Adobe May Change To Monthly Patch Cycle 76
Trailrunner7 writes "Adobe, which has been under fire for the security of its flagship products, Flash and Reader, for some time now, may be on the verge of changing its patching process to push fixes out on a monthly schedule, which would coincide with Microsoft's monthly Patch Tuesday releases. The change would be the second major adjustment to Adobe's patching process in the last year or so. In 2009 the company moved to a scheduled quarterly patch release process in an effort to give its customers a better chance to plan for testing and deployment. That change was generally well-received. Now Adobe may change the schedule again in order to get patches out more quickly. The company is considering releasing its security fixes for Reader on a monthly schedule, the same day that Microsoft releases its patches."
STUPID ACROREAD ICON (Score:5, Insightful)
But will they stop placing that stupid icon on our desktop during every single update?!
Re: (Score:1)
I hate that too! It seems like I'm deleting the Acrobat Reader icon and shortcut every other day. I've submitted a bug report to Adobe three times already about that.
Re: (Score:1)
In America, You get Adobe Icon. In Soviet Adobe, Icon gets you!
Re: (Score:1)
It's because the maroon's at Adobe confuse "update" with "full install, including a bunch of other non-Adobe Reader stuff like Adobe AIR".
Re: (Score:3, Interesting)
look at what others do to avoid that pitfall.
http://www.appdeploy.com/packages/detail.asp?id=1328 [appdeploy.com]
Re: (Score:2)
look at what others do to avoid that pitfall. [link]
I don't get it. The link directs me to some commercial site that sells (I assume) something or other. A short explanation of what I'm supposed to look for or what this does seems indicated.
Re: (Score:2)
Re: (Score:1)
Of course not... They want more visibility, even at the cost of being annoying....
Re: (Score:3, Informative)
No - because your essentially reinstalling the product. You can use customization wizard (free download on their site) to build a modified install so you never see that icon again ;).
Re: (Score:1, Insightful)
Re: (Score:1)
Thanks for mentioning it and not providing a link [adobe.com]
Re: (Score:2)
That "Wizard" is practically useless -- the updates for it lag so far behind the Reader releases that half of the functions (like removing the icon from the desktop) stop working. For example, the function to prevent the creation of the desktop icon no longer works.
I've found it more reliable to script the installation, removing the desktop icon using the script (%ALLUSERSPROFILE%\Desktop\Adobe Reader 9.lnk or %PUBLIC%\Desktop\Adobe Reader 9.lnk)
Re: (Score:1)
Great! (Score:3, Insightful)
Now I won't know whose patch messed up my computer after the update...
Re:Great! (Score:4, Insightful)
Thats the idea, its called "the blame game" and it cuts down on support costs.
Faster is always better, but... (Score:2)
Will we still have to REBOOT? (Score:5, Insightful)
Re:Will we still have to REBOOT? (Score:5, Informative)
Re: (Score:2)
Because any number of apps may have hooked into the adobe DLLs to use various bits from them and its rather difficult (not impossible) to figure out which apps those might be and give you some info about them.
Also in reality, most users won't know what to do so rebooting is a fine alternative for the computer ignorant.
It amazes me that slashdot has so many users who will tell you much they know about system administration and programming, but don't understand the concept of dependencies
Re: (Score:2)
Because any number of apps may have hooked into the adobe DLLs to use various bits from them and its rather difficult (not impossible) to figure out which apps those might be and give you some info about them.
That's a stupid argument, and slashdot is stupider for it. The OS knows exactly who is using what DLL. It would be a triviality to terminate all such processes, and it ought to be safe, too, since the OS doesn't use any Adobe DLLs. Give the user a chance to quit any which have a GUI, which is also trivial to find out (are they in the window list?)
Re: (Score:1, Interesting)
I am quite sure that there are lots of options that are just left on because it is less effort to not touch them than to figure out if it is really needed.
On the other hand there it might be an effort to avoid issues with those less computer s
Re: (Score:2)
Probably because windows cannot replace files in use. I know in 2010 that seems crazy, but there it is.
It is easier to make you reboot than to make sure nothing has any of their files open.
stop using adobe (Score:2, Insightful)
Avoid acrobat reader at all costs (Score:5, Funny)
Re:Avoid acrobat reader at all costs (Score:4, Insightful)
You know you suck when your company is playing catchup with Microsoft on security and patching.
Seriously. I don't like to swear much on Slashdot, but I'd like to tell Adobe "fuck you!"
This isn't about an operating system. It isn't even about a productivity suite like Office. It's a reader. Stop patching every damned month and secure the bastard. Right now. One patch and you're done. I do not condone any corporate plan to regularly trickle out tiny fixes here and there when they're discovered because that's Good Enough. It's not good enough.
Adobe needs to change their product plan.
Adobe Reader - views PDFs and that's it
Adobe Reader Pro - views PDFs, has all the scripting and form-filling features that are vulnerable and buggy
Adobe Acrobat - makes PDFs
Strip Reader down to as few features as possible. We know that 99% of what Reader is used for is flat basic text reading. So either make a product that does that and only that, or at least make a MODE where turning on all the other features for X minutes requires a UAC-style prompt.
following MS example, do it al the way (Score:1, Insightful)
Hey !! Adobe !, if you insist on following Microsoft's example of distributing crappy software with even more crappier default settings, then please arrange we can update the crap via WSUS as well. your own distribution tools S U C K !
Full installer (Score:3, Insightful)
How about releasing a full installer of the latest revision, instead of this idiocy where we have to download 9.3.0 from their website and then manually tell it to install 9.3.2? It can't be /that/ hard.
Re: (Score:2)
How about hireing some developers with a clue.
How about not putting features in a DOCUMENT format that aren't needed.?
If they want to make PDF do everything that HTML will they'll quickly find people will just send self contained HTML files instead. Why this isn't done now is simply because no one has bothered to make an HTML editor that doesn't fucking suck.
Re: (Score:2)
Download the full MSI installer for 9.3.0, plus the patches for 9.3.1 and 9.3.2 (etc) from ftp://ftp.adobe.com/pub/adobe/reader/win/9.x/
Then, install with:
msiexec
Re: (Score:2)
Neat. Nitpick, though: 9.3.2 will apply directly to 9.3.0, so you don't need the intermediate step.
Re: (Score:2)
Firefox is now going to look really bad (Score:2)
I have spoken to a number of heads of IT about security. They seem to really hate Firefox with a strong passion.
Why? Because they don't inform admins ahead of time if there will be a new patch coming out soon. They release security updates with no warning or set schedule (so admins have to scramble each time there is a new security patch). With IE (via Windows' patch Tuesdays) and now Flash/Reader having a set schedule, Firefox will be the only commonly used software that doesn't have a scheduled security r
Re: (Score:1)
Because it's too difficult to quickly Google their release schedule which gives you upcoming notice of a release? https://wiki.mozilla.org/Releases [mozilla.org]
Re: (Score:2)
Predictable update schedule (Score:2)
This makes sense for home users, however, for enterprises, they like complete control over rollout of patches. The risk of a patch causing problems that impact the business could be very costly and is avoided at all times. IT Departments like to have the patch and test it internally to ensure there is no impact to the business before rolling it out. Also keep in mind that in many enterprises, the end user doesn't have admin access and can't apply the patch anyways.
Re: (Score:2)
Which means the admins just need to have a test machine for this. It seems more like lazy admins than anything else.
I run and test lots of stuff when the update alert comes out from their mailing list.
Re: (Score:2)
Re: (Score:2)
Doesn't FireFox release patches as soon as they are available? Why would you force someone to wait for an update?
Predictable structure when trying to maintain SOP/audits/compliance. A fully patched IE with a critical bug is just fine from a policy perspective and is easy to maintain with scheduled patches (Tuesday is good). Firefox releasing a patch on a friday makes for unhappy admin who would prefer to push it off until after their weekend.
Re: (Score:2)
I have spoken to a number of heads of IT about security. They seem to really hate Firefox with a strong passion.
Heads of IT as in managers, CIOs? Or heads of IT as in Senior Sysadmins? Most sysadmins don't mind scrambling when it means security is being increased. Most managers hate scrambling because it means overtime, and because they look bad because they aren't managing their people's time appropriately. In short, your "head of IT" friends are pointy haired bosses who don't like change.
FYI, as long as you know what you're doing, updating firefox on windows remotely for X machines doesn't require a mad scram
Re: (Score:2)
Enough with third party update (Score:2, Insightful)
Re: (Score:3, Insightful)
Can't Microsoft put their foot down and ask anybody who want to do update to work with them ?
Oh yea, MS should put their foot down and tell them "if you want your 3rd party program to be installed on customer's computers, you have to go through us. No more 3rd party applications installed unless it is through us or at least done our way". No, that wouldn't perk up the DOJ. And I'm sure that everyone on /. and every other blog would say "yes, that sounds like a good idea".
Once they did that, the thread on
Re: (Score:2)
They could fix their update mechanism though. Windows sure could use a repository based update system, the user/admins could add any other repositories they wanted even internal ones. Another big fix would be allowing files that are open to be replaced, so that updates do not always require a reboot.
Re: (Score:2)
So, Windows should be more like Linux then?
Re: (Score:2)
Not just linux uses a system like this, the BSDs all except for OSX do too.
Re: (Score:3, Interesting)
Well, Adobe could release plugins for the new version of WSUS and admins can simply approve them like they do MS patches in WSUS. Or at least change their updaters so they make some sense. I just installed Acrobat 8.0. The updated proceeded to install:
8.0.1
8.0.2
8.0.3
8.1.0
8.1.1
etc
Almost each asking for a reboot.
Instead it should have downloaded the update straight to 8.2 or whatever the current version is and then done the incremental to 8.2.3.
Lastly, they need to disable javascript by default in reader. U
Re: (Score:1)
What about you ask for update when the customer launch your software or else you use WU. Many hardware manufacturer started using WU for updating device drivers and it is working very well.
You code for Windows, you work with Microsoft this way admin can choose what to apply and what to refuse and you stop bugging the end user.
BTW third party updates are o
Re: (Score:2)
So Google and Firefox should have to use Windows Update? Perl, Cygwin should too? This is patently absurd. Perhaps then Microsoft could just say "No, we don't like you, so no updates from our servers, which means no updates".
These companies don't "code for Windows", they write software that runs on multiple platforms, such as Linux, OS X and Windows. They don't need to "work with Microsoft" because it isn't Microsoft's fucking business, only the operating system is. They are COMPETITORS to Microsoft.
Re: (Score:3, Interesting)
Go download virtualbox, put your images into that and test the apps. If you do not have system images, go get fog and make some. This will all make your life much easier.
Better late than never (Score:1, Funny)
Re: (Score:2)
Re: (Score:2)
> My loathing of Adobe is almost boundless.
Yet you continue to use their software.
Re: (Score:2)
Mod summary -1 Redundant (Score:2)
The last sentence in the summary is a repeat of the beginning of the paragraph. Further, the second-to-last sentence is unnecessary - the information there (that the previous quarterly patches were also on microsoft patch tuesday) can be easily added to the sentence before it.
Not that I expect well-written summaries here (and let's be honest, most people don't even read the summary in its entirety, much less TFA) but this is pretty bad.
Going to take a little more than that (Score:3, Insightful)
Adobe patches are crap in general.
1. They usually take the form of nearly complete product updates, patches 80% of the size of the installed product are common.
2. They currently only rarely issue roll-ups so you end up in the you have to have 9.3.1 base, then install 9.3.2 patch , then install 9.3.3 patch can't jump from 9.3.1 directly to 9.3.3
This sort of stuff drives the guy at my company in change of Adobe software deployments insane. For a new machine install it takes forever as each individual patch is installed by the software deployment system.
Re: (Score:2)
Adobe patches are crap in general.
Please mod parent up; this is a lapidary summary, and nothing more need be said.
Of course I'm going to say more. I have a lot of emotional trauma that requires venting. Trauma inflicted on me by Adobe. In fact, it's not just the patches, it's the apps themselves I hate. And I hate Adobe's executives, their dogs, wives, children, houses, golf clubs, and the mothers that gave them all birth.
I have actively distrusted Adobe for several years, ever since they snuck in a stealth updating mechanism (it's called
just put them windows / MS update (Score:2)
just put them windows / MS update
Aw man (Score:1)
Great another monthly problem (Score:2)
In addition to MS patches and girlfriend's problems, this is another monthly problem I don't look forward to dealing with. Who am I kidding? This is slashdot. I don't have a girlfriend. But I'll tell you what, my mom's aim is better than normal when she's throwing things at me from top of the basement stairs once a month.
Now just get few more major vendors on board... (Score:2)
...and the second Tuesday of the month can become a national holiday for everyone except IT (and Free Software users). The next step will an act of Congress declaring the Monday before the second Tuesday of the month to be Patch Tuesday so as to create a three day weekend.
Adobe has been doing this for the past few months (Score:2)
Terrible idea. Which patch hosed the machine? (Score:2)
When a patch goes wrong or breaks something you'll have to do more work to figure out whose patch just broke your machine.
Awesome! (Score:3, Funny)
Adobe exceeds expectations again with upping the frequency of the updater we all know and love.
How about... (Score:2)
... motivating software engineers (by loss of MONEY) who release things that have big ass security bugs in them in the first place. And put up a scoreboard of the engineer with the most stupid bugs for all to see.
"We have gone X days without an exploit." - just like the safety signs in factories. Since after all, it is software safety we're talking about here.