Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Microsoft Bug Security

Microsoft's Security Bulletins Will End In February (computerworld.com) 39

Remember how Microsoft switched to cumulative updates? Now Computerworld points out that that's bringing another change. An anonymous reader quotes their report: Microsoft next month will stop issuing detailed security bulletins, which for nearly 20 years have provided individual users and IT professionals information about vulnerabilities and their patches... A searchable database of support documents will replace the bulletins; that database has been available, albeit in preview, since November on the portal Microsoft dubbed the "Security Updates Guide," or SUG. The documents stored in the database are specific to a vulnerability on an edition of Windows, or a version of another Microsoft product. They can be sorted and filtered by the affected software, the patch's release date, its CVE identifier, and the numerical label of the KB, or "knowledge base" support document.
Redmond Magazine reports that Microsoft still plans to continue to issue its security advisories, and to issue "out-of-band" security update releases as necessary.
This discussion has been archived. No new comments can be posted.

Microsoft's Security Bulletins Will End In February

Comments Filter:
  • Has anyone used the new REST API they are replacing bulletins with? I've had trouble finding information about it, other than being told it's in no way RESTful.

  • Change for the sake of change, lacking any legitimate reason (aside from additional revenue, I have no doubt access is replete with [self aggrandizing] banners and such). It's not better, just different..
    • Re: (Score:3, Informative)

      by Anonymous Coward
      It is better, you can access it across REST API, integrate your own interface and watch exactly what you want to watch. We are looking at integrating it into our alerting system to trigger alerts for individual teams based on their area of responsibility. This is much better than trawling through bulletins.
      • Re:Ah yes (Score:4, Insightful)

        by jellomizer ( 103300 ) on Monday January 16, 2017 @06:58AM (#53675503)

        So offload the work from people who are security and system administration midended and dump it on the other teams who are focused on meeting the business objectives. So this way more security holes get put in but that is fine because it is the other departments fault.
        Just because the staff may have the ability to monitor such stuff it doesn't mean they have the time and resources to actually do the job.
        Hey it may work at your organization but you are crossing on of the pet peeves I have at may work where the System Administration dumps edicts and their jobs to the App teams while the App teams also have a full work load.

    • Re:Ah yes (Score:4, Funny)

      by arglebargle_xiv ( 2212710 ) on Monday January 16, 2017 @09:09AM (#53675789)

      Change for the sake of change, lacking any legitimate reason

      There's a perfectly legitimate reason for doing this. As everyone knows, Windows 2000^H^H^H XP^H^H^H Vista^H^H^H 7^H^H^H 8^H^H^H 10 is the most secure version of Windows ever, so there's no need for security bulletins any more because it's so secure.

      • Security bulletins aren't a great way to track how secure or insecure software is. The best way to do that is with the CVE [wikipedia.org] system. Microsoft (and most other vendors) log publicly and privately reported vulnerabilities as CVEs and link to the CVE when describing vulnerabilities.

        My hope is that this change will eliminate some of the pain of running down security bulletin data. Right now if someone asks you if you are patched against MS16-040 you have to go look that up, look up each individual KB inside t

        • It depends on how they track the issues. At the moment when you're offered update XYZ, which always comes with zero information as to what it does ("this is to address security and stability issues" or whatever), you can click on a link, and then another link, and then scroll down, and then expand some text, and them click on yet another link, and maybe find out what it is the update is addressing. If you can still go from totally-zero-information to at least some information, whether it's a bulletin or C
  • What ?? (Score:4, Funny)

    by ddtmm ( 549094 ) on Monday January 16, 2017 @02:21AM (#53675071)
    I have no idea what this means
    • by SeaFox ( 739806 )

      I have no idea what this means

      Sounds like beginning in February, you'll be able to use that line a whole lot more -- as to why an update was sent out.

    • Abuse? (Score:2, Funny)

      by Anonymous Coward
      It's Microsoft, so it is probably a way of delivering abuse.
      • It's Microsoft, so it is probably a way of delivering abuse.

        ...so fixes can be out out so they can be abused... so...

  • by mmell ( 832646 ) on Monday January 16, 2017 @03:17AM (#53675179)
    It's going to cost enterprises money to adapt to this change - whether it's for the better or not - because they have to spend time and effort evaluating and redesigning their patch and security management stances.

    OTOH, they did manage to make the famous "patch Tuesday" and equally infamous "exploit Wednesday" go away . . . then again, nowadays it seems like every day is "exploit Wednesday".

  • Detailed? (Score:5, Insightful)

    by aliquis ( 678370 ) <dospam@gmail.com> on Monday January 16, 2017 @04:42AM (#53675295) Homepage

    All I've ever seen in Windows is kinda "we've patched a bug in Windows ..." and then you could click some link and then you got about the same information and no real details whatsoever.

    Maybe a bit more detail than what I said but .. nothing really worth mentioning or interesting.

  • Not that I care (Score:2, Insightful)

    by ( 4475953 )

    On my Windows 7 machine, every cumulative security update since last October has failed anyway. I was told that it might have to do with the fact that it's a dual boot system. Be that as it may, since I use Linux for main work it doesn't matter that much, I will just make sure that I never use Windows for any payments or passwords and let Windows slowly 'phase out'. (Unfortunately, I cannot give it up entirely, because I'm using a lot of commercial Windows-only audio software.)

  • Not surprising (Score:3, Insightful)

    by quonset ( 4839537 ) on Monday January 16, 2017 @09:09AM (#53675787)

    With each iteration of Windows Microsoft has made it more and more difficult to find and change settings on your own machine, even going so far as to move settings from one area they've been in for the longest time to a completely different and unrelated section

    Now comes the updates. In the past one could easily find what the update entailed by reading the update itself (not always helpful) or by clicking the link Microsoft provided. Instead of that easy process one will now have to jump through hoops to find what they want.

    Considering how often we hear Microsoft's software is supposed to make life easier, they sure seem to be going out of their way to make it more difficult.

    • With each iteration of Windows Microsoft has made it more and more difficult to find and change settings on your own machine, even going so far as to move settings from one area they've been in for the longest time to a completely different and unrelated section

      Now comes the updates. In the past one could easily find what the update entailed by reading the update itself (not always helpful) or by clicking the link Microsoft provided. Instead of that easy process one will now have to jump through hoops to find what they want.

      Considering how often we hear Microsoft's software is supposed to make life easier, they sure seem to be going out of their way to make it more difficult.

      I think the second line sentences are a way of saying, "A way for Microsoft 'to just get you to install their fucking update or whatever they call an update and stop spending time finding out what it is and making choices as to whether or not you want them. Just fucking do it, already.'"

      Am I wrong? :)

It has just been discovered that research causes cancer in rats.

Working...