Slashdot Mirror
Krebs on Microsoft Suspending "Patch Tuesday" Emails and Blaming Canada
tsu doh nimh writes In a move that may wind up helping spammers, Microsoft is blaming a new Canadian anti-spam law for the company's recent decision to stop sending regular emails about security updates for its Windows operating system and other Microsoft software. Some anti-spam experts who worked very closely on Canada's Anti-Spam Law (CASL) say they are baffled by Microsoft's response to a law which has been almost a decade in the making. Indeed, an exception in the law says it does not apply to commercial electronic messages that solely provide "warranty information, product recall information or safety or security information about a product, goods or a service that the person to whom the message is sent uses, has used or has purchased." Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.
Seems like a no brainer
Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.
Wait, what? I thought Email was cheap, 'cause, you know ... spam.
It must have been something you assimilated. . . .
https://technet.microsoft.com/en-us/security/advisory
Are calendars with recurring reminders a thing anymore?
You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.
Of all the things to bitch about with respect to Microsoft...
OK, what's the real reason for this? It's obviously not the law, and it's obviously not the cost associated with sending out e-mail - if you think ASCII e-mail is a bloated bandwidth hog, you should try watching the average HTTP transaction.
So, here's my conjecture: they are initiating a corporate policy of phasing out e-mail in favour of... something with more lock-in. Just like they wanted to show that they were so hip-against-the-desktop and in favour of walled garden app stoers that they tried to phase out the Start menu.
But what is the alternative they are planning over which they are prematurely beginning their masturbatory fantasy of full control?
The average game lasts three minutes, three games a day. That's about 10 minutes lost productivity a day. 200 days a year that's 2000 minutes, or 34 hours a year. That's an entire work-week (FR) spent playing solitaire, each year. Blame it on the rain? Canada? No! Blame Microsoft!
Clearly school is out for the summer and the kiddies are bored.
for the windows crowd: Unix Linux and BSD sending and receiving an email is pretty mundane business (even to millions of people.) Sendmail begat postfix, which tidied up the nuts and bolts of SMTP in the land of penguins neckbeards and that cartoon blowfish you occasionally see.
sending email from Exchange is orders of magnitude more complex by the nature of Exchange as a monolithic communications product. Because exchange does scheduling, calendaring, contacts, unified messaging, failover management, automatic load balancing, remote configuration management, archival, database storage, advanced RBAC permission delegation and cool stuff like shadow redundancy, outlook servers themselves have become increasingly divorced from the RFC for the SMTP. It isnt a bad thing for businesses that rely on being constantly connected, but it does mean the simple act of sending an email means relying on what for us would be an OS in itself. Exchange 2013 requires 2 gigabytes of free disk and recommends 16 gigabytes of free RAM. To compare and contrast, many in the BSD community can handle millions of messages per day with 2 gigabytes of ram and 1 gigabyte of free disk. that includes storage for the message being sent.
I think microsoft is doing this because exchange wasnt designed to just "send an email" anymore. it expects interactivity, redundancy, and universal access to the information being sent by default. the *nix solution runs hard and fast, but as an SMTP implementation requires significantly more engineering to provide the same level of service and feature set as outlook.
Good people go to bed earlier.
I should know better than to feed the trolls....but I just don't get this "Happy Monday from The Golden Girls" thing.
I've seen it a few times on various articles (maybe not always "Happy Monday"). I guess I could Google it, but that seems like a lot of work for something as unimportant as this.
*shrug*
Is there no reason they couldn't just use Twitter?
And besides, isn't this solved by Windows Update? Why are they sending email at all? Shouldn't Windows Update just tell you 'Hey, Idiot, you have a patch to install' like every other piece of software does these days?
Haven't they heard about Help-->About-->Check for Updates?
Amateurs
It's supposed to by 'confidant' not 'cosmonaut'
Canadian IT head here. Just spent the morning reading over the law that this is in knee-jerk reaction to. I think Microsoft's reaction is warranted. According to the new law, a company can be charged up to 10 Million dollars for an infraction (read single email) of un-solicited email. The law is poorly formed, and not well thought out, as well as lengthy and vague enough to create a broad swatch of culpable people.
What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable. Also if you install software on someone's computer without explicit, but easy to understand examples of what the software is/does you can also be held culpable.
All email a company produces in Canada form this point on have to include a link in the bottom or ability to opt out of all future email.
Canadian businesses, no matter how small, are beholden to this law. Small companies are going to fold left and right because they cannot afford to comply wiht the new regulations, and those that don't try to comply run the risk of paying a huge penalty.
In my personal opinion this is a grab at trying to make Canada Post relevant again (and financially viable). At the moment bulk mail is the only thing keeping Canada post afloat, and if you couldn't send an email to try to drum up business, you can always send a mailer...
While anti-spam law is well intentioned, in it's current form it is so broken it should not have seen the light of day.
Is there no reason they couldn't just use Twitter?
Using RSS instead of Twitter allows Microsoft not to rely on the single point of failure that is Twitter Inc.
And besides, isn't this solved by Windows Update?
For one thing, having thousands of PCs in a company individually download multi-megabytes updates from Windows Update wastes the bandwidth compared to use of WSUS. For another, some administrators prefer to test Windows patches before deploying them because Windows patches some are known to break programs that inadvertently rely on underspecified behavior.
This law or not, any recurring e-mails are spammy. E-mail should be reserved for one time interactions like order confirmations and of course personal communication. With RSS feeds, user can unsubscribe, suspend and resume viewing updates at their convenience.
MS's emails may not be exempt, for example a security notice for an XP security hole suggesting users to upgrade from XP to windows 8, even if it's only a time component of the email, would not be exempt, and they could face a $10 million fine. Per email. Furthermore, the onus is 100% of MS to have documented proof they had consent to send the email if they are charged.
The law is horrible, how many spam emails are actually coming from Canadian companies? Less then 1%? It will be legitimate businesses that get hit with this, meanwhile it's business as usual for actual spammers.
The Canada Anti Spam Law requires very specific opt in from the people recieving emails. It requires that certian content not be in the email. It has fines. Microsoft is going to have to train its people and change its templates. It is going to have to get its emails approved by Canadian lawyers. It will take time for it to get in complience of the law. But the deadline is tommorow. So they will RSS feeds instead. It is very easy for an expert to say the emails are exsempt to the press. But I bet if you showed them a few emails they would find a few problems. Things Microsoft needs to fix or get fined.
no more work than posting that post. on the same note im with you, i just dont get it. now sharks with frickin lazers on the other hand....
have you seen my sig? there are many others like it but none that are the same
Probably told MS not to tell security IT's about new updates so they have more time to exploit them.
interesting take on things, and i can see why they would be concerned. a 10 million dollar fine for a single email? if they are sending tens of thousands of them out, even 1 goes to the wrong address and bam. thanks for the insight, wish i had mod points
have you seen my sig? there are many others like it but none that are the same
I have no desire to learn more about any Golden Girls fanfic where Bea Arthur has retired from the Russian space program, either.
Ideology: A tool used primarily to avoid the bother of thinking.
Being that Bea Arthur looks a lot like like Brezhnev, cosmonaut is appropriate here.
I automated this a while ago, using Powershell to query the RSS feed, pull out the details, and send the proper parties an email if there's a new message relevant to us.
It probably seems like reinventing the wheel, but allowed us to split out the emails to relevant for each group, rather than one monolithic email. Which meant each affected party was liable to actually read it.
Overall though, anything that shows how useful RSS is, is a good thing.
"Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
Most of my contacts have already sent out message of the type "new law coming, please reply to opt-in".
My guess is that Microsoft was asleep, left it too late (law goes into effect tomorrow, Jul.1) and decided to skip it rather than trying to hustle.
"dumping an expensive delivery channel"....
Aside from the $CDN potential fines, just how is email *expensive"?
RSS is the right way. Distributions lists for notifications of this type have been done with mail historically because it was there not because it was a good medium.
Consider if you use e-mail for this sort of thing you need to take care of several functions e-mail does not itself take care of:
*allow people to subscript
*allow people to unsubscribe
*scrub you mailing lists for dead addresses.
Your mail servers might be stuck with large disk queues waiting on dead domains where the MX server does not answer etc too because well that his how mail works. All of these things are not as simple as they first appear. Do you remove an address the first time you get a 500 error? Because some admins server sends an improper error code, then a bunch of users start screening about how they signed up and never get their news letter.
With RSS you just put the link out there, you don't have to manage your subscribers. You don't have to provide any unsubscribe function users can take care of themselves. You if anything from your web logs get better feedback about how often the messages are viewed because you can assume people pulling the feed actually receive it and that its not just getting filtered off to junk/spam folders.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Most FOSS people I know just gave up waiting for good calendaring/contacts etc, and use Gmail and Android.
Wait, what? I thought Email was cheap, 'cause, you know ... spam.
No, you're confusing email with the US Mail spam delivery system. The whole thing is subsidized by spam you can actually throw in the trash can.
it's COFFEE POT, nothing else makes sense.
How easily people forget and get in to a comfort zone. When Microsoft first announced switching to a patch Tuesday email, everybody on /. criticized them for waiting up to a week to announce 0-day vulnerabilities and patch information.
A once a week email is close to worthless. It's better to leave vulnerability notification to people who are serious about it and stop wasting Internet bandwidth, cycles. and storage.
It's all about teamwork!
Also, knowingly responding to an obvious troll can itself be a subtle form of trolling ;)
As a Candian I... uh....
I'm sorry.
You're an idiot. I have been getting email's all month from like every vendor I have ever dealt with, every company, with an email saying "hey there, please stay in contact with us". So it's hardly killing businesses left and right as you claim. Or even is it really that complex, just judging by the amount of small vendors emailing me. Some don't even use list management, but have an email you can send a message to to confirm. To most I am just ignoring it, because hey, I never did give you permission to email me forever because i bought some product off you 5 years ago! To some I have responded that its OK to email me. This is a great law! That is exactly what I expect from companies.
For our organization, we have been doing double opt in for YEARS. So there was very little to do for us to become compliant.
In short, if you are the "head of IT" for a well run business, you would have 1) already made people opt in for communications years ago, possibly implementing even double opt in and 2) already provide legit unsubscribe links and have very little to do technically to be complaint in this law. If you were doing things properly that is.
Of course if you are one of those businesses that was doing things wrong for years and are now whining about it, well what can I say.
Time to start doing a better job and managing your email lists properly.
As a potential lottery winner, I totally support tax cuts for the wealthy
I was referring to "The general principle that [...] delivery SMTP servers SHOULD NOT, perform validation tests on message headers". Plenty of spam filters rely on message headers. What do you think DomainKeys Identified Mail is?
Is there no reason they couldn't just use Twitter?
Because their target market is not preteen girls. Professionals need to see these notices, and Twitter has an abysmal penetration among educated professionals. I know at the software development company where I work, we had less than a dozen hits to twitter.com out of almost 250 million web proxy log lines the last time we looked. Also, our Facebook page gets nearly a hundred thousand hits each month compared to the nearly zero for Twitter. Adults just don't use that garbage, and I don't understand your call for Microsoft to shove that garbage down our throats.
I just don't get this "Happy Monday from The Golden Girls" thing.
It's just one tool in a Social Media Management (SMM) team's arsenal.
They use it like a placeholder to shift negative discussion about their client further down the page where it's far less likely to be read.
This may come as a surprise, but some people just like to troll to troll.
Poorly moderated forums ASK for it.
Just another victim of the issues around bandwidth and cost to do perform the updates.
With Net Neutrality no longer being upheld, Microsoft's patching and update process is very expensive. Can it even be done with a server onsite getting patched first and updates to the rest of a businesses client machines coming from it? If so, then even that did not help at the multi-national conglomerate I worked at. A huge Java dev cloud user env, the Administrators performing updates to thousands of machines were told to stop some days when the network experienced problems. Though the network was as much to blame as anything else.
Still the company with more than 10,000 clients simply stopped updating Windows machines. Simply stopped.
The personel that were patching were let go or moved to other duties, their positions were never back filled. Cut labor at what cost long term?
I strongly believe MS sees the writing on the wall and just as they cut other costly support services, they cut this patching / update process for the same reasons...not the reasons they tell us. Cut that labor and bandwidth.
Net Neutrality issue here perhaps? After all if MS starts getting charged for the bandwidth required to do the patching and updating by the ISPs wanting to charge more for bandwidth....
...that absolutely NO ONE in North Mexico would EVER sue MS for "spam"....