Microsoft Kills Many Critical Flaws, Some 0-Days, Un-Trusts One Wildcard Cert 103
An anonymous reader writes: For this December Patch Tuesday, Microsoft has released twelve security bulletins, eight of which have been rated critical. Those refer to the cumulative security updates for Internet Explorer, Microsoft Edge, JScript and VBScript, and updates for Microsoft Windows DNS, Microsoft Graphics Component, Silverlight, Microsoft Office, and Microsoft Uniscribe. Microsoft also released a security advisory announcing the removal of a digital certificate from the Certificate Trust list (CTL).
Re: (Score:1)
And how shall we be able to trust Microsoft now with the "telemetry" and Windows 10 "upgrades" that they push?
Too bad it also includes a Trojan Horse (Score:1, Funny)
... err, I mean, Windows 10.
Yay updates (Score:1)
In other news Microsoft also released another 14 updates that increase telemetry, attempt to forcibly install Win 10, beat your children and do unspeakable things to the cat!
Re: (Score:3)
In other news Microsoft also released another 14 updates that increase telemetry, attempt to forcibly install Win 10, beat your children and do unspeakable things to the cat!
Oh, noes! Not the cat!
KITTEH!
Re: (Score:2)
Re:Tuesday? (Score:5, Funny)
Re: (Score:3)
You may be surprised to learn it's only the second Tuesday of the month ("Patch Tuesday"), and not every Tuesday.
It's actually a sensible policy that allows corporations to plan on regular updates. A large company can't simply accept patches without a lot of testing to make sure they don't accidentally bring down every computer in the business because of some issue with their mission-critical software. That sort of little mistake can cost many millions of dollars. By regularly scheduling the patches, the
Re: (Score:1)
So why does everyone else need to follow the schedule of a bunch of slow-ass corporations? That's now a month of time where your systems are wide-open to hacking. This may surprise you to find out, but not everyone is a corporation: there's actually people who use computers at home!
Re: (Score:2)
It would be great if the patches could be released sooner than at one month intervals, but everything has a trade-off. Fast patches mean sloppy patches or buggy code (remember the Stagefright patches?), especially when you're talking about a billion machine in nearly that many unique configurations. Keep in mind that non-corporate customers still needs the benefit of QA to ensure things don't break on our computer. It's probably even more important for us, because unlike at a corporation, we don't first
Re: Tuesday? (Score:1)
If there is a really serious security issue they'll sometimes release out of band.
Win-10 Nag included in the deal? (Score:2, Insightful)
I have Windows Update on a pure as-needed basis and glad I do after hearing about the supremely unethical 'Hey! Upgrade to Windows 10! Hey!' nag that came in some updates.
On another front a friend was having trouble with his boot drive and as we were shutting it down Windows jumped in to install a bunch of updates - that finished corrupting the boot drive and many, many hours were dedicated to recovery and repair.
I'll give these patches a look but want no shady behavior out of the Redmond Mob.
Re:Win-10 Nag included in the deal? (Score:5, Insightful)
I want to punch the idiot at Microsoft who decided that "shutdown" means "the user can leave the PC running for hours".
That guy never brought his PC to a LAN gaming session.
Re: (Score:3, Insightful)
Oh, sorry, Microsoft has decided it is their computer, and you may only use it according to how they see fit.
They don't give a crap about what you want here, they're just going to automate this stuff to take away all the scary bits.
Apparently you're not qualified to concern yourself with such things.
Re: (Score:2)
Oh, sorry, Microsoft has decided it is their computer, and you may only use it according to how they see fit.
Your computer, their software. So, as long as you use their software you agree to bend over and take it in.
Re: (Score:2)
Not to mention, not offering a way to do it and then power the PC up afterwards - why can't I go and select "Install updates and restart" when I leave on a Friday night? The PC will install the updates, take as long as it needs, then restart itself so I could remote into it during the weekend if I need to?
Why do I want to shut it down an
Re: (Score:3)
...you mean, other than just letting your "office" machines get their patches directly from the internet instead of WSUS or SCCM?
Re: (Score:1)
Macs [apple.com]
Dell Ubuntu [dell.com]
I imagine more options will start appearing soon enough, at least for Linux/BSD given the nonsense MS is pulling with Win10.
Any spyware in this batch? (Score:4, Interesting)
Saw that there were several "important" updates available to me last night. I've disabled Automatic Updates, since I can't really trust Microsoft to not try and install Windows 10 behind my back, and instead have Windows Updates a startup item now so I can stay on top of new updates more easily.
Haven't had a chance to go through what's listed there -- doesn't anyone know if there are any I need to be hiding from this batch?
Re: (Score:3)
.
There were also a couple of optional updates that looked as if Microsoft was trying to hide something in their KB description. So I didn't install them either.
Re: (Score:2)
I actually don't install any of the optional updates not unless it's the update for my graphics card drivers.
What's interesting is how often the Optional Updates disappear on their own. I mean, what happened there? The were 13 of them available one day, and a week later there's only 7 and I never installed any of them. Make me wonder if they were found to be bad and quietly pulled by Microsoft.
Re: (Score:2)
KB 3112336 is for upgrading to Window 10 from 8.1.
"This update also improves the ability of Microsoft to monitor the quality of the upgrade experience."
Unchecking that one. The rest of them look okay. There are a couple dumb ones (a mounting issue with Kingston flash drives, and an update to a previous time zone update), but most of them are for security issues. One is for Flash on IE (which would effect anyone on 8 even if they normally use a different browser).
Re: (Score:2)
They don't always make the KB articles available before pushing the updates. Check back later as it will eventually appear.
Re: (Score:2)
The sly Windows 10 installer came back for me, despite having disabled and hidden it and blocked it via the registry previously. You can spot it because even if it doesn't say "Upgrade to Windows 10" it will have a variable install size (listed as say 20-200MB) or just be huge (2GB+).
KB3112343 (Score:4, Informative)
Comment removed (Score:5, Informative)
Re: (Score:2)
Can you ask why you need 100%?
Re: (Score:2)
Re: (Score:2)
This is the "Windows Update Client for Windows 7 and Windows Server 2008 R2: December 2015" update. This don't have the actual GWX client that nags etc.
And now that we've un-trusted Microsoft ... (Score:4, Insightful)
How can any of us trust that when Microsoft puts out patches they're not also saying "fuck it, while we're here we'll just tinker with a few things and add stuff we've wanted for a while"?
Microsoft are being such bastards about shoving Windows 10 up our collective asses I'm afraid at this point Microsoft has to be treated as a hostile and un-trusted entity -- they've pretty much decided that furthering their own interests is compatible with the update system which is supposed to provide us security.
We don't trust you didn't write something horribly insecure, we don't trust that you aren't sneaking something in unrelated to security, and quire frankly we don't trust that you're going to do a good job of fixing these problems.
Windows Update took about an hour to scan (Score:5, Insightful)
.
This extreme slowness is a recent thing, occurring only for the last three four four months. I really takes the fun out of running Windows Update.
In all fairness (Score:1)
Strictly speaking, sending a computer with Debian into a singularity would only cause apt-get to appear as slow as windows updates to outside observers. From the frame of reference of the user it would still run as fast as it always does.
Re: (Score:3)
Re: (Score:1)
Windows Update took about an hour to scan for what updates I needed on each of the three PCs I updated yesterday.
.
This extreme slowness is a recent thing, occurring only for the last three four four months. I really takes the fun out of running Windows Update.
Haven't seen that happen myself with Windows 7 but I remember that near the end of XP's life Windows Update would run for a long time and often fail to finish at all.
Re: (Score:2)
I really takes the fun out of running Windows Update
I didn't realise people run Windows update. I thought that you just get a list of updates pending to be installed and you can work your way through them as you desire. What is this scan thing you're doing?
Re: (Score:2)
3114409 has been pulled, but might have caught some people who patched early.
Re: (Score:2, Troll)
Re: (Score:2)
I don't actually use Windows but I have it on good authority that there are quite a few free versions that don't have ads right in the store and available with the same search query.
Re: (Score:2)
It's know as "Metro" or "Modern". Until MS kills it and goes back to the UI people WANT, without additional spyware, forced installs and all the rest, they will continue to see people migrate away from their software and services.
Which UI is that? The one in Windows 7? The one people coming from XP also bitched about?
Windows 7 updates slow these days (Score:5, Interesting)
Re:Windows 7 updates slow these days (Score:5, Interesting)
It almost seems that Microsoft has intentionally slowed updates for Windows 7...
I wonder if it has something to do with Microsoft no longer doing service packs.
.
Nowadays, the Windows 7 windows update client has to pour through everything since SP1 to find the dependencies and omissions, in order to determine what updates need to be installed. It is almost as if the service pack team didn't tell the windows update team that service packs would be discontinued, so now the windows update process is basically flopping around in a dependency tree so large that is is falling over on itself. If Microsoft were to issue a SP2 for Windows 7, then the dependency tree would be small again and windows update would move more quickly.
.
Windows 10 doesn't have the slowness problem (yet) because the dependency tree is much smaller on the newer OS.
Or, it could be just as you say, Microsoft is intentionally slowing down the update process for Windows 7, trying to put a hurt on the customer experience.
Re: (Score:2)
Microsoft thinks that it did issue an SP2 for Windows 7. The name is a little misleading: "Windows 10".
Re: (Score:2)
Yea, they basically push entire new builds out to users with a option to defer them available on Pro.
I Have A Fix For Silverlight (Score:2)
2. If you ignored step 1, then uninstall it.
Re: (Score:2)
I seem to recall Silverlight being a system component your can't remove once your add, though.
0 day? (Score:2)
Its cute ... you guys have warped 0-day into something utterly meaningless.
The term was always stupid, you mean 'undisclosed'. It stopped being 0 day 24 hours after it was first discovered, regardless of when you found out about it.
The reality is, unless someone on slashdot was actually writing it, its pretty unlikely you've EVER seen a 0 day exploit.
You guys now days have no experience or clue about what words mean so you just start making shit up and using them in utterly stupid ways.
Re: (Score:2)
You're adorable. You think summaries should be accurate here. And more so, headlines. Just precious.
Meanwhile, various tools let me criticize the idiots without giving the retards at Dashslot any revenue. Precisely because of this nonsense.
I stopped caring, and voted with my wallet. Do the same, pp, and readers alike.
Internet Explorer? (Score:2)
But updates are evil??! (Score:2)
There is no reason at all to ever run it. Your system will be perfectly safe. Worse IT professionals actually believe this??!
Glad mine are turned on
there's only one hitch... (Score:2)
...installing this comprehensive necessary patch DOES actually also install Win10 automatically.
Sorry.*
-MS
*not really.
Update Hell Today/Can everyone coordinate updates? (Score:2)
Microsoft's "Critical Update" screwed up my iPhone 5S's update to IOS 9.2 to the point where it almost bricked the phone.
I ended up spending 15 minutes with Apple Support trying to get the phone back using a Mac when ... the Mac announced it had an update to El Capitan and Xcode.
Maybe it's time that manufacturers set aside unique days (of the month) for releasing their updates so that they all don't collide?
Sorry, just bitching because I really didn't need to lose an hour on an iPhone update which is normal
Critical security update for Microsoft Edge .. (Score:2)
They broke Office 2011 Pro's Outlook! (Score:2)
Every time I start it up, its layout gets resetted. So annoying!
Re: (Score:1)