Slashdot Mirror
Krebs on Microsoft Suspending "Patch Tuesday" Emails and Blaming Canada
tsu doh nimh writes In a move that may wind up helping spammers, Microsoft is blaming a new Canadian anti-spam law for the company's recent decision to stop sending regular emails about security updates for its Windows operating system and other Microsoft software. Some anti-spam experts who worked very closely on Canada's Anti-Spam Law (CASL) say they are baffled by Microsoft's response to a law which has been almost a decade in the making. Indeed, an exception in the law says it does not apply to commercial electronic messages that solely provide "warranty information, product recall information or safety or security information about a product, goods or a service that the person to whom the message is sent uses, has used or has purchased." Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.
Seems like a no brainer
Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.
Wait, what? I thought Email was cheap, 'cause, you know ... spam.
It must have been something you assimilated. . . .
OK, what's the real reason for this? It's obviously not the law, and it's obviously not the cost associated with sending out e-mail - if you think ASCII e-mail is a bloated bandwidth hog, you should try watching the average HTTP transaction.
So, here's my conjecture: they are initiating a corporate policy of phasing out e-mail in favour of... something with more lock-in. Just like they wanted to show that they were so hip-against-the-desktop and in favour of walled garden app stoers that they tried to phase out the Start menu.
But what is the alternative they are planning over which they are prematurely beginning their masturbatory fantasy of full control?
The average game lasts three minutes, three games a day. That's about 10 minutes lost productivity a day. 200 days a year that's 2000 minutes, or 34 hours a year. That's an entire work-week (FR) spent playing solitaire, each year. Blame it on the rain? Canada? No! Blame Microsoft!
Clearly school is out for the summer and the kiddies are bored.
for the windows crowd: Unix Linux and BSD sending and receiving an email is pretty mundane business (even to millions of people.) Sendmail begat postfix, which tidied up the nuts and bolts of SMTP in the land of penguins neckbeards and that cartoon blowfish you occasionally see.
sending email from Exchange is orders of magnitude more complex by the nature of Exchange as a monolithic communications product. Because exchange does scheduling, calendaring, contacts, unified messaging, failover management, automatic load balancing, remote configuration management, archival, database storage, advanced RBAC permission delegation and cool stuff like shadow redundancy, outlook servers themselves have become increasingly divorced from the RFC for the SMTP. It isnt a bad thing for businesses that rely on being constantly connected, but it does mean the simple act of sending an email means relying on what for us would be an OS in itself. Exchange 2013 requires 2 gigabytes of free disk and recommends 16 gigabytes of free RAM. To compare and contrast, many in the BSD community can handle millions of messages per day with 2 gigabytes of ram and 1 gigabyte of free disk. that includes storage for the message being sent.
I think microsoft is doing this because exchange wasnt designed to just "send an email" anymore. it expects interactivity, redundancy, and universal access to the information being sent by default. the *nix solution runs hard and fast, but as an SMTP implementation requires significantly more engineering to provide the same level of service and feature set as outlook.
Good people go to bed earlier.
>You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.
Yes, because that's something normal people routinely do...or you're totally disconnected from reality, but just smart enough to realize that you're stupid, so you posted as an AC.
I should know better than to feed the trolls....but I just don't get this "Happy Monday from The Golden Girls" thing.
I've seen it a few times on various articles (maybe not always "Happy Monday"). I guess I could Google it, but that seems like a lot of work for something as unimportant as this.
*shrug*
So it's the new 30k oil change then?
Canadian IT head here. Just spent the morning reading over the law that this is in knee-jerk reaction to. I think Microsoft's reaction is warranted. According to the new law, a company can be charged up to 10 Million dollars for an infraction (read single email) of un-solicited email. The law is poorly formed, and not well thought out, as well as lengthy and vague enough to create a broad swatch of culpable people.
What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable. Also if you install software on someone's computer without explicit, but easy to understand examples of what the software is/does you can also be held culpable.
All email a company produces in Canada form this point on have to include a link in the bottom or ability to opt out of all future email.
Canadian businesses, no matter how small, are beholden to this law. Small companies are going to fold left and right because they cannot afford to comply wiht the new regulations, and those that don't try to comply run the risk of paying a huge penalty.
In my personal opinion this is a grab at trying to make Canada Post relevant again (and financially viable). At the moment bulk mail is the only thing keeping Canada post afloat, and if you couldn't send an email to try to drum up business, you can always send a mailer...
While anti-spam law is well intentioned, in it's current form it is so broken it should not have seen the light of day.
Is there no reason they couldn't just use Twitter?
Using RSS instead of Twitter allows Microsoft not to rely on the single point of failure that is Twitter Inc.
And besides, isn't this solved by Windows Update?
For one thing, having thousands of PCs in a company individually download multi-megabytes updates from Windows Update wastes the bandwidth compared to use of WSUS. For another, some administrators prefer to test Windows patches before deploying them because Windows patches some are known to break programs that inadvertently rely on underspecified behavior.
This law or not, any recurring e-mails are spammy. E-mail should be reserved for one time interactions like order confirmations and of course personal communication. With RSS feeds, user can unsubscribe, suspend and resume viewing updates at their convenience.
MS's emails may not be exempt, for example a security notice for an XP security hole suggesting users to upgrade from XP to windows 8, even if it's only a time component of the email, would not be exempt, and they could face a $10 million fine. Per email. Furthermore, the onus is 100% of MS to have documented proof they had consent to send the email if they are charged.
The law is horrible, how many spam emails are actually coming from Canadian companies? Less then 1%? It will be legitimate businesses that get hit with this, meanwhile it's business as usual for actual spammers.
The Canada Anti Spam Law requires very specific opt in from the people recieving emails. It requires that certian content not be in the email. It has fines. Microsoft is going to have to train its people and change its templates. It is going to have to get its emails approved by Canadian lawyers. It will take time for it to get in complience of the law. But the deadline is tommorow. So they will RSS feeds instead. It is very easy for an expert to say the emails are exsempt to the press. But I bet if you showed them a few emails they would find a few problems. Things Microsoft needs to fix or get fined.
"Normal" people don't routinely read emails about Microsoft's security updates, either.
no more work than posting that post. on the same note im with you, i just dont get it. now sharks with frickin lazers on the other hand....
have you seen my sig? there are many others like it but none that are the same
normal people no, but to the people these are targeted to, it should be trivial to set up
have you seen my sig? there are many others like it but none that are the same
interesting take on things, and i can see why they would be concerned. a 10 million dollar fine for a single email? if they are sending tens of thousands of them out, even 1 goes to the wrong address and bam. thanks for the insight, wish i had mod points
have you seen my sig? there are many others like it but none that are the same
https://technet.microsoft.com/en-us/security/advisory
Are calendars with recurring reminders a thing anymore?
You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.
Of all the things to bitch about with respect to Microsoft...
Because, you know, the typical small businesses are overflowing with IT-wizard-like employees who are masters at using these things, and hold the process in high enough regard to keep an eye peeled for patches.
Oh, wait, they aren't.
Quo usque tandem abutere, Nimbus, patientia nostra?
I have no desire to learn more about any Golden Girls fanfic where Bea Arthur has retired from the Russian space program, either.
Ideology: A tool used primarily to avoid the bother of thinking.
Because, you know, the typical small businesses are overflowing with IT-wizard-like employees who are masters at using these things, and hold the process in high enough regard to keep an eye peeled for patches.
A business that can't be bothered to keep competent IT most likely has automatic updates turned on, even for their servers, thus the e-mails to them would be redundant. Businesses with competent and dedicated IT people are most likely using WSUS, which provides its own mechanism to get e-mails about newly available updates, as well as total control over when and where they're installed.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Being that Bea Arthur looks a lot like like Brezhnev, cosmonaut is appropriate here.
I automated this a while ago, using Powershell to query the RSS feed, pull out the details, and send the proper parties an email if there's a new message relevant to us.
It probably seems like reinventing the wheel, but allowed us to split out the emails to relevant for each group, rather than one monolithic email. Which meant each affected party was liable to actually read it.
Overall though, anything that shows how useful RSS is, is a good thing.
"Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
"dumping an expensive delivery channel"....
Aside from the $CDN potential fines, just how is email *expensive"?
RSS is the right way. Distributions lists for notifications of this type have been done with mail historically because it was there not because it was a good medium.
Consider if you use e-mail for this sort of thing you need to take care of several functions e-mail does not itself take care of:
*allow people to subscript
*allow people to unsubscribe
*scrub you mailing lists for dead addresses.
Your mail servers might be stuck with large disk queues waiting on dead domains where the MX server does not answer etc too because well that his how mail works. All of these things are not as simple as they first appear. Do you remove an address the first time you get a 500 error? Because some admins server sends an improper error code, then a bunch of users start screening about how they signed up and never get their news letter.
With RSS you just put the link out there, you don't have to manage your subscribers. You don't have to provide any unsubscribe function users can take care of themselves. You if anything from your web logs get better feedback about how often the messages are viewed because you can assume people pulling the feed actually receive it and that its not just getting filtered off to junk/spam folders.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Most FOSS people I know just gave up waiting for good calendaring/contacts etc, and use Gmail and Android.
Wait, what? I thought Email was cheap, 'cause, you know ... spam.
No, you're confusing email with the US Mail spam delivery system. The whole thing is subsidized by spam you can actually throw in the trash can.
How easily people forget and get in to a comfort zone. When Microsoft first announced switching to a patch Tuesday email, everybody on /. criticized them for waiting up to a week to announce 0-day vulnerabilities and patch information.
A once a week email is close to worthless. It's better to leave vulnerability notification to people who are serious about it and stop wasting Internet bandwidth, cycles. and storage.
It's all about teamwork!
Also, knowingly responding to an obvious troll can itself be a subtle form of trolling ;)
As a Candian I... uh....
I'm sorry.
You're an idiot. I have been getting email's all month from like every vendor I have ever dealt with, every company, with an email saying "hey there, please stay in contact with us". So it's hardly killing businesses left and right as you claim. Or even is it really that complex, just judging by the amount of small vendors emailing me. Some don't even use list management, but have an email you can send a message to to confirm. To most I am just ignoring it, because hey, I never did give you permission to email me forever because i bought some product off you 5 years ago! To some I have responded that its OK to email me. This is a great law! That is exactly what I expect from companies.
For our organization, we have been doing double opt in for YEARS. So there was very little to do for us to become compliant.
In short, if you are the "head of IT" for a well run business, you would have 1) already made people opt in for communications years ago, possibly implementing even double opt in and 2) already provide legit unsubscribe links and have very little to do technically to be complaint in this law. If you were doing things properly that is.
Of course if you are one of those businesses that was doing things wrong for years and are now whining about it, well what can I say.
Time to start doing a better job and managing your email lists properly.
As a potential lottery winner, I totally support tax cuts for the wealthy
I was referring to "The general principle that [...] delivery SMTP servers SHOULD NOT, perform validation tests on message headers". Plenty of spam filters rely on message headers. What do you think DomainKeys Identified Mail is?
Just another victim of the issues around bandwidth and cost to do perform the updates.
With Net Neutrality no longer being upheld, Microsoft's patching and update process is very expensive. Can it even be done with a server onsite getting patched first and updates to the rest of a businesses client machines coming from it? If so, then even that did not help at the multi-national conglomerate I worked at. A huge Java dev cloud user env, the Administrators performing updates to thousands of machines were told to stop some days when the network experienced problems. Though the network was as much to blame as anything else.
Still the company with more than 10,000 clients simply stopped updating Windows machines. Simply stopped.
The personel that were patching were let go or moved to other duties, their positions were never back filled. Cut labor at what cost long term?
I strongly believe MS sees the writing on the wall and just as they cut other costly support services, they cut this patching / update process for the same reasons...not the reasons they tell us. Cut that labor and bandwidth.
Net Neutrality issue here perhaps? After all if MS starts getting charged for the bandwidth required to do the patching and updating by the ISPs wanting to charge more for bandwidth....