Slashdot Mirror
Microsoft Explains How it Decides Whether a Vulnerability Will Be Patched Swiftly or Left For a Version Update (zdnet.com)
Microsoft has published a new draft document clarifying which security bugs will get a rapid fix and which it will let stew for a later release. From a report: The document outlines the criteria the Microsoft Security Response Center uses to decide whether a reported vulnerability gets fixed swiftly, usually in a Patch Tuesday security update, or left for a later version update. Microsoft said in a blogpost the document is intended to offer researchers "better clarity around the security features, boundaries and mitigations which exist in Windows and the servicing commitments which come with them." The criteria revolve around two key questions: "Does the vulnerability violate a promise made by a security boundary or a security feature that Microsoft has committed to defending?"; and, "Does the severity of the vulnerability meet the bar for servicing?" If the answer to both questions is 'yes', the bug will be patched in a security update, but if the answer to both is 'no', the vulnerability will be considered for the next version or release of the affected product or feature.
If the answer to both questions is 'yes', the bug will be patched in a security update, but if the answer to both is 'no', the vulnerability will be considered for the next version or release of the affected product or feature.
What if it's 1 yes and 1 no?
rather than just adding workarounds that will later be found to be faulty or incomplete?
See subject & via APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between characters & download).
Yields more security/speed/reliability/anonymity vs. any SINGLE solution (99% of threats = hostnames vs. IP address (that most firewalls use)) more efficiently/FASTER + NATIVELY 4 less!
(... Vs. "Bolt on 'MoAr' illogic-logic" competitors slowing you, hosts speed you up 2 ways (adblocks + hardcodes u spend most time @) vs. competition loaded w/ bugs (DNS/AntiVir) + their overheads (messagepass ('souled-out' to advertiser addons) + filtering drivers) & their complexity leads to exploitation).
* Created in FreePascal/Lazarus 1.8.2 using GTK3 on OpenGL 3.1 via KDE Plasma desktop on Kubuntu 18.04 plus patches.
APK
P.S.=> Enjoy - it's much better vs. the Windows model on many fronts (speed & efficiency (plus new "merge" feature))... apk
Reading between the lines... "We (don't give a fuck) care about our customers security."
Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017
(APK's work), I've flat out said it's good by BronsCon February 11 2016
his hosts program is actually pretty good by xenotransplant August 10 2015
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015
I like your host file system by Karmashock September 09 2015
I do use APK's host file on all my systems at home by OrangeTide December 01 2017
I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017
* See subject: Best part is this Linux 64-bit model is faster & more efficient (does 2x the work in 1/2 the time, literally)
APK
P.S.=> Enjoy a faster/safer/more reliable internet... apk
by the NSA? FBI? Ongoing investigation?
Domestic spying is now "Benign Information Gathering"
This is nice and all, but why was Windows 8.1 and Server 2012 R2 skipped when implementing Spectre v4 mitigations? According to https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012 only 7, Server 2008 R2, 10 and 10-based Servers had the fixes, which for some reason are also turned off by default even on Client versions. The previous Spectre/Meltdown patches were turned on by default on Client and off on Server.
The performance impact is within margin of error for some simple tests (compute, SSD and network) I did with a Kaby Lake CPU with the proper new microcode, so this can't be the reason.
...we have some arbitrary promises about security and we evaluate each bug against those arbitrary promises. Oh, and we have no legal liabilities or requirements to do anything, so you have no recourse so stop complaining.
if (paying_customer) {
deploy_fix();
charge_customer_more();
} else {
deploy_rushed_buggy_fix_and_let_customer_test();
}
if (can_make_more_money) {
do_not_deploy_fix();
}
if (issue_is_critical) {
deploy_fix_with_mandatory_telemetry_update();
add_more_data_exfiltration();
charge_customer_more();
} else {
charge_customer_more_anyway();
add_more_data_exfiltration(0;
add_telemetry_update();
deauthorize_windows_just_for_fun();
}
KDE Applications for Windows 32+64bit [and other OS]
"Welcome to the Binary Factory for KDE. This CI system is intended to generate binary installers for macOS and Windows, as well as AppImages for Linux for the set of KDE projects which support these."
Selection Menu: https://binary-factory.kde.org...
Windows 64bit: https://binary-factory.kde.org...
Windows 32bit: https://binary-factory.kde.org...
Android: https://binary-factory.kde.org...
AppImage: https://binary-factory.kde.org...
MacOS: https://binary-factory.kde.org...
swiched to Linux long ago
and i decided to upgrade it myself with Linux, buh bye microsoft spyware
Politics is Treachery, Religion is Brainwashing
See subject & via APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between characters & download).
Yields more security/speed/reliability/anonymity vs. any SINGLE solution (99% of threats = hostnames vs. IP address (that most firewalls use)) more efficiently/FASTER + NATIVELY 4 less!
(... Vs. "Bolt on 'MoAr' illogic-logic" competitors slowing you, hosts speed you up 2 ways (adblocks + hardcodes u spend most time @) vs. competition loaded w/ bugs (DNS/AntiVir) + their overheads (messagepass ('souled-out' to advertiser addons) + filtering drivers) & their complexity leads to exploitation).
* Created in FreePascal/Lazarus 1.8.2 using GTK3 on OpenGL 3.1 via KDE Plasma desktop on Kubuntu 18.04 plus patches.
APK
P.S.=> Enjoy - it's much better vs. the Windows model on many fronts (speed & efficiency, mostly (plus new "merge" feature))... apk
Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017
(APK's work), I've flat out said it's good by BronsCon February 11 2016
his hosts program is actually pretty good by xenotransplant August 10 2015
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015
I like your host file system by Karmashock September 09 2015
I do use APK's host file on all my systems at home by OrangeTide December 01 2017
I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017
* See subject: Best part's this Linux 64-bit model is faster & more efficient (does 2x the work in 1/2 the time, literally)
APK
P.S.=> Enjoy a faster/safer/more reliable internet... apk
cp /dev/null /usr/microsoft/whitepaper.txt
Just substitute "operating system" for "car" .
Narrator:
A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one.
Business woman on plane:
Are there a lot of these kinds of accidents?
Narrator:
You wouldn't believe.
Business woman on plane:
Which car company do you work for?
Narrator:
A major one.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
can't have too many M$ FP stories a day!
LAME!
In the meantime in the opensource world you can get an update as soon as someone creates fix.
Ess Pee Aitch
I'll also get my response to your inevitable reply in right now, to save time : "I didn't read your post. SPH. You're welcome".
See subject: Grow up OR take your loony bird meds ok? I'm never wrong against losers like you, that's certain, & you're obviously butthurt over that.
* SysAdmins (which YOU have given away is the MOST you are - ain't much & why) are the 1 thing I will address from your blatant immature lunacy - & with NOTHING BUT truth/fact: They're merely USERS w/ a BETTER PASSWORD (imo, failed programmers who upon finding out it's a LOT tougher to write code than to merely USE OTHERS' CODE that actually write tools they merely USE in "scriptkiddie SCRYPTZ") - no denying it.
APK
P.S.=> What makes ME laugh the MOST @ 'their kind' (& like you said, I was one until I elevated OVER/BEYOND that limited skillset)? They try "pass it off" like they are "GOD" (lol, bs) - minus coders like myself they are HELPLESS minus tools we create FOR them to "use" (as users with nothing more than a better password) - their illusion goes to MANY of their heads (not all, but many & some actually DO code, but why limit yourself that way to ONLY networking? To each his own on those "exception" RARE cases))... apk