MSIE Uber-patch Of The Month 371
mkraft writes "Microsoft released another security patch for Internet Explorer to fix 6 'new' vulnerabilities. Info on the patch can be obtained via download or Windows Update. Not sure what 6 things the patch fixed, but I'm assuming they fixed 6 of the 14 known exploits listed at http://jscript.dk/unpatched/"
Maybe not even all six -- the maintainer of the above URL
claims in a post to Bugtraq
that Microsoft got some facts wrong and "patched a symptom" of one of the vulnerabilities, "not its root cause," and that IE5 and IE5.5 remain unpatched with the same "Critical" vulnerability.
Also, please compare to previous MSIE Uber-Patches Of The Month:
December 2001, 3+? holes in IE;
March 2002, 2+? holes in IE;
April 2002, 2+? holes in Mac IE.
Like clockwork. (Score:5, Funny)
Is it Thursday already?
--saint
Re:Like clockwork. (Score:2)
Not exactly like clocwork, rather three weeks late (Score:2)
security info gets displayed, and it says that
the patch was signed 24.04.02 21:04
really sure what to think about that, but there
is nothing really important on the box anyway.
So basically... (Score:5, Funny)
Seriously, it seems they are finally turning around and trying to make their products more reliable. They've come a long way since Win95 (or WinME...
Re:So basically... (Score:2)
Re:So basically... (Score:2)
Hacker: We have to nail that leak!
Bernard: Minister, if you nail a leak you make another leak.
other browsers are teh bomb! (Score:5, Funny)
netscape - doesnt have any holes - it crashes before anyone have time to exploit them.
mozilla - its not called holes, its a feature until further notice.
opera - pages download quick, dont they? then stfu.
It Breaks Javascript (Score:2, Informative)
http://www.ntbugtraq.com/default.asp?pid=36&sid
Re:It Breaks Javascript (Score:2, Interesting)
Don't name form elements "submit", folks.
Breaks some Javascript (Score:5, Informative)
The example code that fails with the patch is here [ntbugtraq.com].
patches for IE (Score:2, Funny)
The big problem (Score:2)
It is the one that makes it dangerous to push the Back Button [bucknell.edu]
C'mon, guys... (Score:4, Informative)
And if you actually go to download it, you'll see that it DOES apply to versions 5 and 5.5. (http://www.microsoft.com/windows/ie/downloads/cr
Re:C'mon, guys... (Score:5, Informative)
Why is this news? (Score:2, Insightful)
Brr. I hate monopolies.
I going to write a letter like the Peruvian one to my government right now!
Netscape not secure (Score:2, Offtopic)
Netscape [netscape.com] isn't secure [greymagic.com] either. A well written web page can read and capture local files.
Micro$oft, although they write their fair share, isn't the only company that writes bad code.
Re:Netscape not secure (Score:2, Insightful)
If this had been an MS vulnerability with a working exploit, it would have been posted here in a second --and would have generated 800 MS-bashing comments.
Slashdot has been good entertainment over the years, but I pity anyone who PAYS for a site that is so slanted it can't see beyond it's navel.
(Guess how this post will be mod'd
Re:Netscape not secure (Score:2)
(Guess how this post will be mod'd
It will most likely be modded down, and probably for good reason. Your submission was rejected because Slashdot covered the hole in NS/Mozilla in this Slashback [slashdot.org].
Just because your submission was rejected does not mean the story didn't make it on the site.
Please, if you are going to post something negative, at least get your facts straight first. Also, FYI, the Mozilla vulnerability was fixed within 24 hours, and does not affect 1.0RC2+.
Microsoft spent the ENTIRE month of FEBRUARY 2002 (Score:2)
Do you suppose they need to do more?
Ironically... (Score:2, Interesting)
And then they "recommend" that you go for automatic updating. Typical.
Good, nice to see, Good Job MS (Score:2)
Of course, I say this even though my mother got Mandrake 8.2 for Mother's Day.
I wish things were always so easy... (Score:5, Insightful)
I have Windows XP on my desktop and RedHat on my public server.
I have grown to appreciate the way Windows XP patches itself. Frankly it is a bit of a pain in the butt having to apply patches to my RedHat server each month and I would be much happier if it could just do it itself, automatically, like XP does.
I hate Microsoft. They're bastards. But the auto-patching that Windows XP does is great. We need it for Linux, both desktop and server.
Re:I wish things were always so easy... (Score:2)
For me, I ran into rpm hell and all kinds of crap with r00that. BSD is where the real experience comes from. Few bugs and better code.
Re:I wish things were always so easy... (Score:5, Informative)
You just need to register your machine and it can automatically update your machine for you.
Some may complain that it is a 'for pay' service but you do get one system for FREE.
Check rhn.redhat.com [redhat.com] for more details.
Re:I wish things were always so easy... (Score:3, Interesting)
Not exactly a newbie-friendly feature. I'm still pissed at RedHat for that one.
Re:I wish things were always so easy... (Score:3, Informative)
Re:I wish things were always so easy... (Score:4, Interesting)
But the auto-patching that Windows XP does is great. We need it for Linux, both desktop and server.
I don't run XP (though my bro-in-law does, hates it, is going back to Win2K, a good move IMHO), but some feature like what you describe would be nice if they're properly balanced and thought out.
I'd like the ability to assess what the patches are needed, what they are supposed to do, and ideally be able to see the source code before I patch my servers.
The last thing I want my server to do is to "figure out for itself" that it needs to download some worm and then automatically go do it.
Rather, let me decide and then it's my fault if I download a worm.
One of the nice things about Linux in general is that it exposes its guts to you and lets you make as many decisions as you want about what to do with it and how to modify it. If you want to shoot yourself in the foot or shoot for the moon in a new way that works for you, then by all means go for it. Linux distributions won't be so arrogant as to presume that "they know better what's good for you".
You can see where it's difficult to judge the proper tradeoffs between ease and convenience on one hand, and security on the other hand. All those Outlook attachments have been more than sufficient evidence of how easily such judgement can be in error.
Re:I wish things were always so easy... (Score:3, Informative)
1. Download the updates automatically and notify me when they are ready to be installed.
2. Notify me before downloading any updates and notify me again before installing them on my computer.
3. Turn off automatic updating. I want to update my computer manually.
I, being a lazy bastard, choose option 1, then hit the snooze button for a few days before installing... it's the only time I ever have to reboot!
CYA dialogs suck (Score:2)
Rather, let me decide and then it's my fault if I download a worm.
You know what I hate? Dialogs that are designed to shift blame to the user if the program makes bad decision. "This code is signed and looks safe. Are you sure you want to run it?" (Use a sandbox!) "It was my fault I lost my mail because I clicked 'yes' when it said my Inbox was corrupted and wanted to know whether it should rebuild the indexes." (Don't ask the user confusing technical questions!)
Having the user verify each security patch does little to protect against patchworms, and it prevents patches from being distributed while the admin is sleeping. I would not be happy if a Code Red-like worm broke into my computer while the patch system waited for my permission to install a critical security patch.
Including a verification dialog would make it seem to me that the system was designed insecurely -- insecurely enough that the author decided he needed to be able to blame me for clicking "Yes" when the crypto-based verification breaks.
Re:I wish things were always so easy... (Score:2)
Debian (Score:4, Informative)
upgrading with apt is easy, and not much work.
*BSD also have their update tools, and some other posters mentioned Redhat tools.
These things exist, you just have to use them. Or maybe they should be made prominent however XP does it so people will complain about the security pitfalls of doing so.
Re:I wish things were always so easy... (Score:2)
Re:I wish things were always so easy... (Score:5, Funny)
Re:I wish things were always so easy... (Score:3, Informative)
How to autoupdate RedHat (Score:3, Insightful)
Try AutoUpdate [univie.ac.at]. It does a good job keeping RedHat up to date.
Re:I wish things were always so easy... (Score:3, Insightful)
While you're at it, I'm offering a service where I'll monitor your checking account and pay your bills automatically each month for you. Please forward me your Credit card number and a copy of your drivers license and social security card at your convenience.
Re:I wish things were always so easy... (Score:3, Insightful)
If you claim that you are immune to this because you only use IP addresses or go directly to the root DNS servers, then you deserve to use linux. Please stay in your moms basement updating your software and save the rest of the world from the horrors of encountering freaks like you.
MS uses certificates to verify that the patches are in fact from them. I'm not sure if there is any mechanism in place for linux kernel updates. You just gotta trust that kernel.org and the mirrors point to where they should be.
Re:I wish things were always so easy... (Score:2)
And Mandrake has been doing this a lot longer than Microsoft.
Re:I wish things were always so easy... (Score:2)
- I hate Microsoft. They're bastards.
- I have Windows XP on my desktop.
Either you are lying on one of these counts or you are too stupid to recognize that running Windows XP on your desktop is in direct support of Microsoft being bastards whether you paid for it or not.-Erik
Re:I wish things were always so easy... (Score:2)
"an empowered & informed member of society (pragmatism not idealism)"
Erik, man, it's not stupidity. It's pragmatism. It's what you need to have a nice house in the suburbs and a Ford Explorer (Eddie Bauer Edition).
It's very possible to hate Microsoft and still run XP on your desktop, and there really doesn't have to be much in the way of cognitive dissonance.
Look at one of the Palestinian kids on the TV news. The one holding a "kill Americans" poster. What's on his ass? Levi's Jeans. What's on his head? A Yankees cap.
People don't have to lie or be stupid to both hate Microsoft and run XP.
(However I run XP and quite like Microsoft. Then again, I always looked up to Andrew Carnige and the DuPonts, and Vanderbilts.)
Re:I wish things were always so easy... (Score:2)
Re:I wish things were always so easy... (Score:2, Informative)
Re:I wish things were always so easy... (Score:2)
Excellent!!! (Score:2, Funny)
With this patch, IE will finally be perfect and I can sleep in peace knowing that Big Bill® is watching over me.
This is getting boring... (Score:2)
You might say that this is against me, not to patch my software, and you are right, but I am tired.
I think the security model used by MS and others (well, assuming this is a security model) is not valid anymore, I cannot go patching my software every morning after booting the computer!!
Re:This is getting boring... (Score:3, Informative)
thats one of the things that Windows does rather seamlessly though. I booted to it this morning to take care of a few things, and a little reminder notice popped up in the toolbar saying "a update is available"... all i did was click "Yes" and it was installed, it told me i had to restart to finish the update, and i ignored that part...once i finally do restart my computer it will be fully installed. This process took me a grand total of about 1 second of my time.
There are plenty of valid complaints about MS, but this is one of those cases where they are doing something right.
Microsoft is getting smart (Score:5, Insightful)
Microsoft is a formidable opponent. They're very rich and very good at using those riches to get what they want. We need to avoid being smug.
MS is rich because.... (Score:4, Informative)
They are finally making the software robust and not crash 20 times a day.
They are finally making it such that you can actually use the programs without fear of having to reinstall the whole when you try to get a new screensaver.
They are finally making it a good product.
What's wrong with this? They've been charging for the full product all along, when only now are they finally delivering. They have suckered the entire world. They take your money every time you buy a computer even if you don't use their software.
Re:Microsoft is getting smart (Score:2)
In the most optimistic light, Microsoft might be becoming better at fixing bugs. That is good for them and their poor users. But no matter what they do, they are still going to sell word processors that have a macro language powerful enough enough to read/write external files and execute foreign code. They are still going to ship a web browser that downloads binary code from webpages and executes it. Right now, they're just fixing some bugs in how the browser makes the decision about when its ok to do that. They still haven't (and never will) eliminated the glaring stupidity of the "feature" in the first place -- a "feature" that even the dimmest and most inexperienced programmers would instantly know should not be implemented. And they can never address the real security concerns without massive compatability breaks with established legacy -- which would destroy all the reasons for using their products in the first place.
You're wise to caution against being smug, but look at what they're shovelling: Microsoft products suck intentionally. The bonus suckage due to bugs is just an extra. Take away the bonus suckage and they'll still be mediocre.
Well, golly. If only I COULD patch mine. (Score:2, Interesting)
Windows Update fatally crashes my system each time I go to download all the 'critical updates' my system needs. Which means that I'm unable to actually patch my boxen, unless I maybe reinstall the operating system, which would make me lose all my application settings/components and be forced to reinstall them, etc, etc.
One central source, one update system. One critical point of failure. One of the many problems that come with having one operating system to rule them all and in the darkness find them...
Boy, do I hope nobody tries to r00t my 98 box. After plugging in my shiny new cable modem it probably looks real attractive now.
Re:Well, golly. If only I COULD patch mine. (Score:2, Interesting)
Re:Well, golly. If only I COULD patch mine. (Score:3, Informative)
Re:Well, golly. If only I COULD patch mine. (Score:2)
I'll take that bet -- what services is your 98 box running? Let's look at the currently-popular remote Winbloze exploits:
Code Red: Requires unpatched IIS running. Most vulnerabilities are from W2K/NT install CDs that activate IIS upon installation. 98SE doesn't "give" you IIS. No problem.
That remote device ident bug that was shipped out-of-the-box: Are you running Win2K/XP? No, this is Win9x, which doesn't support the feature out-of-the-box. No problem.
All the outleak bugs: Are you using Outbreak as your mail client? No? Good! No problem.
All the IE bugs: Are you using IE as your browser? No? Good! No problem.
All the Netscape/Mozilla bugs: Are you regularly surfing untrustworthy sites with Javashit enabled? Don't Do That, Then. (Rarely a problem on any Windows config.)
OK, you might get bit by an obscure bug like downloading a JPG that exploits a buffer overrun in some version of Nutscrape, but that's pushing it.
Bottom line - a Win9x box with a fresh install doesn't do enough to make it easily-r00table.
Win98SE is no longer the "new hot thing" in operating systems, so relatively few cr4x0rz are designing new exploits for it.
If I had to choose a Microsoft operating system for an always-on net.connection for home use, I'd go with 98SE, install Netscape for web browsing, a third-party mail client from the days before HTML mail (gotta avoid the IE rendering engine), spend a day downloading/installing the DiVX codec and Windoze Media Player 6.2, and some basic MP3 utilities, and voila.
For bonus points, after installation, verify that File/Print sharing is still off, set the OS to display all file extensions and full path names, put some ad-blocking in the HOSTS file, install Junkbuster, and maybe a "personal firewall" to block incoming traffic to port 80, 137, etc... and throw in a copy of AdAware as an early warning system. If the user's clueless, maybe some antivirus software. (Remember, we're not using a remotely-exploitable mail client, so the user has to be pretty clueless to get r00ted.)
Such a box does everything the home user wants (movies, music, web, email) and has very few remote exploits even without the "defensive" software addon.
Granted, because it's Win9x, everything runs as root, so it's not protected from internal error (like dumbasses running untrusted executables), but it's pretty secure against external threats.
Over 1-year timeframe, and given the prototypical "enclued, but lazy, home user" who can't be bothered to suck a 60M "Windows Update" every weekend through his 28.8K dialup, (or risk his system's stability even if he can be bothered to download everything), I'd bet this 98SE box stands up better over a 1-year timeframe in the wild than a Win2K or XP install.
What I've said isn't revolutionary -- it's just the old rule of "Don't run services you don't need. If you subsequently find you do need them, turn them on later." Is there any valid reason a "home Linux user" should default to turning on an FTP server, BIND, a web server, and Sendmail? Hell, no. There's no reason for a generic home user to have services listening on any of these ports.
For install-time r00t holes, the difference is that most Linux distros have realized this, and aren't turning this crap on at install-time. Most Windoze distros haven't.
For run-time r00t holes, the biggest hole is that everyone uses IE's DLL to render HTML, even when the application (email, USENET, MP3 player) doesn't really need to render web content. It's so easy to hook into IE that most apps "just do it", and thus a hole in the engine exposes dozens of apps to exploits, not just the web browser.
bugtraq (Score:3, Interesting)
Date: Thu, 16 May 2002 12:32:17 -0500
Subject: MS02-023 Patch Breaks JAVASCRIPT
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
The installation of the 15-May-2002 Cumulative Patch for IE (V6 in this
case) breaks the following Javascript code. This code works in IE versions
*not* patched with Q321232 but fails to execute on IE6 which has been
patched. I don't have IE 5 or below so I don't know if they broke those
versions as well.
Then there is lots of javascript. Just like microsoft to break something else while they fix another thing.
The original message should be in the bugtraq archive by now
63,000 Bugs in Windows 2000 (Score:2, Interesting)
It makes me wonder just how many known bugs IE shipped with and how many of those known bugs are just now being fixed in the latest patch.
Re:63,000 Bugs in Windows 2000 (Score:3, Insightful)
Point is always that software has flaws. QA is more of a triage than anything. The stuff that's critical will get fixed so the product can ship. Other stuff will get fixed when the opportunity arises (or enough people demand it). Most large software projects generally have these issues. Fact is, software will never be 100% bug free. You'll always find bugs, but you'll guess generally that some of them shouldn't be encountered by too many people if they're obscure enough. That's the call you have to make. Otherwise, software will NEVER ship.
Re:63,000 Bugs in Windows 2000 (Score:4, Interesting)
The problem, to my mind, is the relative number of serious security-compromising bugs in each of those, and the speed with which patches are made available.
Microsoft seems to put out software with a lot more serious security holes and then lets them sit out there forever and a day before a patch is made available.
Sure, users have a responsibility to patch their systems and to keep up with security and other issues. But let's say the average user can handle 5 issues a month (which may be a little high). That wouldn't even get you close to closing all the serious holes in MS products. It'll close a much higher percentage of serious holes in other systems, however.
That's my gripe: MS sroftware is so buggy that keeping up with the holes is a full time job. I don't even think a full time sysadmin would want to spend all his time patching Outlook, much less Joe Average.
Every piece of software has bugs and security holes. Microsoft's numbers are just too disproportionately high for me to tolerate.
Re:63,000 Bugs in Windows 2000 (Score:5, Insightful)
This statistic was often trotted out, but I'm afraid it doesn't mean what most folks think it means.
Win2K went out with 63,000 open issues not because the software was flawed, but because it was thoroughly tested.
Now, don't get me wrong: thoroughly tested is not the same thing as good, though lots of testing is sure nice.
(Secondarily, the larger number of defects also reflects the relatively larger code base of Windows. Again, don't get me wrong: more code is not necessarily better, either, but it leaves more room for defects.)
But the point is, as IBM determined something like four decades ago, the difference between software with a lot of known defects and software without a lot of known defects is not the defect rate: it's the thoroughness of the testing.
All software has defects. The question is whether anyone has gone looking for them.
Hey Slashdot Crowd (Score:2, Insightful)
Re:Hey Slashdot Crowd (Score:2)
Who the f*ck is moderating this crap, these days?
t_t_b
At least there fixing it ... (Score:2)
Now if only theyd fix the winnuke bug.
I remember one guy in the office wanted me try and break his
über secure win2k box with software firewall.
I winnuked his ass and he cloudn't even move his mouse.
There was no way he could filter it out as the bug is in the TCP/IP stack i think.
Yes I understand this is lame but he asked for it
how to get them (MSFT) to make patches that work (Score:3, Funny)
2. Choose a cool marketing name for the hole, like "achilles' hole" or such. Make it fancy.
3. Call the news agencies. Once there is a fancy marketing name, they will jump on it and create public hysteria. Remember "Code Red" ? It was just like any other worm attack except that it had a cool name for the media blew it way out of proportion.
4. Watch the patches roll in.
5. Lather, rinse, repeat. Every six weeks should do it. The public should see a pattern sooner or later.
Re:how to get them (MSFT) to make patches that wor (Score:4, Insightful)
Bullsh*t.
How come my firewall is *still* seeing 80+ Code Red/Nimda probes daily?
Just like any other worm?
You have no clue.
The number of infected Micro$oft boxes out there is scarcely any less than it was six months ago, thanks mainly to clueless Micro$oft users...
t_t_b
What the patches fixed (for the lazy) (Score:4, Informative)
For those that are SO lazy that you can't click on the link:
Technical description:
This is a cumulative patch that includes the functionality of all previously released patches for IE 5.01, 5.5 and 6.0. In addition, it eliminates the following six newly discovered vulnerabilities:
Finally, it introduces a behavior change to the Restricted Sites zone. Specifically, it disables frames in the Restricted Sites zone. Since the Outlook Express 6.0, Outlook 98 and Outlook 2000 with the Outlook Email Security Update and Outlook 2002 all read email in the Restricted Sites zone by default, this enhancement means that those products now effectively disable frames in HTML email by default. This new behavior makes it impossible for an HTML email to automatically open a new window or to launch the download of an executable.
Sorry... (Score:2)
http://www.microsoft.com/technet/treeview/default
for fucks sake.. (Score:2, Interesting)
I don't care if its a mac/ms/*nix/*BSD or what, but if it gets the job done, relatively well and fast, I will use it.
For programming, i don't care if its VB/C/Glade/Perl/Python whatever.. whatever suits the job best. And yes, sometimes, if not MOST of the time, it's a MS solution (for me at least, YMMV).
And for the record, win win98 installation, which I just reinstalled everything ( 2 days worth of installs and hundreds of reboots ) is showing the same symptoms of the problem for the reinstall, which I'm assuming came from windows-update. So no, I'm not living in a perfect world. At the moment, I'm cursing Billy boys name, but I'm still using Win98 for most of development work and 2 linux machines as servers, since, like I said, best solution for the problem.
So flame away, you
Let's see how Mozilla gets security updates (Score:2)
Re:Let's see how Mozilla gets security updates (Score:2)
You'll almost certainly have to download the whole browser. It would be too hard to deal with people upgrading from all the nightly builds and the 3 week milestones, etc.
This is not really a problem because, Mozilla is aimed at developers. Users are supposed to use Netscape or other Mozilla based browsers.
For Linux users, it would be up to the Linux distro to provide patches like that if they wished. But none of them will either. Too much work for no money.
With the Right GNU/Linux Distro Fixes Are FAST (Score:2)
On my Source Mage [sourcemage.org] system I simply run a 'sorcery update' before going to bed, and any new versions of packages are downloaded, compiled, and upgraded accordingly. All dependent packages are recompiled as needed, such that all are optomized and compiled against the most current rev. Downloading and compiling mozilla may be time consuming, but if I'm asleep while its happening who really cares?
On my Gentoo [gentoo.org] system I do an 'emerge rsync' followed by an 'emerge --update system --pretend' (to first see what it is going to do), then if I like what is going to happen, the same command again without the --pretend to actually do the update, followed by an 'emerge --update world --pretend' and, once again if I like what is going to happen, an 'emerge --update world'. If I don't want to upgrade everything (not as safe to do under Gentoo as Source Mage) I simply do an 'emerge --update [package-name]', such as 'emerge --update mozilla' before going to sleep.
In either case, the next morning I wake up with the most current security patches (if any) and newest stable versions of all the Free Software out there, including Mozilla.
I had Mozilla rc2 running within 24 hours of its release, fully compiled and optimized for my machine. No waiting on Red Hat, Suse, or, God forbid, Debian to get around to pushing their versions out. (Though in defense of Debian they do push SECURITY fixes out very fast
Browser wars (Score:4, Insightful)
Now that this "war" is over, I hope MS (and Netscape) make a good review of their browser before releasing it, and stabilize the existing code. If we are lucky, IE 7 will be shipped only in 2003 or 2004 - and by "we" I mean every internet user, for the bugs in IE helped the spread of annoying worms like Nimda and Klez.
What I found interesting... (Score:3, Insightful)
Just because someone bashed MS, that doesn't mean that they are being unreasonable.
link down, other info kind of funny (Score:2)
System Requirements: This update applies to Internet Explorer 5.5 Service Pack 2.
How to use: Restart your computer to complete the installation.
How to uninstall: Uninstall is not available.
Windows Update hosed my system!! (Score:2)
I tried the same method described above to start IE and Windows Explorer. Both failed. I read the TechNet bulletin referred to in other posts. It looks like MS updated the code that support something they're calling a "local resource file". Correct me if I'm worng, but doesn't MS use "local resource files" to handle the desktop in Win2k?
BTW, the only positive outcome is that my memory usage has dropped form 135 MB to about 80 MB. Besides my desktop, among the missing applications are my AntiVirus program and firewall.
Finally, I get the same symptom when I try to use the Administrator account. I don't know how I'm going to back out the patch if I can't run the Control Panel Applet without IE/Windows Explorer.
Any pointers would be appreciated. Good thing I have a Linux box and/or Mozilla to fall back on.
MS (in)security and /. MS bashing (Score:5, Insightful)
This is one of the few *very* public sites that I can go to and read public criticisms of MS, step by step. If I wanted to read what a fantastic job MS is doing with it's security and how it really is such a *fab* company, then I could either go to MS' site and read the marketing departments latest press releases or go to ZDNet and read commentaries by the zombies in their editorial department.
I *want* to read extremely critical news here on
/. May often be wrong but they don't try to tell me how wonderful is and how I can just back and let MS handle all my problems.
Cure worst then the disease (Score:2, Insightful)
I go back to the site to try again, but it says I have the patch already. The question is, did it finish installing before it crashed?
Best way to update machines at client site?? (Score:2, Interesting)
So how do I go about updating 20+ Win2k machines at a client site running all different version of IE?
There has to be an easier way than running around to each machine applying a patch every month.
Re: (Score:3, Interesting)
Re:But... But.. (Score:2, Funny)
It's all that Microsoft non-compliant human behavior. As soon as they fix that the need for patches will go away.
Re:But... But.. (Score:2, Interesting)
-Sara
Re:God Forbid... (Score:2)
Re:God Forbid... (Score:3, Troll)
Although, there is a NTBugtraq post just now that say the patches break Javascript on MS browsers so maybe you don't want to install it just yet. It states:
The installation of the 15-May-2002 Cumulative Patch for IE (V6 in this case) breaks the following Javascript code. This code works in IE versions *not* patched with Q321232 but fails to execute on IE6 which has been patched. I don't have IE 5 or below so I don't know if they broke those versions as well.
Russ Cooper had an article on NTBugtraq recently pointing out how bad MS quality control is. They have separate patch sites for different products with tools that break each others patches. We don't need to break Microsoft up. It is doing so on its own.
Re:God Forbid... (Score:3, Interesting)
Re:God Forbid... (Score:2)
Re:God Forbid... (Score:3, Insightful)
Slashdot opinion:
Bah, I'm clicking "ignore posts from MS" on my preferences. I'm starting to think Taco could get his "cult" to commit mass suicide if he could prove that it'd help them rail on MS...
Re:God Forbid... (Score:3, Informative)
I can't vouch for the accuracy of the bugtraq post, but if true, this is not 'fixing the symptom until the underlying problem can be fixed', this is 'fixing one popularized symptom while leaving others untouched'.
A number of people have noticed that a majority of
Re:God Forbid... (Score:2)
Mmm...Kool*Aid (Score:2)
So would we be drinking the Kool*Aid out of a Slackware cup? Or a Debian cup? Or a SuSE cup?
They deserve to be flamed (Score:5, Insightful)
Of course people are going to flame Microsoft for designing such a product with so many critical security holes which compromise their computer, making it part of the OS and then arrogantly refusing to give people the ability to remove it. At least I can un-install every other browser if I decide it doesn't suit me.
You complain about people flaming Microsoft. I submit to you that if that corporation wasn't so arrogant, pushing its views and way of doing things onto everyone else then stifling the innovation of others, that people would be a lot more forgiving of mistakes.
I have no sympathy. Not for this corporation. Microsoft made this bed, it can sleep it in now.
Re:God Forbid... (Score:2)
Slashdot has many readers and posters, sometimes what seems hypocrite just means different opinions from different sources show up.
Apples & Oranges (Score:2)
On the other hand IE is developed behind closed doors at Microsoft which claims to do all it's quality control and testing in house before it's software is released - Indeed microsoft claims this as a reason to use Microsoft Software rather than Linux.
Re:The difference is... (Score:2)
... which has been in progress for the last 4 years, with an existing codebase to work from, and still isn't officially at a 1.0 RTM release.
Simon
Re:The difference is... (Score:2)
I think everybody would be content if Microsoft made an attempt to make their software reliable and secure before they release it
Re:The difference is... (Score:2)
Right, because no software from companies other than Microsoft ever has security or reliability issues? Don't kid yourself!
Most of those products are lambasted as buggy and insecure as well.
Besides which, I don't know of many companies which have such a bad track record of having nearly every product they release almost unsuable because of bugs in it's first release.
Re:The difference is... (Score:2)
Re:I have a question? (Score:2, Informative)
Re:I have a question? (Score:2)
The reason why exploits are written for IE/Outlook is not necessarily because Microsoft packs their product full of holes, but because more people use the products, more people will be affected by the exploit, and the chance of the "security expert" seeing their name mentioned in the media goes up.
Re:I have a question? (Score:3, Insightful)
The reason why exploits are written for IE/Outlook is not necessarily because Microsoft packs their product full of holes, but because more people use the products, more people will be affected by the exploit, and the chance of the "security expert" seeing their name mentioned in the media goes up.
Exactly, security is directly tied to popularity, why just look at Apache... oops.
The diference is that the people who bring you Apache are subject to peer review everyday, and they don't whine that people only exploit their code because it is popular when holes are found, but rather look at their project rationally, and FIX IT. Pretty amazing difference in handling criticism I would say....
Re:I have a question? (Score:2)
I was not comparing Apache's complexity to MSIE. I was not comparing Open Source to MSIE. What I did say is that a product's popularity has NO corelation to it's security, and whining that MSIE only has security problems because there are a lot of copies in use is STUPID, and from an engineering perspecitive, DANGEROUS.
But I will try to use smaller words for you next time....
Re:I have a question? (Score:2)
think of the difference between lynx and IE.
99% of web sites hardly scrape at the surface of the capabilities of IE. Sadly the days of quick html rendering have almost gone.
Re:I have a question? (Score:2)
/. rails Microsoft for not patching their bugs, and rallies behind patching up the Linux bugs. Well, let me say this: If you make a patch that no one uses, what's the good in doing it?
If we milk up all of the patches that we can, they're more likely to keep popping them out. If we can give them more feedback, let them know what we need, chances are they'll be more willing to give it. At least they're making an effort to patch the bugs, unlike other companies out there.. And certainly, if you're responsibly doing your job in a corporate environment, this matters- don't want no one compromising your system, does ya?
Just because an article doesn't matter to one doesn't mean that other people won't find it interesting. I don't like Mr. Katz, but I realize that other people find him insightful..
And if you don't use windows at all, lucky you, but I'm sure you have a friend out there who runs MS products, and THEY may want to know. So it does matter in some way.
.