Slashdot Mirror
No Fix for Word Next 'Patch Tuesday'
Sktea writes "A spokesman for Microsoft has said that they will issue no patches on the next 'Patch Tuesday' for versions of Word vulnerable to the recent zero-day threat. There is no mention whatsoever of the omission in the latest advance notification at the company's security site." From the article: "The software maker is working on a security update, but apparently needs more time. The company did not specify how many flaws Tuesday's updates will address or in which components of Windows the holes lie. The Visual Studio update could offer a patch for a zero-day vulnerability in the developer tools that was made public last month. "
This isn't anything critical like fixing a problem with their DRM. This only hurts the end users, not anybody they are beholden to RIGHT NOW in order to attempt to become the supreme overlords of the livingroom, like they so desperately want to be.
I'd rather they take a little more time and "fix" it the first time, rather than having to issue multiple patches to fix it, each one opening up more glaring holes. Of course, I'd prefer it wasn't there to begin with, but hey, the world isn't perfect.
Comment removed based on user account deletion
"received unexpected from trusted sources"
"Expected" is the tricky word there. Most people who receive Word docs in the course of work expect their normal, trusted sources to send them documents that are themselves somewhat new, newsworthy, you know, containing information that's worth sending. A doc that's totally expected probably didn't need to be sent.
Let's say you're the editor of a newsletter or magazine. You expect docs from a few score people who occassionally submit stuff. You expect them to show up with e-mails that say, "Hi George, Here it is!" The bad guys can easily fake that stuff - and often do - but you're a normal editor, not a security expert, so you give the normal English reading to "receive unexpected," and this stuff all looks like stuff you expected, so you open it....
What Microsoft should say is, "Don't open any attached docs without phoning the source first and specifically confirming the file." As it is, they're saying just enough to cover their ass ("We warned you!"), without saying enough to enable the typical user to really practice safe Word use.
"with their freedom lost all virtue lose" - Milton
If this was a WMA DRM crack, we'd see a patch within three days. Don't you just love Microsoft?
"Sufferin' succotash."
Believe it or not, there exists a non-trivial percentage of end users who seek out and pay for software upgrades that provide new features. I, for one, eagerly await Adobe Photoshop CS3. Some of us are not so cheap and actually have specific needs and desires for improved productivity and functionality.
Then, of course, there's also corporate IT. That's pretty much Microsoft's core demographic for upgrades.
That's probably because of license agreements made with the corporate consumers of said DRM, allowing them to sue (or jane, or ...) Microsoft's pants off when the product 'protecting' their music/video fails. This in stark contrast to the EULA which disclaims any warranties and then some.
Indeed!