Microsoft: Patches, Patches Everywhere!

Ridgelift writes "Even though Microsoft's recently announce they would not be issuing any new patches for the month of December, the boys at Redmond were scrambling today to figure out why some systems are being patched. The reason? They haven't got a clue."

The apparent lack of a patch.

[Neck_of_the_Woods]

I guess they are going to have to issue a patch to stop the machines from patching....ironic.

fill in joke here

[daeley]

"They haven't got a clue."

...Yes, well...

The reason ?

[frodo from middle ea]

Simple, there is a bug in the patch issuing s/w which needs to be patched .

Curious

[bluedust]

Imagine a Microsoft product doing something without reason...

Where is Edward James Olmos?

[charlieo88]

So the computers are patching themselves now, are they?

When exactly was it that the Cylons are supposed to attack?

Transcript

[blogboy]

"Hey Bob...did you patch this?" "No, I thought you did." "Phil!" "What?" "Is this your patch?" "Not me. No patches in December, remember? It's our gift to the world." "Then who the hell...hey Eddie!" "Not now...I'm trying to track down this patch..." "Crap."

Fin.

And...

[Nom du Keyboard]

It moved to a fixed schedule of monthly patches to make the process more predictable for network and system administrators.

...and virus writers.

Re:Monthly patches?

[Apreche]

Hey guys, when you find a new back door, don't tell anyone until right after MS releases a patch. You'll have a whole 30 days to crax0r everyone's b0x0r!

It's not a patch

[spidergoat2]

It's an undocumented upgrade.

It' MS's fault

[nytes]

They keep sending me those security patches in email, and I keep applying them. I wish they'd stop it.

Obligatory Treasure of the Sierra Madre quote

[adso]

Patches? We don't need no stinking patches!

The Final Windows Patch

[Doc Squidly]

All these M$ patches are getting annoying, so I've applied the last fix for M$ problems that I'll ever need.
It's called LINUX [linux.org].
There's even a version of this patch works great on PPC [linux.org].

Re:It' MS's fault

[CodeHog]

Mod this one up, that is funny. I was talking to a guy who actually did apply one of the security patches he received in an email. One of his *friends* told him to do it. Hmmmmm....with friends like that... anyway, I informed him M$ NEVER sends patches via emails. He was genuinely surprised. Live and learn.

Re:The apparent lack of a patch.

[kautilya]

Perhaps..they should move to a different business model. You will get windows for free. But you have to pay for patches!!!

Re:Microsoft did the right thing

[Short Circuit]

When they said "no new patches", they meant it. They simply raised existing patches. :)

Addendum

[tds67]

In October, Microsoft committed to making its patch-release schedule more regular, by only publishing patches on the second Tuesday in each month.

In other news today, the Cracker community announced it would commit to new virus and worm releases on the second Wednesday in each month.

Re:The apparent lack of a patch.

[0WaitState]

We once again apologize for the fault in the patch process. Those responsible for patching the patchers who have patched the patch process, have now been patched.

Re:Monthly patches?

[ThatDamnMurphyGuy]

...and of course you read the announcement about this, didn't you? And as such you know that they will still release zero-hour patches for vulnerabilities which are actively being exploited in the wild and/or are to the top left of the threat matrix (remote/system level explots).

You mean there are patches available for things OTHER than vulerabilities from Microsoft? Wow. Must have missed them at the bottom of the Windows Update page after the 250 zillion Security Patches. :-)

Re:Monthly patches?

[LizardKing]

they will still release zero-hour patches for vulnerabilities which are actively being exploited in the wild

"Kewl", as the script kiddies might say. This simply means that those crackers who resist the urge to get some f4me for their new exploit by announcing it on a SadCrAck3r IRC channel have a four week window to root more boxes.

Chris

No no NO! Microsoft is COMMITTED to Security!

[Ridgelift]

Lest we forget...

www.trustworthycomputing.com [trustworthycomputing.com]

Re:The reason ?

[frodo from middle ea]

I just want to be the fly on the wall of M$'s office

Patch Officer :- Sir, Out windows update service has issued a Patch today.
Billy G :- But I said NO Patches in month of Dec.
Patch Officer :- Yes Sir, but the patch issuing s/w has a bug, We need to patch it ASAP.
Billy G :- But I said no patches in Dec , damn it.
Patch Officer :- But then we won't be able to prevent the windows update service from issuing the first patch
Billy G :- READ MY LIPS man, NO patches in Dec.

Shall we say patch-22 :-)

Windows Update became self-aware!

[BigGerman]

head for the hills

Re:The apparent lack of a patch.

[.com b4 .storm]

We once again apologize for the fault in the patch process. Those responsible for patching the patchers who have patched the patch process, have now been patched.

And with great dispatch, might I add. :) *groan*

Re:What's the big deal?

[geekoid]

Like MS needs the help.

Re:The apparent lack of a patch.

[Joe the Lesser]

Patch bites can be preti nasti mind you

How I read it

[swb]

I read this in October:

In case you didn't get a chance to review the statement from Steve Ballmer last week, I will try to bring you all up to date on the new process for security alerts.

The net of this all is that Microsoft is moving to a monthly security bulletin release schedule. This change was in response to customer feedback.

After today, we will be releasing security bulletins on the second calendar Tuesday of every month. Today was the starting day, and was an exception.

There are a couple of benefits to this new process:

1) Switching to a monthly release cycle for security patches allows customers to install multiple patches with a single install and single reboot (using Qchain.exe, Update.exe and other similar tools). This will minimize downtime on mission-critical systems and will allow customers to consolidate the patch deployment to once per month.

2) Another benefit of the monthly cycle is that it offers customers more time between releases of security patches. This allows customers to evaluate, test and install patches in their computing environments in a timely manner. The release schedule is also more predictable and allows customer to plan in advance for deploying patches.

You may notice as well that the format of the bulletins has changed, so when you view the bulletin from the link inside of the security alert email, you will notice the sections of the bulletins have changed a bit.

The change in this process is in order to make it more predictable for our customers so that you can plan and implement patches as quickly as possible.

If you have any feedback on this new process, please feel free to let me know and I will pass it along to the security team directly.

Which I translated as:

We were so humiliated by the never-ending barrage of security vulnerabilities in our products that in order to enable our sales force to make any headway at all against Linux/IBM/Sun we decided to bundle all our security vulnerabilities into a once-per-month release. Our analysis of MSN News and Entertainment Tonight indicates that on our chosen date, the second Tuesday of the month, people are much more likely to be preoccupied with Ben 'n' Jen and the previous day's sporting events, and will easily overlook the most recent worm/virus/breech attributable to our bloated, unmanageable software base.

The other reasons for the new monthly cycle are that since we'll be dumping more patches into a single file, you'll need more time to debug, back out or ultimately rebuild systems corrupted by patches that will also include special new "features". We also think that our new monthly cycle will coincide with your or your spouses' monthly cycle, allowing you to be victimized by uncontrolled emotional outbursts in one tidy week, instead of having it spread out all over the month.

Thanks again for buying Microsoft.

Patches....

[Dj]

Patches want to be free!

This is the first action of the Patch Liberation Front!

Re:Nice double-entendre...

[Anonymous Coward]

Yes. That's exactly what he's saying.

Re:The apparent lack of a patch.

[Anonymous Coward]

Even more ironic is that their server is IIS but because of the bug it's really "a-patchy" server. ;-)

Re:Monthly patches?

[Fjornir]

That's the whole point, see! Having patch-day be a regular event allows lusers to set reminders, "Yay! Patch-day! I get six 5-minute coffee breaks because all of these need seperate reboots!" and stay current.

But admins aren't subjected to the constant trickle of noncriticals... "Huh. An alert just popped into my mailbox saying there's a patch I need.... Its not patchday, so I wonder how big the impact will be for us..." And if its big he can take appropriate action...

No way ...

[s20451]

Where is Edward James Olmos?

Forget that. Begin the thawing of Lorne Greene.

Re:The apparent lack of a patch.

[scrote-ma-hote]

This is true message on the update site, I have a screenshot if you want it emailed. I've nowhere to post it.

New Windows Update Software Required

The Windows Update site has been updated. To update your version of the software and begin using Windows Update, click Update Now.

Update Now

Re:Where is Edward James Olmos?

[gmhowell]

I have no idea, but wake me for the lesbian cylon scene between six and Boomer. Note to self: buy more hand cream.

Re:The apparent lack of a patch.

[jrockway]

*crickets*

FrontPage is a Security Hole?

[calyphus]

It isn't enough that it creates some of the crappiest html since Pagemill, but an html editor that creates security holes, too? What will they have to patch next? Notepad?

Re:Whatever happened to One Service Pack behind?

[TrancePhreak]

Are your keyboards missing the Page Down button? How about Page Up? Maybe some keyboard manufacturers are leaving out these keys to save money.