn't. I mean .. Apple came up with expose, which is really cool. Spotlight is eally cool .. and dashboard. True aside from Expose these weren't super "original" but they sure got it to work nice.
s /design.htm
It's side but very few corporations foster innovation. I think it has to do with the fact htat internally within corporations there is too much back tabbing and politics going on. I don't believe it's inherent in capitalism. Google is able to innovate. Apple is able to innovate.
Microsoft does have people capable of doing the innovation necessary. For example, a research group developed a cool UI called TaskGallery http://research.microsoft.com/ui/TaskGallery/page
Quote: "Instead of confusable and hard to learn icons, open documents and running applications are shown as snapshots, small versions of their actual appearance."
That was back in 1999, yet it was Apple that came out with Expose! And now well M$FT will look really bad copying the idea from Apple.
LOL.
Recommended reading available on request.
Yes please. I'm a product of the american skool system.
Security Flaw is discovered Someone else finds Security Flaw Flaw is patched
got laid in high school, do you think there'd be a Microsoft?
Of course not.
You got to spend a long time stuffed in your own locker with your underwear wedged up your ass before you start thinkin "I'm going to take of the world with computers! you'll see, I'll show them."
Your Average Joe
Once upon a time, musicians gathered in groups and performed on street corners -- just for fun. Often they'd drop a hat, so passers by could show their appreciation. Sometimes they could put on whole performances, rent space and charge admission. Once in a while, they could play for their king and make real money.
Then the record industry was born. Now a song could make a musician a steady stream of money, for many years. However, after decades of "success" the public saw through this sham and invented ways of putting the right perspective on the value of music and performance. And the musicians returned to being performers because the former era was over.
Actually, that's not how the story ends because the rich benefactors of the record industry used their money to create laws to enforce their way.
Once upon a time, computer programmers gathered in groups to share ideas and collaborate on projects -- just for fun. Often they would solve some incredible problem and get recognition for it. Sometimes they'd get paid hourly to solve a specific problem. Once in a while they'd get real funding.
Then the software industry was born. Now an application could make a programmer a steady stream of money. However, after decades of "success" the public saw through this sham and invented ways of putting the right perspective on the value of software and applications.
Actually, that's not how the story ends. It'll be a while before we get to the end.
I sell lots of open source software. Very little of this software have I written. It's easy for a software-savvy person to download and install OSS applications. It's difficult for the majority of the people on the planet to understand how to download and install any application. That's what I charge for.
You probably wouldn't believe how many times a week I'm asked to install CSS applications. These are packaged products that should be easy for anyone to install. Yet your average business owner and their entire staff are intimidated by the prospect of having to install any application (OSS or CSS) -- they'd rather visit the dentist.
Think about it: For CSS applications, the end user often pays twice.
Can a programmer with 20+ years of experience make good money with OSS? I do.
=)
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
The fact is that no-one is going to have a critical environment that uses IE
Really? Thats great news! I'll just go and tell my boss that none of our web based apps are "mission critical". He'll be thrilled that we don't have to worry about them anymore.
"I realise this is not a very popular opinion but it's the truth, and there for needs to be said" -Bill Hicks
Free Software is about giving your customers the freedom to do what they want with the code you have written - giving away code for free is not required.
I am TheRaven on Soylent News
This is why concise, clear and well documented modular programming is a winner. Even Firefox suffers this. It's a huge mess of code that a handful of people could even be bothered to read...
In microsofts case everything has to be implemented upon layers of undocumented C++ classes to which the average microsoft employee [let alone third party developer] can't decode.
Tom
Someday, I'll have a real sig.
I realize you are trolling but I ran XP home for the past 7 months with a cable modem connection, download ing porn and warez, cracks and never got owend. I also am not an idiot and installed zonealarm, ad-aware, and ms antispyware as well as virus scans with a warezed version of NAV 2005.
Peopl e who ge towned are usually idiots.
So, M$ knows that you get a complex QA process (and therefore worse quality) if your products "are closely tied to the OS".
If they are so concerned about security, why don't they try to create components that are less closely tied to the OS?
Some people submit a vulnerbility report to the brickwall called Microsoft Support. Then after 6 months they release a security opdate. And now they call the submitters "Grey hats"? What do they call themselves? The "Pink hats"?
:-) = I am happy
:^) = I am happy with my big nose
C:\> = I am happy with my OS
> So what's different about that compared to the
> pre-release testers employed by Microsoft?
The OSS groups are open, thus if I really want the fix, I can download and inspect it myself.
New things are always on the horizon
That's not really true in general.
There are 3 types of users... those that just use the app and, if something doesn't work, go and use something else - these are the majority and you never get feedback from them.
Then there's the ones that are helpful and feedback problems. It's good to build up a core of them.. they're a scarce resource. If you want a subset of those who actually send patches.. well I've had 5 patches since January, from approx, 250,000 downloads.
Then there are the ones who demand a fix *now* and get really pissy that the app they downloaded for free doesn't do exactly what they want it to do (bonus points for those who have deployed in a mission critical app without testing first). There probably aren't more of those than in the second group but they take up a disproportionate amount of time.
I usually reckon for every bug report I hear about maybe 100 people have tried it and not bothered to report it (the ratio is probably much higher). It's kind of annoying when someone finds something 2 months after a release and 50 people add to the thread saying they had the same bug and were waiting for a fix...
Yep, but usually the companies that ask you to make some software ask you for ALL the rights of it.
And, what about selling a company the software and giving them the GPL (something YOU have to do if you are using the GPL as it sates that the software must come with its license).
I wonder what would they say when they discover that the software they are buying at $5000 can be downloaded from sf.net
Or even worst, that their competitors can get it also free.
Ubuntu is an African word meaning 'I can't configure Debian'
It's Microsoft, where are the pictures of happy people smiling at their PC screens???
No more I say.
I think this is the power of Open Source software. Bug fixes, little feature enhancements, and all the other little fixes that should be there can get made. With closed source software, you never really know when you're going to get a fix to a certain problem. Think about VS .Net not playing nice with SVN, because it dislikes filenames starting with a ".". In the open source world, this bug would be fixed in days and everybody would have access to the fix. With Microsoft, it's a wonder when, if ever it will be fixed.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Our software is so hopelessly intermingled due to the manner in which we tried to get around the anti-trust laws, that simple updates take far longer than they should.
You mean it's been updated? Oh, those are "features", not bugs!
Running on 1200bps are we? I agree, no netbeui will penetrate that :)
No more I say.
Um, the GPL doesn't say that you have to give your code free to everyone on the planet.
It says that you have to give your code free to anyone you sell the binary to... *if* the person ask for the code.
so a company using internal GPL'd code does NOT mean that their code will be avaliable to their competitors, unless they sell their product to their competitors.
multifariam.net -- yet another nerd blog
The OSS groups are open, thus if I really want the fix, I can download and inspect it myself.
And you're deeply immersed in *all* the codebases you run enough to understand what's going on?
I don't see a "Lennie" on the GCC submitters list. So you don't update your GCC?
to mod you flame-bait.
But I won't.
Granted, the notion that you might release a patch without much testing is a heretical one.
But here's another heretical notion: Some changes (to some systems) require less testing than others.
A small, isolated patch to a well-controlled system should not require an exhaustive, timeconsuming, complete test pass. If you have found that every change does require an exhaustive test pass (because of the number of times you've been burned by seemingly unrelated new bugs cropping up as a result of a seemingly-innocous patch), this is a symptom that your project is not well-controlled.
There's also the point that when a patch is to fix a critical security hole for which exploits may already be circulating, users may actively want to deploy that patch ASAP, even if there's some risk of a newly-introduced bug -- a BSOD is not nearly as bad as being 0wned.
"A few weeks later, the Blaster worm ripped through the Internet and Microsoft released MS03-039 with an admission that additional ports involving RPC remained unpatched. That was an experience that taught us a valuable lesson. It's better if we find it before the bad guys figure it out" he said. - MSRC program manager Stephen Toulouse.
Its hard to believe anything MS says about how thorough its security efforts are, given their 20-year ongoing failiure. It really looks as though the continuing security stumbling is an outgrowth of the convenience-over-security+appearances-over-qualit
Just look at patch tuesday. Rather than release a patch when its ready, they wait so it will be easier for customers. Nice and predictable, in a world where security problems are anything but. It has nothing to do with waiting to test thoroughly, it has everything to do with appearances. They won't really improve their continuing security debacle until their OS monopoly is effectively broken, and they have to actually put up or shut up.
"We are all geniuses when we dream"
- E.M. Cioran
It's like making the most dismal part of software even worse. Software development processes suck and produce buggy software. The fix to this problem is not to do even less testing and make the end user fix it. It's like GM sending you a catalog of repair equipment instead of recall notices.
User review of code in OSS is a great idea, but it doesn't replace the need for a solid process to happen before the code is released. You can't cross your fingers and hope your end users fix your stuff. Cause what if they don't?
Help me take back Slashdot. When did 'News for Nerds' become 'FUD and Conspiracy Theories for Extremist Nutjobs'?
[1] "We're on all the [security mailing] lists, just like you are, and we investigate everything, even if it's a post about a simple weird behavior in a product," said MSRC program manager Stephen Toulouse [2] Even though Microsoft has recruited external patch testers as part of a formalized Security Update Validation Program, Toulouse said the quality assurance process has become "very, very complex," especially for products that are closely tied to the operating system
Who the hell modded this funny?..
He's close, but not spot on; customers demand quality software, but are forced to deal with faulty programming and broken applications. Customers wait for 'quality' patches, and deal with the associated trouble of a system that's broken-in-the-meantime. But hey, we've got fade-out windows and drop shadows, and some really neat animated assistants, so I really shouldn't complain?
perl -e "eval pack(q{H*},join q{},qw{70 72696e74207061636b28717b482a7d2c717b343 637323635363534323533343430617d293b})"
You have a choice. Every new patch dosn't mean a new release so normal users will run stable code. But then there are a few that like to live on the edge and download the CVS version, which contains a patch. You would be suprised how many people do that.
Cheers,
RoadkillBunny
Or to someone who gives it to the competitors.
Even Windows for Workgroups 3.11 can be set up for broadband. As for dialup, it's just as capable of getting 56k as XP.
Does anybody have a link to an article about the process that Firefox uses? I'd be interested to compare the two.
This is actually insightful, and unlike the rest of /., isn't bashing MS like its going out of style.
But it does mean that any products they develop that incorporate your tool must be GPL'ed. And they generally take a dim view of giving products away for free.
If you don't know where you are going, you will wind up somewhere else.
Use a distribution, they will test for you while you use your computer for thing you want to do.
Sheesh, I am a programmer and i rarely compile/patch a program i want to use, i just install it and use it.
Dilbert: As part of your ISO 9000 certification do you have a defined pathing process and what is it?
Elbonian Balmer: We hold a village meeting where we boast of skill and curse the devil spawned enduser.
Elbonian Gates: Sometimes we Juggle.
Elbonian Balmer: The at the last second we slam out some code and go roller skating.
What always cracked me up about that joke is that it is defined process and therefor meets the requirements of iso 9000 certification.
Some drink at the fountain of knowledge. Others just gargle.
I have several friends who used to do technical support for Microsoft, and according to them many of the recent patch problems are caused by the following things:
1. Microsoft and it's outsourcing companies have started to 'offshore' many of the patch creation and testing jobs to India (and possibly other overseas countries). Now don't get me wrong, I'm sure they have some great programmers in India writing excellent code (I've met some amazing programmers here in the US that came from India), but what quality code can you expect from someone making something like $3.00 an hour (or less!) and being pressured under deadlines.
2. Since many of these jobs have been outsourced or offshored to another country, the staff actually at Microsoft doing patch creation and review has been reduced severely (possibly as much as 1/3 or 1/2 of the jobs since remain here). There are too many patches, too much code, and too much testing for the small number of people left actually at Microsoft to handle.
I'm not saying the previously released patches from Microsoft were anywhere near flawless, but I think there has been a large increase lately (in the past 1-2 years) in faulty patches and then secondary patches to correct problems caused by the first patch. The problem seem to also come from Microsoft's move to patch security holes as quick as possible at the stake of breaking something or breaking third-party software (due to not enough testing), even if that something is major and breaks the whole OS. They are in the mind-set that security patches come first and that they can then go back and use feedback from users to correct bugs in the security patches released to fix security bugs.
By the way, my friends also lost their technical support jobs when their jobs were offshored to India. Sounds like the whole support aspect of the Windows OS is moving overseas.
Here's a question. What's stopping a malicious hacker from taking half-ass tested patch and inserting a payload into it and then publishing it as "stable & tested"?? How do you know its good when you can get patches from untrusted/unknown sources or someone's personal page?
How many of you actually check that the patch is good before blindly applying it?
Maybe you can't but others certainly can, and if you are so inclined, you can learn.
Also the fact that code is open makes the authors more careful, i would think. If I am going to publish code with my name on it, I would hope it doesn't suck.
Closed source could have terrible code style and use all sorts of hacks, and no one would know. Or it could be perfectly written using Hungarian notation. With OSS, if you have bad code, people who can read it, will, and tell others.
Besides, if you want, just do a search for printf and gets in the code -- you might find some bugs w/o having to write a thing.
Why?
Closed source application authors doesn't sell them too. Usually they work for the people who sell the programs. At least all the ones I do.
You know, writing code and selling it are complete different matters, that require a complete different set of skills and that usually can't be made at the same time.
sigh. Why is it that when people can't figure out how something is done, they simply say "it CAN NOT be done"?
Firstly, let's get something clear: hardly anyone makes money simply selling software. A perfect example is databases -- for all but the high-end database projects, a free database works just as well (sometimes better) than a commercial, closed-source DB. Yet, people still buy MS-SQL server, and Oracle, and the like for even small projects. Why? They are buying the support of MS and Oracle: not just the telephone support but the "this large company has vetted my software" support. They are buying trust and service.
Now that that's clear, let me explain that I make money by selling OSS solutions, and that RedHat and Novell make money from my work. I contract as an OSS developer/integrator. I sell my development ability and support. But, my clients buy Linux from Novell or RedHat; they are getting support from me, so why would they buy these OS, when they can be had for free?
The answer is simple: people (and to a greater extent, corporations) see value in something they've paid for. If something happens to me, they know someone will stand behind the product. They know that someone they've paid is working on security patches and improvements. And, ultimately, they know the product is less likely to be abandoned.
So, when my clients buy Linux from RedHat, they are buying exactly the same thing as when they buy Windows from Microsoft: trust. Trust that the software has some degree of quality, trust that it will be patched and maintained, and trust that it will continue to be available. With OSS, however, they get the bonus of knowing that migration to another vendor will be relatively painless because the vendors of OSS software have access to each other's code.
It is possible to make money with OSS, but it is a lot harder to start your own OSS business. People don't like buying software (closed *or* open) from one-person organizations.
We may not imagine how our lives could be more frustrating and complex—but Congress can. – Cullen Hightower
And this is different from what M$ really does? (I did RTFA but the BS-O-meter pegged several times in the process. M$ users pay to Beta test both the software and the patches).
10 monkeys, one keyboard, five minutes.
lather, rinse, repeat.
Although teorethicaly it is possible to sell OSS, it is not proffitable.
Why would someone want to buy something he can download for free in other place?, if people tend to "download for free" something that they CAN NOT (by law) use for free??
You could always sell your software (like regular closed source shops), and provide your source to your customers only (which is all the GPL requires). I could see an OSS license emerging that basically states "you get the source, but you can't re-distribute our software" - no different than closed source, except the customer has the added benefit of the source code. Handy if a customer is willing/capable of tinkering with it themselves.
Oh, as for your other concern: don't worry the slightest bit about it. Well under 10% of software developers actually work on closed source, sellable software. The overwhelming majority of us develop in-house stuff, and open/closed source isn't an issue.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Honestly, if you reported this to me, I'd blow you off too. Even academics admit it is virtually impossible to eliminate side channels. No UNIX does it, and Windows doesn't either. And it doesn't take hyperthreading to communicate info across tasks. As soon as the first OS failed to flush the cache across context switches, this type of window opened.
Any local root exploit will provide more capability to steal info from other processes anyway. And ther are many many of those in Windows and Linux too. EVERY ONE of those would take priority over this problem, which means this issue will probably never rise to the top.
So your research, IMHO, got at least as much attention as it deserved from Microsoft.
One man's flamebait is another man's informative.
who's going to want to install it?
:(
People who, for example, compile Linux builds on a weekly basis to test for bugs. It's always been this way in the Open Source world.
"Oh look, a new patch for WinXP! Let me update my CVS repository..."
"Alright, now it's just time to compile the DLL."
(5 minutes later)
"Okay, now let's make the winxp installer patch"
(5 minutes later)
Reboot.
Yeah it's a pipe dream, I know...
department for testing
(damn restricted length subjects).
Even just for home use, Firefox is a huge pain in the ass to update compared to IE.. so much so, that I'm still running 1.0 or 1.01 on most of the machines I use.
It seems like they do very little/no testing that updates to FF won't break things..
I am the maverick of Slashdot
It should not, no. But unless you're omniscient and can see EVERY possible ramification of your change, especially in a large code base, it should.
And since most of us aren't all-seeing, how hard is it to rerun your unit tests?
No unit tests? Probably not a well-controlled system then, is it?
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
What are the specific problems you have with FireFox updates?
The only ones I've seen are that (on Windows) it doesn't clean out the old entry in the add/remove listing so you end up with listings for it from 0.8 up to 1.0.4. But that doesn't cause anything to break.
They also don't release "patches" to a version. You get the whole new version and it does a complete install. But that doesn't cause anything to break.
I'm still looking for the specific problems that people are having with FireFox but all I'm getting are generalities about how it "broke" or it isn't as good as IE.
Apparently you've never heard of a Linux distribution. Among other things, they QA shit. Maybe drop your LFS install and get a real distro?
sorry, I'm still waiting for my coffee to be done :(
Because we all know that failures make tons of money. Just look at Paris Hilton. /Just because you have issues with something doesn't make it a failure.
I think you are responding more with anger than with logic. Firstly, whoever did your deployment of firefox, should have tested it before he went to everysingle machine and deployed the update, this is called quality contorl/damage contorl. secondly it is very easy to remoe firefox, and install whichever version you need. From what i gathered in your statement, you are claiming you have never had any down time or senseless tech cycles put towards removing spyware or malware on any of your computers. I do tech support as a consultant for about 20 small businesses. this is by far the most common phone call i receive, "my computer is broken i cant get past these pop up adds, internet explorer keeps crashing its really slow and i cant get my work done" now there are some malwares and spywares you cant get rid of, i've reimaged machines after several hours of attempting to remove some of the newer variants. now let me ask you where did you save the time, and money? was it from the extended hours of firefox, in a deployment cycle, (seriously this should take moments to install and uninstall)? If you think i am exaggerating call Dell or any other computer support company and ask them the number one call they receive, it isnt that firefox isnt working its their entire os, to which they respond put in your restore disk, so they can keep a profit margin. Im not a fanboy, but i do see the weakness behind Internet Explorer, and the fact that microsoft didnt update a thing until they lost ground to Firefox (ie: they had to protect their name) seriously redo your math, and figure out, where your costs lie, if you think the only response is hiring a unix/firefox coder to analyze and fix firefox code, then your techs are incapable, or just plain idiotic,or you should cease doing your own tech cos you are doing more damage than good.but i suppose you just pass the costs along to your customers, as is the american way.
Here's a question. What's stopping a malicious hacker from taking half-ass tested patch and inserting a payload into it and then publishing it as "stable & tested"?? How do you know its good when you can get patches from untrusted/unknown sources or someone's personal page?
Uhhh... don't use untrusted sources? Trust sources only after they demonstrate integrity? Replace malicious with ill-tested, buggy and the same applies.
You're an idiot.
Looks like Sarge has got some problems.
Which goes to my original point. Regardless of the amount of testing that goes into your project, at some point you're going to have to release to the real world and all that QA work that you thought you did turns out to be insufficient.
Better to have released early and often and let the real testers (your users) find the bugs. Sarge is hardly the state of the art, but it took so long to finally get released. How is the old buggy release any better than Redhat's up to date buggy release?
I constantly hear people say all the ways you CAN make money doing OSS. The fact is, I have not heard these things from a single person actually DOING them. It's like hearing fat people talk about how you should diet. While there's something to the ideology that they would know more then someone who has never had to worry about their weight... you're still not going to take them seriously. Companies most certainly do buy software from single person companies called Micro-ISVs, if you don't believe me check out Eric Sinks articles on the subject. He is someone who has done it (both open and closed).
It's complete malarkey that testing is only a priority on a closed source application. In fact, the beauty of open source is that many of the lower level products of open source (libraries) are fundemental elements of much larger commercial products. Regression testing at the library level is a very common practice, and some development communities (I'm sure you all dislike perl, it's not my favorite language but this is my favorite example) like CPAN even force atleast some tests to be in place before a library can be distributed through that system.
In many of the large sucessful projects I see test cases are a huge part of the development. Look at mozilla's tinderbox system, it automates lots of tests before patches are even accepted into the development branch. This is after a patch has been either created by or reviewed by one of the core developers.
Open source is not some wild west land where anyone can go around adding any code to any project they want...well I mean they can, but it won't effect the distribution. Distributions are still controlled by the author of the project, and anyone else the author decides to delegate the responsibilities (aka privileges) to.
When I'm building a proprietary application, I often end up building it out of a number of generalized solutions which I abstractify into libraries with carefully thought out APIs in order to promote reuse and flexibility. I do this so that not only I can use them with other applications, but so with some careful evangelizing with my customer(s) I can convince them it is in their best interest to allow these generic elements of the application to be distributed in the public domain.
One thing people keep missing about open source is that it's a developer's method of doing things. It doesn't mean we can't create great user desktop software, but it does mean that open source isn't an approach to replacing vendors who develop and support software. It can be a model for sharing all generic parts of an application to give it good code review, increase its stability, and for developers to collaboriate indirectly on a very large scale.
I think OS-X is a great example of this at work, Cocoa being *just* as proprietary as windows, but the actual underlying system is just as open source as linux. Obviously Apple's developers know how to build a great user interface and have the infrastructure necessary for enterprise quality support, where the open source community has the ability to build flexible, powerful, innovative solutions that could not take shape without having thousands of prying eyes on the source code. The result is a solution that's easier to use, harder to break, more flexible and more powerful than anything that could ever come out of Redmond.
Now if only we could get Apple to quit being selfish and make the daring move to becoming an OS Vendor as well as a computer manufacturer, maybe there could be a viable desktop software solution for the average person who thinks of a computer as an appliance. From what I've seen, Microsoft's software is far to easy to break for these kind of people, and the literally computer illiterate stuggle with it horribly. And speaking from experience, developers used to more sophisticated ways of doing things (such as by following standards and whatnot) find MS software hard to work with.
Microsoft warns on security fixes
Microsoft has issued an alert about a bumper package of security updates for Windows.
A total of 10 updates will be released on 14 June to fix a variety of flaws in the operating system.
No message.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Was I talking about IE?
No, hence my comment about bringing the thread on topic (the article was about IE).
a lot of corporates consider their intranet (extranet/web) apps 'critical
Yes, hence my references to IE, wininet, and winhttp. None of these three should be used on the backend. I'm down with IIS and it's infrastructure (ISAPI, ASP, ASPX), but custom apps relying on win32 dlls to provide outbound web functionality (once again wininet, winhttp, and IE) is just begging for trouble.
On the client side, people can use whatever they want. They're clients after all, and are not "running" the app. The server is. If they're a fat client (rmi over iiop esque), then all their browser should be doing is kicking off the client, and the VM should do all the rest.
BBH
#1. "Some extensions don't work (I've since forgotten which ones)"
/., vague, undefined and some of them you just don't even remember.
Sorry, that isn't "specific". That is vague and unhelpful. Disregarded.
#2. "When I start up the app, sometimes the "update" icon is right next to the "help" menu item (not where it should be).. and the app is completely frozen. Only restarting FF fixes this (and it sometimes does not)"
What app? Again, "specific". Not general. Disregarded.
#3. "The fact that they don't release patches (critical security updates, at least!) is a major downfall for FF."
They DO release patches and critical security updates. They just release them as a completely new build. Disregarded.
So, all of your complaints are of the type most often seen on
Great.
In the meantime, I'm running 1.0.4 without any problems and the auto-update feature of the extension system just told me that there's a new version of ie-view available. It's already installed and all I have to do is re-start FireFox.
Holy shit. If MS incorporates that quote into their Get the Facts campaign, no business will ever use OSS again.
You have tried to support your argument with faulty reasoning! Go directly to jail; do not pass Go, do not collect $200!
#1. "I THINK: Single Window, Sort bookmarks, close tab on double click, last tab. I believe that's the list."
p ?application=firefox&category=Tabbed%20Browsing
... ... ... yet you still seem to be using FireFox ... even though it is frozen.
I'm not going to waste my time on each of those. Here's the URL for "close tab on double click".
https://addons.mozilla.org/extensions/showlist.ph
Search for the phrase "Tab Clicking Options supersedes Close Tab On Double Click".
So, when the functionality provided by an extension is provided by FireFox in a later version, and the coder maintaining that extension posts that, you feel that there is a "problem" when that extension no longer works on the newer version of FireFox.
Hey, lots of luck getting IE7 to work on Win2K.
2. "FIREFOX of course."
Hey, don't blame me if your writing isn't clear. So, sometimes FireFox freezes when you launch it.
Sometimes a reboot fixes that freeze
Sometimes it doesn't
Which means that, sometimes, FireFox freezes and not even a reboot will get it unfrozen
Right. Whatever. Good luck with that.
3. "New version != security patch."
Ummmm, yes it does. The installation might not be as easy as you'd like, but it is still a security patch.
Anyway, lots of luck with your Microsoft experiment. I'm sure my firewall will be blocking the loads of spam that your pwn'ed machine will be spewing.
Buh bye now.
Coolio!
"This isn't a study in computer science, its a study in human behavior"
In other words, companies prefer to buy from large vendors, and will only buy from smaller vendors if there is a significant advantage for them.
We may not imagine how our lives could be more frustrating and complex—but Congress can. – Cullen Hightower
...it is better not to see them being made."
[Apologies to Otto von Bismarck.]
If the customer own the code, they can licence it however they wish. The developer contracted to produce it has no right to choose the licence, assuming the contract was drawn up by competent people.
CHOOSE ONE:
A. Too bad that 'patch' swapped bits around when it read the filesystem, so now your computer is toast.
B. Too bad that 'patch' broke your compiler.
C. Too bad that 'patch' conflicts with the next patch to fix the current patch, causing your head to blow up and your computer to crash.
Too bad that 'patch' wasn't tested, eh?
It shouldn't be hard, no, and if you've got 'em, clearly you should.
No unit tests? Probably not a well-controlled system then, is it?
It's one of those strange, Catch-22-like paradoxes, isn't it? The more test suites you have (and the more they're automated), the less likely it is you need them.
But in a (hypothetical?) "well-controlled" system, you can see every possible ramification of a proposed change, pretty easily, and without being omniscient -- because having modularity that works, so that changes are isolated, is one of the hallmarks of a well-controlled system!
From the article:
"This is exactly why it can take a long time to ship an IE patch. We're dealing with about 440 different updates that have to be tested.
Hmmm, so Microsoft is so big that in order to fix a problem, they have a huge number of things to check...
Am I supposed to feel bad for them? Sorry, I don't. Their software runs on ~ 95% of all desktop computers. They have a war chest in the tens of billions of dollars. Their president has a net worth close to $50,000,000,000.00.
I don't think it's unreasonable to expect them to pay, say, 10,000 people $100,000 / year to work on all of the fixes/patches and the testing. That would come out to only $1,000,000,000 per year. I think they can afford that.
Imagine warehouses and warehouses filled with people/hackers searching for the problems, finding them, and then testing the solutions.
Now, I know that realistically you can't just throw thousands of people at a set of coding problems and expect to get a thousand-fold efficiency increase...I'm just trying to illustrate the point that Microsoft can easily afford to bring to bear a humungous amount of resources to these problems.
The way the guy was talking in the article, he makes it sound like "oh, poor me...my team and I have to test (gasp) 440 different updates."
For an ordinary company, that would indeed represent a very daunting task. But Microsoft is *the* giant. It *should* be able to handle the consequences of its successes.
If not, then they're really...dumb.
Direct experience. People at work upgraded to IE 6 when it came out and at Microsofts suggestion. That is, not when it first came out, but when Microsoft thought it was good enough for everyone to use and started advertising IE 6 existence and suggesting people upgrade.
Suddenly, they started receiving empty emails in Outlook.
After a whole day of ruling out things and reading through Microsoft help pages, I find the fix. A couple days earlier and there would not have been a fix to find.
Here is a Microsoft quote from the eweek website. I wasn't aware the Microsoft "could" break the interent. But, if Al Gore can invent it than perhaps Microsoft can break it. "We have to test thoroughly to make sure it doesn't introduce a new problem. We have to make sure it doesn't break the Internet." http://www.eweek.com/article2/0,1759,1825805,00.as p