Slashdot Mirror
Microsoft to Release 7 Patches Next Week
craters writes "Microsoft plans to release 7 patches next week for Windows and Office. From the article: 'In the monthly pre-patch notification it sends out five days prior to unveiling fixes, Microsoft said that at least two of the seven will be rated Critical, which by the company's definition means that the vulnerability can be remotely exploited.'"
It appears there is a conflict at Redmond. In one case they are fixing a bug which has yet to be discovered, in another they are fixing a bug which has existed for around nine months.
It's about time they came up with a proper strategy other than randomly fixing the bugs they want to fix.
Martin
Ohhhh man... it figures.. right when I had my spyware pickup line down to a science...
Example:
Me: Well maam, I can fix the problem.
Hot Housewife: Great! Whats it going to take?
Me: Well I've been reading some websites on good ways to deal with myWife.
Hot Housewife: mmmmHmmmm
Me: ANd then we'll look and see if I can find my article on Kama Sutra, and get to work.
Hot Housewife: Screw the article.. why don't you just start checking out my ports now!
Please delay this patch for a couple more weeks, until my viagra laden penis enlargment pills and kingly inheritance arrive from my new friends in Nigeria, thus negating my need for cheesy spyware pickup line attempts.
Don't anthropomorphize computers: they hate that.
. . .to call in sick.
You are not the customer.
Microcrap? CLEVAR!!!!
Happy VD from Microsoft!
"The basic tool for the manipulation of reality is the manipulation of words." - PK Dick
---
Seriously, Microsoft has become far more security conscious than they were. Don't forget that XP is now almost five years old...with all the talking they've done about security over the past several years, doesn't it stand to reason that they've learned quite a bit just from trial and error?
120 characters for a sig? That's bloody useless.
I switched to OS X about a year ago (thanks for making a low-cost Mac, Apple).
Why?
Because on my Windows 2000 system, the size of the patches 33 in number so far, is bigger than the OS itself! And some quaters say 33 is pretty conservative because M$ puts more than one patch in the so called "hot fix" as seen in the Control Panel. I am already afraid, not to mention a patch that might break other software!
Anyone know when the date is when MS will stop making security patches for Windows 2000?
I've been avoiding getting newer versions of Windows with any of my new machines I've gotten or made for quite a few years now, and have no plans on ever using Windows XP on my home systems. Will I have to look to third parties for future flaws found in the various Windows 2000 bugs that will be discovered?
Off topic: Am I the only one who just can't find it funny? Every time it comes on, I try to tell myself, "it's just a joke, laugh." Except I'm not convinced it is a joke. Instead, it's reinforcing everything that makes me crazy about Apple and its fanbois - the arrogant, holier-than-thou attitude, the egocentrism, the narcissism, the balls-to-the-wall no-apologies elitism, the elevation of form over function. Honestly, of everything on television, that's only thing that consistently gets me worked up.
It's doing DULL little tasks. Like reading Slashdot. Duh!
Please. 5 years, and there is no end to the virus/spyware problem. And now they, Microsoft, are going to provide "protection" for an additional fee. Why should they do that? Why not include it in Windows XP?
If they were smart, they would release a Windows XP 2 edition that has every little update, and includes 5 years of virus protection. They should charge like $75 for it or something. It would be good PR, and an easy way to make some more money.
It's either on the beat or off the beat, it's that easy.
I moderate therefore I rule!
--
And just when I thought it was safe to set up Office 4.0 on a 386 for grandma. Looks like I'll be busy fixing things for a while. Oh wait, she doesn't have a modem....
You can get the Windows patch here. And after you do that, the Office patch is right here.
There's no cause to panic yet, because this doesn't _necessarily mean a worm can happen (ie, doesnt breach the SP2 firewall, or work in outlook, or IM, or get past HTML filtering in most web email providers). Based on the past, more likely is that they are talking about an IE only exploit. If the remote exploit is just in IE that it means is that if you visit a malicious website .. they can infect your computer. Yes, a danger .. but if you are paranoid and only go to selected websites .. you're reasonably safe.
Microsoft warned users...
I don't use Windows systems often, but most of my colleagues and friends do. How exactly has Microsoft warned its users? Pop-up windows? Ads in the local paper? Public service announcements on cable television? Are the requirements for Microsoft repairing computer-disabling software bugs the same as, say, General Motor's obligations for repairing automobile-disabling engineering mistakes (e.g. recalls)?
$nice = $webHosting + $domainNames + $sslCerts
is the Kama Sutra remover that's no longer of any use now that they've waited so long to release it. Now they're just kicking those 3 infected users while their down. They're basically saying "Now that it's deleted all your documents, here's that removal tool we decided not to release a couple weeks ago, so you wouldn't be bothered with an unscheduled patch release."
IMO, Windows XP is a disgrace to the NT family. If the time ever comes when I "need" to get off of NT 4.0, I'll be on Linux by then, as I am already gradually converting to it anyway. Linux isn't perfect either (and it's time-consuming to trouble shoot some things), but I'd much rather go that route than to ever go the way of XP.
I don't see what the big deal is, both Linux and MacOS get patched. Some more often than others...
so all of the linux/OSX fanboys and start flaming Microsoft yet again. Sure, they have vulnerabilities in their product, so does everyone else. If anything, being the security professional that I am, Microsoft has made me MONEY over the last few years. BTW, I use linux ALL of the time.
"Give up hope, dreams are for suckers."
I'm not saying this isn't good news, but it's not very big news, is it?
I mean, do we need a frontpage story just because MS releases a patch? Don't they do it more or less regularly?
And besides, why should we care since all of us here use either Linux or BSD?
Maybe Microsoft will release updated virus definitions once a month too.
Let's see, there's one patch for gluttony, because the Windows software is bloated.
There's another patch for lust, so Google Desktop won't track your pr0n habits.
There's supposedly a patch for sloth, but I'm too lazy to see what it does.
There's a patch for wrath, you son-of-a-bitch!
There's a patch for envy, it will nullify Firefox.
There's a patch for pride and that just leaves one patch for greed, but Micro$oft will fix that sooner or later.
Looks like Microsoft is trying to patch there image.
The posts start out provocatively talking about "hot fixes", "KamaSutra", "fingering", "port scanning"... But I get worried when the conversation moves to "virii" and "worms".
ConsultingFair.com
As I've said several times here before:
:D
I don't have a virus/spyware problem. My XP box has NEVER had a virus or spyware. I don't put a lot of effort into it, it just hasn't picked one up.
Here's what I have:
A NetGear broadband router (buffer against most worms)
Windows Firewall that spends most of its time turned off
AVG Free
AdAware Personal that I scan with irregularly
Spybot and its automatic utilities
AVG, AdAware, and Spybot are almost always the first three things mentioned if you go anywhere on the internet and ask how to secure your XP system. A broadband router is often recommended even by ISPs these days, and provided by SBC DSL as part of the DSL modem (though I use my own because I like it better).
If we flipped Microsoft's market share with Apple or Linux, we'd find out just how many security holes exist in those operating systems. We don't see all the virus and spyware activity for them because there aren't enough in the hands of uneducated users for a virus to propagate. If you want to sell crappy $10 software at Wal-Mart, you write it for the largest number of average users you can. If you want a virus to spread and get noticed, you do the same.
mod this post -1 Unpopular for saying Apple and Linux have security holes
120 characters for a sig? That's bloody useless.
7 reboots.
What?
Is one of the patches for the Access lawsuit which requires you to patch office xp? To bad SCO doesn't sell indemnity insurance for Microsoft products, they're barking up the wrong tree with Linux.
One ring to bind them - should probably have more fiber and less rings in their diet.
Microsoft releases security patches once a month every 2nd Tuesday of each month (one month last year required no patches, and occasionally (rarely) a super-critical flaw requires an out-of-cycle patch)), which means that this same story appears on slashdot each month so fanboys can orgasm over the fact that another set of patches is being released.
7 98, Apple releases security patches more-or-less monthly as well (not quite as often as MS) yet we see no headline stories on slashdot regarding those patches.
Of course, according to http://docs.info.apple.com/article.html?artnum=61
Slashdot at its finest!!
-- "I never gave these stories much credence." - HAL 9000
That's easy. I'll just list a few reasons:
1. XP comes with IE embeded into the OS. NT doesn't. LitePC.com allows me to remove IE from all Windows OSes for free, except for XP. I wouldn't even take XP for free, unless I were compensated the amount of money it takes to remove IE and all the other crap it installs.
2. NT gives me more control over processes. I can even kill "critical" tasks if I so choose. Thus, it is very easy to keep the number of processes running in the teens. Let's see that kind of control on XP....
3. XP's explorer.exe is absolute garbage compared to NT's. Right click your desktop for instance. NT brings up the context menu instantly. XP has some delay. Also hover your mouse over the clock. Half the time, the date never comes up. It always comes up in NT. Now press the Windows flag key and E to bring up an explorer window. It's nearly instantaneous even on the slowest of machines on NT. It has horrible delay on XP.
4. More ports are open to attack, out of the box. Sure, NT is typically vulnerable to ports 135, 139, and maybe another port. Now compare to XP. Run netstat -an if you like or run the ShieldsUp test on grc.com. It's no wonder why NT 4 wasn't impacted by Sasser and the likes. A simple batch script on startup can plug most issues on NT without even having a firewall. Try surviving on the 'Net on XP under the same conditions.
I have plenty of other reasons, some of which are personal preferences (such as how XP handles multiple pages on the taskbar compared to NT), but I won't bore everyone with those. Needless to say, XP isn't for everyone. Ordinarily, it wouldn't bother me what OS, browser, and mail client that others use. However, I get tired of getting port scanned by the numerous XP zombies running IE and Outlook that haven't bothered to patch their sorry boxes.
Oh, and don't bother with the USB arguments. Some of us survive just fine without it (even though there are patches to support it on NT / 95 / even 3.1!) If I needed that, I would have "upgraded" to Windows 2000lite / 98lite by now.
Translation: Until next week, if you run Windows there are at least seven ways to pwn you.
In six or seven years that i'm using it this Debian box has NEVER had a virus or spyware. I don't put a lot of effort into it, it just hasn't picked one up.
You've had better laughs this week.
CooL...I have automatic updates. Nothing here to see.
I completely agree. I just can't understand what Apple is trying to accomplish with this. This message reads more like an insult than a selling point.
Being "conscious" about it doesn't do jack and shit. Windows security is going nowhere. Microsoft is trying to fix decades of bad security design decisions and failing at it. The fact that most recent Windows software right now STILL won't run correctly without elevated privileges (including games, which are the LAST thing that should need them for fuck's sake) speaks for itself.
Microsoft has always encouraged both developpers and users to ignore basic security measures. That alone is almost impossible to fix.
Note that I'm NOT saying non-Windows systems (ie. OSX, Linux) have flawless security. Far from it! But the general concern for security is there, and has always been. Microsoft has some serious cleaning up to do if they want to reach that level.
that doesn't mean debian is fool proof, it just means people haven't bothered to target it because it holds such a small minority of the OS market.
I'm in the middle of downloading about two dozen patches for Suse 10.0
At least they're issuing patches
If my call is important, why am I talking to a recording?
// I'll just list a few reasons://
It's easy to answer those objections:
1. Install Firefox, remove access to IE (easy to do with profiles)
2. Upgrade your hardware.
3. Upgrade your hardware.
4. Install kerio or Sygate PFP (about a two-minute download).
Frammin' on the jim-jam, frippin' at the krotz!