Homeland Security says 'Patch Windows Now'

gregger writes "Wow, so the Department of Homeland Security is really concerned with Microsoft patches now... enough to come out and tell us to patch our machines. This warning, chronicled in eWeek, was issued less than a day after the release of 23 patches from Redmond. So, if you don't apply the patches, then what?"

Comments

Two Reactions

[eldavojohn]

In my country, the United States of America, I have never seen everyone so polarized. As a result, I personally highly value the ability to see actions and events from both sides. It's a becoming a rare trait.

On one hand, this announcement shows that the government is looking out for us. They are concerned about terrorists using our machines to commit acts of cyber terrorism. They are helping us protect ourselves by advising that we patch our machines with hyper critical updates from Microsoft. We should be glad that our government is so thoughtful and has decided to twist Microsoft's arm into fixing these problems and releasing updates. After all, as Americans, nothing is more important to me than my internet. It's my commerce, education, and ... uh ... love life. I wouldn't care if terrorists destroyed every TV & radio station in the United States, but I would riot if I was denied an internet connection for more than a few weeks. They're just protecting my interests much like a public service announcement or a tornado warning. I mean, the US-Cert team has been doing this for a while--even on my Mozilla browser. This "Patch Windows Now or Else..." is just FUD from the Slashdot editors--if you read the government press release, it's merely a recommendation, not a demand, warning or threat to patch your machine.

On the other hand, should we be suspicious? I mean, there have been much more severe critical problems with prior editions of Windows that the government hasn't deemed necessary to recommend. How do we know that these patches aren't part of some sort of government initiative to harvest data? I mean, we've seen it with our phones and e-mail--why not another form of technology? Could it be that these patches will occasionally phone Microsoft who then relays our data and actions to the FBI and/or NSA? Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative? Why Windows? And how can we believe them if we never get to see the source code of the original program and the source code of the patches? Two points to note: Why now? And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do? These patches might be a wolf in sheep's clothing. I don't think the government is so worried about our interests but more so they're worried about the gathering of intelligence in their case against every single United States citizen.

Re:Two Reactions

[TheSpoom]

It's my commerce, education, and ... uh ... love life.

This is Slashdot, that last bit was assumed.

Re:Two Reactions

[ToasterofDOOM]

That is the most level-headed thing I've EVER heard on this site, and that says very little. This just goes to show that the goal of this government is not to oppress you or take away all of your freedoms, they do genuinely care for this country and its people, even if their methods are flawed.

Re:Two Reactions

[Lokni]

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

This is unprecedented action. Why now?

Re:Two Reactions

[Billosaur]

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job. Look at how we have to analyze this to see just what the DHS is up to, rather than simply thinking "Hey, patching my copy of Windows is probably a good idea." It's funny that when Microsoft says apply the patch, we dutifully go about it and grumble about all the bugs in their software, but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job. THe thing that maes this problematic is that DHS is being pretty cryptic, and they have no track record of doing this. It'll be interesting to see if this happens again when the next MS patch cycle occurs.

Re:Two Reactions

[Das Modell]

I don't really believe that Windows would transmit anything to the government (and I don't even live in the states so whatever). Someone would have figured it out a long, long time ago. Seemingly everything is hacked, cracked and exposed these days, Microsoft is under constant scrutiny, and I'm sure a lot of paranoid people have been trying to find out if Windows is sending sensitive data to Microsoft.

Re:Two Reactions

[Jimmy King]

We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

It's not so much that people have failed to notice the government doing their job for once, several people have shown appreciation of it. It's that the government has been doing corrupt things and not protecting us for so long that people question whether they're really trying to protect us this time. It's kind of like that scene in a lot of movie revolving around highschool, where the popular kids constantly pick on and beat up the dorky kids. Then one day they invite said dork to a party, the dork thinks "wow, they've changed their minds and like me", only to show up and get their ass kicked and/or be the butt of some school wide joke.

Re:Two Reactions

[betterunixthanunix]

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

Two reasons for this: market share and business interests.

Windows simply has a bigger market share, which makes critical flaws a far bigger threat. It is just easier to gather up a botnet of 50000 Windows machines before somebody notices than to get that many *nix machines.

And the government is interested in what businesses need. Microsoft has been campaigning for years against Linux, which gives the government an impression that Linux presents a serious threat to Microsoft. Since most people have the impression that FOSS is anti-business, even people in the government, there is no pressure to pay any attention to it.

And there is also the question of visibility. How many times have you heard of a major *nix virus in the news? How many times has it been Windows or MS-Office?

Re:Two Reactions

[LS]

I'm sorry that you are so scared of the truth that you jump at such a weak opportunity to keep the rug from being pulled out from under you. Who are "they" that you speak about? You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself. There is no "they" that either care or don't care for this country and its people, becase the government is made up of thousands upon thousands of people with different ideas and goals, some of them good, and some of them very sinister. Stop laying your parental fantasies on top of the government, because others like myself prefer not to have these nannies looking over our shoulders, especially when some of them have already proven to be homicidal.

Re:Two Reactions

[PFI_Optix]

I don't need nor desire the "government" to hold my hand.
I think the "government" has a lot better things they should be worrying about.

I don't see where this is anything close to hand-holding. You aren't being forced to do anything, the government isn't doing it for you, and if you don't do it, they aren't going to come after you. There's nothing wrong with a PSA that encourages people to secure their computers.

And if you really need a reason for it all, it costs tax dollars to deal with things like identity theft and stolen information. By encouraging people to secure their systems, the government may reap a long-term benefit of lower expenses and increased revenue without raising taxes.

Re:Two Reactions

[ArcherB]

But mostly I blame the "government" for allowing the situation with Microsoft to exist.

By "government" I of course refer to the current administration.

Uh... M$ was making buggy software long before the "current administration" came to power. Just like the plotting for 9-11, wars between Arabs and Israelis, wars in general, global warming, hurricanes and so on all predate the current administation. I'm not saying the current admin is perfect or that previous admins are 100% to blame, but I think you need to spread that blame around.

It's bad enough people think that history began when they were born, but there is no excuse for thinking all problems began less than seven years ago, provided you can read.

Re:Two Reactions

[maxume]

DHS is a big, stupid bureaucracy. Get used to the fact that they are far more concerned with appearing to be doing something than they are with actual security.

Announcing that it is a good idea to apply security patches to computer systems is a fairly safe way to appear busy.

The security level bullshit is another great example -- if they think something is neccesary during a 'red', then it is probably a good idea to do it during a 'yellow', as their intelligence is bound to not be perfect. Announcing the 'red' and then doing stuff related to it makes them look busy.

Re:Two Reactions

[ExE122]

Wow, look at the replies... I love how aroused everyone gets over the prospect of a possible government conspiracy. I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

From the article: "This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users"

I think that statement is pretty much an ordered list of government priorities when urging these security measures. Why is the government getting involved? They're looking out for their own interests. The average government worker is likely sitting on a windows workstation right now, surfing the internet with IE, creating a presentation in Powerpoint, running some calculations in Excel, or typing a document in Word... and they probably don't even have the administrative rights to run their own updates, so they sit around waiting for some IT grunt to get off his lazy ass and do it for them.

Even as we speak, I'm sitting at a Windows work station without version management and without admin rights. I have to use the company standards of IE and Office because I can't install Mozilla and OpenOffice. I don't even know if our IT department is aware that they need to run any patches. I haven't seen them do it since I've started working here. And what's worse, I'm working for a government contractor which is always making a lot of fuss about security!

Which brings me to my next point. The government is also looking out for industry and commerce. I'm sure you've noticed the U.S. economy isn't what it used to be. The last thing this country needs is a cyber attack wreaking havoc among businesses and putting even less trust in online commerce than there already is.

Shouldn't we be suspicious that the government has never openly declared critical Linux updates an imperative?

Actually, the DHS has funded open source security auditing. Its true, they have never made it an imperative critical update, but you have to take into account the users and usages of open-source products. If you've installed and/or administrated Linux, its very likely you have enough know-how that you don't need a government warning to get you to stay on top of security patches.

Windows, however, is the most widely used operating system, especially for people who don't have the first clue about security or administration. How many Windows users out there use Administrator as their standard account? People like that need to be warned about the importance of updates.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

--
Take off every sig. Move sig for great justice.

Re:Two Reactions

['nother poster]

This is unprecedented action. Why now?

Well, the first time anyone does anything it's unprecedented by definition. ;) As to why, because they felt it was necessary. The reason for the necessity is left as an exercise for the reader since I have no idea. Maybe the government wants to p0wn your PC more than they do already. Maybe they know of a specific threat from an enemy state or terrorist group and are taking precautions. Or maybe, just maybe, they are sick of 50,000 zombies spamming herbal Viagra ads to their personal e-mail accounts.

Re:Two Reactions

[SpaceLifeForm]

I'll just note that DHS is a heavy windows user,
and they have a vested interest.

Re:Two Reactions

['nother poster]

A long time ago (1988), in an Internet far far away (before commercialization), one of the first "computer viruses" (actually a worm) to be well known among the public was when some kid (grad student) crippled most of the UNIX boxes with a piece of broken self replicating code.

Re:Two Reactions

[MECC]

How do we know that these patches aren't part of some sort of government initiative to harvest data?

Because the government isn't that competent or clever. The effective 'intelligence' of any organization is inversely proportional to its size.

Re:Two Reactions

[B11]

but when DHS says to do it, it's part of some sinister plot... or is it? We've become so conditioned to the idea that the government is corrupt, we fail to notice when they are actually doing their job.

Given the track record, why are you surprised? And since when is it wrong to question government's motivation? Are we just to assume they have our best interest at heart? On a less cynical note, why would I take the computer advice of an agency that came up with the color coded alery system, and the "in case of chemical attack, duct tape your windows shut?" I'd almost trust the "Geek Squad" over the DHS on computer security issues.

Re:Two Reactions

[corbettw]

It seems to me that if the terorists wanted to cause chaos and confusion, they've been doing a good job.

Except that's not what they want to do. They (and by "they" I mean Islamist terrorists) want everyone in Dar al-Harb to either become Muslim and join the Dar al-Islam, or die. Sowing confusion isn't really a part of either of those.

Re:Two Reactions

[truthsearch]

Actually, you can blame just the current administration for letting Microsoft get away with things. The Microsoft anti-trust case began during the previous administration. A few weeks after Bush entered office he removed every lawyer on the case with any experience in monopoly law. He had them replaced with novices and shortly after the case ended with Microsoft not even getting a slap on the wrist. Gates was never even investigated for his perjury in federal court. While Microsoft is guilty of illegal business the current administration specifically let them off the hook.

Of course the customers let them off the hook for writing bad software, but that's another story.

Re:Two Reactions

[Shaper_pmp]

I think the government really does have its priorities, but monitoring 10 million computers to find out what porn sites people like to visit isn't one of them.

How about monitoring 10 million phone calls?

And with a handy backdoor installed monitoring computers would be even easier to automate.

I'm not saying they have, merely that your pooh-poohing of the whole idea is a bit baseless when they've already been caught doing essentially the same thing in a different medium.

While I'm not going to deny the possibility that they do have more up their sleeves, I think the past couple years have made me less likely to don the tin foil. With the terrorist attacks, resulting WMD wars, Gee Dubya elections, and blatant fear-tactics, I've really begun to realize that "government intelligence" truly is an oxymoron.

Sorry, just to clarify:

The constant exposes of systematic corruption throughout all levels of the US government, from pre-warnings of 9/11 through to financial scandals to the gutting of judicial oversight and introduction of almost limitless executive power for the Whitehouse... two blatantly corrupt elections, at least one illegal war and enough lying, bullshit and willful misrepresentation to indict and incarcerate any normal group of people ten times over... and all this means you're less likely to don your tinfoil hat?

The only way this makes sense to me is if you're saying conspiracy theories shouldn't attract tinfoil hat accusations any more... because everyone knows they're watching you, lying to you and breaking the law all the damn time?

Re:Two Reactions

[955301]

Well, let's take a cursory glance then.

Wikipedia (Unless you think I've conspired to make up the entry here):
"The department was created from 22 existing federal agencies in response to the terrorist attacks of September 11, 2001."
Making a single department from 22 agencies is called consolidation.

Next, distractions: An alert system which never goes off alert is not an alert system at all. It's a continuous message to be vigilant, which is not information, it's a fear tactic. What's more, there would have been a massive uproar if the government had no internal response to the hijackings, so they took existing groups and rebranded them as a single simple solution to the communication problem. Then muddied up the water with reorgs and ill-managed funding.

http://www.usmayors.org/72ndWinterMeeting/homeland report_012204.pdf

http://hsgac.senate.gov/index.cfm?FuseAction=Press Releases.Detail&Affiliation=C&PressRelease_id=960& Month=4&Year=2005

these go on and on. It's the '80's Pentagon spending all over again.

Stop worrying about how I say something and actually take a look around.

Re:Two Reactions

[Silverstrike]

That's a completely nieve sentiment. I'm sorry, but government, at least in some form, is absolutely necessary. How do I know? I'm human. And by and large, humans are greedy, amoral, unethical creatures that left to their own devices lie, steal, cheat, murder and rape their way through life. Don't believe me? Look at any area of the modern world lacking a strong government, like Africa.

Now, since government is comprised of humans as well, it also must have checks and balances in place to ensure that those in power don't lie, steal, cheat, murder and rape their way through life, much to the misery of the people they rule. For examples of this, see any totalitarian regime. ie: North Korea

You say this as if you actually prefer strong authority figures keeping the world in order for you because you are unable to do it yourself.

Are you able to keep the whole world in order? You do realize at there's 6 billion people on the planet right? Most of them would kill you, your family, and everyone you know, if it made their lives even marginally better. So go ahead, try to "keep the world in order", I'm sure that'll work out great for you, by yourself. What's that? You'll get some friends to help? You do realize you just created a government then, right? Albiet, an informal government that probably would rule by force. Good job.

All that being said, I do value my privacy and freedoms greatly. I wish the government would stay out of my life. However, I also appriciate the fact that the crazies down the street know that their asses will end up on jail, should they try to hurt me or my family.

Re:Two Reactions

[twofidyKidd]

We (The slashdot conflux) have always advocated improved computer security, particularly in the case of the Windows operating system. Patches have proven to be an effective method for maintaining said system against such related problems, and from the position of the corporate sys-admin down to the family's IT technician, we've always made it a point to ensure the most updated patches were in place. Now it's finally a matter of the government's to help ensure all the citizens of this country take similar steps.

Should we: A) rejoice because someone of authority has finally been sold on Windows security through patching by some qualified expert, B) assume that there's a greater conspiracy at work here which involves improving the government's ability to surveil their constituency, or C) imagine that there's a very legitimate, non-civil-liberties threatening need for the government to urge the users of the majority operating system in the United States, and very possibly the world, to maintain their systems at a sensible level of security? Maybe Al-Quaida (sp?) communicates via holes in certain unpatched systems (wild-guess speculation), or maybe terrorists are being funded by income brought in by spam-bots and zombie machines (plausible).

The real problem is that our cynicism makes viewing realistic possibilities hard to imagine, and our tools go logical deduction sort of seem to fail. Occam's razor can't be used in a situation like this because time has proved over and again that the interests of people at the government level aren't always in the interest of people at the constituency level. This is one of those times that we (the slashdot conflux) would like to imagine that someone (like Lawrence Lessig or Brad Templeton) has finally said something to an official that he finally understood and as a result has taken this action, but since we often have a hard time getting our own management to listen to the good ideas we put forth, we're hesitant to believe such a thing has happened. In fact, given the recent history of our government, we're much more inclined to consider a sinister purpose. The DHS press release has many of the "hidden agenda" trappings, like specifically indicating which patch to apply, as well as the call of immediacy.

Just to put things in perspective; right now, Britons are unloading all liquids and gels into trash cans prior to boarding US-bound planes, while we're wondering if the US government is acting in our best interest by adamantly suggesting we patch our Windows computers.

Re:Two Reactions

[NeutronCowboy]

I think before calling people naive, you might want to check what said people are exactly saying. No one said (and certainly not the post you replied to) that governments should be abolished. No, what he said is that if some government is good, more government is not better. There are many instances where it is patently obvious that more government is actually far, far worse than no government at all. And one of those instances is, gasp, Africa. Far from being weak governments that wreck havoc there, it is the strong, autocratic and centralized governments that are responsible for the worst abuses. Darfur is not a problem because of too little government, it is a problem because the government cannot be stopped by the population it is terrorizing.

Again - the central problem raised is not that government in general is bad. The central point is that more government is not the answer to government problems.

Re:Two Reactions

[vwjeff]

So, if you don't apply the patches, then what?

The terrorists win.

Simple logic.

Re:Two Reactions

[Jtheletter]

Global warming isn't the government's fault, it's OUR fault. Does the government make you drive a car to work?

OK, I'll bite, but keep in mind I'm half-joking here. (And I do agree that global warming is a collective "we" fault).
Ok, so, the Federal Government has massive yearly deficits, and a total nation debt in the trillions, not even counting future promised expenditures such as Medicaid/care and Social Security payments. Refusing to raise taxes to cover these costs because it is politically untenable means that they must sell debt to foreign investors and then literally print the rest of the money. This is an inflationary policy that increases the money supply hugely, causing the misallocation of resources and fueling the boom-bust economic cycle while claiming to try to prevent it. This has caused a massive housing bubble which has seen home prices nearly double in many areas in the last 5 to 10 years. At the same time, real wages have barely kept up with core inflation (which itself is undercalculated by using metrics that don't actually apply to real-life costs). Thus the current average worker is even less able to afford housing today, especially in well-developed and urban areas where a great deal of commercial and industrial jobs are located. Hence, in order to be able to afford housing that fits their pay they must relocate to less densely populated areas where home prices and rents are within their means, and thus they must commute farther to their jobs. So, there, I proved the government makes us drive our cars to work. ;)

Of course things like car-pooling, buying more efficient vehicles, cutting down on uneeded driving, etc are all things that help reduce emissions and are largely being ignored. There's no small solution to the problem. And while I was being rather tongue-in-cheek with my seven degrees of seperation style argument above, all of it is true to a certain extent. There are a lot of problems in this country that stem from a misallocation of resources due to Federal fiscal irresponsibility (Bush hasn't yet met a spending bill he didn't like, and none fo the spending bills have any 'signing statements' that reduce spending. Don't let my hatred of his policies make you marginalize me however, plenty of Dems are causing the spending problems too, the whole fed level is out of control in a nonpartisan way.). If the government would be reduced to a level that doesn't consume 40%+ of it's citizens' incomes, plus more deficit spending on top of that, then perhaps we'd have some "extra" capital to throw at other problems, gloabal warming being one among many but an important one. Food for thought.

Re:Two Reactions

[LS]

If you mean _naive_ sentiment, I would obviously disagree. I would posit that the most horrendous crimes in the history of the world are actually executed by a tiny majority in overly strong governments which take advantage of a weak-minded and normally peaceful populace. I would like you to give me an example of a genocide or other serious crime against humanity that wasn't orchestrated by a dictator, monarch, or totalitarian government of some sort.

You claim that government keeps people in line. But this is a circular argument, because people pre-existed government; people created government, which indicates that the morals and values and organization that create government come from the people, and not the other way around. Countless philosphers, historians, heros, saints, and common folk throughout time developed civilization's sense of justice and morality that government is built upon without a beating stick keeping them in line, and I feel sad for you if your root of your values is the fear of punishment.

What this boils down to is that I believe that the vast majority of people are good (or at least good intentioned), but perhaps a bit gullible, and a small minority take advantage of this, some of them evil, some of them not.

Re:Two Reactions

[budgenator]

We used to just walk around with a clipboard in the Army, maybe do some scribbling and pointing once in a while for emphysis. Get at least three other people to follow you, and people would cross the street to avoid you!

Then What?

[MinutiaeMan]

"If you don't patch Windows, the terrorists win!"

Re:Then What?

[Ninjy]

Pf, just wait until we respawn in the second round.

so....

[Anonymous Coward]

this means the gov't mandated backdoor has been placed in the update queue?

Re:so....

[milamber3]

Seriously, people are laughing at the parent post but they would have laughed at a sacastic post about the NSA getting warrentless taps to listen to our phone calls in the recent past as well.

OMG

[broussem]

Then your computer will blow up and we'll all die

Re:OMG

[supremebob]

Oh, you must own a Dell laptop then :)

Typical over-reaction from the Slashdot staff

[Megaweapon]

It's just a recommendation, and they've been doing this for a while now. Perhaps this is to save a little face for the massive Rails exploit posted just a few stories below?

Hmm..

[TheOldSchooler]

"So, if you don't apply the patches, then what?"

They buy you a brand new Intel Mac! Courtesy of U.S. taxpayers.

Meh

[TheSpoom]

So great, DHS is recommending that people keep their machine patched. Anyone who says this is a bad thing has their tinfoil hat on a little too tightly. The only thing that concerns me is that DHS's responsibility in the US government seems to get more and more broad; anything that can be deemed in the protection of "Homeland Security" they can control, from intelligence to customs and border patrol to cyber security.

Anyway, this isn't that big a deal.

Re:Meh

[jimktrains]

When I first heard their name the night they were announced in the pres's speach, I immedialty thought, "Damn, isn't that how the Nazi's took so much power over the MotherLand when they came to power?" It was the motherland/homeland similarity that brought it on, but it seems to not be too far from the mark.

Re:Meh

[Dionysos Taltos]

The only thing that concerns me is that DHS's responsibility in the US government seems to get more and more broad; anything that can be deemed in the protection of "Homeland Security" they can control, from intelligence to customs and border patrol to cyber security.

You know ... that's a pretty big concern. If that's truly the only thing that concerns you, you should still be scared stiff. We have a U.S. Department which is 100% staffed by the current administration, and it continues to broaden it's role. I would be extremely concerned about the end-game, and I believe there is an end-game in mind which doesn't involve Democracy.

Ahh I can see it now...

[Nicaboker]

You wake to a pounding on your door. At your door are two men dressed in suits. you "Umm can I help you." Suits " You're under arrest." you "On what charge?" Suits "For not patching your windows computer." You "patch my what?? I use Linux!" Suits with a baffled look "Lin-what? Are you threatening us?" Suddenly more suits surround you and begin beating you while you hear "King Bill" laughing in the background.

Download link for patches

[DoofusOfDeath]

http://www.ubuntu.com/download :)

I now practice secure computer usage.

[krell]

Considering this morning's prohibitions on taking liquids onboard (after a terrorist plot was uncovered), I'm resisting temptation so far to place my bottle of 'Dew in my computer's cup holder.

Hey!

[no-body]

I am trying, but it crashes!

malware

[Blighten]

So, does this mean that the creators of malware/viruses/spyware are going to be classified as terrorists?

Dig out the Duct Tape

[hanshotfirst]

They were confused. They don't really mean MICROSOFT Windows - this is the same old patch your HOUSE windows - cellophane and duct-tape. There's a red-level threat in the UK today, therefore nobody can carry-on water on airplanes in the US. Clearly water can kill you, so they are making sure none of that nasty humidity in the summer air can get into our homes. Thank goodness for the protective vigilance of our gubmint!

So, if you don't apply the patches, then what?"

[Patrik_AKA_RedX]

Easy: the only website you get to access would be the one from guatanamo bay.

Re:A plot?

[Red Flayer]

Or it could be DHS making a publicity move. They've got to justify their budget to the public somehow, and a lot of what they do is behind-the-scenes stuff.

Also, to be cynical as ever, we DO have elections coming up in a few months.

As far as I'm concerned, the boy has cried wolf far too many times for me to react to any warning DHS or any other governmment agency says about threats.

Re:A plot?

[Darth_Burrito]

I'm a system administrator at a large university. Apparently Microsoft actually contacted a few people around the university urging them to patch up. This shocked a few people because apparently we don't normally get that kind of communication from them here. It went around our listserv yesterday. So anyways, it seems like Microsoft might think it's an unusually big deal too.

then...

[r00t]

You're not with us. That means you're against us.

GET HIM!!!!!

Re:Otherwise the NSA won't be able to "help" you

[LurkerXXX]

Right. And of course you sniff all the packets that your machine sends out from your windows machine every time it gets a patch from microsoft, etc, etc, to make sure it's not 'reporting back' on your activities since you last connected to Microsoft, etc, etc?

The opensource firewall only protects you from them initiating contact to your machine from outside. It doesn't prevent hidden reports being sent out. That takes a lot of human monitoring, and some packets, you just don't know the real content/context of (reports to MS etc).

Paranoid poster doesn't search enough

[technoextreme]

And why isn't the government's warning message included with specific reasons and details of what the problems are and what the patch is going to do?

Actually, they did that. You just didn't bother looking. http://www.kb.cert.org/vuls/id/650769
http://www.us-cert.gov/cas/techalerts/TA06-220A.ht ml

Why now?

The cynical side of me also says that some department in the United States got hacked into. They do say that the exploits were being used but dont go futher.

Re:NSA patch

[troon]

hmm, what's with the black helicoptor outside. Woah, look at the scope on that guys rif

Another strike from the Grammar and Spelling Department (Apostrophe Patrol).

Cracking down on piracy

[192939495969798999]

They probably just want you to install WGA, which is required for new Windows patches... they probably saw my new motivational poster.

I would.....

[VeeCee]

but it appears my copy of Windows is not genuine.

68%

[Gary W. Longsine]

I agree 67.314159% with everything the OP said!

US Threat Level

[NullProg]

The U.S. government raised the security alert on passenger planes to its highest level for the first time on Thursday after Britain said it had foiled a plot to blow up flights to the United States.

The government also raised the security alert level for Windows users from Purple to Pink after Microsoft announced it had foiled a plot to make Windows more secure.

But Can Microsoft Be Trusted?

[Prototerm]

After Microsoft stuck their WPA Notify spyware on my machine, claiming it was an important, possibly vital update, how am I expected to trust them?

* No * Thank * You *

I have a better solution: I run Windows 2000 SP4 (XP is bloatware in my opinion) inside a Virtual Machine on Linux. The virtual machine has no connection to the internet (its IP address is blocked by the router), and does not run email or a web browser. When the copy of Windows is shut down, *it reverts to a snapshot*. All data is stored external to the VM's "C drive", where it's protected by Linux. Voila, no updates needed!

We've all heard how Microsoft's latest efforts to fight piracy hurt innocent people running legitimate copies of their software. We have all seen how Microsoft installs "beta" software without asking permission. Distrust, like trust, is earned. The folks in Redmond have *earned* my distrust.

Re:Since you are a system administrator...

[Darth_Burrito]

These ports have to do with things like name resolution, network file sharing, remote execution, and stuff. I don't really know all the details. While linux can talk samba with windows, it is more a windows to windows kind of thing. Read this for some more info. What port 445 does

One should probably never have 139 and 445 exposed directly to the internet, one should probably only have them exposed beyond an individual workstation if that workstation is part of a realish network (eg, three pcs that never talk to each other plugged into the same linksys router wouldn't count). When in doubt, block it and see what happens.

Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

What a remarkable commentary on the sad state of affairs in the "Land of the Free" that our government makes a press release regarding patches to our computers and the first thing we think of is that the patch is associated with monitoring us somehow. For the record, I had the exact same thought as the OP and agree 100% with what he said.

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types. One of the primary rules of espionage is to just blend in, fade into the background, don't call attention to yourself. If the government were to do something like this, and I don't believe they would, it would be quietly slipped into a run of the mill security update. Nothing special, just a routine monthly security update like the ones we have come to expect.

Re:Sorry, slashdot is just tinfoil hat heavy

[The Spoonman]

Sorry, but these two post really comment on the sad state of affairs on slashdot. Slashdot is a bit heavy with tinfoil hat types.

Perhaps, but I would argue that the growing number of tinfoil hats is due to the growing amount of government misconduct going on right now: erosion or outright removal of basic rights, blatant collusion with corporations to screw as much money out of consumers as possible which includes rewriting emminent domain to allow corporations to take people's property, spying on the populace's phone and financial records, a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky. Let's not forget trying to subsititute "intelligent design" as actual fact in the classroom, all the while calling global warming "junk science".

And, as bad as all of that sounds, that's just the small stuff. If we start counting in the current jihad...er, crusade...uh, "War on Terror"...yeah that's it...well, the atrocities just keep adding up.

As the old adage goes: "just 'cause you're paranoid, don't mean they ain't out to getcha."

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

But a lot of people don't download the updates, which could be the reason for the warning.

The updates are automatic. You have to manually disable that feature. Do you really think the type of person who would manually disable automatic updates is going to run out and do whatever Homeland Security says to do?

Re:Sorry, slashdot is just tinfoil hat heavy

[AHumbleOpinion]

... a growing theocracy hell-bent (pun intended) on ensuring EVERYONE follows christian beliefs, no matter how whacky ...

Sorry, but you're going to have to go find some impressionable young mind that doesn't know any better to buy that. I'm old enough to remember how Reagon was demonized just like Bush Jr., how Reagan/Fallwell were going to turn the US into a theocracy, ... I'm old enough to remember how Gore was going to outlaw free speech in music and movies, ... I'm old enough to remember how Clinton was demonized, how Clinton was going to turn the US into a socialist state subserviant to the UN, ...

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

Re:Sorry, slashdot is just tinfoil hat heavy

[budgenator]

Actualy I've worked pretty closely with some guys from the DEA, FBI, BATF and Secret Service, and the truth is they're not bad people but I wouldn't want their trash talk to turn into group-think either. One thing we should realize is that the mid and lower levels people know they have powers that they shouldn't have and they need these powers to keep some really vicious people under control. Most of these guys have families and they want to protect their families as much as they want to protect us, and if they mis-use these powers they really shouldn't have, they'll be taken away, they realize this. Using these let's call them Supra-legal powers in cases of normal criminality would be such an abuse.

Re:Sorry, slashdot is just tinfoil hat heavy

[The Spoonman]

I'm old enough to remember how Reagon was demonized just like Bush Jr.

Firstly, I'm old enough, too. Reagan was a porn star compared to Bush Jr. and Crew. This goes beyond Bush. This enters the Senate, the House and now the Supreme Court. Zoning boards across the nation are zoning anything the chrisitians don't like out of town (porn shops, strip clubs, etc). Are you old enough to remember the hub-bub about Janet's boob? When was "intelligent design" even on the table at school boards, let alone a serious consideration?

The truth is the people, the voters, are in control. Politicians of the left and right are only getting away with what the voters *allow* them to get away with. Stupid crap happens because the irritation level does not rise to a level that motivates enough voters. When politicians do cross that line they get whacked down by the voters.

So, what you're saying is you're old enough to remember the dream, but haven't awakened to the reality yet? 'pubs are fixing elections across the country, ADMITTING to fixing elections, and no one raises an outcry. Of course, give people even the whiff that their american idol election is fixed and then you'll get a letter-writing campaign.

Or

[Ruff_ilb]

>_>

That's what they WANT you to think

_ /tinfoilhat on

because they got hacked

[stormi]

I'm sorry but all of these conspiracy theories floating around seem completely ridiculous to me. If I were to guess why the government is recommending we patch Windows, I would say it's because they got hacked just a few weeks ago and there was an article on slashdot about it. This is probably their lame way of covering up or making things right again, even though anyone who cared has obviously forgotten about it by now anyway. Microsoft's advice to them on how to not get hacked was probably along the lines of "patch Windows regularly" and they probably bought it. Now the Government says to the Vulnerable Public, have no fear! We have it figured out! It happened to us too, but we know you need to patch things!

Just my two cents.

My dual boot lappy

[Almost-Retired]

So I head off to boot my lappy to XP, something it hasn't done in weeks, run the updater, deselect the WGA option, and the sonofabitch installed it anyway.

Is there no end to the microsoft perfidity?

Oh, wait, this is /., and that makes me look like a nubie, which I hardly am, and you all know that. IMO, the inbreeding in Redmond has reached the point of no return, and I'm thinking of reclaiming the space the XP install uses for something usefull.

--
No Cheers this time, Gene

Re:They learned the communicty an important lesson

[zaphod_es]

nor any viruses

The real issue

[tholomyes]

This update is as important as it gets. There are vulnerabilities in every major MS program which allow remote code execution, which means that as soon as the exploit is discovered, it can take advantage of holes all over your system.

Affected programs and services:
- MS Server Services (TCP 139 and 445).
- DNS servers
- Internet Explorer
- Outlook Express
- Microsoft Management Console
- HTML Help
- Visual Basic
- Microsoft Office
- Windows kernel

I'm not too surprised that they're trying to push awareness of this patch. It was the lack of patching several weeks beforehand that allowed Code Red to do as much damage as it did.

Possible Conspiracy or just being paranoid?

[Ghost-in-the-shell]

Has anyone considered the possibility that the patches contain monitoring code that will in fact allow the department of Homeland Security to monitor people's computer communications? It is not as if such accusations have not come forth before. This article over at the CBC website comments about alleged CIA operations, in where they are flying prisoners around the globe to be handled in different jurisdictions. This particular article comments about such flights landing in Canada. In Gander to be exact. So it is not to far fetched to consider possible ulterior motives to getting people to update.

So while I applaud the Department of Homeland Security for advising the citizens of the USA to stay on top of their computer updates, I also wonder if there is any ulterior motive behind it. Have they asked Microsoft to include some code that they can use? Or for the bigger conspiracy theorists out there, have they infiltrated their own programmers among those who are writing Windows updates and Vista code?

And for the ultimate in conspiracy theories! Has anyone thought about the timing of the press release? One day before terrorist in the UK are busted in the closest terrorist attack since 9/11, and no one can use the argument that Homeland Security did not know about it the day before. It's not like they woke up and said "Let's bust some guys in England who just happen to be plotting to do something with commercial flights going to the USA"

My opinions might not be popular but they have a point. Be skeptical of everyone, till they prove you wrong!

You unpatriotic communist raghead whiner!

[EmbeddedJanitor]

Windows Visa will automatically send the details of people that don't update to the 'no fly' list.