Microsoft Skips Patch Tuesday

maotx writes "According to their recently released security bulletin, Microsoft will skip this month's Patch Tuesday. Patch Tuesday, also known as Black Tuesday amongst Administrators, is the second Tuesday of every month, in which Microsoft releases a series of patches and critical updates for its various operating systems and applications."

Comments

fuck you bill gates, AND FUCK YOU EOD.

[eh0d is my daddy]

fuck this whole fuckin place.

They have decided

[guildsolutions]

That security on there software is too expensive, and that they can lower the TCO and become cheaper tha linux by forgoing security completely.

Re:They have decided

[PunkOfLinux]

Hey, you know what? The average user still doesn't give a damn. And that's why windows is so insecure -- it's not because it has market share, it's because the average user doesn't feel the need to update.

Re:They have decided

[guildsolutions]

Very true. Microsoft could help the cause by making updates simpler, and requiring less restarts. Have you seen a mac when it needs its OS updated? Its much simpler.

Re:They have decided

[eneville]

The thing about Darwin (OS X) is that it runs on a micro kernel. You can unload parts of the kernel, make changes and reload them. That's really cool. There is a micro kernel project for linux also, but I've never looked at that. I'm happy to restart my desktop when I recompile the kernel. That's acceptable for me.

Re:They have decided

[guildsolutions]

That said, windows has part of the GUI in the kernel to 'speed' things up aparantly. Is not the goal of efficent programing to only include the basics of what you need in the kernel and build up from there? IE, why do you need to reboot to change the windows domain you belong to, or the workgroup for that matter? That said, I belive it is one of the biggest security risks associated with windows, is when you boot the machine, everythings built into the huge kernel and everything is turned on and started. If windows worked simliar to OS X, you could boot and not worry about loading code that was 20 years old, that had no relevance to anything you do anymore *)

Re:They have decided

[Anonymous Coward]

Oooops. I meant underrated - not overrated. My bad.

Re:They have decided

[needacoolnickname]

I just had to restart my Mac to install iTunes 5 and always have to for an OS update. Some security updates don't require a restart, but many of them do as well.

Re:They have decided

[guildsolutions]

Yes but to fix a bug in Apache you dont have to restart. A lot of the security updates that deal with libraries and stuff you do need to restart. Why iTunes requires a restart I am not exactly sure, that has always baffled me.

But wouldnt you agree that keeping your mac up to date is much simpler than keeping your windows PC up to date?

Re:They have decided

[MightyMartian]

Would putting a microkernel in Linux even leave you with Linux? Linus Torvald's opinions on microkernels is well known.

Re:They have decided

[Overly Critical Guy]

It's still much simpler. OS X's Software Update is an actual application, not a webpage, and it lists available updates and nothing more. You fire up the app from the Apple menu, check the boxes, and start the download process.

Windows starts up Internet Explorer and opens the Windows Update site, which is loaded with hyperlinks and buttons, has an "Express" and a "Custom" update process, and generally requires more clicking and waiting to get it done.

Re:They have decided

[SScorpio]

I don't know... Open IE which I have homepaged to http://update.microsoft.com/ since I use Firefox for everything else.

Click the Custom Button

Select the updates I want, normally all of them, click the download/install button.

Do other things as the updates download and install.

Normally a reboot after the process is complete

What is so hard about that? Or if you're a confused home user just leave the automatic updates turned on. It will automatically download the updates and install them for you. It will then tell you when it needs to reboot.

Re:They have decided

[Fareq]

The goal of efficient programming is to create efficient code.

In this case, the Windows GUI is very responsive on even the slowest of computers. On the other hand, OS X requires a reasonable video card, and Linux GUI is just always slow.

Re:They have decided

[eneville]

Well this is getting offtopic now, but it does not stop a side project from deploying this as a patch, like many features in the past, eventually enough people want it and then it becomes main stream.

I think it's just something that Linus will think 'hey i could have done this if it was a micro kernel' and his views may change. Who knows, it's forever being changed.

Re:They have decided

[l0ungeb0y]

That's complete BS. The average user does give a damn.
The problem is that the average user is scared as hell to update their Windows OS because when they have in the past it broke things and caused all sorts of problems.

There's an old saying: "Once bitten, twice shy".
You do the "right" thing only to get bitten in the ass because of it, you learn quickly not to do that again.

The average user isn't a geek and while so many geeks can't understand this fact and rant how most people are clueless.
This works both ways. How would you like it if every trip to the auto-mechanic you were chided for having certain tires, not using a particular brand/weight of motor oil, not being timely enough in getting a tune up, why didn't you change your own oil, your tire pressures too low? Or if you went to a lawyer, you were spoken down to and treated like a schmuck because of your ignorance of legalese?

So when these people run Windows auto-update in their attempt to "be good" and then need to call in some geek to fix it, only to get an ear-full of crap about IE this and Outlook that and VB-de blah de blah, you think they really want to suffer that indignity again?

It's a two fold problem really -- Running MS Auto-update is like playing Russian Roulette and if you lose, you've got to fork over cash for a lecture from some holier than thou sociopathic computer geek that's lost all perspective of life outside /.

So for many, the best option is to ignore the patches to avoid the headaches they've learned by experience to associate with negative experiences.

And it's people like you that help reinforce that associative perception. Good job.

Re:They have decided

[jaavaaguru]

If you install iTunes, and at the point where the dialog box with the restart button appears press command-option-escape, and kill the installer, you don't have to restart the computer and iTunes works fine. At least that's what I did with iTunes 5.

Re:They have decided

[Anonymous Coward]

Well Windows doesnt really tell you it wants to reboot it more or less DEMANDS IT that little focus stealig window is a bitch :)

Re:They have decided

[rcamera]

you apparently don't know what you're talking about. windows update does NOT open a browser with "express" and "custom" buttons. by default in xp sp2, it is set to automatically download & install updates. updates are done in the background. when the update process is completed, the user is prompted to reboot. gee - that sounds easier than the "fire up the app from the Apple menu" process you described. going forward, you should get a clue before spouting utter bullshit. but it was a nice try, asshole.

Re:They have decided

[Nasarius]

I think the grandparent is talking about this, which doesn't really do much.

Microkernels are an inevitable future. They have so many advantages for developers and users, and their only real downside is speed. Linux is great and all, but there's so many really cool things that can be done with operating systems that just aren't possible with a monolithic kernel. Maybe some kind of Linux compatibility layer (like FreeBSD has) could be used to ease the transition.

Re:They have decided

[John Straffin]

Have you two met? Pot, kettle. Kettle, pot. You apparently don't know what you're talking about, either.

"Windows Update" is a web site, complete with "express" and "custom" buttons.

"Automatic Updates" are a part of the Windows OS, are done in the background, and when the update process is completed, the user is prompted to reboot.

Going forward, you should really reconsider going forward.

Re:They have decided

[outZider]

You apparently forgot your medication this morning. Windows Update, the web site that is in your Programs menu by default, displays an 'Express' and a 'Custom' button for choosing your updates. With SP2, there are also more Automatic Updates features included, but that web site is still there and still useful for application upgrades.

The same thing goes for Mac OS X. You can either select Software Update from the Apple menu to manually grab new updates, or Software Update will spawn as often as you choose to and display the new updates for your consumption, or install them automatically if you choose that route.

Medication is in the cabinet, second shelf down, on the right hand side. Thanks. :)

Re:They have decided

[JohnnyBigodes]

Except that in the auto industry, like any other industry, if thousands upon thousands of mechanics told *everyone* that a using a particular brand of oil would fuck up their engine (making a comparison with IE/Outlook Exp. here), then if after some time you were using that brand of oil, it's your damn fault if the engine acts up and yes, you should be chided for it (first-time infractions can walk away free).

Beware that you have a good point there, still, it doesn't apply to some of the stuff "us geeks" have to put up with nowadays.

Re:They have decided

[andreyw]

Considering the kind of re-engineering that has to go in the process, 'patch' is just not the appropriate word to use here. Try 'fork'. Btw, L4Linux, MkLinux are existing codebases that do what you want.

Re:They have decided

[Zakabog]

How would you like it if every trip to the auto-mechanic you were chided for having certain tires, not using a particular brand/weight of motor oil, not being timely enough in getting a tune up, why didn't you change your own oil, your tire pressures too low?

Ok here's a scenario, I go to the mechanic and tell him "My engine has no power and heats up really quickly now." and he checks a few things, comes back and says "You have no oil." He'll put in some oil, tell me to check it every so often stuff like that. Now I go back to him with the same problem, he does the same thing. This happens about once a month for 4 months. Now being an average person and not knowing much about cars I think "Ok this mechanic is terrible, I shouldn't have to check my oil, my car does that automatically doesn't it?" He knows I'm probably thinking it, so you think the next time I visit him he's not going to be a little angry that I still haven't checked my oil ever and now I'm just wasting his time?

Personally, I change my own oil and rotate my tires and do all my own car work. I use synthetic fluids and I treat my car right. If I was going to someone for help with something though I'd listen to them the first time. Maybe I'd need to be told once more but after that if the problem repeats it won't be too hard to fix. I do that myself and I expect (and usually get that) from my customers. I have a lot of patience though I will never demean a customer even if I have to explain something 4 or 5 times (I've had to explain to a customer on the phone for 15 minutes that the F4 key was one key not two.) And in the end it's worth it, not getting any calls for a long time, and when you finally get a call from the same person it's not for something you've already fixed before.

Re:They have decided

[Mike_ya]

The average user doesn't even know about window updates. The average user is willing to pay me $100 plus cost of parts to fix their 6 year old computer running Windows 98 instead of buying a new computer with XP for $400.

Re:They have decided

[TetryonX]

Build a kernel with everything you can as modules.
With exception to deep-kernel changes, most things can be unloaded/reloaded on the fly.... Course this doesn't work with some modules that won't remove because they're busy.

Imho a good working kernel doesnt need to be updated every revision. Only when you know something that was quirky before will be fixed, or other known speed improvements to your system. Only serious security issues for my system forces me to update the kernel.

Re:They have decided

[eneville]

All the above is true. But, sometimes you want to make a new module for something and you really dont want to have to reboot. For example AFS, drbd etc which you really dont want to reboot a whole cluster one by one for, because you choose a new clustering method.

Re:They have decided

[legirons]

How would you like it if every trip to the auto-mechanic you were chided for having certain tires, not using a particular brand/weight of motor oil

To be fair, if you drove around with the automobile-safety equivalent of internet explorer, the police would pull you over and tell you to stop driving until it was fixed...

Re:They have decided

[Anonymous Coward]

"The average user isn't a geek and while so many geeks can't understand this fact and rant how most people are clueless." - by l0ungeb0y (442022) on Saturday September 10, @02:26PM

I'm with you for the most part, good examples... on this particular one of yours I quoted?

I say "Thank GOODNESS for folks that do NOT want to know how to mess about with their systems"...

Why do I say that? Well, heck man:

They keep guys like us, (who ARE "geeks/nerds/technojocks" in this field) working!

* :)

(So, that said? Well, Ya just gotta love those folks who are not "nerds" etc./et all, I say!)

APK

Re:They have decided

[HuguesT]

Hi,

> Microkernels are an inevitable future. They have
> so many advantages for developers and users, and
> their only real downside is speed.

I've seen this line of reasoning outlined for the last 15 years or so.

The fact is speed still matters and will likely continue to matter, and microkernels still aren't the majority. Purists even dispute that OS/X runs a microkernel...

Second post!

[Anonymous Coward]

W00t!

AT LEAST WINDOWS IS MORE SECURE THAN LINUX!

[Anonymous Coward]

fp?

Yes!

[MyLongNickName]

Finally, all of the Microsoft vulnerabilities have been fixed. No more work to do.

In your face, LINUX!

Re:Yes!

[b100dian]

All team moved to Vista!
Brooks' Law

Re:Yes!

[MrAnnoyanceToYou]

"Occasionally, the testing process and our strict focus on quality can result in a month where no security updates are released, as is the case for 13 September 2005."

One considered snickering at this one.

Re:Yes!

[Anonymous Coward]

Zomg!1
Windoz sux in yuo fase dollaar bill gaytes!!!!!111
suxusuxusuususxusxusu

I HAW USED LINUX ALL MYLIEF AND IT ROOX!!!!!!!!

Re:Yes!

[CDMA_Demo]

I think Microsoft has come to realize that its more profitable to allocate resources for arresting hackers and worm-writers than setting aside teams devoted to bug-fixing. Remember the Stephen Glass story Hack Heaven? Sometimes life imitates con-art.

Hasta la Vista, XP!!!

Re:Yes!

[iminplaya]

There is no 13th floor.

T... F... A!

[boisepunk]

Microsoft Security Bulletin Advance Notification
Updated: September 9, 2005
Security Bulletin Advance Notification

Update: Microsoft will not issue any new security updates on September 13th as part of the September monthly bulletin release cycle.

Based on customer feedback, Microsoft instituted a monthly security update release process on the second Tuesday of each month to provide customers with security guidance and updates on a predictable and manageable schedule. This update release process involves a significant testing focus to help ensure customers will receive updates that are of a high quality and Microsoft will not release an update until it meets those standards. Occasionally, the testing process and our strict focus on quality can result in a month where no security updates are released, as is the case for 13 September 2005.

In addition, to help customers prioritize monthly security updates with any non-security updates released on Microsoft Update, Windows Update, Windows Server Update Services and Software Update Services on the same day as the monthly security bulletins, we also provide:

Information about the release of updated versions of the Microsoft Windows Malicious Software Removal Tool.

Information about the release of NON-SECURITY, High Priority updates on Microsoft Update (MU), Windows Update (WU), Windows Server Update Services (WSUS) and Software Update Services (SUS). Note that this information will pertain ONLY to updates on Windows Update and only about High Priority, non-security updates being released on the same day as security updates. Information will NOT be provided about Non-security updates released on other days.

On 13 September 2005 Microsoft is planning to release:

Security Updates

No new security updates on September 13th as part of the September monthly bulletin release cycle. This represents a change in the information found in the Advance Notification on Thursday, September 8, 2005. Late in the testing process, Microsoft encountered a quality issue that necessitated the update to go through additional testing and development before it is released. Microsoft is committed to only releasing high quality updates that fix the issue(s) in question, and therefore we feel it is in the best interest of our customers to not release this update until it undergoes further testing.

Microsoft Windows Malicious Software Removal Tool

Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services and the Download Center.

Note that this tool will NOT be distributed using Software Update Services (SUS).

Non-security High Priority updates on MU, WU, WSUS and SUS

Microsoft will release one NON-SECURITY High-Priority Updates for Windows on Microsoft Update (MU), Windows Update (WU), Windows Server Update Services (WSUS) and Software Update Services (SUS).

Microsoft will still host a webcast next week to address customer questions on any previously released security bulletins. For more information on this webcast please see below:

TechNet Webcast: Information about Microsoft's Security Bulletins (Level 100)

Wednesday, 14 September 11:00 AM (GMT-08:00) Pacific Time (US & Canada)

http://msevents.microsoft.com/CUI/WebCastEventDeta ils.aspx?EventID=1032279532&EventCategory=4&cultur e=en-US&CountryCode=US

Re:T... F... A!

[MyLongNickName]

I am glad to know that if Microsoft gets Slashdotted, we have this cut and paste to refer to. We all know Saturday morning in the U.S. is the heaviest traffic time, and that Microsoft runs its servers off of 486's with 32 megs of ram.

We have no idea how you beat out all the subscribers, and got around the 404's. But somehow, undoubtedly through minutes of perserverence, you were able to get the job done. And in your rush to provide this service, you were STILL able to make sure it was formatted nicely. Well done.

If it weren't for you, therer is absolutely no way I could have read this fine article. I Thank you and your country thanks you.

Re:T... F... A!

[MyLongNickName]

I was just going to yell "Karma Whore!", but the stupid 2 minutes between posts rule gave me way too much time to think of something like this....

Re:T... F... A!

[Anonymous Coward]

I beilieve that's only 640k since it's billyg's boxen

Re:T... F... A!

[colinrichardday]

Microsoft Windows Malicious Software Removal Tool? So Microsoft admits that some of its software is malicious, and that users should remove it?

Re:T... F... A!

[boisepunk]

this is how you spend your time?

Kettle: Hey pot, you're black!
Pot: And you are...?

Re:T... F... A!

[duckpoopy]

It's good to see that they are still teaching sarcasm in high school.

Re:T... F... A!

[Anonymous Coward]

No, you got it all wrong. It's a malicious tool that removes all your software

Re:T... F... A!

[MyLongNickName]

High School? I'm in my thirties! I've been out of high school for three years now.

Re:T... F... A!

[togtog]

I thought they only had 640k of RAM.

This isn't news.

[Vapebait]

And it's not something that matters.

Memo to all employees:

[freetipe]

"Patch Tuesday" has cancelled.
"Hawaiian Shirt Friday" will continue as normal.
"Executive Chair Throwing Saturday" is uncertain, but quite likely.

Re:Memo to all employees:

[boisepunk]

Get back to your TPS report and put THE RIGHT COVER on it this time!

Maybe this means...

[TooMuchEspressoGuy]

...that Microsoft software is so secure, that they don't NEED to patch it anymore!

...

*sigh* Who am I kidding...

What happens for patch-quick operations ?.

[Gopal.V]

A patch every month ?. Do they hold onto the patches if it happened to be one that slipped a schedule and became available on the thursday after the first release. Do they wait an entire month before shipping in the next ?.

I've often heard tuesday mid-morning was the best time to release a new package - mostly hearsay. Any bit of truth in it ?

Tuesday's are considered unlucky in Indian lore - to undertake new things. Wednesdays are the day of beginnings - but it's already Wed here by the time it's released worldwide.

Re:What happens for patch-quick operations ?.

[Saven Marek]

The whole idea of releasing patches only once a month and on a set date is ridiculous.

Vulnerabilities aren't discovered and exploits aren't written to respect the timing of Microsoft in this regard.

What happens if a vulnerability is discovered and an exploit written for it a couple of days after patch tuesday? Microsoft's whole bug fixing scheme is then set to only handle it 28 days later.

And we all know what happens in 28 days later.

What happens when a vulnerability is fixed that needs more testing for many people, but also comes attached to vulnerabilities that can be simply exploited? do we wait for the former before applying the latter, or apply the latter and to hell with the consequences in the former?

I think this is moron thinking. Each patch should be one small patch to fix that vulnerability and only that vulnerability. no other bug fixes with regards to non security issues, no combining patches, no waiting for days to fix a patch.

Then the monthly updates can be set client side however the client wishes to handle it. daily or weekly or monthly. whatever they wish to handle. at the time.

Re:What happens for patch-quick operations ?.

[Varun Soundararajan]

If M$ were running a hospital, ambulances would come once in a month to your house, asking if someone is serious, and the day when it comes to your house would always be a tuesday. Unfortunately due to unforseen reasons, this month, M$ is unable to send ambulance to your house. M$ feels there are not enough emergencies this week, or that the hospital is already overwhelmed.
----
This space intentionally filled up.

Re:What happens for patch-quick operations ?.

[clem.dickey]

> I've often heard tuesday mid-morning was the best time to release a new package

Back when weekly trade papers mattered, Tuesday was early enough to make next week's papers. Monday was too early; the journalists might not yet be recovered from the weekend.

Re:What happens for patch-quick operations ?.

[mollymoo]

I expect they try to keep on schedule, but they've known about these bugs for weeks or months already so what's another month if the vulnerability hasn't been disclosed?

Does releasing patches on a regular schedule increase security by increasing the uptake of patches, or decrease it by increasing the time from discovery to patch? Does anybody have any numbers on the uptake of Windows patches since they started the monthly schedule?

Re:What happens for patch-quick operations ?.

[saskboy]

I'd even advocate MS writing patch worms that force exposed and flawed computers to close a hole that would cause a destructive worm to tear across the net, such as Zotob and Blaster did. But I know that Microsoft is famous for breaking its own products with its own patches, so I can't really support that method.

I installed SP4's Rollup 1 on W2K the other week, and it broke Office XP's ability to save to the Floppy drive!

Re:What happens for patch-quick operations ?.

[lseltzer]

Just so it gets said, they set this schedule because large corporate customers demanded it, and they're happy with it. In case this is the first time you noticed, they've been doing this for almost 2 years I think. Oracle does something similar, on a quarterly basis. Having a regular schedule (with some warning in advance of which products are affected and how many updates there are) allows them to plan for patching in advance.

The fact that they have a schedule doesn't preclude them from issuing an "out of cycle" update, which they have done 2, maybe 3 times.

Re:What happens for patch-quick operations ?.

[93 Escort Wagon]

" A patch every month ?. Do they hold onto the patches if it happened to be one that slipped a schedule and became available on the thursday after the first release. Do they wait an entire month before shipping in the next ?"

Yes, that is exactly what they do. It was a business decision - they were getting hammered in the press because of the frequency at which people had to update their computers. So they decided to move things to a monthly schedule, because psychologically it would lend an air of normalcy to the patching freight train that is Windows. And frankly, it has worked like a charm.

They say it's "to help system administrators plan and deploy", of course - but I don't think even Windows admins believe that.

Whatever else you might think of Microsoft, they are not stupid.

Re:What happens for patch-quick operations ?.

[electronerdz]

I believe the original intention was for large corporations who have to patch several thousand machines. Going to each machine every day to do a single patch would be absurd. But instead, you could patch them all the same starting on that Tuesday and working your way through the month. However, you are still patching machines like crazy. And setting it client side only works in non-domain situations, like home computers, or peer to peer networks. If you are a domain user, chances are, you are not allowed to run and install updates.

Re:What happens for patch-quick operations ?.

[Mechcozmo]

Then the monthly updates can be set client side however the client wishes to handle it. daily or weekly or monthly. whatever they wish to handle. at the time.

Software Update for OS X. Been doing that since 10.0. And it comes, by default, to check weekly and on the computer's first run.

Re:What happens for patch-quick operations ?.

[Keeper]

Vulnerabilities aren't discovered and exploits aren't written to respect the timing of Microsoft in this regard.

Correct and incorrect at the same time. Patches are reverse engineered and exploits are written based off of the changes in the patch. Which means once you release a patch, the clock is ticking for your customers to pick it up and deploy it before some script kiddie writes a worm that brings down your network.

What happens if a vulnerability is discovered and an exploit written for it a couple of days after patch tuesday? Microsoft's whole bug fixing scheme is then set to only handle it 28 days later.

Depends on the nature of the exploit. If it is serious, they'll release the patch out of cycle.

I think this is moron thinking. Each patch should be one small patch to fix that vulnerability and only that vulnerability. no other bug fixes with regards to non security issues, no combining patches, no waiting for days to fix a patch.

What do you do when two patches apply to the same binary? Your "single patches" trash each other. Do you propose deploying untested patches? When is a bug a non-security issue?

What happens when a vulnerability is fixed that needs more testing for many people, but also comes attached to vulnerabilities that can be simply exploited? do we wait for the former before applying the latter, or apply the latter and to hell with the consequences in the former?

A vulnerability is a vulnerability. Wanting to run a partially patched system is idiotic.

Then the monthly updates can be set client side however the client wishes to handle it. daily or weekly or monthly. whatever they wish to handle. at the time.

No, they can't. The changes in Microsoft's patches are reverse engineered. Exploits are written against a patch within 72 hours. Once the patch is released, you MUST deploy it or your are vulnerable to every bot author who wants to add your machine to their zombie army.

Re:What happens for patch-quick operations ?.

[LO0G]

No, they can't. The changes in Microsoft's patches are reverse engineered. Exploits are written against a patch within 72 hours. Once the patch is released, you MUST deploy it or your are vulnerable to every bot author who wants to add your machine to their zombie army.


This is SO true. Zotob was reverse engineered and released only two or three days after the patch was released.

Re:What happens for patch-quick operations ?.

[Jeff DeMaagd]

Not only that, I think it is also the matter of making sure the patches don't conflict with the plethora of existing software that the corporations use, rather than just blindly updating every computer. I had one computer which would use 100% of CPU power while doing nothing if a certain patch was applied, for reasons I didn't understand. I think it would be a very bad thing to have if this happened on nearly every one of an organization's fleet of nearly identical computers.

Re:What happens for patch-quick operations ?.

[Andrewkov]

What kind of admins actually visit every PC to install patches? Not good admins.

Re:What happens for patch-quick operations ?.

[Anonymous Coward]

What do you do when two patches apply to the same binary? Your "single patches" trash each other.

You must be used to some pretty shithouse patching systems to make a claim like that.

Is MS software still that bad? I stopped using it before WinXP. People making comments like that above make me think that it must be, if it's just accepted that silliness like two patches applying to the same binary will trash each other is true, when it's clearly, not.

Re:What happens for patch-quick operations ?.

[Anonymous Coward]

And we all know what happens in 28 days later.

This?

Re:What happens for patch-quick operations ?.

[Anonymous Coward]

Vulnerabilities aren't discovered and exploits aren't written to respect the timing of Microsoft in this regard.

Actually, they are.

Now when a botnet operator gets his hands on a new exploit, he *DOES* synchronize the use of this exploit with the MSFT update schedule to maximize the time his exploit works.

My guess - Microsoft probably has some vested interest in some organziation (perhaps Gator, perhaps NSA) who is interested in exploits staying open. Otherwise, this monthly update plan is the stupidest thing they've ever done.

Re:What happens for patch-quick operations ?.

[ron_ivi]

large corporate customers demanded it

I assume you mean the spam-bot operators. They're the ones who benefit the most from this schedule because if they time their exploits right, every new crack can be used for a full month.

Any other "large corporate customer" would demand the publishing of workarounds AS SOON AS ANY WORKAROUND IS IDENTIFIED for a security issue - even if that workaround is "disable the XYZ service".

Re:What happens for patch-quick operations ?.

[ErikZ]

Dude, I just admin two machines. No need to get all fancy-like.

Re:What happens for patch-quick operations ?.

[Anonymous Coward]

Wanting to run a partially patched system is idiotic.

Man, I agree. Because when patch X breaks mission-critical application A, it's absolutely stupid to want to uninstall patch X, but still be able to install patch Y, Z, etc.

I mean, man, how can anyone claim to not be able to get any work done because of patches? Without that excuse, we might actually have to work for a living.

Re:What happens for patch-quick operations ?.

[dabraun]

They also do this because it allows those large corporate customers (and others but that's not so much the issue) to update their systems with the new patches the day the patches are released.

Contrary to popular Slashdot thinking, very few windows vulnerabilities have been exploited before the patches were issued (ignoring the person who discovered and verified the exploit.) Most of the big-name viruses that have spread based on Windows security flaws spread after the patches were available.

A previous poster suggested that 'Microsoft should release the fixes as soon as possible and the customer can decide on what schedule to take them.' This is exactly the WRONG approach to take. The more people that decide 'ahh, I'll patch once a month' in a world where patches are issued on any given day - the more vulnerable they are to widespread exploits.

Windows has a lot of users and and a lot of people are interested in exploiting it. Once the patch is out it is only a matter of time before someone reverse engineers the change to find the exploit that will exist on unpatched systems.

Re:What happens for patch-quick operations ?.

[Keeper]

Right, because when your mission critical system is compromised because you don't have patch X applied, you're in a MUCH better situation. *rolls eyes*

Re:What happens for patch-quick operations ?.

[Keeper]

You must be used to some pretty shithouse patching systems to make a claim like that.

You must live in some fantasy land where merge conflicts never occur.

If the patches are applied in a defined order, it isn't a problem. It isn't possible to patch a binary in a random order as the GP requested. Hell, we still can't do that on a source level without human intervention every now and then.

The screen is so wide

[ReformedExCon]

In Firefox, the linked website is wider than the screen. Did anyone try it with IE?

As far as it goes, Black Tuesday is only a means for hackers to learn vulnerabilities in Windows by analyzing the dropped bits. It's very infrequent that an exploit is released before the updates are.

Windows is sure to have many problems, but if hackers are only willing to investigate changed bits and then attack not-yet updated systems, then not putting any updates out will keep those hackers at bay.

I don't think they should do this. Security through obscurity is very temporary. But I understand the reasoning behind not giving hackers hints. Maybe Microsoft's next update release will make things really good.

Re:The screen is so wide

[Anonymous Coward]

Renders at screen width in IE6 on Win2000, but wide in Firefox..more MS goodness =)

Re:The screen is so wide

[Anonymous Coward]

Hmm...works just fine on firefox here. 1.0.6, 1280x1024.

Re:The screen is so wide

[BrokenHalo]

Heh... Thank the X11 developers for xinerama. I just dragged the window across so the navigation frame was on the left screen, and voila! Plenty of room.

Re:The screen is so wide

[bach37]

Okay for me, Firefox, Fedora 4. 1600x1200 using 21" Apple Studio Display (please don't laugh).

Re:The screen is so wide

[Anonymous Coward]

Set your screen fonts "min size" to none; that will work with most sites. However; not so with microsoft, it will be un-readable. Who says MS doesn't like firefox?!?!?!?!

Re:The screen is so wide

[Anonymous Coward]

works fine for me... but i'm running 1280 x 800 on a new HP notebook... perhaps most of the MS worker bees are using widescreen formats as well.

(mod up: informative)

Re:The screen is so wide

[paulbiz]

In Firefox, the linked website is wider than the screen. Did anyone try it with IE?

No, but the site looks like it's a table-based layout and it contains a very long piece of text, which I assume would not wordwrap since it contains no spaces. If your font size/screen resolution combo isn't sufficient, you'll need to scroll.

STOP the illegal war!

[Anonymous Coward]

Stop the illegal war!

The US PROPAGANDA MACHINE has done an excellent job at controlling public anger against the unjust Iraq war, in TOTAL contrast to the VIETNAM WAR.

The Vietnam war ended when the PUBLIC started protesting not at a DEAF government, but the people fighting the war (the NATIONAL GUARD). Having anger against the millitary helps ensure that reserves are down, and no PROFITTERING wars will HAPPEN in the short term.

A HATE CAMPAIGN needs to start against those who are willing to fight in an UNJUST WAR. However, this needs to be done in a NON-VIOLENT way.

Other nations (such as CHINA and RUSSIA) should CONDEMN this illegal war, and help out with propaganda AGAINST the US.

PROTEST against Millitary recruitment, and the armed forces.

DONT LISTEN to their propaganda about needing a STRONG ARMED FORCE. Force isn't needed when you HAVE NO ENIMIES

---
cut and paste this text and post it wherever possible. Only by spreading the word will the war stop

Re:STOP the illegal war!

[Anonymous Coward]

Cut and paste all you want, but please, for God's sake, remove the gratutious capitalization. We don't want people to think they've accidentally clicked on a timecube link.

Re:STOP the illegal war!

[Anonymous Coward]

How is it an "illegal" war when we had the right to go in and use force based on the very words of the treaty Iraq violated for over ten years?

Oh, yeah, right, I forgot. U.N. sanctions are completely meaningless and should never be enforced. I forgot about the liberal way of doing things.

Be sure to never, ever address the fact that the treaty says we have the legal right.

Ever noticed how reporters no longer ask "What do you think about...?" They ask "How do you feel about...?" That's the liberal, emotion-over-fact mantra that has taken over the elite media, which polls already show over 80% of which call themselves liberals. You can't deal with facts, so you have to deal entirely with emotions and yelling in people's faces. Look at how nobody cares about Cindy Sheehan and her attention-whoring anymore. You know, despite the fact her son willingly chose to volunteer for a second shift after being over in Iraq, in an all-volunteer army. Funny how the media never, ever reports that.

Liberals are just walking scripts of emotion-based rhetoric these days. No wonder they keep losing election after election. Go on cutting-and-pasting, sheep. I pledge to make sure the war on terror continues as long as necessary, because liberals sure as hell aren't going to protect anybody or make the world a safer place. In their world, "Anything goes because it's always our fault. That makes me so enlightened!"

Re:STOP the illegal war!

[Anonymous Coward]

How is it an "illegal" war when we had the right to go in and use force based on the very words of the treaty Iraq violated for over ten years?

Oh, yeah, right, I forgot. U.N. sanctions are completely meaningless and should never be enforced. I forgot about the liberal way of doing things.
You're an idiot. The sanctions were working, Iraq was toppling, it's economy faltering, it would have collapsed anyway.
Ever noticed how reporters no longer ask "What do you think about...?" They ask "How do you feel about...?" That's the liberal, emotion-over-fact mantra that has taken over the elite media, which polls already show over 80% of which call themselves liberals. You can't deal with facts, so you have to deal entirely with emotions and yelling in people's faces. Look at how nobody cares about Cindy Sheehan and her attention-whoring anymore. You know, despite the fact her son willingly chose to volunteer for a second shift after being over in Iraq, in an all-volunteer army. Funny how the media never, ever reports that.

There are enough deaths from the war, but nobody asked why. Besides, it's not as if FOX News has ignored that. Plus, you seem to underestimate Rupert Murdoch's control. And as to not dealing with the facts, how about the fact that there WERE NO Weapons of Mass Destruction in Iraq? How about the fact that because of this over 25,000 Iraqis have died due to US military operations (Iraqi civilians, mind you). And last I checked, it was Bill O Reilly doing all of the yelling and emotional crap, as well as public misinformation.

Liberals are just walking scripts of emotion-based rhetoric these days. No wonder they keep losing election after election. Go on cutting-and-pasting, sheep. I pledge to make sure the war on terror continues as long as necessary, because liberals sure as hell aren't going to protect anybody or make the world a safer place. In their world, "Anything goes because it's always our fault. That makes me so enlightened!"
Two things. First, you can never ever win the war on terror simply because it's impossible to wipe out terrorism. It will always exist as long as somebody hates you, so unless you anihilate everyone but yourself, there will still be terrorists. Secondly, I don't see any arguments in your statements, I see you using the word Liberal like the way you should be using Neocon. Finally, go ahead, volunteer for the war. You don't deserve to live.

Patches?

[slideroll]

We don't need no steenking patches!

Jeez, miss the key point why don't you...

[Zocalo]

It's not so much that there isn't a patch this month, as that Microsoft has decided to hold off on releasing a patch due to stability concerns, which is laudable. So, while we have no patches this month, we also have a known unpatched, remotely exploitable hole in Internet Explorer until the eventual release. The big question is, will Microsoft release an out of cycle patch to fix the issue, or will be have a full month of PCs getting owned just because they visited the wrong URL using IE6?

Re:Jeez, miss the key point why don't you...

[maskedbishounen]

(...) or will be have a full month of PCs getting owned just because they visited the wrong URL using IE6?

And how is that different from any other month?

*ducks*

Re:Jeez, miss the key point why don't you...

[raind]

I tend to believe the latter; which is a shame cause I want some time off...sigh/

Re:Jeez, miss the key point why don't you...

[Anonymous Coward]

The only funny thing is that this should be modded INSIGHTFUL instead of Funny. PCs using IE6 get 0wn3d year-round regardless of patching state.

Or perhaps it was funny as in thinking about them tools who get pwn3d everyday case their browser teh suck? (woosh?)

Re:Jeez, miss the key point why don't you...

[twitter]

The big question is, will Microsoft release an out of cycle patch to fix the issue, or will be have a full month of PCs getting owned just because they visited the wrong URL using IE6?

They have to make sure they don't break the five or six of ten PCs that can actually fill out FEMA registration forms do they? That would nail one the only real advantage that platform has right now. They can break them in a week or two, so the patch that improves your net half life from 12 to 15 minutes will come. While M$ slaves and fanboys tank their master for this small relief, I'll add my voice to the many calling for FEMA to fix their site so hundreds of thousands of people don't have to break their computers.

Re:Jeez, miss the key point why don't you...

[4of12]

It's not so much that there isn't a patch this month, as that Microsoft has decided to hold off on releasing a patch due to stability concerns, which is laudable.

It's laudable if the stability concerns truly do outweigh the security concerns.

But, then, Microsoft is weighing the evidence and making the decision for everyone, all at once; not individual sysadmins, who might weight the balance differently, depending on the stability of their particular application mix. You're not making the decision. They are.

Meanwhile, the alien voices in my head keep telling me that Microsoft will use the cumulative security record in all its gore to help us swallow TCPA to come at a later date.

Re:Jeez, miss the key point why don't you...

[dabraun]

What ever hole exists has probably existed for a long time. When Microsoft discovers a hole themselves (or when a third party who knows how to keep their mouth shut discovers it and tells Microsoft) there is not that much additional risk created by leaving the hole there until they have the right fix and even more importantly until they have prepared customers (by having set release dates for fixes) to make the update very quickly.

Re:Jeez, miss the key point why don't you...

[Anonymous Coward]

Moderators: Please note that "twitter" is a known fanatical sycophant whose obnoxious offtopic rants are legend here on Slashdot. It doesn't matter what the topic is, he'll find a way to scrape in some pointless Microsoft bashing. While nobody expects us to love Microsoft in any way, his particularly tepid style of calling anyone he replies to "troll" or "liar" or "fanboy" because he happens to disagree with whatever they're saying is well documented and should not be rewarded. If anything, twitter is the type of person that should not be part of the open source/free software community. He is an anathema to all that is good about free software.

I'm posting this so that you (the moderator) have some context to consider twitter and not mod him up whenever he posts his filler preformatted rants about installing Knoppix or Mepis or whatever that unfortunately get him karma every single time and allow him to continue posting his trademark toxic crap (read on) day in and day out. You may consider this a troll - I consider it community service. And I ain't kidding.

If you're a /. subscriber, I invite you to look through some of his posting history. I guarantee that you'll be hard pressed to find someone that is more "out there" than twitter. You'll also probably notice he's got quite an AC following. Don't just read his posts, make sure you go through the replies.

To get an idea of what I'm talking about, check this post out. This is an article about email disclaimers. The parent of the post is complaining about the ads in the linked page and so on, and twitter actually goes off on a rant to blame it on Microsoft and recommend Lynx, because "is teh free".

Here's another. In this post twitter not only calls the OP a troll but attempts to "tell it like it is" while making some vague argument about "GNU". Yes, if you're confused, you're not alone. The reply (modded +4) proceeds to simply destroy his bogus argument. You will notice he did not reply. This is what some people call "drive-by advocacy". A sort of I'll just leave you with my thoughts here and move on to the next flamebait kind of deal. In fact, he almost never replies because he knows that his fanatical arguments simply do not hold up to any sort of discussion. It's not that he's chosen the wrong cause - he's just going at it in a completely wrong way.

Here's that drive-by advocacy and FUD in motion: twitter goes on about some topic and then drops the usual "oh and M$ is teh evil" because "WMP phones home" or some such. Called on his FUD, he then claims that WMP stores every song and movie you've ever played in a file, somewhere. Pressed further, he just sort of slithers out of sight, his FUD-spreading complete. This is not about some Microsoft technology that nobody likes anyway; it's about lying for the sake of lying. Way too many of his posts are exactly like this one.

More? Just read though this post and the subsequent replies. I guess this stands on its own. Or these two. Or this one. Or this one.

Still not convinced? This is what twitter considers "humour" while going about his daily "M$" routine.

M

Sometimes Microsoft does beat Open Source

[Henry V .009]

"Late in the testing process, Microsoft encountered a quality issue that necessitated the update to go through additional testing and development before it is released. Microsoft is committed to only releasing high quality updates that fix the issue(s) in question, and therefore we feel it is in the best interest of our customers to not release this update until it undergoes further testing."

That is one positive thing about Microsoft. When they release a patch, you can be sure that it has been tested through the roof. It's a rare open source project that can match Microsoft on that.

Re:Sometimes Microsoft does beat Open Source

[Anonymous Coward]

Indeed. It's a pity the same amount of effort wasn't put into developing the software in the first place.

Oh, and there's a reason most admins wait a while before applying service packs.

Re:Sometimes Microsoft does beat Open Source

[A beautiful mind]

Oh come on, how many times we had a patch that needed another patch from MS?

Also, most F/OSS end-users profit from the simple fact, that the whole world is beta-testing the patch for them. How could MS hire that kind of testing force, ever?

Re:Sometimes Microsoft does beat Open Source

[JamesTRexx]

It's a rare open source project that can match Microsoft on that.

It's a rare open source product that's being used on ~95% of the desktops.

Re:Sometimes Microsoft does beat Open Source

[soloport]

How could MS hire that kind of testing force, ever?

Either you don't use Microsoft products or you haven't looked in the mirror, lately -- where you'll find yet another member of their "testing force".

Re:Sometimes Microsoft does beat Open Source

[Anonymous Coward]

It's a rare open source project that can match Microsoft on that.

It's a rare open source product that's being used on ~95% of the desktops.

Uh, your TCP/IP stack?

Re:Sometimes Microsoft does beat Open Source

[Pink_Weasel]

"Microsoft is committed to only releasing high quality updates..." as opposed to releasing high quality products

Re:Sometimes Microsoft does beat Open Source

[A beautiful mind]

I didn't use MS products lately...

Re:Sometimes Microsoft does beat Open Source

[kalidasa]

Yeah, the fact that I had to back out a patch the other day because it broke security auditing is a great example of Microsoft testing patches "through the roof." That's just me: another satisfied MS enterprise customer . . .

Re:Sometimes Microsoft does beat Open Source

[Anonymous Coward]

... Uh, which would be one of those rare (as in one of the few) products, yeah?

Re:Sometimes Microsoft does beat Open Source

[tunah]

No, I believe the word is 'common'.

And to make up for it...

[Anonymous Coward]

...Ubuntu has just disgorged several 10's of MBs of security updates which took several minutes to download on my ADSL line. God knows how 56k'ers would cope.

Note to Ubuntu devs - please follow SUSE's lead and start issuing binary-diff-style updates post-haste, or nobody is going to bother to catch up on critical security fixes and will end up getting rooted left, right and centre.

Re:And to make up for it...

[Anonymous Coward]

Just wait for the official release then, If you're running beta software you're doomed with many updates.

What about the critical vulnerability out Sep 9?

[farbles]

The Inquirer has a story saying that there was a critical update and the software tool coming out September 13.

WTF?

No, from TFA, they're NOT skipping Patch Tuesday

[bearl]

TFA article clearly says that they're issuing several updates right on schedule this coming Tuesday.

They are delaying a security update that was previoiusly scheduled for Tuesday. They're delaying it because they found some problems during late testing. Good on 'em for that.

Aside from that, the rest of the updates will be issued as scheduled.

Uh, you think?

[Anonymous Coward]

That is one positive thing about Microsoft. When they release a patch, you can be sure that it has been tested through the roof.

Is that why these patches always seem to break things?

Weasel wording...

[JonToycrafter]

Notice how the wording says that no SECURITY patches are coming out this month due to their "strict focus on quality"? Notice that there's still a high=priority non-security patch coming out.

I looked for examples of what this covered on my WSUS server, and found that this generally means, "Some patch or service pack or program isn't going to install/run unless you install this 'non-security patch'."

KB885523: "This update resolves a compatibility issue with a non-Microsoft software application installed on your computer [excellent weasel words again there]. This application prevents successful installation of Windows XP Service Packs, critical security updates, and other system file updates. This update should be applied to your system to enable safe installation of these updates now and in the future."

A spot check of other "non-security updates" indicates that it's pretty common for them to resolve bugs that make installing patches impossible.

I can't complain too much though - like many others, I'd be out of business if they got their act together.

*Blink*

[Anonymous Coward]

Wow. Did we all forget about SP2?

Oh wait now it's modded funny. I guess the poster was being funny :)

No Patch? Skipped a month?

[marktwen0]

Microsoft announced they had omitted the patch

Funny--my girlfriend also said something about not needing to use the patch this week...and something else about a missed month...

Oh, wow! Cigars, anyone?

Re:No Patch? Skipped a month?

[Anonymous Coward]

I guess that'd be funny if you actually had a girlfriend.

Re:No Patch? Skipped a month?

[maelstrom]

I always suspected people were getting fucked by Microsoft, but this isn't quite what I had in mind.

Re:No Patch? Skipped a month?

[Anonymous Coward]

What? You call your mother a girlfriend?

Windows now secure!

[syousef]

It's good to know no more patches are needed for Windows, and that it is now finally secure.

Next month, on the day formerly known as patch Tuesday, Microsoft will buy everyone a pony. Henceforth it shall be known as Microsoft Pony Tuesday. We shall be celebrating with the pixies and faeries!

Double-meaning in title

[A beautiful mind]

When the title says "Microsoft skips patch tuesday", it means that Microsoft will skip a patch's deployment on tuesday, not that they are going to cancel the "patch tuesday".

Sigh.

Re:Double-meaning in title

[Anonymous Coward]

Nope, this sentence from the summary makes the original poster's intentions quite clear...

"According to their recently released security bulletin, Microsoft will skip this month's Patch Tuesday.

"Patch Tuesday," with both words in caps, shows the original poster meant to imply they were skipping Patch Tuesday, not a patch on Tuesday.

And they're not skipping it, they're delaying it.

Good try though!

That Time of the Month

[Mad Man]

Patch Tuesday, also known as Black Tuesday amongst Administrators, is the second Tuesday of every month in which Microsoft releases a series of patches and critical updates for its various operating systems and applications.

I always refer to it as "That time of the month for P.M.S.: Patching Microsoft Servers."

("Patching Microsoft Systems" also works).

Are we still on for Pancake Wednesday?

[Anonymous Coward]

We were figuring on the IHOP.

Windows Vista patch??

[LiTrIx]

will there be any patches released for Windows Vista. BTW i found this great Windows Vista community. it seems that it's the most active forums that's currently available. the URL is: http://winvistasecrets.com/

Re:Windows Vista patch??

[Anonymous Coward]

Who modded this up!? BTW, I found this great site!!? He's promoting his own site here. Get a grip mods!

Re:Windows Vista patch??

[Anonymous Coward]

I found this great site...HAHAHAHAHA no.

Vulnerability Wednesday

[soloport]

"CERT and other vulnerability watchdogs have noticed an continuous increase in new exploits which are released, almost synchronously, on the second Wednesday of each month." -- Phrak News

Re:Vulnerability Wednesday

[MyLongNickName]

"MyLongNickName and other humor watchdogs have noticed a continuous increase in new serious replies which are submitted, almost synchronously with sarcastic messages" -- Slashdot News

Re:Vulnerability Wednesday

[Anonymous Coward]

If I got my jollies by making viruses, then I'd release them on the second Wednesday of each month simply so that the people who are responsible and apply the patches promptly would not be punished, but the people who are irresponsible and/or ignorant would learn their lesson.

And yeah, I know people can't always apply patches immediately. It also takes a while for a virus to spread.

Re:Vulnerability Wednesday

[Weirdofreak]

Does that mean that once every seven months the exploits are released before the patch?

Re:Vulnerability Wednesday

[Ernesto Alvarez]

  "CERT and other vulnerability watchdogs have noticed an continuous increase in new exploits which are released, almost synchronously, on the second Wednesday of each month." -- Phrak News

That is happening because crackers analyze the patches and learn what is the vulnerability being eliminated. There was an article about that topic on one of the major sites (securityfocus, I think). It's not a mystery, it's been happening a lot in the last 6 months.

Re:Vulnerability Wednesday

[denbesten]

In June of this year, the second Wednesday preceeded the second Tuesday. Sort of scarry, huh.

Stop visiting /.

[Anonymous Coward]

It will mean one less reader, meaning less activity. If activity slows enough, OSDN/VA Software would allocate less bandwidth to Slashdot. Then, users would end up slashdotting Slashdot, which would cause countless more users to quit, reducing activity further, and allocating more bandwidth away. Eventually, they would cut Slashdot off altogether, since NOBODY would be visiting.

In short, your quitting Slashdot would help bring about what you want.

--
Bonk the Zonk! TMM for editor!
Trolling all trolls since 2001.

Vulnerability "maximizes shareholder value".

[Futurepower(R)]

Microsoft software is insecure because that is a way of "maximizing shareholder value", in my opinion.

When people have problems with their computer, they often buy a new computer. Then Microsoft sells another copy of Windows, which, of course, still has huge security risks.

That also seems to be why Microsoft software is so... unfinished. If they ever finished the job, no one would need to buy another copy. So maximizing shareholder value means minimizing quality as much as possible, considering what customers will accept, and trying to introduce new hassles that can be fixed by even later versions.

Re:Vulnerability "maximizes shareholder value".

[empaler]

It's sort of an inverse marketing policy to Apple's - they just 'stack shit higher' with every new version, prompting users to buy new version because of glitter rather than faults in earlier versions.

Re:Vulnerability "maximizes shareholder value".

[legirons]

That also seems to be why Microsoft software is so... unfinished. If they ever finished the job, no one would need to buy another copy.

Mac OS X looks pretty "finished" (for people who like that sort of thing), but copies still get sold [at retail, to people who already have a copy] each time an new version comes out.

Admittedly it's not the same as people buying hundreds of copies of Windows XP Pro at retail prices because they're scared they'll become uninteroperable with other companies if they don't.

If there were any bugs, why would we replace it.

[barfomar]

If your present vehicle is working, what incentive do you have to buy a new one?
It's only after it becomes unreliable (or really ugly from rust etc) that you think about replacing it.

Software (despite what M$ would have us believe) doesn't wear out.

The only way to sell new stuff is have it break down. They only fix a few vulnerabilities at a time to make us believe they're trying to keep it safe, but they really built the "rust" at the factory.

Add a few new "features" (read code bloat) and the replacement cycle starts all over again.

They're probably secretly supporting a few exploits the keep the damand up.

Re:Title, maybe - summary means the day

[Anonymous Coward]

Read the summary at least before attempting to explain away the unnecessary MS bashing.

Re:What about the critical vulnerability out Sep 9

[Karma_fucker_sucker]

"The Inquirer"

You know, I have never heard of that site before and I though you were making a joke. I had to go there thinking I would see something like, "Bill Gates has alien's child!" or "Bill Gates gives all of his money to Linus Torvalds!"

Is Microsoft SERIOUS about security? You judge.

[Futurepower(R)]

Microsoft: We're so great that there is nothing to do this month! Oh, don't worry about those High Severity Remote Code Execution vulnerabilities.

Macromedia and Real Networks have been competing with Microsoft, but Microsoft is considerably ahead in being insecure.

Re:No, from TFA, they're NOT skipping Patch Tuesda

[Anonymous Coward]

I have always wondered what it would be like if magically, all of M$'s non-techie customers (private and commercial) suddenly had the ability to fully understand the way their "Magic boxes" work, and could objectively evaluate what Microsoft tells them.

What a wonderful day it would be if average users started asking hard questions and DEMANDING answers (as in: Why does there need to be a patch Tuesday in the first place?)

I'm not a Linux fanboy by any means( I use both windows and linux boxes, and both OS's have their own advantages), but why in the hell should anyone who pays money to a company for an OS have to put up with it having to be patched and updated constantly just to keep it functional?

How long do you wanna bet it would take for Suse, Mandriva, or Redhat to go bankrupt if they had issues with their products on the scale that M$ has?

Hopefully, over the next couple of generations, most people, having grown up with computers since early childhood, will be educated enough not to be snowed by all the FUD and misinformation coming out of Redmond and demand products that are secure and functional "out of the box".

Good thinking.

[Futurepower(R)]

MOD PARENT UP!! Good thinking.

Lameness filter encountered. Post aborted! Reason: Don't use so many caps. It's like YELLING.

We have a lame lameness filter.

--
If your gov't chooses killing as policy (CIA trained Arabs in 1980), expect others to choose the same.

lame lameness filter

[hostyle]

Mod parent up! :)

Re:What about the critical vulnerability out Sep 9

[almostmanda]

The Inquirer reports tech news.

The Enquirer reports stories about bat boy.

Small, but important, difference.

Re:No, from TFA, they're NOT skipping Patch Tuesda

[Overly Critical Guy]

An inaccurate headline and summary on Slashdot? You, sir, are threatening the hegemony.

Black Tuesday?

[Anonymous Coward]

Are they so reluctant to release security patches that they name the day "black"?

Recall notice.

[kd5ujz]

Why would a business invest in software that has a set patch schedule. Would they buy a fleet of cars that need to be brought in to fix a safty recall monthly?
Sure, a safety fix deals with life and death, but look how much money some of the corporations stand to loose to this bullshit. Look at Caterpillar.

Re:Recall notice.

[Vegeta99]

If that company doesn't replace its cars' tires or brakes as part of a regular maintenance routine, those said cars will eventually careen off the road and kill someone.

In fact, usually car manufacturers recommend that tires and brakes be checked at every oil change, or 3 months. Hmm.

Re:Recall notice.

[rkroetch]

If that company doesn't replace it's computer's harddrives on a regular basis, their computers will make awful screeaching noises and lose all of their data. Now, if car companies required regular computer flashes, that's another story. Big difference between hardware wearing out and software being made with security holes.

Re:Recall notice.

[kd5ujz]

Brake pads will make awful screeaching noises if you dont replace them, and their normal life span is probably half of a current hard drive.

Another "critical" Windows flaw found

[Anonymous Coward]

There are several unpatched vulnerabilities in IE 6, according to Secunia. The security monitoring company has issued 85 alerts on the web browser since 2003; 19 of those security bugs remain unpatched, according to Secunia's website.

In addition to the Windows security fixes, Microsoft on Tuesday plans to release an update for Windows that it deems high priority but is not security related, the company said.

Perverted priorities and Microsoft. Film at 11.

Full story.

someone desperately needs

[Phil Urich]

to mod parents up! Damn my lack of moderation points! (For once a year it seems....)

MS is cheap already

[lullabud]

It doesn't cost anything to 0wn a windows box and I've got a 10k strong botnet to prove it!

They're just copying Apple again

[lullabud]

Trying to release "Mini-Microsoft" or something, I'm sure.

So, you don't change your oil

[YuppieScum]

until your engine siezes up?

Its not infequent for exploits before release

[Anonymous Coward]

Nice myth there.

Even Microsoft site scanning monkeys found that one.

Send IE to as many sites as able and see how many get exploted and by what. They found a lot of 0 day faults that were in use on partical sites.

Spammers and Crackers find faults and explot them and tell people nothing. Virus writers seam not to be doing this any more.

All OS have 0 day faults question is who is going to attack you system. Are you going to loss you email account because of spaming or lose you data due to data thief or lose you idenity. Yep viruses are only minor problems.

Linux developers report faults fast so that firewalls can be altered and effected sections could be disabled before patch to counter 0 day.

Problem how many DHCP servers does microsoft make 1 How many DHCP servers does linux have. It has many. This applies basicly for every service.

So a notice of a major fault is a minor problem in the Linux world. Windows World major fault is a major problem because there is no other services to swap to.

Microsoft either opensource or double develop.

Microsoft Windows Has Open Source Parts

[Anonymous Coward]

Tcp/IP Stack was Patched some time between 1994 to 1998.

The Open Source Patch was only intergrated in Windows XP SP 2 and even then not completely yep not all the known faults in the Open Source Tcp/IP stack are fixed in Windows XP SP2 heck they did not even have to develop it all they had to do is copy the code in.

Jpeg Interface OpenSource.
Png Interface OpenSource.
Zip file interface OpenSource.
The list go on and on. Large sections of Windows is Open Source.

Without OpenSource Windows will fail.

Let just say 100% of the market uses Open Source 95% uses Closed source as well. So are weak to attack from both.

Yep Open Source people write subsystem parts that Microsoft used. Reason why we have all os attacks from time to time. Microsoft in all past cases is the last to patch.

Microsoft Attacking Open Source should be taken with a grain of salt. They are attacking the very developers they depend on to find and remove faults from the open source parts in their OS.

what a great analogy

[twitter]

The average user isn't a geek and while so many geeks can't understand this fact and rant how most people are clueless.
This works both ways. How would you like it if every trip to the auto-mechanic you were chided for having certain tires, not using a particular brand/weight of motor oil, not being timely enough in getting a tune up, why didn't you change your own oil, your tire pressures too low?

I'd love it if cars were like software and the mechanic was a well meaning and exasperated free auto evangelist. The tires, oil and all that would be free and I'd only have to press a button to refresh them, if only I'd give up the inferior "big oil" brand that's so highly advertised. I know it would be difficult to see through the FUD and fog, but one day I'd be very happy. If you know of an automobile or any other physical object that works like software, please let me know.

Other than that, I completely agree with you. Everyone needs to be nice to their customers instead of acting like M$ Partners or Steve Balmer. Also, the only thing dumber than running Windoze is running Windoze on autopilot. The "upgrades" will burn you.

Setting up a nice new laptop from school showed me just how bad the Windoze world has gotten. The gave me a brand new Dell Inspiron 2200, which is about as fast as my best desktop machine. Being new, Mepis had some problems with the machine's power management, which I have yet to resolve. It won't go into hibernate. Silly me, I thought the Windozy ACPI software would fix things so I asked where the utilities were in the forrest of disorganized tabs. No luck, Windoze merely disabled the wifi without asking after taking forever to boot and run a stupid anti-virus tool that "scanned" every file one of the 40,000 useless files on the partition. I was able to turn wifi back on by forcing it to connect to my home wifi and turning it off that way. Acpid and wmacpi, which I just installed via apt-get, will probably work better. How can anyone stand to run that nasty single interface, security nightmare? What single advantage does it have that make it worth the trouble?

Re:what a great analogy

[PunkOfLinux]

The games... duh. although, more games are coming out with linux support so... i dunno anymore

BUt i haven't played games in so long now it's not even funny.

Re:what a great analogy

[Anonymous Coward]

Moderators: Please note that "twitter" is a known fanatical sycophant whose obnoxious offtopic rants are legend here on Slashdot. It doesn't matter what the topic is, he'll find a way to scrape in some pointless Microsoft bashing. While nobody expects us to love Microsoft in any way, his particularly tepid style of calling anyone he replies to "troll" or "liar" or "fanboy" because he happens to disagree with whatever they're saying is well documented and should not be rewarded. If anything, twitter is the type of person that should not be part of the open source/free software community. He is an anathema to all that is good about free software.

I'm posting this so that you (the moderator) have some context to consider twitter and not mod him up whenever he posts his filler preformatted rants about installing Knoppix or Mepis or whatever that unfortunately get him karma every single time and allow him to continue posting his trademark toxic crap (read on) day in and day out. You may consider this a troll - I consider it community service. And I ain't kidding.

If you're a /. subscriber, I invite you to look through some of his posting history. I guarantee that you'll be hard pressed to find someone that is more "out there" than twitter. You'll also probably notice he's got quite an AC following. Don't just read his posts, make sure you go through the replies.

To get an idea of what I'm talking about, check this post out. This is an article about email disclaimers. The parent of the post is complaining about the ads in the linked page and so on, and twitter actually goes off on a rant to blame it on Microsoft and recommend Lynx, because "is teh free".

Here's another. In this post twitter not only calls the OP a troll but attempts to "tell it like it is" while making some vague argument about "GNU". Yes, if you're confused, you're not alone. The reply (modded +4) proceeds to simply destroy his bogus argument. You will notice he did not reply. This is what some people call "drive-by advocacy". A sort of I'll just leave you with my thoughts here and move on to the next flamebait kind of deal. In fact, he almost never replies because he knows that his fanatical arguments simply do not hold up to any sort of discussion. It's not that he's chosen the wrong cause - he's just going at it in a completely wrong way.

Here's that drive-by advocacy and FUD in motion: twitter goes on about some topic and then drops the usual "oh and M$ is teh evil" because "WMP phones home" or some such. Called on his FUD, he then claims that WMP stores every song and movie you've ever played in a file, somewhere. Pressed further, he just sort of slithers out of sight, his FUD-spreading complete. This is not about some Microsoft technology that nobody likes anyway; it's about lying for the sake of lying. Way too many of his posts are exactly like this one.

More? Just read though this post and the subsequent replies. I guess this stands on its own. Or these two. Or this one. Or this one.

Still not convinced? This is what twitter considers "humour" while going about his daily "M$" routine.

M

Re:If there were any bugs, why would we replace it

[PitaBred]

I don't know about you, but I just get bored sometimes, and want something new. Why does the old one have to be broken before I get a new one? The resale is better if it's working.

Bumper sticker

[leonbrooks]

"My other computer is your MS-Windows box"

Shouldn't that be...

[Anonymous Coward]

FAT Tuesday?

You say tomato, I say tomato . . .

[colinrichardday]

So it's (Microsoft Windows)(Malicious ((Software Removal) tool)). Dang, I could have sworn it was (Microsoft Windows) ((Malicious Software) (Removal Tool)).

Let's write it all in Lisp.