Slashdot Mirror
Flurry of Security Patches
yggy writes "It's been a hectic day on the security patching front. Microsoft's bulletins for July include patches for three critical vulnerabilities on the same day that Mozilla releases new security updates for Firefox and Thunderbird. Not to be left behind, Apple fixed two Tiger flaws while Oracle issued a critical database server update." (See these separate stories on today's release of Firefox 1.0.5 and the 10.4.2 update from Apple, too.)
So today we have a bunch of new patches, which means tomorrow we will have all the exploits being developed and released. The major problem with patches is they often are not installed by end users, and that is the bread and butter of zombie botnets.
Voice your opinion!
Before you go using the (rather bad) logic that OSS is bad because of the issuance of a high risk patch, you might want to look at how many high risk patches Microsoft has released compared to the Firefox people.
-Jenn
It's called doublethink. That's because Microsoft is Big Brother you see...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Uhm, no. It's actually called double standards. However, you can link to Wikipedia as much as you like trying to prove that wrong, but in the end, you're just going to look like a clown.
Of course it would have nothing to do with the fact that one of these pieces of software is a (comparitively simple) web browser, while the other is an OS which users expect to run on some dodgy p3 which has been gathering dust in a corner for the last 6 years or so and has millions of lines of code to debug :)
Anyone that claims open source is entirely free of bugs is dreaming and/or misinformed.
The beautiful part is the speed at which critical bugs in OSS are corrected after being discovered.
Nah - its not that Microsoft sucks because the release patches.
Neither does OS suck because they release patches.
Its because microsoft takes so long to release patches for certain vulnerabilities that have been documents - even up to half a year before..
And that the continue to promote products that have been proven to be seriously flawed, and release new versions without those flaws fixed.
There is a difference between releasing a product, and then patching it - and releasing a product knowing it needs patches before its released.
I gotta admit - look how much testing the do on the patches they do release. Service Pack 2 anyone?
Although it can be funny, tell them to plug the power in.
Most of the exploits are written AFTER the patches come out. Most exploit writers just look at the patch, see what it fixes, and then figure out the vulnerability. So the patches don't really need to be released immediately. (This is the practical reality, of course there are others who find this plan to be horrible, but it works for me.)
I really like this once a month patch cycle. I get an idea that maybe they plan the patches a little better, and test them more.
Maybe EA should have done that with Battlefield 2, instead of trying to rush a patch out.
No reason to lie.
Shouldn't that read, "ZoneAlarm on Win98 freezes PC?"
You think so? Check out the patch list for FF 1.05
l nerabilities.html#Firefox
http://www.mozilla.org/projects/security/known-vu
12 vulnerabilities in this patch, the oldest was created in APRIL! And it's marked as high severity.
The newest we don't know, because Mozilla is keeping it hidden until July 20th, but if you take the Bugzilla report number, and add one to it you can get the bug that was created directly after it, and that was created in MAY!
So yes, Mozilla DOES sit on critical bugs for months.
If you need web hosting, you could do worse than here
The only way to tell the difference between a hamster and a gerbil is that the hamster has more white meat.
</sarcasm>
In case you hadn't guessed, these things take a bit of time.
"Those who are too smart to engage in politics are punished by being governed by those who are dumber" -- Plato
Look, the point is not that someone with good computer skills can run Windows without problems. The point is that running Windows requires that you have an understanding of computer security, but most of its users don't have that. People use computers to get work done, they don't want to and shouldn't have to think at every step they take "is this a good idea or will my system be compromised now."
The fact to the matter is that Microsoft products are so insecure that you need to learn a whole set of rules about what to do and what not to do to use them securely, while at the same time they are being viewed as easier to use than competing products, especially for people who are not computer experts. The truth is that it's much easier for a non-expert to use a Linux or OS X system securely - getting the work done is about just as easy, but keeping secure doesn't require nearly as much effort or knowledge as on Windows.
Having said that, simply putting a Windows box behind a firewall will go a long way to cure problems, and a competent sysadmin should be able to keep the software and virus definitions up to date. Alas, many companies seem not to have competent sysadmins, and home PCs are still a problem - even the current PC generation often only knows how to use the system, but doesn't know or care about keeping it secure.
I commend Microsoft for forcing Windows Update down unsuspecting users' throats. That's an important step forward. Now if they would also fix all the security holes in a timely manner, Microsoft software might actually become the easyest to use. However, as it stands, almost any alternative is easier to use.
Please correct me if I got my facts wrong.
I would rather bet money on someone w/o a lot technical skills keeping their Windows box up and connected to the internet then having the same person connect a *nix box to the internet and make sure everything was working.
Good luck getting grandma to connect w/o help from you to "AOL" which is also known to her as the Internet.