Slashdot Mirror
Microsoft to Release 6 Security Updates Next Week
An anonymous reader wrote in with an article that leads: "Microsoft will release six groups of security patches next week, including three critical updates for Windows and Excel users. The critical updates will fix bugs in many different versions of Microsoft's products including the latest versions of Excel, Windows XP, Vista and Windows Server 2003, Microsoft said."
... at least now we will be safe !
This shows the importance of a good NAT firewall. However it'd be interesting to know if the user must click allow on a lot of UAC warnings first to be compromised or it comes through clean since this is supposed to be one of the main benefits of Vista. The UAC works reasonably well for me, it's just annoying when stupid companies like ASUS ship "Vista Ready" cds in the box that have unsigned code that generate a lot of warnings.
Microsoft Patch Release Announcement
(Slashdot Standard Form #97)
Microsoft will release [$COUNT] security patches
[ ] Today
[ ] Tomorrow
[ ] Next Week
[ ] When they goddam say so
Including [$NUMCRITICAL] critical updates for
[ ] Windows
[ ] XP
[ ] 2000
[ ] Server 2000
[ ] Server 2003
[ ] Vista
[ ] Linux (..sorry, just kidding!)
[ ] Word
[ ] Excel
[ ] Access
[ ] PowerPoint
[ ] Bob
[ ] Internet Explorer
[ ] Outlook
[ ] Outlook Express
[ ] Exchange
[ ] DOS 6.22
[ ] All of the above
A spokesperson said "We take a very serious view of or responsibilities to ensure that the Microsoft computing experience is safe and secure for all our valued customers - and these updates show our commitment to that goal"
When what they really meant to say was...
[ ] Fsck, we just found some more stuff we missed during beta testing.
[ ] We never thought someone would try THAT
[ ] Yeah, we were kinda hoping we could keep that one quiet but then some geeky, long-haired nerd had to go and post about it on teh Internets.
AT&ROFLMAO
Does everyone here secretly run Windows systems, or is this another MS-bashing opportunity? Can we have security fixes released for Linux kernel published too please? I think that might be more relevant for the practical purposes this article was no doubt published...
I mean, Christ, it's almost like everyone here hates Microsoft or something!
Wait a minute....
throw new NoSignatureException();
(Slashdot Standard Rely #42)
This doesn't affect me because I run
[] OSX
[] Linux
[] Multix
[] CP/M
init 11 - for when you need that edge.
why is there an article about patches anymore? Everything gets patched... Windows / Linux / OS X / a few hundred thousand applications that run on them.
Slashdot all the news about iPhone and patches that you have ever dreamed of....
When I start Windows Update it informs me that it needs updating. Attempting to do so leads to a carped update with some error code. In short: Without the "improved" version of the software no more Windows update for me and since getting the "improved" version fails to install in the first place...
This seems to be a known problem for which there doesn't ssem to be a fix yet. And no! Re-installing the OS is not and option since this toasts my Ubuntu partition.
Microsoft is a company that pisses me off more and more on a daily basis. Thank you for listening.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
One of the joys of working for a big company is the splendid way in which a large patch distribution nails network bandwidth and pulls down every machine in the office while it is installed. I'm not sure who's at fault here but they sure ain't the sharpest tool in the box.
Could be because a large portion of Slashdot's readers are sysadmins and chances are that many of them are administrating Windows machines at work?
This just in...
The sun will be rising in the east today and setting in the west. We will continue to cover this breaking news as more details come to light.
is the solution. That way, you can concurrently run Windows in a window on Ubuntu and you can recover the wasted Windows disk partition too, using ntfs-3g. Actually, when using an emulator, Win98se works even better than Expee and since you won't be using any of the internet 'features' of Windows anymore, the vulnerabilities won't affect you, while making backups of Windows becomes a breeze using tar. With Windoze on Qemu, you don't need to bother updating it anymore either - it just keeps on working.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Yes, Linux is more secure than Windows. We know that.
That doesn't mean that we can rest easy on Linux Security. We must never for a moment think that even with Linux we are ever completely safe. As long as any computer has power to it, it has a security risk, but I'd like to present an alternative way of thinking about it.
Linux must not only be better in security, but better in capability.
I know that design wise, OpenLDAP/Kerberos/Samba/FreeRadius/AFS will produce a far more secure network infrastructure than Active Directory will. But that combination will not produce as capable an infrastructure as the real ADS. The worst security vulnerability Linux could have is the security vulnerability produced when an orginization chooses Active Directory on Windows over Open Directory on Linux.
If you want to change this, contribute to OpenLDAP, to Samba, to FreeRadius, and Kerberos. Lets make Open Directory not only more secure to Active Directory, but outright superior.
The real point is why is this considered news that needs to be released to /. ?
They have released this quantity of patches before...
Often...
This is like walking outside and exclaiming in surprise, "Look everybody! There's still air out here!!!"
Imagine all your PC's have their own IP address. (Scenario more likely if you have IPV6). You can put a firewall where your NAT used to be, have all the advantages of NAT and none of the disadvantages. NAT is an ugly hack which, by pure coincidence, turns out to have some firewall-ish features.
10 ?"Hello World" life was simple then
We have a fairly strong infrastructure of MATLAB, Excel, SQL, and Access (all working together) for handling incoming data, processing it, creating easy to read and edit reports with pretty charts for the CEO types, and finally storing it and analyzing it for future access.
We typically receive the data in Excel and do some basic transformations into Access (rarely do our clients understand Access) where we can do some of the simpler SQL stuff (not everyone here understands SQL) and push the main data into SQL. From here, Matlab can pull the data out in the formats it needs, run some calculations, and spit out pretty results to Excel that can be sent directly to our clients for review -- charts and all.
I can imagine dozens of ways to use Excel to compromise a system, but the important thing here is that idiots shouldn't open and run macros in Excel if they don't know what they do, or where they come from. Excel is the winning spreadsheet for us because we can do absolutely anything in it -- from simple optimization algorithms, to a piece in a larger application.
If some of you Microsoft haters actually understood some of the power within the Office group (interop is wonderful) then you might not hate it quite so much.
... The only Vista bug that I can see in this bulletin is "Moderate", not "Critical". That's because there are multiple levels of protection, kinda like those in OpenBSD and SELinux. Remember, NSA had a say in Vista's design. There is Mandatory Integrity Control (something not widely known, I believe it's separate from UAC and is mostly under-the-hood stuff), Address Space Randomization, buffer guards, low-integrity for IE, reduced privileges for services, nothing can escalate without an in-your-face irritating UAC (Union Aerospace Corporation, anyone?) prompt, and of course, lots of pixie dust I can't talk about. So in case there's a buffer overflow (take the ANI bug for instance) - there are a few layers of mitigation that seem almost unbreakable *AT THIS TIME*. I'm yet to read news about a pwned Vista box. I'm sure it's possible that some clever guy somewhere will write an exploit that dodges all that stuff, but it obviously is taking much, much longer than with any other OS, except, of course, for OpenBSD (kudos there) :) . Of course there will be bugs in legacy code that are still there. But layered security and systematic elimination of bugs work.
Microsoft *did* hire some of the best security experts available lately. And I can say it shows. At least now I feel not very scared to use IE when I have to.
Then of course, everyone loves "Free Games!!!11eleven", mushy-mushy desktop pets, free trial CDs, free money from your late uncle from central Boozemania or whatever. If your user account gets pwned, and your user has access inside the network of your company, you're toast no matter what OS you run.