Slashdot Mirror
Microsoft Taking Longer to Fix Flaws
An anonymous reader writes "A look back at the last three years of security patches from Microsoft shows Redmond is taking at least 25 percent longer to issue patches for "critical" vulnerabilities, now averaging around 135 days to issue a fix. The exception appears to be with "full disclosure" flaws, for which Redmond issued fixes in an average of 46 days last year."
So they're concentrating efforts on the full disclosure exploits... and this is bad why?
Unfortunately, this trend seems to plague many of the major application vendors as well.
I was expecting to find a scathing review of the patch process, but instead found a fairly reasonable assessment of the realities of issuing security patches: disclosed vulnerabilities get patched faster in an attempt to cover the users from the most probable exploit vectors whereas undisclosed vulnerabilities give the breathing room to do more testing and attempt to repair related flaws that are discovered in the process.
That doesn't make me happy with the current situation, but it does make sense to react quickly (even if it puts the reaction at risk of being a problem itself) when something is actively being exploited. More quality assurance can be placed on patches that are not actively exploited (although each day increases the chance it will be exploited) and even more quality assurance can be placed on patched for flaws that are unlikely vectors.
Being responsible for very high reliability networks (our customer facing web and their support servers), high reliability networks (the corporate network, where I can apologize to someone's face if it blows up) and low reliability networks (my own internal network where I can fire anyone who complains) I have different thresholds for pain in the patching process depending on the network involved.
I'm far more willing to just slap a patch on my internal network: after all, it is my testing ground and it affects me far more than anyone else if it dies. After I have assured myself it isn't total bunk, I will patch our corporate network. Finally, our high reliability network is patched only after the corporate network's servers and clients have given us confidence in the patch. Of course, that means our high reliability network has to be far more insulated (URL scanning proxies in another operating system, tightly controlled trust relationships, intrusion detection, etc) but it is worth the extra effort and cost to avoid a "bum" patch bringing down the show.
Microsoft may not be reacting perfectly, but I think they are trying to balance corporate stability with the realities of exploitation. It sounds like they do need to throw some more resources to the departments involved to shorten the critical path, but with a system this complex, test cycles are going to be long and involved.
Sig under construction since 1998.
a bear shits in the woods.
So, you mean to tell me that they fix flaws faster when they have users and system administrators breathing down thier necks? Say it ain't so!
Seems as though the reason stems from the fact that Microsoft actually has to make sure their patches are compatible with the rest of the things they support. As they support more and more hard and software, the total can only go up.
In the Windows Meta File case MS patched my machine and rebooted it without my consent after just a few days. I guess it all depends on how serious the flaw is.
http://www.stockmarketgarden.com/
The most interesting result of Security Fix's study is that Microsoft took longer to fix a problem if the researcher waited to disclose the problem until after Microsoft published the patch.
I'd like to know if the time to issue a fix also depends on existing exploits, i.e. is Microsoft faster if there is already an exploit out there. If yes, than it seems obvious that Microsoft does not really put as much afford into fixing bugs as they claim, they're "motivated" by public pressure.
One explanation for additional delay in case of a not yet disclosed or not yet exploited problem may be more thorough testing, so it may not even be a bad thing. But I'm afraid that the delay is not really "in the best of the customers", more in the best of Microsoft. I have no prove, but it seems to be the general company policy.
Chriss
--
memomo.net - brush up your German, French, Spanish or Italian - online and free
memomo: free web based language trainer DE-EN-ES-FR-IT
In the Linux world, the deployment of a bug fix and discovery of any potential bugs is part of the testing cycle. So you get a quick turn around time when a bug is reported.
.. whatever it takes to make sure it is tested is a GOOD thing. I don't want to be their beta tester :)
When Microsoft has to issue a bug fix (and all jokes aside about not testing), I am sure they have a team devoted to testing it, then it has to get sent to all internal Microsoft employees and tested, and then probably even has some initial customer testing with the bigger companies to make sure nothing breaks, and then finally gets released to the public.
Hopefully 165 or 365 days
now averaging around 135 days to issue a fix.
/me Shakes head.
That's totally unacceptable, in almost every way. FOUR months. FOUR months for the flaws to be potentially exploited.
... no presure to fix .... ... no danger to market monopoly ...
so who cares ?
move alogn, there is nothing to see for you here....
If you look at the data, you will notice that some critical flaws were patched in less than 3-4 weeks. While that may seem long, it is somewhat reasonable due to the amount of verification/validation necessary. People forget that 95% of the world runs on M$ so they have to really test a patch before releasing it.
On the other hand... because so much of the world depends on M$, they have an obligation to its customers to provide a secure OS and timely patches. Personally, I feel they are doing an "ok" job and seem to be getting better. Alot of vulnerabilities can be avoided just by running your PC behind a router and/or by using a firewall application. Personally, I have NEVER had a virus at home on any of my computers because I take simple preventative measures like running Norton AV and AdAware. I also put all my pcs behind a router.
http://religiousfreaks.com/While it is certainly interesting (if true) that Microsoft takes longer to release patches with no known exploits roaming around, I would find it far more interesting to see which causes more harm: the longer patch times or the full disclosure.
Just because Microsoft releases a patch quicker when full disclosure is used doesn't mean this results in less harm to users. It might take Microsoft 200 days to release a patch, but if the only people who know about the bug are the researchers who discovered it and Microsoft, then the end result is that little harm was done to the users.
If, however, an easily understandable exploit is posted before Microsoft has fixed the bug, those 45 days might be a lot more dangerous for those users than the 200 days in the previous example.
Of course, it's very difficult to know if the security researchers who discovered the bug are the only ones with knowledge of that bug. Could other people know about it and be actively using it to compromise machines? Maybe. But I would really like to see some data on this.
I suspect that the vast majority of major worms and viruses take advantage of well known exploits published on the Internet by usually well meaning security researchers. Certainly all of the major worms I can think of off the top of my head follow this pattern. (MYTOB, LOVGATE, NETSKY, SASSER, ZAFI, SOBER, BAGEL, etc.)
If so, people really are safer when the exploit is not published before Microsoft releases a patch despite the significant lag time for those fixes.
So I guess which approach you take depends on your goal. If your goal is the glory of a 0-day exploit, then post away. But if your goal is the security of the end user, maybe you should keep it to yourself for the time being.
This is a great case for Intrusion Prevention Systems. I have seen many vendors providing "Virtual Software Patches" during the window from when a vulnerability is released to the time that it's actually patched. It's not the ideal solution, but it's definitely one of the best ways to take care of the problem today without waiting for m$ to get their stuff together.
I'd say that in this week I've seen stuff from 3Com/TippingPoint, Secure Computing, Sonicwall, etc. all about securing WMF fairly quickly after the exploit had been announced.
Why bother if you are gonna post crap like this?
With work going full force on Windows Vista, you would have to understand that Microsoft has other things on its plate. Also, perhaps these issues are a little more difficult to fix.
Click Click Bloody Click PANCAKES!
Assuming that the more important repairs are done in under thirty days,
I'm willing to overlook the 365 day fixes that push the average way up.
Is it a day?
Is it a week?
Is it a month?
Doesn't Microsoft have enough money to maintain images of different configurations just for such testing?
Doesn't Microsoft have the people who could automate such testing?
Is the problem that they don't have enough money? Or that they don't have people who are smart enough? Or that they just aren't doing it?
That's it! I'm putting in a suggestion to my company that we put in this 3rd party patch for the few Windows servers we have left.
Or to paraphrase, "sell me a bug ridden OS once shame on you, sell me a bug ridden OS twice shame on me".
Cue everyone giving lousy examples of why they cannot live without windows.
Proposal for a new moderation system, you can only mod people in OS discussions who are on the same OS as you.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Redmond is taking at least 25 percent longer to issue patches for "critical" vulnerabilities, now averaging around 135 days to issue a fix.
It wasn't necessarily because it actually took longer for them to fix these new vulnerabilities, rather, their marketing department just wanted you realize the immediate benefits of installing Microsoft Anti-Spyware beta.
He who knows best knows how little he knows. - Thomas Jefferson
While releasing non-critical patches on a monthly cycle seems sensible, three months is a very long time. I wish I could believe it was all being spent on testing.
A danger is that the time difference between patches for undisclosed vs. fully-disclosed vulnerabilities will encourage people to fully disclose without waiting. I hope Microsoft are working to bring down their cycle time for characterising the vulnerability, and developing and testing the patch.
Does anyone have statistics for the number of bugs found in patched code vs. the time taken before releasing the patch?
/* This sig is disabled. Press CTRL-W to enable. Thankyou */
The timeframe doesn't seem entirely unreasonable. When you think that they are releasing a patch which will be automatically downloaded and installed on literally tens of millions of computers, most of which without any system administrator to aid in the process.
That is a daunting task, and I can imagine theres a very lengthy process a patch must go through.
To Microsofts credit, I can hardly remember a time that a patch was released which cuased any major problems, which in itself is a great achievement given the amazing variety of hardware and software the users may have. There was of course alot of hype over compatibility issues in SP2, but to the best of my knowledge any actual issues were understood ahead of time and due to compromises that were made intentionally for one reason or another.
Big ones, small ones, some as big as yer 'ead!
Give 'em a twist, a flick o' the wrist...
/* This sig is disabled. Press CTRL-W to enable. Thankyou */
Imagine if their patch accidentally disabled * * * TENS OF MILLIONS * * * of computers. If that happened, they'd loose so much consumer confidence -- essentially loosing whatever gains (if any) they have made in the last several years (and billions in spending).
(okay, that did happen on a lot of sp2 systems, and MS is not loved for it)
MS has to ensure that the patch works on a staggering and dizzying array of systems and architectures (lots of different mobos, pentiums, AMD's, dual core CPU's, XENON's, via chips), and for dozens upon dozens of applications. That's why you often find that they'll often release a patch on NT or more server based systems before they release it for consumer systems.Another reason is that, depending on the type of problem, will do a full tracability check, and also cross reference all their code that references the changed module, and evaluate (probably manually) if they put that dependency at risk. A huge, horrible job, suitable only for type-A micro-detail oriented folks. I wouldn't want to do it!
If MS disabled TENS OF MILLIONS of computers, you would see a huge shift away from regular Patch Tuesday activities, towards one of 'install on a test bed' -- extremely tedious and manual that everyone would hate. Millions of people would be put out. Seriously bad Karma.
So, they can:
I'm sure at least someone is thinking "Heck: our flaws are the manure in which an entire security industry will grow in".
If the brakes on your cars were discovered to have a fatal bug would you want your car company to first test a patch and see how it effects every car in the world OR that they contact your ASP and tell you your brakes are untrustworthy and to stop driving your car?
Depends, can my computer fail to come to a complete stop at an intersection, leading to a fatal collision?
A common argument of those who oppose full disclosure is that it does harm by allowing the development of worms, and provides infection vectors for Spyware. I personally think the widespread worms are a good thing. The act like wildfire clearing the underbrush of vulnerable machines.
What really concerns me is not some 14 year kid in Bulgaria playing "my botnet is bigger than yours" games. I'm concerned about hostile governments, terrorist groups, and organized criminals who already have a stable of zero day holes to attack my company's systems. These are the threats that keep corporate and government security teams awake at night. All the piddly little public nuisances are just ploys to get funding.
Yesterday, eEye released information about a Windows hole that they reported over 5 months ago. The WMF hole was known to Microsoft long ago, and has existed for YEARS! Does anyone really believe that the REAL bad guys don't have the knowledge to get inside any (at at least very nearly any) company in the world. The US military is getting hacked for God's sake.
I say full disclosure now. It won't make us less secure, it will only appear to.
-SHP
I don't live under a bridge and eat little children, really.
The reason it is taking so long to fix vulnerabilities in my best estimation is that they have many different applications/OSs to test these patches with, while at the same time are trying to ramp up the efforts for a smooth release of Windows Vista. Attacks against Windows PCs are increasing by the day and it is probably much more time consuming to fix the myriad of these vulnerabilities than what it was say 5 years ago. But that is just a guess.
He who knows best knows how little he knows. - Thomas Jefferson
http://www.knoxnews.com/kns/local_news/article/0,1 406,KNS_347_4379932,00.html
Hackers 'phish' $70k from Y-12
By BOB FOWLER, fowlerb@knews.com
January 11, 2006
OAK RIDGE -- Savvy computer hackers siphoned off nearly $70,000 from Y-12 Federal Credit Union members' credit cards in an intricate Internet fraud scheme that lasted only 90 minutes Monday night.
"It was extremely sophisticated,'' Y-12 Credit Union Vice President Chris Smith said of the latest version of online phishing.
There was a late-December surge in underground hacking of various Web sites after a hole was discovered in Microsoft software, Smith said.
"These folks figured out how to exploit it (the hole),'' Smith said.
They hacked into the credit union's Web site so when customers hit the account login button, it redirected them to a bogus Web site in Greece, he said.
That Web site featured a picture of the credit union's Web page. But in the login process, members were asked to enter both their credit card number and their personal identification number, or PIN.
"Your credit card is your vault, and your PIN is your key,'' Smith said. "We would never, ever, ever ask for your PIN.''
"Our systems are so secure that they (hackers) know it's much easier for them to trick you into giving them what they need.''
Smith said the hackers apparently used the information they gleaned to generate a magnetic strip for an ATM card, which they then used to plunder customers' credit card accounts from ATM machines.
The elaborate phishing trip lasted only from 7 to 8:30 p.m. Monday. By then, several credit union members had called "and let us know something wasn't right,'' Smith said.
The credit union promptly shut down its Web site, used the patch only recently made available from Microsoft, and made the necessary repairs, he said.
Initially, 17 credit union members were affected. Others called in Wednesday, Smith said, "and that number could grow.''
Members who lost money will have it refunded by the credit union, Smith said.
Bob Fowler, News Sentinel Anderson County editor, may be reached at 865-481-3625.
If you're a MICROSOFT GOLD member click here to get the patch !!NOW!! from our super faster servers!!
All other members please use the public servers. Wait time is 10 minutes to 90 days. Please be patient. OR UPGRADE TO GOLD MEMBERSHIP STATUS!! FIND OUT HOW BY CLICKING HERE!!!
Maybe someone will use the .Excel files (as if they are making fun of us), open it with OpenOffice.org, save it as native OpenOffice.org files, then conduct a honest statistical analysis of what happened and whether it was statistically significant or not and what consequences the results predict...
...Only semi-attractive women can ask and they need to allow me to fuck them in the ass in return...
...The WMF idiocy showed that MS and its users still live in a dreamland...
It's comments like these that help to strengthen the argument that you are a sane, well-balanced individual, who should be listened to, due to your high level of intellect. Welcome to grade 4.
Flatery will get you nowhere.
Parent is speaking .raw truth here...
It's amazing that the trolls justifying the software giant's bad track record are modded insightful, and parent is modded troll. Ballmer, do you have mod points here?
Would throwing more resources actually help speed the process, though? More resources (meaning more people) just tend to get more done in the same or longer time. It's not a linear relationship, anyway. And the "more" they get done is not necessarily productive. On its face, adding more resources to the test phase would seem to make testing faster, but what happens to the bugs that the testers find? More testers, more bugs, and an increased need to analyze and correct them.
What it comes down to is setting arbitrary deadlines, and project-managing backwards to say how thorough a job you'll do with the time and resources at hand. In other words, the only thing more resources buys you is additional thoroughness, and maybe not even that.
sigs, as if you care.
semi-attractive women only?? and in the ass?? what about their sisters, mothers, aunts, cousins, pets?? what about 2 hours on Google Earth??
www.lemonodor.com A mostly Lisp weblog
Focusing on the exploits or not, 46 days is a long time to wait for a critical fix.
.... Yawn.... While you wait for the expresso machine to finish filling up that paper cup. I used to work for a *NIX vendor where the usual procedure was to offer a workaround to plug up the security hole. The patch was then developed and sent off for testing from where it would sometimes return for a rework because it caused unexpected problems in some other part of the OS. If Microsoft, Sun, IBM, Apple or any of the numerous enterprise quality Linux distros out there would sling these fixes out as soon as the developers finish them you would now be griping about how unstable these systems are because of badly tested patches. I will admit my former employer usually got better turnover times per pach than 6 weeks but for 3-4 weeks to pass from the time problem being reported and until the patch had been fully tested accross all major OS versions still in widespread use and approved for release was not unusual and we only had one Server OS to worry about. I can even remember a couple of errors that took over a year to track down because they were hard to reproduce and the culprit was difficult to isolate. Of course this was a few years ago and OS'es, at least in my experience, do not tend to get simpler as time passes.
Fixes like this have to be tested and re-tested which is not exactly something you do
Only to idiots, are orders laws.
-- Henning von Tresckow
Microsoft does have a problem with the variety of configurations and applications which need to be tested for them to release a patch... but a "beta" patch would enable them to get a fix out for the majority of users in the majority of configurations... while they work to get a final version to test on every known permutation of application and hardware possibilities.
That would surely speed the "beta" by at least two weeks.
to comment on your sig...
joe
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
If you would have said what you've said in a bit more polite manner, your post would have been rated insightful not flamebait, because you're making a lot of good points.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
I mean, when you consider how long it takes them to put the flaws in their products in the first place, it's only reasonable that it would take them longer to get the flaws back out again, right?
--- Asking inconvenient questions for over 30 years...
Why? Because the black hat community is very, very nice to MS.
I've never met a truly destructive worm or trojan. I don't mean one that disabled systems as a side effect of its operation. I mean one specifically designed to destroy data, and/or BIOS/CMOS/anything flashable.
A 4 month patch cycle. I imagine that if North Korea, or whoever felt angry about the global economy, decided to try and do something devestating that they could easily prepare some kind of trojan payload that would install itself, replicate for a week or so, and then destroy the system in question. Blow away the BIOS (won't be determined until a reboot), blow away the partition table, and then start writing loads of garbage all over the disk.
Such a worm would break MS. MS execs would be brought before a congressional hearing.
That is, after banks, airlines, and major companies managed to rebuild some kind of IT infrastructure.
MS is very luck that no black hats have decided to do such a thing. I guess its most likely because no one wants to bring THAT kind of heat down upon themselves.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Fuck off, you racist asshole!
Here is a simple analysis I did. It proves that MS makes more money when there are more vulnerabilities.
Windows = 700 million computers
Microsoft = 40.34 billion in annual sales
Microsoft = 289.7 billion market cap
You = childish
Wonder who is really living in the "real world" and who is living in the "dreamland" as you so eloquently put it.
What do you mean "Only semi-attractive women...", what's wrong with going for "Only women who are at least semi-attractive...", were you trying to tell us you would exclude "very attractive women"? ;-)
Seriously though, while Microsoft has countless issues and problems, I think that saying Linux is an easy replacement is like saying windows is easy to fix.
I gather that Microsoft Windows is an abortion of code, and the fact that it actually works as well as it does could be considered a miracle. I watched a Channel9 interview of the Vista Kernel guys, they, although not quite in these words, admitted that Microsoft's past practices has resulted not only in bad code, but bad code in 3rd party software vendors. Microsoft is slowly rewriting Windows to bring it to a truly secure level, but are also being hampered by 3rd party code that just does not play by the rules.
Consider the following situation, a commercial application is released for Linux which insists on running as root, now, if a million users buy this, and follow the instructions by the software vendor on how to make the software run as root we land up with a million users with inherently insecure software, could that be considered a fault of Linux?
I know that with XP it is hard to get by as a limited user, but if one sticks to Microsoft apps, everyday tasks can be achieved with no headaches. But then one day the user comes home with a piece of software like Pastel Accounting which for some God forsaken reason HAS to be run as an Administrator, and now they are vulnerable.
I use Windows, I run as an Administrator, I use Firefox, I use the standard Windows XP SP2 Firewall, I don't use any Anti-Virus or Anti-Spyware software, but most importantly, I do my Windows Updates regularly, by regularly I mean to say that my machine is told to automatically download updates, and if I happen to be logged on to my machine, it will prompt for a restart which I do as soon as possible, or alternatively, if I left my machine logged off, it will automatically restart at 3am.
This machine is close to a year old now, it has not had any malware issues, this is attributed to my computer's software being up to date, and more importantly my knowledge of software and computers. For using Windows I get the convenience of being able to run any software written for it, commercial or open source, and I get access to drivers which I know will work on my OS with no more hassle than clicking an "install" button.
If I switched to Linux, I would be on a more secure system, but wouldn't have access to half the software I am using right now, and the other half would probably require weeks of tweaking and reading of news groups to get working, and at the end of it, I still would end up using Windows for games, because it's just easier.
What I am trying to say is, yes Windows is bad from a security perspective, but right now it is not only Microsoft that has to come to the party to sort it out, however, in spite of this if the users weren't such dumbasses, we would also have far less problems, so users also need to be informed, as demonstrated by my running a Linux app as root example.
And in all honesty, Windows works perfectly for me, it installed with absolute ease, not a moments problem during operation either, not even a system hang, why should I switch to Linux which I know will frustrate me because it just doesn't run some of the things as easily as Windows?
I agree that one truly nasty worm could do significant damage to MS' empire (though I wonder if it would utterly ruin them or not). I think the main reason this hasn't happened is that the risk/benefit ratio is too high. Look at parasites in nature. The ones that destroy a host quickly and utterly don't get a lot of time to reproduce themselves and ensure the continuation of their species and they end up having to find a new source of resources much too often. So what we're left with are ones that seek to remain undetected and feed off a host for a longer period of time while reproducing like crazy.
The obvious computer analogue is that wanton destruction is simply not profitable nor worth going to jail for. Selling personal data to spammers, phishers and shady marketing companies is.
Stack overflow: pid 352258, proc httpd, addr 0x11f7ffff0, pc 0x12000195c Segmentation fault (core dumped)
I assume this means the whole company is working on Vista (there next money maker) and XP is legacy ...
Just a guess ...
There are various approaches that are possible:
#1. We have one guy writing the patch and one guy doing the testing and it's released when it is released.
#2. We want 95% of our patches coded, tested and released within 4 weeks of notification, how many people and machines do we need to dedicate to hit that target?
Microsoft's slogan for Vista "Microsoft Vista... Patches in a week" On hearing that many people will upgrade based on security reasons. What I'm saying is that Microsoft is playing politics with patches so you are more likely to upgrade.
How about this: Can a computer fail to tell the traffic light to switch to stop at an intersection, leading to a fatal collision?
Of aircraft crash, or fatal medical misdiagnosis, etc etc?
Consider:
Linux runs on ALL those platforms (Intel, AMD, etc). And more (Alpha, IBM Mainframe, Sparc, etc.). There is really no comparision.
Consider:
Linux supports more legacy hardware with the OS core.
Consider:
Linux vendors typically support 4+ GB of object code with a typical installation.
Not that I care one way or the other about Linux/Windows comparisions, but this should give you something to think about.
The obvious conclusion to draw? That the Open Source model is SO SUPERIOR to Microsofts, that there is really no direct comparision possible. Of course, that is probably wrong. Another possibility is that Microsoft really doesn't care. Which makes sense (ob disc: I *am* a Microsoft shareholder) to me -- their goal is to maximize profit. And if the OSS model where THAT much superior, Microsoft should have adopted something like the Redhat model years ago.
Of course the problem is that Microsoft installations are more vulnerable to quiet "black hat" attacks. The general rule is to assume that if YOU found a vuln, someone else has already found it. So it really doesn't make sense to keep quiet about them, and, as a user, there seems to be some kind of speed-up on the fixes.
I don't like this a a Microsoft shareholder; more resources have to be spent on fixing 'sploits, and less on actually making money.
Your conclusions may vary.
Ratboy.
Just another "Cubible(sic) Joe" 2 17 3061
Could be a lack of motivation among their people. Perhaps Microsoft isn't noticing that most of their employees are wearing Google t-shirts lately. ;)
Possibly an indication that they're taking their time for once and solving the problems more properly?
No, statistics show they are not getting better (though it looks like Microsoft is putting more efforts into improving their patch development process), read TFA: "In 2003, Microsoft took an average of three months to issue patches for problems reported to them. In 2004, that time frame shot up to 134.5 days, a number that remained virtually unchanged in 2005."
I do the same thing, and for the same reasons. Yeah, Windows isn't as secure as Unix/Linux. Yeah, it tends to be a chore to keep everything up to date and patched. Yeah, Microsoft is an evil corporate machine that I don't like supporting. But the simple truth is that compared to most Linux distros, Windows is a much more painless experience from a usability standpoint. If I happen to want some new killer app, chances are I can easily find a copy that will run on Windows with minimal difficulty. Linux? Forget about it. I'm not saying I don't like Linux, because I do. I think it's great. But when very few software vendors support it, it's just not practical for me to use it as my everyday machine. When software vendors finally start aggressively supporting Linux, then I'll make the switch, but until then, I'll rely on firewalls, anti-virus, anti-spware, and my own know-how to keep my Windows machine from getting owned. The reason so many Windows machines get owned is because (and I've seen this even with people who claim to know some things about computers) the end users don't take the time to set up Windows properly, install a firewall, anti-virus, and anti-spyware, or apply the updates. Lots of people seem to be stuck on the idea that Norton Anti-Virus is some magical app that will protect them from anything.
Also, I think that a lot of the reason that Linux is praised for being more secure is the fact that most hackers don't really give a rat's ass about trying to exploit the 5% (or whatever the stat is now) of Linux/Unix/Mac machines out there. It's just not worth the trouble. If it was, I bet we'd be seeing a lot more vunerabilities being discovered.
Did anyone else read that as "flix flaws flaster"?
Not enough man power? not enough money? Wrong questions. Try again When it comes to software development, throwing more people at a problem entailing a complex peice of software in fact increases the amount of development time taken to produce a deliverable. This is one of the first concepts taught in IT management. The most obvious reason why any fix is taking longer, rather than shorter, is from bad design. It is from bad design that these exploits are appearing in the first place -- issuing "on-the-fly" fixes makes this design even worse; therefore, fixes will continually be on the trend of taking longer and longer, irreguardless of the amount of money and manpower thrown at it. A solution would be to redesign windows; however, given the beaucratic atmosphere now present at Microsoft, this sort of change is impossible.
This would be akin to having the anology of cars without modern safety features. "Personally, I have NEVER had a serious injury while driving any car because I take simple preventative measures like buying seat belts, safety glass, and air bags." The question one should be asking is why does the user have to buy "seat belts, safety glass, and air bags" for their computer in the first place?? Shouldn't these things be standard features? Turning around responsiblity to the user is allowing MS off the hook. Users are using Windows as designed and getting sometimes serious malfunctions. It would be one thing if people were abusing their machines and breaking them. It is something else to be normally surfing the internet, reading email, or doing any other nominal activity and hitting a serious problem that leaves their system bare to the hackers. This is squarely Microsoft's problem not the users!!
I'm tired of this kind of applogetic excusing for Microsoft. As much as people want to blame the users, its still all in MS's lap since many of the problems stem from software doing things that it should never be allowed to do in the first place. AV software, hardware and software firewalls, malware scanners...its all a hack to stop users from breaking their machines doing normal operations because MS won't or can't engineer a system that disallows it.
Years of experience on other systems have shown that computers are complex machines with complex interactions all of which are prone to error and worst exploit if not carefully designed. On the other hand Microsoft sold most of the world on the promise that Windows is as easy to use as a VCR and requires just as much maintaince and look at where we are. We have to throw more and more money and time into work arounds while MS takes longer and longer to fix up things. Why aren't more people asking why does Windows work this way?
We're dealing with a number of different dates, some of which are often months or years apart:
Somehow, being a political movement / cult, MS becomes exempt from the rules of a normal business and from what customers expect. No other device or appliance has had even a fraction of the defects as MS' without going through a major product recall. Our dear Chairman Bill will go down in history as the man that made bad engineering acceptible aka the Microsoft Effect
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
If we can assume that, in general, each exploit found is slightly more complex than the last one found then the increasing amount of time to fix these exploits makes sense. I know this isn't always the case, but I suspect there is some truth to it.
It's the whole low hanging fruit metaphor. As each venerability because more difficult to identify and exploit, the fix for it also because more difficult to identify and patch.
I mean really, why? If I get a patch to, say, gaim, I know that my motherboard and soundcard just aren't going to matter. That's what the job of the OS is, to abstract away those details from the application.
Why does Microsoft have to test patches to things like browsers against all possible configurations? Why does it matter which CPU or motherboard or soundcard you have for a stupid browser issue?
This all comes down to the stupidly broken architecture of having a largely monolithic system that has a spaghetti-like mass of depencies within whatever modules it might have internally. So, despite the fact that the argument that Microsoft has to test patches so extensively, I still think that's Microsoft's own fault, and they should be held accountable for the increasing amount of time it takes to test patches.
Need a Python, C++, Unix, Linux develop
Hardware is not perfect. Read errata on processors or motherboards sometime.
they are so busy creating new exploits in the next version of windows they don't have the time to fix the old ones!
It may be that Open Source apps are more modular, and thus easier to fix in a way that doesn't affect everything else.
And in all honesty, Windows works perfectly for me, it installed with absolute ease, not a moments problem during operation either, not even a system hang, why should I switch to Linux which I know will frustrate me because it just doesn't run some of the things as easily as Windows?
One word: FREEDOM.
I think microsoft is going to care less and less about windows xp and 2000. I hope singularity and their other research OS does well at least, cause those are the interesting ones. WINDOWS IS CRAP, especially if you like to tweek your computers! ~Shan
Great, I am "free" to make my life more difficult...
Comments like yours are mostly just a waste of everyone's time, did you even fully read my post, and by responding with a comment "one word", are your trying to tell me my post was of no real substance that it deserved no more? You really need to learn to justify your statements.
I fully understand the concept of free software, but I don't see how the fact that Linux is free changes the fact that Windows works better for me. It's absolutely wonderful that I can see what Linux may be doing behind the scenes, and if I so wish, actually change it, but for my purposes, Linux may as well be closed source, because I do not have the knowledge or expertise to fully appreciate the freedom that Linux offers me.