Microsoft Kicks Off Third-Party Bug Warnings
Pigskin-Referee writes "Microsoft has expanded its vulnerability disclosure policy to include not only those in its own products, but also flaws in third-party software that runs on Microsoft operating systems. These will follow the same practices as the advisories issued for Microsoft's products, and it makes sense, because many users look to Microsoft to ensure that their computers are secure, even when the problem lies with a third-party program. The company will contact and coordinate with the third-party vendor before an advisory is issued."
Since Adobe and Java are widely ignored by the general population because they have hundreds of icons on their system tray. I'm almost to the point of charging $10 extra per customer who ignores these updates.
http://www.stopacop.so -- You have rights. How about standing up for them before they go away?
Finally. Now if they track every product they'll finally be able to fairly compare themselves to Linux distributions.
Anyone else notice their advisories are against competitors?
Yeah... I call BS
To the bugs behind the OS.
to any systems security is welcome. I do think however that MS should have introduced this directly with the launch of W7. So much could have been done by now.
"I'm taking this loop off." - Jack O'Neill
Ban flash from Internet Explorer and watch virus infections fall dramatically.
There's nothing concerning Chrome or Opera in the Microsoft Security Advisory RSS feed.
Liberte, Egalite, Fraternite (TM)
Ah Java and Adobe!
Ya see, I run my XP box as user. The Admin account is used only for Admin. Now, in my user mode, the Java and Adobe update icons show up in the tray and when I click on them, after a while of them doing their thing, I get the "You have to have administrative privileges to perform this update." Can I do a "Run as" on those updates? Nope. Gotta log-off and log back on as the admin. "Switch User"? Turned it off for performance reasons.
Then in Admin mode, gotta re-download all of the updates again and then do the install.
So, what if your customers, or least the people using those machines, don't have admin access?
Oh, I don't have that problem with any of Microsoft's products, btw.
iTunes on Windows sucks too.
Listen Windows devs, not everyone runs their machines as Admins all the time! Geeze!
And no, you shouldn't have to be an admin to install a fucking document viewer.
because many users look to Microsoft to ensure that their computers are secure
Okay, that explains a lot.
#DeleteChrome
Finally something Microsoft is doing right. Fact is, "Windows" it vulnerable as hell not only because of their own crap, but the crap of others... and truth be told, it's probably more other crap that does more damage to Windows than anything else. Okay so there's a combination of stupid in effect... Microsoft can't seem to limit the applications and drivers to prevent them from doing bad things (as they should) and bad apps need backward compatibility... yeah... no... not really but Microsoft seems to think so.
Anyway, keep doing that and a little more and I won't hate Microsoft OSes so much.
Wow, this endeavor could very well add thousands, or 10's of thousands, of new jobs to the economy. Or, it's a PR campaign to push IE9, et al MS apps.
Hmmm, which is more likely?
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
Add Adobe Flash, Adobe Reader and Java to Windows Automatic Updates. That will resolve 90% of the issues.
XP is crap grandpa. Just update your fucking applications already and stop using a 236354 year old operating system because your poorly designed program from 1993 can't run without admin rights.
Seriously, are you really bitching that Windows finally has a security model? God damn you people are impossible to please.
The biggest fault that Bill Gates doesn't understand in his crappy OS's is just this: The concept of a System Registry. Absolute, Joke! Terrible flaw!!!!! Microsoft = Frequent reboots because of drastic memory leaks. Frequent security patches that require constant reboots. "Require" anti-virus software (Norton, McAfee) that do not work to the extent they say they do. This all equals downtime and headaches for businesses. Microsoft doesn't belong at the Enterprise Level. PERIOD! It's an absolute money pit to maintain and administer because of the reasons I stated. Although it is Job Security!!!!
Just a little more time.
Let's get it in the open, Vista was a documented Hail Mary from when they lost two entire years of dev time and started over about 2004. 7 is just what Vista should have been if they had planned better.
So now that 7 got the "housekeeping" done, it's time to see what Windows 8 is, with its plans for App Stores vs. whatever evil media tracking tricks get baked into the OS.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Windows has this awesome updating feature that even works with certain Windows programs (like Office). Why do they not have any way for third-party programs to tie into it?
I think if you did a poll on a large number of computer users and asked "Would you rather be informed when your software might have a security flaw, or just have it fixed?", most would choose to just have it fixed. And if programs can use the built-in Windows mechanisms, people are more likely to update their software (since a lot of basic computer users ignore update notices, and lots of more advanced users turn off the update programs since every program has a separate update program that wants to run all the time).
"Microsoft has expanded its vulnerability disclosure policy to include not only those in its own products, but also flaws in third-party software that runs on Microsoft operating systems. These will follow the same practices as the advisories issued for Microsoft's products, and it makes sense, because many users look to Microsoft to ensure that their computers are secure, even when the problem lies with a third-party program. The company will contact and coordinate with the third-party vendor before an advisory is issued."
Look, for the umpteemed time, a programming error in an application that leads to a system compromise, is a defect in the underlying Operating System, namely Microsoft Windows/WinNT/Longhorn/Vista/Windows ...
> Pay no attention to the the bugs behind the OS.
And what ever you do don't mention WIndows, talk about Internet malware instead ... :)
Microsoft ENTIRE "business development suite": (only 5 KNOWN unpatched security vulnerabilities)
---
Vulnerability Report: Microsoft Office 2010: (04/23/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft SQL Server 2008: (04/23/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (04/23/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Visual Studio 2010: (04/23/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 17% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Explorer 9.x: (04/23/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Windows 7: (04/23/2011)
http://secunia.com/advisories/product/27467/?task=advisories
Unpatched 8% (5 of 59 Secunia advisories)
---
THAT's 3.5++x LESS THAN IS PRESENT ON THE LINUX 2.6x KERNEL ALONE! See below...
(Toss on the rest of what goes into a Linux distro? That # goes "up, Up, UP & AWAY...", bigime, "increasing that lead, that Linux has", lol, in more unpatched known security bugs present that is (a dubious honor/win, lol, to say the least!))
---
Compare a "*NIX/Open SORES" OS in Linux's "latest/greatest"?:
---
Vulnerability Report: Linux Kernel 2.6.x (04/23/2011)
http://secunia.com/advisories/product/2719/?task=advisories
Unpatched 7% (18 of 259 Secunia advisories)
---
THAT? Again - That's rougly 3.5++x as many as Windows 7 has that are unpatched
Also, AGAIN:
THAT'S ONLY THE LINUX KERNEL MIND YOU, not the entire 'gamut/array' of what actually comes in a Linux distro (such as the attendant GUI, Windows managers, browsers, etc. that ship in distros too that have bugs, and yes, THEY DO), THAT ADDS EVEN MORE BUGS that COMPOUNDS THAT # EVEN MORE!
APK
P.S.=> So, so much for "Windows is less secure than Linux" stuff you see around here on /., eh?
(It gets even WORSE for 'Linuxdom' when you toss on ANDROID (yes, it's a LINUX variant too), because it's being shredded on the security-front lately, unfortunately)
BOTTOM-LINE:
What this all comes down to, is all the "Pro-*NIX propoganda straight outta pravda" practically doesn't stand up very well against concrete, verifiable & visible facts now, does it? Nope... apk
Microsoft ENTIRE "business development suite": (only 5 KNOWN unpatched security vulnerabilities, vs. 18 in the Linux KERNEL ONLY (which is, after all, ONLY A FRACTION OF WHAT'S POSSIBLE IN AN ENTIRE LINUX DISTRO))
---
Vulnerability Report: Microsoft Office 2010: (04/23/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft SQL Server 2008: (04/23/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (04/23/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Visual Studio 2010: (04/23/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 17% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Explorer 9.x: (04/23/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Windows 7: (04/23/2011)
http://secunia.com/advisories/product/27467/?task=advisories
Unpatched 8% (5 of 59 Secunia advisories)
* Of which only 2 are remote, with basic workarounds (don't be stupid stuff)...
---
THAT's 3.5++x LESS THAN IS PRESENT ON THE LINUX 2.6x KERNEL ALONE! See below...
(Toss on the rest of what goes into a Linux distro? That # goes "up, Up, UP & AWAY...", bigime, "increasing that lead, that Linux has", lol, in more unpatched known security bugs present that is (a dubious honor/win, lol, to say the least!))
---
Compare a "*NIX/Open SORES" OS in Linux's "latest/greatest"?:
---
Vulnerability Report: Linux Kernel 2.6.x (04/23/2011)
http://secunia.com/advisories/product/2719/?task=advisories
Unpatched 7% (18 of 259 Secunia advisories)
---
THAT? Again - That's rougly 3.5++x as many as Windows 7 has that are unpatched
Also, AGAIN:
THAT'S ONLY THE LINUX KERNEL MIND YOU, not the entire 'gamut/array' of what actually comes in a Linux distro (such as the attendant GUI, Windows managers, browsers, etc. that ship in distros too that have bugs, and yes, THEY DO), THAT ADDS EVEN MORE BUGS that COMPOUNDS THAT # EVEN MORE!
APK
P.S.=> So, so much for "Windows is less secure than Linux" stuff you see around here on /., eh?
(It gets even WORSE for 'Linuxdom' when you toss on ANDROID (yes, it's a LINUX variant too), because it's being shredded on the security-front lately, unfortunately)
BOTTOM-LINE:
What this all comes down to, is all the "Pro-*NIX propoganda straight outta pravda" practically doesn't stand up very well against concrete, verifiable & visible facts now, does it? Nope... apk
A large number of the security holes in Windows apps are caused by flaws in Windows libraries. Calling out others who have used your flawed library has the effect of diluting warnings about yourself. MS won't look so bad if they point their finger at others and say "see, theirs sucks too!"
Microsoft ENTIRE "business development suite": (only 5 KNOWN unpatched security vulnerabilities, vs. 18 in the Linux KERNEL ONLY (which is, after all, ONLY A FRACTION OF WHAT'S POSSIBLE IN AN ENTIRE LINUX DISTRO))
---
Vulnerability Report: Microsoft Office 2010: (04/23/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft SQL Server 2008: (04/23/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (04/23/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Visual Studio 2010: (04/23/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 17% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Explorer 9.x: (04/23/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Windows 7: (04/23/2011)
http://secunia.com/advisories/product/27467/?task=advisories
Unpatched 8% (5 of 59 Secunia advisories)
* Of which only 2 are remote, with basic workarounds (don't be stupid stuff)...
---
THAT's 3.5++x LESS THAN IS PRESENT ON THE LINUX 2.6x KERNEL ALONE! See below...
(Toss on the rest of what goes into a Linux distro? That # goes "up, Up, UP & AWAY...", bigime, "increasing that lead, that Linux has", lol, in more unpatched known security bugs present that is (a dubious honor/win, lol, to say the least!))
---
"Fact is, "Windows" it vulnerable as hell not only because of their own crap, but the crap of others" - by erroneus (253617) on Friday April 22, @07:12PM (#35911156) Homepage
Ahem: Overall, Windows 7's LESS "vulnerable" than Linux is (see above & below)...
(The apps of others', such as Adobe products, doesn't help MS, & yes, they're making a "good move" on this... I agree!)
However, on that VERY NOTE?
Well - Lets compare a "*NIX/Open SORES" OS, in Linux's "latest/greatest"::
---
Vulnerability Report: Linux Kernel 2.6.x (04/23/2011)
http://secunia.com/advisories/product/2719/?task=advisories
Unpatched 7% (18 of 259 Secunia advisories)
---
THAT? Again - That's rougly 3.5++x as many as Windows 7 has that are unpatched
Also, AGAIN:
THAT'S ONLY THE LINUX KERNEL MIND YOU, not the entire 'gamut/array' of what actually comes in a Linux distro (such as the attendant GUI, Windows managers, browsers, etc. that ship in distros too that have bugs, and yes, THEY DO), THAT ADDS EVEN MORE BUGS that COMPOUNDS THAT # EVEN MORE!
---
Funniest part:
All those "local exploits", once a bug gets "inside" (via email or bogus link clicked on by a user, part of the "don't be stupid" stuff I noted above under Windows' list?)?
They can & often DO, become REMOTE EXPLOITS, easily enough, because they get used by malware once it's "invited inside" by users...
Don't think THAT can't & doesn't happen on Linux variants as well (think ANDROID, for example)...
The only reason most Linux distros aren't exploited is n
Above all else - That's only a kernel in Linux: NOT AN ENTIRE DISTRO! ( as Windows 7 is )...
Funny how you Linux people ALWAYS seem to "conveniently omit that", eh?
(Toss on the REST of what comes in Linux?? That # of "faults" goes "up, Up. UP & AWAY"...)
---
"Not a single highly or extremely critical advisory issued for the 2.6 kernel, and 42% of the advisories not critical at all. " - by WorBlux (1751716) on Saturday April 23, @09:54PM (#35918358)
Not now, but last week there was a REMOTE one, in Linux, AND for weeks in the "rose" subsystem...
(And again: There certainly are MORE OF THEM in Linux, by far, still.)
(AND YET AGAIN - THAT'S ONLY THE LINUX KERNEL BEING JUDGED (not the entirety of what a Linux distro is & ships with, which adds MORE BUGS!))
---
"For Windows 7 42% of the advisories for were highly or extremely critical. 66% of the vulnerabilities of windows 7 are remotely exploitable, vs. 15% of 2.6.x" - by WorBlux (1751716) on Saturday April 23, @09:54PM (#35918358)
And, still: There's only 5 of them in Windows 7, an ENTIRE OS mind you, not just a kernel like Linux 2.6x (with EASY work-arounds, that 'boil-down' to 1 simple thing: "DON'T BE STUPID", in essence!), vs. 18 in Linux's KERNEL ALONE!
So - Toss on the REST of what DOES GO INTO A LINUX DISTRY & THOSE BUG #'s go "up, Up, UP & AWAY" & get higher still!
Period!
---
LMAO - this next one?
Oh, it's a FAVORITE of mine, that *NIX heads here have "tried to use to pull the wool over everyone's eyes with":
"Beside that your comparing less than two years of history to over 7 as well." - by WorBlux (1751716) on Saturday April 23, @09:54PM (#35918358)
Both Linux &/or Windows NT-based OS' are of the relatively SAME relative age, in BOTH "hit market" (release to general public) around the 1992-1994 period... so, your point here, is WHAT?
I will tell you what mine is though - Both OS' are the same age pretty much, & one (Linux) has MORE UNPATCHED KNOWN SECURITY BUGS THAN THE OTHER (Windows)... that's what.
---
Heh, this one's a "new twist" I had to think about... but, not long:
"In addition the environment and incentives are different." - by WorBlux (1751716) on Saturday April 23, @09:54PM (#35918358)
Let's see:
Hmmm... let me think on that, lol! No, I'll still "stick to my guns" here of:
Linux just plain has MORE KNOWN UNPATCHED SECURITY ISSUES IN ITS KERNEL ALONE, than does Windows 7 (an ENTIRE OS DISTRO), and for good measure, THAN DOES THE ENTIRE MS "Business Development Suite" in MS':
---
1.) DB Engine SQLServer 2008
2.) WebServer IIS 7
3.) Office Suite Microsoft Office 2010
4.) WebBrowser IE9
5.) Development Tools IDE Visual Studio 2010
6.) Operating System Windows 7
---
= 5 known security issues unpatched IN AN ENTIRE BUSINESS DEVELOPMENT SUITE (Nearly Ms' ENTIRE TOOLSET) , vs. 18 in an OS' kernel ALONE (Linux 2.6x)...
PERIOD!
APK
P.S.=> Oh, lastly: I've got a BETTER WAY, as well as a practical example!
"Bottom line, one of the best ways to test code for bugs is to throw random data (fuzzing) at it and see what happens. Or at least that's a much better way than to rely on than plain numbers generated by two very different operating philosophies and practices" - by WorBlux (1751716) on Saturday April 23, @09:54PM (#35918358)
AHEM: Again - WHAT ABOUT ANDROID?
ANDROID'S showing you ALL that once you get
Now spamers will have one more vector for scareware distribution!!!
Oh, I so love this world!!!!
-- no sig today