Microsoft Suspending "Patch Tuesday" Emails

New submitter outofluck70 (1734164) writes Got an email today from Microsoft, text is below. [Note: text here edited for formatting and brevity; see the full text at seclists.org.] They are no longer going to send out emails regarding patches, you have to use RSS or keep visiting their security sites. They blame "governmental policies" as the reason. What could the real reason be? Anybody in the know? From the email: "Notice to IT professionals: As of July 1, 2014, due to changing governmental policies concerning the issuance of automated electronic messaging, Microsoft is suspending the use of email notifications that announce the following: Security bulletin advance notifications; Security bulletin summaries; New security advisories and bulletins; Major and minor revisions to security advisories and bulletins. In lieu of email notifications, you can subscribe to one or more of the RSS feeds described on the Security TechCenter website." WindowsIT Pro blames Canada's new anti-spam law.

Comments

It looks like a response to anti spam laws

[Karmashock]

I don't know why subscribe and unsubscribe would not satisfy those laws but apparently MS is convinced they don't... so...

Re:It looks like a response to anti spam laws

[Karmashock]

contextually that doesn't make sense because they're not recalling patches or changing patches but merely informing people ABOUT patches differently.

Previously you could put yourself on a mass email list for patches.

MS is saying they're not doing that anymore.

But they will retain an RSS feed for the same patches.

Therefore, this appears to be a response to anti spam legislation/rules.

Re:It looks like a response to anti spam laws

[Anonymous Coward]

Microsoft doesn't have 'unsubscribe'. They link to a profile page that doesn't really have unsubscribe options. I've been trying for years to stop partner emails, but the only way is to stop being a Microsoft partner. Weak. I flag them all as spam on gmail.

Re:It looks like a response to anti spam laws

[hankwang]

From TFA (2nd link): "Your CEO, and each officer, may be fined up to $1,000,000"

Now that's refreshing! Corporate misbehavior resulting in personal fines for the management. I could think of a few more cases where that would be a good idea.

Re:It looks like a response to anti spam laws

[crispytwo]

Canada passed a new law regarding spam in electronic messages (in particular, email) starting July 1

the law is here: http://laws-lois.justice.gc.ca...
faq is here: http://www.crtc.gc.ca/eng/com5...
the potential fine is $10 million

The companies that are effected are legitimate ones who do business in Canada
The onus on proving you have permission to send an email is on the company sending it.
There has been a flurry of activity wanting permissions recently due to the legislation.
It seems that nobody really knows what it means to be identified as a spammer.

Microsoft is probably thinking - to hell with it; the risk is too high. The RSS is good enough.

Great!

[Animats]

That's the way it should be. If you want to subscribe to something, use RSS. That's totally under the control of the recipient. If you unsubscrbe from an RSS feed, there's no way the sender can keep sending to you.

It's easy to follow an RSS feed if you're using Thunderbird; a bit harder if you're a Google slave.

The Canadian law doesn't apply to these

[presidenteloco]

Only emails of a commercial nature are banned without opt-in.

A security notice is not an email of a commercial nature, unless it also contains marketing offers etc.

Re:The Canadian law doesn't apply to these

[msobkow]

That may be technically the case, but IBM, Oracle, and Sybase/SAP have all asked for permission to keep sending technical newsletters. No one wants to take a chance that some bozo is going to interpret a technical notice as being spam and laying charges accordingly.

What were simple mailing lists now require an authorization database to comply. In many cases companies are just going to shut down the lists rather than go to the expense/hassle of authorization databases or risking non-compliance claims.

On the bright side, it's nice to see US companies abiding by foreign laws for a change. For far too long they've gone with the attitude "we're on US soil, so we only have to follow US law", but now they're finally waking up to the fact that they have to follow the laws of every jurisdiction they do business in, or stop doing business there.

Re:The Canadian law doesn't apply to these

[msobkow]

You do realize that if you're sending email about a commercial product it's a commercial email, right?

It doesn't have to be advertising -- it just has to be commercial in nature, as in about a product that you charge for, not commercial as in advertising.

Re:Linux?

[chromaexcursion]

This is just a guess, but I believe your assessment why you were modded down is correct. Making comments that might offend people has consequences.
Your post is off topic, and bashes Microsoft for things not relevant. As for your previous posts, having modded comments, previous posts are pretty much impossible to find. Modding is based on the current comment.
I'm not a fan of Microsoft. I've been playing and working with computers since before Microsoft existed. I've posted on this thread. Canada is the party at fault, Microsoft is just responding to a stupid law.
I love bashing Microsoft, but the pickings have been slim lately, they're failing. They won't go out of business, but their clout is gone.

Never Got MS E-mails

[DERoss]

I never got E-mails from Micro$oft about updates, vulnerabilities, etc. Instead, I have an RSS feed from US-CERT (computer emergency response team), an agency of the U.S. Department of Homeland Security. (Yes, they do have a few useful functions.) US-CERT not only notifies me about Micro$oft's alerts and provides links to them, but that agency also notifies me of alerts from other companies.

The link to subscribe to the RSS feed is http://www.us-cert.gov/ncas/cu....

Re:Linux?

[Arker]

Linux is worse off now than windows 8 between Unity, GNOME 3 and the cluster fuck that is systemd

I think you must be confused, Linux requires none of the things you just mentioned, and neither does a linux-based OS.