Slashdot Mirror
.ANI Vulnerability Patch Breaks Applications
Jud writes "Microsoft's fix for the .ANI vulnerability was part of Patch Tuesday yesterday. However, all is not well with the update. Reportedly, installing the patch will break applications such as Realtek HD Audio Control Panel and CD-Tag, which mentions they are affected by the problem on their main page. A hotfix is currently available from Microsoft, however their current position is this is an isolated problem and the fix is not planned to be pushed out through Microsoft Update. "
"their current position is this is an isolated problem"
Weird, 'cause I hear about one of these stories almost every week. Isolated in what sense?
My turnips listen for the soft cry of your love
I just wanted to make a quick post before I see all the standard lame M$ bashing gets out of hands from a ton of idiots that are most likely using Windows while posting.
This is exactly why it takes Microsoft so long to put out patches sometimes. Unlikely all these free and open source packages, Microsoft Windows is actually used by tons of users at home and in the business world. People need their machines to do their daily activities and jobs. This is why so much testing is needed before something can just be shoved out there. This is why you tend to see this sort of thing from patches released out of cycle. It obviously has not and could not have been tested as much (and yes sometimes problems occur with patch Tuesday patches).
You might not see as many issues with *nix based systems. Why? Well, there just are as many users. This might sound like a cliche but it is a fact. Look at when official Redhat patches and other updated packages actually come out. They come out days, weeks, and months later. Sure there is some patch that some random guy hatched together -- the power of open source!! However, if you were to apply that untested P.O.S. across the world in tons of real environments, you'd probably have a shitton of problems.
This does not excuse problems with patches, but at least it came quicker. Remember, M$ has to release stuff that fortune 1000, government, home users, and everyone else can live with. Pushing some patch 30 minutes later for an OSS package that 2000 rag tag home users use.. just isn't the same.
If you read the hotfix page you'd see this: The Hhctrl.ocx file that is included in security update 928843 and the User32.dll file that is included in security update 925902 have conflicting base addresses. This problem occurs if the program loads the Hhctrl.ocx file before it loads the User32.dll file. So yes it is Microsoft's fault that they screwed up.
It's not only possible. It's mandatory. It's called input validation, and everybody else is doing it. The only reason I can see why Microsoft is an exception is that they have convinced people like you that it's not their fault if *their* software breaks. Get a clue.
Windows comes with a perfectly usable GUI interface to volume controls and other audio hardware settings. Why did Realtek have to create a crapware application to do the same thing?
I have no idea; that seems to be the way everything works on Windows. Instead of just providing a device driver, every vendor has its own mega-application that provides the driver plus a lot of extra stuff for controlling it. You usually see the same thing with video drivers, wireless drivers, etc.
Anyway, if I want the audio to work in XP on my wife's new laptop, I have to use Realtek's crapware application. That's just the way it is.
I guess this is a good argument for the Linux model, where drivers are provided as part of the kernel, and are all standardized, rather than being completely vendor-provided. If you're running KDE, you'll just KDE's built-in mixer and volume control software, regardless of what audio hardware you have. That hardware will have drivers in the kernel which have nothing to do with any GUIs. By having everything community-supported rather than vendor-provided and supported, much better standardization exists, and you don't have to run around to different vendors' websites trying to find drivers for your hardware because it's all already included in the kernel and distro.
since any monkey can be a "developer" (or a virus author) without knowing what they're doing with those development environments they put out they should expect to have a lot of bad software as a result of that.
Wow, brilliant.
So... since I can write a really bad script that deletes a user's files or a bad application for any OS, it is the OS's fault or the company that designed the scripting language?
Cool, I will write tons of applets to wipe hard drives to give to my friends and then tell them that you said they should blame the company or people that made the OS or scripting languages and should sue them.
SlashDot has went from intellectuals with free time to the mildly retarded with way too much free time.