Slashdot Mirror
Microsoft Kills Many Critical Flaws, Some 0-Days, Un-Trusts One Wildcard Cert
An anonymous reader writes: For this December Patch Tuesday, Microsoft has released twelve security bulletins, eight of which have been rated critical. Those refer to the cumulative security updates for Internet Explorer, Microsoft Edge, JScript and VBScript, and updates for Microsoft Windows DNS, Microsoft Graphics Component, Silverlight, Microsoft Office, and Microsoft Uniscribe. Microsoft also released a security advisory announcing the removal of a digital certificate from the Certificate Trust list (CTL).
Saw that there were several "important" updates available to me last night. I've disabled Automatic Updates, since I can't really trust Microsoft to not try and install Windows 10 behind my back, and instead have Windows Updates a startup item now so I can stay on top of new updates more easily.
Haven't had a chance to go through what's listed there -- doesn't anyone know if there are any I need to be hiding from this batch?
Warning, they are trying to sneak in yet another update to chuck Windows 10 down your throat. KB3112343 enables support for additional upgrade scenarios from Windows 7 to Windows 10.
How can any of us trust that when Microsoft puts out patches they're not also saying "fuck it, while we're here we'll just tinker with a few things and add stuff we've wanted for a while"?
Microsoft are being such bastards about shoving Windows 10 up our collective asses I'm afraid at this point Microsoft has to be treated as a hostile and un-trusted entity -- they've pretty much decided that furthering their own interests is compatible with the update system which is supposed to provide us security.
We don't trust you didn't write something horribly insecure, we don't trust that you aren't sneaking something in unrelated to security, and quire frankly we don't trust that you're going to do a good job of fixing these problems.
Lost at C:>. Found at C.
.
This extreme slowness is a recent thing, occurring only for the last three four four months. I really takes the fun out of running Windows Update.
In other news Microsoft also released another 14 updates that increase telemetry, attempt to forcibly install Win 10, beat your children and do unspeakable things to the cat!
Oh, noes! Not the cat!
KITTEH!
It's the Wimpy security remediation model -- "I'll gladly fix on Tuesday that security vulnerability you found today..."
I want to punch the idiot at Microsoft who decided that "shutdown" means "the user can leave the PC running for hours".
That guy never brought his PC to a LAN gaming session.
It almost seems that Microsoft has intentionally slowed updates for Windows 7. It's been taking 30 to 60 minutes to check and get a repsonse using Windows update on our Windows 7 machines. Windows 10, on the other hand, is rapid, but buggy with more than one failed update that required running a script in an elevated command prompt to get it removed, when not needed, or installed. Having experienced annoying and on one PC serious issues with Windows 10, our Windows 7 PC's are staying with Windows 7, with automatic updates disabled. I manually check now, with recommended updates turned off, since I lost all trust in Microsoft in the past few months thanks to sloppy work and buggy updates. I have been installing GWX Control Panel in most of our customer computers that are still running Windows 7 or 8.1, with their blessings and often at their request since they like their PC the way it is.
Oh, sorry, Microsoft has decided it is their computer, and you may only use it according to how they see fit.
They don't give a crap about what you want here, they're just going to automate this stuff to take away all the scary bits.
Apparently you're not qualified to concern yourself with such things.
Lost at C:>. Found at C.
You may be surprised to learn it's only the second Tuesday of the month ("Patch Tuesday"), and not every Tuesday.
It's actually a sensible policy that allows corporations to plan on regular updates. A large company can't simply accept patches without a lot of testing to make sure they don't accidentally bring down every computer in the business because of some issue with their mission-critical software. That sort of little mistake can cost many millions of dollars. By regularly scheduling the patches, the IT staff can plan a regular test and integration cycle.
On the development side, these fixes have to go through a huge battery of tests before they can be deployed. This can take quite a while to do. I'd imagine it's much easier for MS if they can perform these compatibility tests on an entire batch of fixes, rather than doing it for each single patch. You can argue it's likely more damaging to have a badly-tested patch bring down a large number of machines than whatever was being patched in the first place.
In the event of issues that are time sensitive (critical zero-day issues), MS has been known to push out-of-band patches. Most patches though, especially anything not already found in the wild, are not nearly that time-sensitive. Keep in mind many of these flaws have existed for years, possibly even decades, before being discovered.
Irony: Agile development has too much intertia to be abandoned now.
...you mean, other than just letting your "office" machines get their patches directly from the internet instead of WSUS or SCCM?