Slashdot Mirror
Microsoft Plans Largest-Ever Patch Tuesday
CWmike writes "Microsoft said it will deliver its largest-ever number of security updates on Tuesday to fix 13 flaws in every version of Windows, as well as Internet Explorer (IE), Office, SQL Server, important developer tools and Forefront Security client software. Among the updates will be the first for the final, or release to manufacturing, code of Windows 7, Microsoft's newest operating system. The 13 updates slated for next week, eight of them pegged 'critical,' beat the previous record of 12 updates shipped in February 2007 and again in October 2008." Update Reader Kurt Seifried writes to correct the math a bit, pointing to Microsoft's Advance Notification page for the release, which says that rather than 13 flaws, this Patch Tuesday involves "13 bulletins (eight critical and five important), addressing 34 vulnerabilities ... Most of these updates require a restart so please factor that into your deployment planning."
It's PDAY!!!
So it installs linux?
I am still worried about using Ebay to buy my star wars collectables from my Chrome Browser - http://it.slashdot.org/story/09/10/06/2118211/Null-Prefix-SSL-Certificate-For-PayPal-Released
The sun is the same in a relative way, but you are shorter of breath and one day closer to death
The more likely you are to have errors. I would love to see a chart of patches released over time... anyone put that together yet?
No comprende? Let me type that a little slower for you...
Does this mean that my Windows 3.1 box will finally get the DST update?
Last week's "critical updates" were two copies of Windows Genuine Annoyance.
Isn't Tuesday the first day back from a long weekend? Is that really the best time to do this? We'll be up to our eyeballs in password resets already. (How do people forget a password in three days?)
When our name is on the back of your car, we're behind you all the way!
I'm guessing windows 2000 isn't one of the operating systems that will be patched?
:(
I couldn't find details in the article, but since extended support has ended... RIP win2k
P.S. unless it's not affected by this? but I think there are previous vulnerabilities which haven't been patched too so maybe win2k is already dead and I missed the boat.
Will it make every PC that uses windows ME self-destruct?
i got this awesome bug fix such that Outlook now says "This copy of Office is not genuine. Click here to learn more online." in an unremoveable toolbar
can't wait to see what gets patched next!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Microsoft plans largest ever patch Tuesday with a ton of awesome features. It will be ready in a few years. Make that 10 years. And actually, scrap the features. By the time it arrives, none of the features are anywhere to be seen, and all they accomplish is add eye candy, a 16 Gb memory footprint and 75% performance cut. Oh, and nobody will install the patch.
13 patches released at 13:00 of Tuesday 13. Windows sysadmins that day will have to pass below ladders, see a black cats cross in front of them and then break a mirror. But that will be nothing. The worst part will be when they turn on the computer, and see that windows is still running.
EVERY version of windows? Including windoze 95? I don't think so!!
Why the fuck is there a story about this? Is Slashdot that lame?
is there a fix for popular '12345' Windows Live passwords ?
http://blogs.technet.com/msrc/archive/2009/10/08/october-2009-bulletin-release.aspx
For October we are releasing 13 bulletins (eight critical and five important), addressing 34 vulnerabilities, affecting Windows, Internet Explorer, Office, Silverlight, Forefront, Developer Tools, and SQL Server. Most of these updates require a restart so please factor that into your deployment planning.
Here in the US it'll be Columbus Day. ...you nitwit.
Look, I know it's fashionable to make negative remarks about MS round here, but it's only fair to say 'well done' to them for bettering their previous high count. Hopefully they haven't run out of bugs to fix and they'll work hard to find and fix even more next time. Who knows, this time next year they could be fixing hundreds of bugs every month - and if we're lucky, some of them could be quite serious or critical - wouldn't that be just awesome!
Go MS!
AT&ROFLMAO
I was about to bitch about the submitter/moderator not RTFA, but it turns out, the article doesn't mention it either, so I'll clarify instead: thirteen updates are being released which together address thirty-four security vulnerabilities of varying severity across varying products (ten of which are targetted at Windows). So, that's NOT thirteen flaws (plenty more actually), just thirteen updates, some of which (all?) address multiple flaws in the particular system they are targetted at. Of course, this is just the advance notification, so full details about how many vulnerabilities each update addresses and the general information on them won't be released until the patches are next Tuesday. I think it's also worth nothing (although the summary of course neglects to mention it) that the good aspect of these updates are both major zero-day exploits (targetting IIS & SMB 2.0) are patched with these updates.
And while I'm posting, why does Slashdot insist on linking to shitty tech magazine articles (poorly) summarising the raw and accurate data straight from Microsoft? Seriously, I'm not sure if it's some sort of aversion to linking to MS, but they're the ones doing the patching, so it follows that they have the best, newest, most accurate data on them, and they'll likely be the first to provide updates on their content. These articles are just summarising what Microsoft has published on their various web-sites, and being a summary, they provide a lot more information and raw data:
Microsoft Security Bulletin Advance Notification for October 2009
October 2009 Bulletin Release Advance Notification
because as well all know, the concept of exchanging cash for digital content is solid unquestionable morality. meanwhile, if i were to assert that perhaps digital content reaches maximum economic value for its creators when it is valued at $0, that true economic influence is felt in the ancillary benefits surrounding the distribution of digital content, i'm just some sort of a kook
you could say i might even have something valid to say there, but microsoft plainly states it wishes to have cash in exchange for its digital content, and i have no right to abrogate that agreement. right, just like i have no right to question that the great grandchildren of the writer of "happy birthday" still deserve cash for someone playing that song somewhere. just like i have no right to question why a picture of a stupid mouse is still private property. etc.
you know what? i have every right to abrogate an "agreement" i was never consenting party to and see no logical, philosophical, moral, or economic coherence in
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Does it fix the problems with Windows 7? After reading this review of a pre-release download, I'm a bit hesitant to use it.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
It's a very good security strategy to piss off all your customers with WGA and Windows Media bullshit until they all turn off automatic updates.
The geek is pissed off by what to anyone else is over and done with one or two clicks of the mouse.
hmmm....I wonder where's the patch that wipes windows from the hard drive and installs *nix.....
I am using special exam software to take a grad school exam Wednesday morning. The version of the software which I'll be using was released TODAY. Would I be smart to turn off Automatic Updates on Monday, or is this just paranoia?
There is just NO comparison, Linux especially and all UNIX like systems are hugely more correct and stable than Windoze(TM) will ever be. Two reasons:
Bad and sloppy code gets found, fixed qickly, and is met with hoots of derision from other developers.
Certain FEATURES touted as a + for Windoze eg OLE never made it into Unix since their design required the OS to be broken by design and the developers declined to do it.
A couple of days reading LKML will show you how much chance a really bad idea, eg filetype based on extension, has of making its way in.
I run Internet facing machines with no firewall and get to send about 5 days a year fixing problems eg defend the slow ssh attack.
which distribution will they choose, it would be hard to satisfy the typical slashdot user
We can probably assume that the 34 vulnerabilities are just different OS and browser variations of the same 13 flaws.
Funny thing about Slashdot, though. People complain nonstop about all of the bugs in Windows, but then when Microsoft makes an effort to patch as many of them as possible in one go, they complain about "the biggest patch Tuesday ever!!!!" It shouldn't be a surprise, folks. If you believe that Windows has all these bugs, then you should probably also believe that they will be patched at some point too. Seems like they should be bragging about how many of the bugs their patching.
And by the way, when the previous record holder was 12 flaws, it's not really saying much that the latest is 13 flaws. That's like saying I'm richer than someone with $1,000,000 because I have $1,083,000. In the grand scheme of things, that $83k doesn't really matter.
So does this mean that users who buy windows 7 retail won't need to wait for the service pack as they already have it?
you think strong ip laws makes the begging less necessary? man, i wish
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I'm guessing windows 2000 isn't one of the operating systems that will be patched?
You're guessing wrong.
For details and a full listing of the affected software:
Microsoft Security Bulletin Advance Notification for October 2009 [Oct 8]
Yep. Nothing maximises profits like paying people to develop a huge patch, and then providing the bandwidth to distribute that patch free.
Unless, of course, your comment was a subtle parody of anti-MS crowd. ;)
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
You answered your own question. The answer is yes, always turn off automatic updates when you need to guarantee that nothing changes. (Hint: This rule includes production servers; always test first before putting a patch into production.)
As usual. You breathed on the PC, or you installed a mundane office app, time to restart the computer! I wish all Windows users would familiarize themselves with a good Linux distribution or other Unix/Unix-like system. Even if they decided they didn't like Linux and preferred Windows, at least this would disabuse them of the idea that any non-kernel update has a good reason to require a reboot to complete the installation. Then they would have some education as to what to reasonably expect, and the pressure placed on Microsoft might even advance the average users' experience a bit. The whole problem with Windows is that the average person thinks its quirks, shortcomings, and examples of plain stupidity are normal, as though they were the inescapable reality of operating a computer. They are not.
Also, maybe someone can help me out here. Why the hell does Windows Update often aggressively use 100% CPU when running in the background? By "aggressively" I mean it will tremendously slow down anything else you are doing (not at all the same thing as a low-priority task that can use 100% CPU when nothing else wants the CPU). I can boot Linux on the same PC and update not only the core OS (which would be similar in function to Windows Update) but also every last installed application without that kind of system load, without any noticable slowdown in any regular applications (browser, office software, e-mail client) I use. Frankly, I know this will make some of the more narrow-minded folks automatically assume I am trolling, but here's the reality: I see too much shit like this to take Windows seriously or to consider it an equally viable option compared to Unix. The technies and others I know who really like Windows and think it's great couldn't perform the most basic system administration tasks in any other OS, which tells me that they have no real basis for comparison, that their opinion is not an informed one. If someone with a wide variety of experience with alternatives wants to speak up and tell me why they really like Windows, why it's not substandard compared to any other modern system, please do, but good luck to ya.
So where are the instructions for the patch party?
thegodmovie.com - watch it
Does this mean they're releasing Windows 7 a full 10 days early, then?
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
I'm not sure if this was an attempt at trolling, or just random wtf-age, but I was legitimately amused by it.
you can make a movie for $100 million, and make a nice profit in THEATRES. where you sell TICKETS
television was supposed to destroy theatres, then the vcr, then the dvd, then the internet... and there's always more money in it, even with all the cell phones and crying kids. people love the cinema
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Amazing that a software company would dip into it's infinite cash reserves and pay programmers to do some work, and repair their broken products.
Believe me ... I've sat and recompiled Spca5xx for a roomful of PCs after the monthly Linux updates. Last time I did it was less than a year ago.
Is it in the kernel now? Maybe ... I don't use Linux much these days.
No sig today...
...so far!
The CB App. What's your 20?
addressing 34 vulnerabilities ... Most of these updates require a restart so please factor that into your deployment planning."
Great... 34 restarts... :P
ERROR: SIG NOT FOUND (A)bort, (R)etry, (F)ail?:
Comment removed based on user account deletion
and your point?
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Seriously, I hate when they release that many patches at once. I'd rather have all Windows one day, all Office a few days later or something. Two of the more recent big patch days, I had Windows problems (Made some computers slow to a crawl) and Office (Your software is illegal..what? They are all legit copies) problems on different computers strewn throughout the office. 16 people all demanding of me that they need to get their work done RIGHT NOW is rough to deal with. Of course, I could stagger the computers which get updated...but that isn't the point. ;)
Or at least patches to Win2K would be nice, maybe some working timezone data.
I also would highly recommend Microsoft release patches for Windows 3.11 to fix flaws in Win32s, and perhaps add IPv6 to Wolverine (winsock 1.1 for Windows for Workgroups)
“Common sense is not so common.” — Voltaire
So what?
My Ubunutu Jaunty desktop downloaded 130mb of updates last night. And this isnt the first time either.
I didnt see the /. community getting their nickers in a knot about it
Exactly, it's such a tiny cost and to paints your company as caring about the stability and security of the consumers machines.
It means your salesmen can point to these stats, just like you have, and say "we spend our hard earned money to fix your problems".
Of course you must never even hint that every patch is actually a failure in the system that supposed to exist to prevent broken software from ever being released.
weird
Celebrity worship is a poor substitute for Deity worship and costs more to boot.
did slashdot turn into an advanced advance notification service of microsoft.
seriously, when was the last time you read "today [insert distro name here] has released the largest number of critical security updates yet"
boooooooooooooooooo
So we get a patch of 10gb right? largest-ever-patch-tuesday or largest ever patchtuesday seems better to me. .
i've seen that exact troll several times - it's copy/pasted probably from some alt.coprophagia newsgroup or something
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
13 bulletins (eight critical and five important), addressing 34 vulnerabilities ... Most of these updates require a restart so please factor that into your deployment planning
13 and 34 ...
So does that mean 47 restarts?
install them on friday, that'll make it friday the 13 ;)
Never antropomorphize computers, they do not like that
Disgusting...
Here be signatures
Why does a Windows system require so few patches?
I know Microsoft is often poked at, especially around these parts, for having so many vulnerabilities to patch, but at least there on the ball doing it. Not to mention, automatic updating has been the defacto standard now since XPSP2, so nowadays it's pretty hard not to be somewhat up to date. So my OS pulls down a batch of updates once or twice a month, big deal... I think Microsoft has done a good job with the hand of cards they've been dealt.
Not to mention, WSUS in the enterprise is an excellent, free tool for centrally managing patch deployment.
Number of patches and vulnerabilities aside, I think MS is a standout leader in this category.
Are you a CS major? If so, please focus on calculus for a while, and leave the arithmetic for the mathematicians!
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
I've yet to see a good Linux/Unix distribution that offers centralized patch management in an easily administered manner to compare with WSUS.
Kernel issues still require a reboot.
Kernel issues do not always require a reboot.
Most of the time you can have a run-time patching within a separate LKM (Loadable Kernel Module).
Check this out for some more info about run-time patching
Read and Comment at my BLOG
!!!
Actually it is conjectured in several histories that the tumbleweed is from Russia and only came to the Western US when Russian wheat farmers brought the seeds in with their wheat.
Early explorers did not report them.
AG
if i build a fence, i deserve to get paid
if i make a movie, i deserve to sell tickets in a CINEMA
if I PUT IT ON THE WEB, i deserve to have free advertising for my supposed skills as a moviemaker, and entice some to go to the cinema to buy a ticket
if i put a program on the web, i deserve to get a job to customize that program for a corporation's specific needs, make my resume look awesome, and become influential in my field. all of which translates into dollars in my pocket far better than setting up arbitrary, easily broken tollbooths between digital content and internet users, who expect, and deserve, unfettered access
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Yep. I'm a Linux (Gentoo preferred) user who switched back to Windows simply due to stability issues and I have well supported hardware (Intel Board and C2D). Simply put, I got tired of a damn update fragging K3b or Kmail or something else that was a critical app and no unlike many Gentoo users, I didn't believe in pushing 11 on the system, going for very conservative optimizations, using Os as my default (Optimze for Size). It was recently after a Crash Log Review that I determined that both Linux and Windows in 64bit flavors simply aint ready for the desktop, even though both work great on servers due to the limited functionality. Face it folks, update one core component on a 64bit desktop and likely you'll break at least two apps, which happened all to damn often for my peace of mind.
Because of this, I pulled 3 sticks of memory from my dekstop and dropped back to a meager 2GB and installed Win7-32, which seems to be pretty stable. Even XP/Vista/Linux are all pretty stable for 32bits, it's just that the 64bit versions still have quite a few speed bumps and I got tired of having to fix either of them on a regular basis.
Mod me up/Mod me down: I wont frown as I've no crown