Slashdot Mirror
Microsoft Kicks Off Third-Party Bug Warnings
Pigskin-Referee writes "Microsoft has expanded its vulnerability disclosure policy to include not only those in its own products, but also flaws in third-party software that runs on Microsoft operating systems. These will follow the same practices as the advisories issued for Microsoft's products, and it makes sense, because many users look to Microsoft to ensure that their computers are secure, even when the problem lies with a third-party program. The company will contact and coordinate with the third-party vendor before an advisory is issued."
Since Adobe and Java are widely ignored by the general population because they have hundreds of icons on their system tray. I'm almost to the point of charging $10 extra per customer who ignores these updates.
http://www.stopacop.so -- You have rights. How about standing up for them before they go away?
Finally. Now if they track every product they'll finally be able to fairly compare themselves to Linux distributions.
Anyone else notice their advisories are against competitors?
Yeah... I call BS
To the bugs behind the OS.
to any systems security is welcome. I do think however that MS should have introduced this directly with the launch of W7. So much could have been done by now.
"I'm taking this loop off." - Jack O'Neill
There's nothing concerning Chrome or Opera in the Microsoft Security Advisory RSS feed.
Liberte, Egalite, Fraternite (TM)
Ah Java and Adobe!
Ya see, I run my XP box as user. The Admin account is used only for Admin. Now, in my user mode, the Java and Adobe update icons show up in the tray and when I click on them, after a while of them doing their thing, I get the "You have to have administrative privileges to perform this update." Can I do a "Run as" on those updates? Nope. Gotta log-off and log back on as the admin. "Switch User"? Turned it off for performance reasons.
Then in Admin mode, gotta re-download all of the updates again and then do the install.
So, what if your customers, or least the people using those machines, don't have admin access?
Oh, I don't have that problem with any of Microsoft's products, btw.
iTunes on Windows sucks too.
Listen Windows devs, not everyone runs their machines as Admins all the time! Geeze!
And no, you shouldn't have to be an admin to install a fucking document viewer.
because many users look to Microsoft to ensure that their computers are secure
Okay, that explains a lot.
#DeleteChrome
Finally something Microsoft is doing right. Fact is, "Windows" it vulnerable as hell not only because of their own crap, but the crap of others... and truth be told, it's probably more other crap that does more damage to Windows than anything else. Okay so there's a combination of stupid in effect... Microsoft can't seem to limit the applications and drivers to prevent them from doing bad things (as they should) and bad apps need backward compatibility... yeah... no... not really but Microsoft seems to think so.
Anyway, keep doing that and a little more and I won't hate Microsoft OSes so much.
Wow, this endeavor could very well add thousands, or 10's of thousands, of new jobs to the economy. Or, it's a PR campaign to push IE9, et al MS apps.
Hmmm, which is more likely?
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
Add Adobe Flash, Adobe Reader and Java to Windows Automatic Updates. That will resolve 90% of the issues.
XP is crap grandpa. Just update your fucking applications already and stop using a 236354 year old operating system because your poorly designed program from 1993 can't run without admin rights.
Seriously, are you really bitching that Windows finally has a security model? God damn you people are impossible to please.
Just a little more time.
Let's get it in the open, Vista was a documented Hail Mary from when they lost two entire years of dev time and started over about 2004. 7 is just what Vista should have been if they had planned better.
So now that 7 got the "housekeeping" done, it's time to see what Windows 8 is, with its plans for App Stores vs. whatever evil media tracking tricks get baked into the OS.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
The registry is no worse and no more complex than /boot/, /dev/, /etc/, and parts of /lib/ combined. That's all the registry is, with a little /home/ thrown in for HKCU. If you honestly believe otherwise, you've honestly never dealt with either system for any extended period with any applications of consequence. It takes maybe one or two hours of serious study to understand how the registry is laid out and what each bit does for the system. It's not hard. People are just intimidated. They think that editing a live hierarchal database is somehow more scary than editing a live filesystem, without realizing it's essentially the same thing.
Windows itself has not had memory leaks since prior to Windows 2000, and making this argument dates your experiences towards obsolescence. Complaints about other software being shoddy should be directed at those particular vendors. Or should we start blaming kernel.org because we found a bug in a binary driver? FOSS political followers love that.
Rebooting servers to apply patches takes about 1 hour a month for the entire network for about 50 servers. Honestly, if your systems cannot handle the server being inaccessible for the time it takes a system to restart, you've built an amazing fault-intolerant system. It does not take significantly longer than it does to stop and start services on Linux servers, which needs to be done when that software is updated. The idea of never rebooting servers is outdated and unwise, as if you never reboot servers and suddenly you have to due to an emergency restart, hardware failure, or hardware update and discover a problem at boot, you will never know if your system isn't booting because of the hardware failure or because you updated the software this month. Or the month before that. Or the month before that. Or the month before that. Or changed the configuration six months ago. Or twelve months ago. Wait, did Bob do a change nine months ago? Or was that reverting a change from last year? You're suddenly stuck in a position of having no idea why your server is broken and only knowing that the last known good state was three years ago and you probably haven't even got the grandfather backup any longer. Good job. Have a nice weekend with that. Hope your resume is polished and ready.
I've said it before: If you are so poor at systems administration that you cannot adequately harden and secure Windows Server and keep it running smoothly, you do not deserve to be a systems administrator of any operating system. Turn in your badge and keyboard.
The road to tyranny has always been paved with claims of necessity.
"Microsoft has expanded its vulnerability disclosure policy to include not only those in its own products, but also flaws in third-party software that runs on Microsoft operating systems. These will follow the same practices as the advisories issued for Microsoft's products, and it makes sense, because many users look to Microsoft to ensure that their computers are secure, even when the problem lies with a third-party program. The company will contact and coordinate with the third-party vendor before an advisory is issued."
Look, for the umpteemed time, a programming error in an application that leads to a system compromise, is a defect in the underlying Operating System, namely Microsoft Windows/WinNT/Longhorn/Vista/Windows ...
> Pay no attention to the the bugs behind the OS.
And what ever you do don't mention WIndows, talk about Internet malware instead ... :)
A large number of the security holes in Windows apps are caused by flaws in Windows libraries. Calling out others who have used your flawed library has the effect of diluting warnings about yourself. MS won't look so bad if they point their finger at others and say "see, theirs sucks too!"
Mary collect 354 coins, Paul collect 108. Whose coin collection is worth more?
It depends on the value of each coin.
Not a single highly or extremely critical advisory issued for the 2.6 kernel, and 42% of the advisories not critical at all. For Windows 7 42% of the advisories for were highly or extremely critical. 66% of the vulnerabilities of windows 7 are remotely exploitable, vs. 15% of 2.6.x
Beside that your comparing less than two years of history to over 7 as well. In addition the environment and incentives are different. In the FOSS world, shouting "Here's a bug and here's how I fixed it" gets you a lot of credibility. With M$ they want no publicity about bugs expect when it would irresponsible not to disclose them. (e.g. when they are actively being explioted). All the little bugs and fixes if any are held close to avoid publicity and hope that security through obscurity might hold up.
Bottom line, one of the best ways to test code for bugs is to throw random data (fuzzing) at it and see what happens. Or at least that's a much better way than to rely on than plain numbers generated by two very different operating philosophies and practices.
Now spamers will have one more vector for scareware distribution!!!
Oh, I so love this world!!!!
-- no sig today