Microsoft Taking Longer to Fix Flaws

An anonymous reader writes "A look back at the last three years of security patches from Microsoft shows Redmond is taking at least 25 percent longer to issue patches for "critical" vulnerabilities, now averaging around 135 days to issue a fix. The exception appears to be with "full disclosure" flaws, for which Redmond issued fixes in an average of 46 days last year."

Comments

Meh

[Anonymous Coward]

Seems as though the reason stems from the fact that Microsoft actually has to make sure their patches are compatible with the rest of the things they support. As they support more and more hard and software, the total can only go up.

Do expoits speed up the fixing?

[chriss]

The most interesting result of Security Fix's study is that Microsoft took longer to fix a problem if the researcher waited to disclose the problem until after Microsoft published the patch.

I'd like to know if the time to issue a fix also depends on existing exploits, i.e. is Microsoft faster if there is already an exploit out there. If yes, than it seems obvious that Microsoft does not really put as much afford into fixing bugs as they claim, they're "motivated" by public pressure.

One explanation for additional delay in case of a not yet disclosed or not yet exploited problem may be more thorough testing, so it may not even be a bad thing. But I'm afraid that the delay is not really "in the best of the customers", more in the best of Microsoft. I have no prove, but it seems to be the general company policy.

Chriss

--
memomo.net - brush up your German, French, Spanish or Italian - online and free

Why is this a bad thing?

[esac17]

In the Linux world, the deployment of a bug fix and discovery of any potential bugs is part of the testing cycle. So you get a quick turn around time when a bug is reported.

When Microsoft has to issue a bug fix (and all jokes aside about not testing), I am sure they have a team devoted to testing it, then it has to get sent to all internal Microsoft employees and tested, and then probably even has some initial customer testing with the bigger companies to make sure nothing breaks, and then finally gets released to the public.

Hopefully 165 or 365 days .. whatever it takes to make sure it is tested is a GOOD thing. I don't want to be their beta tester :)

Re:Why is this a bad thing?

[randyflood]

You ask why it is a bad thing if the time between the discovery of a security vunerability and the time to relase a patch is increasing. You ackowlegde that in the Linux world, patches are fixed much faster due to their development model. So why is it a big deal if hackers can own your systems for longer without a patch being availiable? Isn't it obvious? HACKERS CAN OWN YOUR SYSTEM FOR LONGER BECAUSE A PATCH IS NOT AVAILIABLE. That is what the big deal is. They can use whatever development model they want. Releasing shoddy patches is only one solution that is available to them. The fact that they are able to cut the time it takes to release a patch in half if a working exploit has been publically released shows that it is more a matter of what resources they want to bring to bear on the problem rather than the minimum time to release a good patch. Or another way of stating this is, they are 25% less concerned with getting patches out in a timely manner than they used to be. So, the importance of security at Microsoft is decreasing.

Re:And this is bad why?

[kg4gyt]

Focusing on the exploits or not, 46 days is a long time to wait for a critical fix.

Re:And this is bad why?

[saleenS281]

when you're accountable to that many customers with so many "supported" configurations, it takes a while to test. They don't have the luxury of most linux distro's where if it breaks some obscure program they can go "whupps, well, tell the author to write a fix for his app".

How much would it cost?

[khasim]

when you're accountable to that many customers with so many "supported" configurations, it takes a while to test.

What is this "a while"?

Is it a day?
Is it a week?
Is it a month?

Doesn't Microsoft have enough money to maintain images of different configurations just for such testing?

Doesn't Microsoft have the people who could automate such testing?

Is the problem that they don't have enough money? Or that they don't have people who are smart enough? Or that they just aren't doing it?

Re:And this is bad why?

[freshman_a]

when you're accountable to that many customers

When who's accountable? The disclaimer included with the last MS security update I downloaded read as follows:

In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.

Now, unless I misunderstood, it's telling me that if I install said security patch, and it breaks something, I can't hold MS accountable.

Re:And this is bad why?

[Itchy Rich]

Now, unless I misunderstood, it's telling me that if I install said security patch, and it breaks something, I can't hold MS accountable.

You may or may not be able to hold them accountable in court, but third party adjudication is not the only form of accountability.

If Microsoft didn't bother to test their patches carefully they'd risk upsetting their corporate customers, and hence their bottom line.

The Microsoft Effect

[SgtChaireBourne]

There's a lot of misdirection going on here. The day an exploit is made public is not the same as when the bug it uses is reported. Nor is that the same as when the bug is found, not is that the same as when MS acknowledges the bug.

We're dealing with a number of different dates, some of which are often months or years apart:

1. Date bug found by black hat
2. Date bug found by white hat
3. Date bug is reported
4. Date bug is made public
5. Date exploit is published
6. Date exploit is found 'in the wild'
7. Date MS acknowledges the bug
8. Date MS announces a patch
9. Date MS releases a patch
10. Date MS releases a patch that fixes the bug / repairs damage from first patch

Somehow, being a political movement / cult, MS becomes exempt from the rules of a normal business and from what customers expect. No other device or appliance has had even a fraction of the defects as MS' without going through a major product recall. Our dear Chairman Bill will go down in history as the man that made bad engineering acceptible aka the Microsoft Effect