Slashdot Mirror
Microsoft Rushes Internet Explorer Patch
drquoz writes "Last week, it was reported that a critical security flaw was found in Internet Explorer. On Tuesday, experts were advising users not to use IE until a patch could be released. On Wednesday, Microsoft released the patch. An interesting quote from the article: 'Kandek suggests that Microsoft is at a disadvantage in updating Internet Explorer because its browser doesn't have a built-in update mechanism like other browser makers. Mozilla, for instance, just released Firefox 3.05 to Firefox users through its auto-update system.'"
No -- Firefox is at the disadvantage. If you're a single user running as administrator, its auto-update is great. However, the users (all running limited accounts) on our Windows/Samba network will have to wait until I install the new update manually because there is no built in mechanism for administrators to push out updates.
And should I use my cobbled together scripts to push out a security update for Firefox on the last day of finals when it might break everything, or should I wait until Monday?
On the other hand, the WSUS server that I set up worked exactly like it was supposed to last night.
Tightly bound indeed. I've been postponing the inevitable reboot all day long (GMT here). It's ridiculous to need a reboot just for a browser update.
I even find it awkward that no popular linux distribution checks and proposes security updates at bootup.
I have an ASUS laptop that runs Ubuntu 8.04. I turned it on, turned on the Wi-Fi radio, and started Firefox to look up something about reenactment costuming. After a few minutes, I noticed the update icon in the tray. One of the updates was Mozilla Firefox 3.05. I clicked download and apply, and it was done. So yes, Ubuntu automatically "checks and proposes security updates".
Perhaps this is because Microsoft so tightly binds IE to the operating system
Not perhaps.
I believe the engineering term is "reap what you sow, bitches."
True, true, and true. But that doesn't change the fact that IE only runs on Windows and 99% of Windows users have Automatic Updates turned on, usually checking weekly. So you're usually looking at a max "lag time" of seven days before an IE user gets the patch. And that assumes the worst possible case: the patch releases right after that user's computer was updated, and they use their computer (and IE) every day.
doesn't allow users the granularity of saying "yes, update my browser but no, leave the rest of my system alone
Indeed, you can't have it automatically update a critical browser flaw, but say 'no' to the 1673rd revision of "Windows Genuine Advantage".
[Insert pithy quote here]
While I would agree with you in theory, your ideas don't match up with what I've seen in the real world.
Until recently I worked in a mom and pop PC repair business. About 9 out of 10 systems I worked on were out of date, typically by a few months. I don't know for sure, but my guess is that users are switching auto-update off because can't be bothered with 'nag' messages from their software.
Granted, the machines I saw were generally dying, so it may not be a fair cross-section of home computer users. Still, the idea that 99% of home users should have new patches within a week flies in the face of what I saw every day.
Dangerous, sexy, turing complete: Femme Bots
Actually, you can - I've done exactly this on my home PC, which was installed from a corporate license (had an MSDN subscription at the time). You need to go through the process manually once - you select everything other than WGA, and when it asks if you really want to ignore that update, you check the box that says something like 'Never ask me about this update again', and click OK. Now, I still get all the critical updates installed automatically, but never have WGA installed on my PC. It's been like that for several years now.
Weekly? The default is to check every day at 3am. If it's turned on and left at the default (like most people do with FireFox), they'll be notified this morning and able to install it right away.