Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Microsoft Security

Microsoft to Offer Patches to U.S. Govt. First 344

Elitist_Phoenix writes "Reuters reports that 'Microsoft is to give the U.S. government priority in fixing security holes in Windows and other software, The Wall Street Journal reported on Friday. Under a plan to take effect later this year, Microsoft will give the U.S. Air Force versions of software 'patches' to fix serious security vulnerabilities up to a month before they are available to others.' Yet another attempt to fight off impending doom, by trying to keep the government away from open source?"
This discussion has been archived. No new comments can be posted.

Microsoft to Offer Patches to U.S. Govt. First

Comments Filter:
  • Haha (Score:5, Funny)

    by 26199 ( 577806 ) on Saturday March 12, 2005 @08:07AM (#11918927) Homepage

    So they're getting the government to beta-test their patches? Sweet.

    • Re:Haha (Score:5, Insightful)

      by danormsby ( 529805 ) on Saturday March 12, 2005 @08:43AM (#11919081) Homepage
      What I find weird about this is that Microsoft write a patch to fix "serious security vulnerabilities", release to the US miliary but hold it back from the rest of the world for a month. Will this make the world a safer place?
      • Re:Haha (Score:2, Insightful)

        by TheSHAD0W ( 258774 )
        If anything, it'll give the NSA a chance to write their own worms before the exploit is fixed.
        • Re:Haha (Score:3, Informative)

          You are referring to active sigint, while some branches may take the short lived opportunity to diff the changes and work back to the exploit, this stunt is politically driven, not the stuff of conspiracy theory unfortunately.

          NSA releasing a worm is not an option since it would, without question, infect allied systems. This is well beyond the mission statement - and the law.

          Active sigint is not done lightly, or quickly.

          Microsoft gets a nice tidy chunk of near free cash from the NSA each year, think money
        • Re:Haha (Score:3, Interesting)

          by h4rm0ny ( 722443 )
          If anything, it'll give the NSA a chance to write their own worms before the exploit is fixed.

          Which is an anti-selling point to governments in the rest of the world. If you were the Japanese government, would you want to know that the US were getting preferential treatment?

          So either Microsoft is giving up on fighting OSS for other governments, or this program will shortly be extended to other nations.

          And if it's extended to other nations, then all those posters who were worried about the USAF staf
          • Re:Haha (Score:5, Interesting)

            by Total_Wimp ( 564548 ) on Saturday March 12, 2005 @12:33PM (#11920295)
            If you were the Japanese government, would you want to know that the US were getting referential treatment?

            If you were the Chinese government, would you want to know the US is getting free help from Microsoft to spy on you? Probably not.

            If you were a concerned person living in another county who happens to find out about an exploit in Windows, would you want the US government getting a month-long head start on hacking/spying on the rest of the world, possibly even including the country you live in?

            Microsoft has spent years trying to convince people who find exploits to "do the ethical thing" and tell them about it before letting the rest of the world know. If you happen to be a citizen of another country, this puts a very big question mark on whether giving MS the exploit is "the ethical thing" to do.

            My best guess is that otherwise helpful security proffesionals who happen to live outside our borders will be posting more and more exploits directly to the web because of this policy. Ironically, that will end up making things _less_ secure for the Air Force in the long run.

            TW
      • by mikael ( 484 )
        It will stop the US military computers from being used as a 'botnet' but it won't stop the rest of the world from being used to launch DoS attacks.
      • My first thought (Score:3, Interesting)

        by einhverfr ( 238914 )
        My initial reaction to this was that it must have something to do with electronic warfare concerns. I.e. this is not about making the public safer, but rather about making the US military more competitive in the event of a conflict.

        Imagine for example that there is a conflict with China over Taiwan--- say they decide on a naval blockade. The US military could have a full month of inside knowledge regarding Windows vulnerabilities that they could try to use in an electronic warfare environment.

        THis move
      • Re:Haha (Score:4, Interesting)

        by Fat Cow ( 13247 ) on Saturday March 12, 2005 @02:34PM (#11921164)
        exactly. since the patch is new software, the only way the government is getting it early is if everyone else is getting it late.

        it's also, bad on the government's part to be complicit in this witholding of security fixes - it makes the country less secure, not more secure.
    • Re:Haha (Score:4, Insightful)

      by smchris ( 464899 ) on Saturday March 12, 2005 @09:03AM (#11919171)
      It isn't bad business psychology. You can just hear the salesmen saying, "Who's your daddy! Does linux offer priority access to security patches? I don't think so."

      Sadly, the majority of poeple will answer back, "Well, gosh gee. You're right. Microsoft makes me feel special! Microsoft is so great."

      Shiny thing catches the sunlight. Bargain. Today only. People are stupid.

      • Re:Haha (Score:5, Insightful)

        by marvin2k ( 685952 ) on Saturday March 12, 2005 @09:17AM (#11919240)
        Sadly, the majority of poeple will answer back, "Well, gosh gee. You're right. Microsoft makes me feel special! Microsoft is so great."
        No, the majority of people will say, "Well, gosh gee. You just handed out a security fix for a vulnerability to the government but you don't give it to me for another month so I my machines are now in grave danger even though they don't have to be. I think I'll try linux for a change, they don't have a "leave your customers hanging in the air" policy."
        • Re:Haha (Score:4, Insightful)

          by canwaf ( 240401 ) on Saturday March 12, 2005 @09:38AM (#11919346) Homepage Journal
          The average computer user would:

          a) Not think that.
          b) Not think of linux as a substitute for Windows.

          Because the average computer user doesn't install security patches anyways!
          • The average computer user doesn't buy software for the US military either. What was your point?
    • Re:Haha (Score:5, Funny)

      by The-Bus ( 138060 ) on Saturday March 12, 2005 @10:09AM (#11919478)
      It looks like you want to: Land the Plane
      1. Don't land the plane
      2. Open an audio file.
      3. Shoot the base,


      "Oh crap."
  • Safety First (Score:5, Insightful)

    by DogDaySunrise ( 829682 ) on Saturday March 12, 2005 @08:10AM (#11918942)
    Sounds a lot more like "Microsoft will delay patches for a month after availability, except to the US Govt". Surely it'd be a lot safer for the US Govt Ltd. for M$ to supply patches to *everyone*, governments included, instead of allowing vulnerabilities to lie unpatched for a few weeks...?!?
    • Re:Safety First (Score:5, Interesting)

      by Rangataua ( 820853 ) on Saturday March 12, 2005 @08:13AM (#11918959)
      I wonder how long it will be before someone creates a virus based on knowledge found in a patch that has only been released to the government.
    • Re:Safety First (Score:2, Informative)

      That was my first thought. Now my network is going to be exposed for a month after Microsoft tells a select class of customers about a vulnerability. Oh, well, not to worry: I'm sure they'll all be trustworthy types, and that's 30 days of bliss before I have to do anything about it...
    • Re:Safety First (Score:2, Insightful)

      by thecwin ( 867144 )
      Maybe it's so that the US Govt can patch their systems before hackers get their hands on the patch and reverse engineer it to exploit others.
    • Re:Safety First (Score:5, Insightful)

      by ctr2sprt ( 574731 ) on Saturday March 12, 2005 @09:08AM (#11919195)
      Well, remember that MS's products are used on hundreds of millions of computers worldwide, and after the OS leaves the box Microsoft has no control over it. People install all sorts of programs and make all sorts of "adjustments" to their computers. This makes QA for patches hideously difficult, since MS has to test against such a wide array of third-party apps.

      So the argument here is that because the USAF is using an NSA-designed build, they can guarantee a pretty stable environment. MS has a known quantity to test against, which lets them test faster (and presumably better), so they can afford to roll those patches out earlier. They then spend the next few weeks trying to make sure their patches work on Everything Else. One of the hopes cited in the article I read is that this will encourage other entities, like banks and such, to adopt the NSA's build (or at least model their own after it). That will, of course, enable Microsoft to expand its "early release" program, making them more money, but it may also lead to better security across the board. As we all know, a good sysadmin can secure anything, even a Windows box. Well, if you aren't a good sysadmin, maybe you can copy one and get similar effects, right?

      That's their line. It does make sense, though I personally would rather see MS release all their patches after minimal QA, then a month (or so) later release "improved" versions. That way, if the patch breaks some third-party program, at least the folks who don't use that program can get the benefits. MS does this sometimes already. Of course, my expectation is that if they did this with every patch, that "month" wait would be closer to two or three months, and often the updated patch would never come out at all.

      • Re:Safety First (Score:5, Insightful)

        by Znork ( 31774 ) on Saturday March 12, 2005 @09:57AM (#11919429)
        "It does make sense"

        It makes sense until you realize that the OSS crowds install even more sorts of programs and make even more adjustments to their computers, yet manage to get patches in a timely manner.

        Which means that either Microsoft is terminally unable to create stable and clean APIs so everything affects everything else, causing an inordinate amount of breakage, or they're still not very serious about the patching thing.
    • Re:Safety First (Score:3, Insightful)

      by Zocalo ( 252965 )
      Actually, since the article says "up to a month" I guess that all it *really* means is that the US Government will get patches as soon as they are ready while every one else gets to wait for Patch Tuesday. The wording is also vague enough that this does not preclude a particularly critical patch being released to the world at large out of cycle either. I suspect selected other parties might be afforded a similar arrangement too such as large companies, those responsible for critical national infrastructur
  • We host many Gubmint sites. I wonder if we'll get special treatment. Somehow I think not.
  • What if... (Score:5, Interesting)

    by 0x461FAB0BD7D2 ( 812236 ) on Saturday March 12, 2005 @08:10AM (#11918947) Journal
    the patches screw up the systems, as has happened in the past?

    Also, how would other governments see this? Would they accept being 'second-class customers', no different in Microsoft's eyes to the Average Joe?
    • by lxs ( 131946 ) on Saturday March 12, 2005 @08:17AM (#11918971)
      What if the patches screw up the systems

      Some general 'accidentally' orders an airstrike on Redmond and blames it on buggy software.
    • Re:What if... (Score:2, Insightful)

      by Misroi ( 834266 )
      You're right, a big part of the testing a patch is releasing the beta version to the public. This might not seems as important for small security leak, but I can't imagine them releasing big patches that haven't been fully tested. I also fail to see how they can "get the patch up to a month before they are available to other". A month is more then enough time for a security leak to exploit many many windows users. If the patch is done, why don't they release it to the general public? Only so the Government
      • They only have to test against known government configurations. The next month is testing against as many of the near infinite number of possible configurations as they can.
    • Would they accept being 'second-class customers'

      I don't see how delaying security patches to the bulk of their customers will make anyone more secure.

      • To be fair (yeah, I know, fair to Microsoft, must be new here.. :)) it may be related to the testing of the patches.

        They can know exactly what computers the government has (most likely bought in bulk to the same company, even if several offices buy them from different places will still be a relatively small target to test on), while they would need to use a LOT more variety to test before they're sure it's safe for most people's computers out there (insert "you mean they test them???" joke here.. :))

        I'm

    • Then fire the admin who didn't take due diligence in testing against known configurations. I worked for Canadian Forces for a couple years until my contract got cut due to the project being on time underbudget and a major success and prior to any hotfix thorough testing was done by the Testing center as well as us prior to push to the site's servers.

      You shouldn't take any vendor at his word that the patch won't cause any issues.
  • by aendeuryu ( 844048 ) on Saturday March 12, 2005 @08:11AM (#11918948)
    People in power love the idea of others sucking up to them. Even if they can get security fixes quicker via opens source, the idea that Microsoft is effectively prioritizing them ought to be incentive enough. You could give them good practical and logical reasons for going open source anyway, and they'd MAKE UP their own reasons for not doing it, because they'd LIKE the idea of having a position like this over Microsoft, and would go along with whatever rationalizing they'd have to do to accept it.

    What's more satisfying? The idea of having some small company like Red Hat at your beck and call? Or Microsoft?
  • After this announcement, I bet their marketshare will go up!

    I can just imagine it now: "Buy Windows, and get security patches for free, up to a month after they have been released!"
  • by sgant ( 178166 ) on Saturday March 12, 2005 @08:13AM (#11918956) Homepage Journal
    Prof. Frink: It's because the Government as the troops and the guns and the tanks and the fire falling from the sky with the burning people running amok in an orgy of blood and kicking and the biting with the metal teeth and the hurting and shoving...

    That's why the Goverment is first.
  • Great idea. (Score:4, Interesting)

    by Mz6 ( 741941 ) * on Saturday March 12, 2005 @08:14AM (#11918961) Journal
    As a DoD Defense Contractor working on these systems, I think this will help tremendously. Currently, we only get patches when Microsoft posts them on their website. From there it needs to be thoroughly tested to ensure the patch will still allow critical software to continue functioning (the government can ill-afford downtime on some of these systems). Beyond that, it then needs to be applied to thousands of other machines on several differnet networks. Of course, we only have a small window to get this all completed. With an extra month to have this completed, we have a small advantage to have these systems patched.
    • Re:Great idea. (Score:3, Insightful)

      by jacksonj04 ( 800021 )
      Sorry, but just because you're a DoD contractor doesn't mean that there aren't hundreds of thousands of other businesses needing to test patches before deployment.
    • Re:Great idea. (Score:5, Insightful)

      by martinX ( 672498 ) on Saturday March 12, 2005 @08:34AM (#11919038)
      A small advantage over whom?

      During your month of testing, your systems are still vulnerable. MS can't make the patches any faster, therefore you having them a month earlier than everyone else can only mean that they are delayed to everyone else who needs them. How could that possibly be a good thing. Banks, powerstations, hospitals - they all can ill-afford downtime.

      Finally, "released to the government" means what? They post them on their website? Like they do now...

      As far as I can see, this helps no-one.

      Please explain.
    • Re:Great idea. (Score:5, Insightful)

      by CdBee ( 742846 ) on Saturday March 12, 2005 @08:35AM (#11919042)
      I find it a little disquieting that the USAF's primary systems may be running Windows. Windows is good for a lot of jobs, but the frontline defence of the world's most - well - controversial nation possibly ought to be on something a bit more resilient.
    • Awsome idea.

      Infact...so Awsome I'd like to have the patches a month in advance as well. As I'm sure everybody else would.

    • by DoofusOfDeath ( 636671 ) on Saturday March 12, 2005 @09:22AM (#11919269)
      Hmmm...

      My government computer runs Debian, and I don't recall having ANY problems like this :)

      Actually, now that I think about it, I *did* need to train my spam filter to discard our security team's "Microsoft virus alert" messages ;)
    • as another DoD defense employee, I would say that this is a mechanism for trying to get back some of the lag in patches. There is nominally a month delay in patches getting pushed to our user computers due to testing, somesuch... This brings the USAF up to the same point as the rest of the civilian world! Gov't bureaucracy at work
  • Crazy, no? (Score:4, Insightful)

    by Toby The Economist ( 811138 ) on Saturday March 12, 2005 @08:14AM (#11918962)
    This seems crazy on a number of levels.

    Is the airforce more important than say, nuclear power plant operators?

    While it's concieveable there could sometimes be some advantage in releasing a beta version of a security fix, there is no advantage whatsoever in merely delaying the general release of a patch, so MS must have agreed to supply early versions of patches to the USAF.

    This, I predict, will cause more problems than it will solve.

    --
    Toby
    • Re:Crazy, no? (Score:3, Interesting)

      by Eil ( 82413 )

      Is the airforce more important than say, nuclear power plant operators?

      While it's concieveable there could sometimes be some advantage in releasing a beta version of a security fix, there is no advantage whatsoever in merely delaying the general release of a patch, so MS must have agreed to supply early versions of patches to the USAF.


      It's not that the USAF needs those early patches more than anyone else, it's that the Air Force has standardized on nothing but Microsoft software for almost everything it
  • by malkavian ( 9512 ) on Saturday March 12, 2005 @08:15AM (#11918966) Homepage
    The Military for having to Beta test MS' latest patches (they'll be the one whose systems crash most by having patches applied that haven't met the real world before), or Commerce, who suddenly realise that they're going to be getting cracked hard, by something MS knows about, has a fix, and just can't be bothered to give them a cure for..
  • by 3770 ( 560838 ) on Saturday March 12, 2005 @08:15AM (#11918968) Homepage

    Yet another attempt to fight off impending doom, by trying to keep the government away from open source?


    Man, people really want Microsoft to become a footnote in history.

  • by jwcorder ( 776512 ) on Saturday March 12, 2005 @08:16AM (#11918969)
    They are giving them the patches first, so when all their systems are down from a bad update, they have the ability to TAKE OVER THE WORLD!!

  • Exploits? (Score:3, Insightful)

    by slavemowgli ( 585321 ) * on Saturday March 12, 2005 @08:18AM (#11918974) Homepage
    So... the government will get an entire month where they can analyse the patches, see what vulnerabilities they fix, and develop exploits to use against those who haven't received the updates yet?

    Not that they probably need much help to find holes in M$ software, but still, this stinks. If the government really was concerned about security, they wouldn't ask to get patches before everyone else; rather, they'd ask that patches be made available to *everyone* as soon as possible.
  • The US goverment gets to know all about the vunribilities in microsofts operating system before the rest of the world does, anyone think that'll make the other goverments in the world trust microsoft software more?
  • by galdur ( 829400 )
    Microsoft announces officially that all security holes will be UNPATCHED FOR A MONTH (except for the U.S. Gov. systems)
  • Marketspeak (Score:3, Funny)

    by NitsujTPU ( 19263 ) on Saturday March 12, 2005 @08:23AM (#11918997)
    Ok, before /. gets all in an uproar. Lets go ahead and explain this.

    This is marketspeak. Marketspeak is nonsense. There is no such thing as well thought out marketspeak.

    I'm sure that when the programmers heard this idea, they sat in a room and just collectively went "duh?!?" to themselves, then realized that marketting execs get paid more than they do, and laughed about it later around the water cooler.
  • Great (Score:5, Insightful)

    by Pan T. Hose ( 707794 ) on Saturday March 12, 2005 @08:24AM (#11918999) Homepage Journal
    Another reason for the EU, China and Korea to finally abandon Micro$oft software altogether. Now it is not only a risk of ordinary corporate lock-in but actually a treat to national security and sovereignty of Asian and European States (excluding Middle East states which are hardly sovereign to begin with) because it means that the US government (CIA, NSA and other *AA) will be able to easily reverse engineer Micro$oft patches and exploit the patched vulnerabilities in the parts of the world where there are no patches available so not only stupid people will have vulnerable systems but actually everyone. We can only hope that our European and Asian brothers and sisters are wiser than their American counterparts who will hopefully jump on the bandwagon as well and stop using Micro$oft software. That should mean a great increase in Linux market share during the first quarters of 2006, 2007 (such a serious transition is never done overnight, there are no miracles, we have to be patient). So paradoxically this is actually a good news because it will inevitably hurt Micro$oft in the long run. Instead of overreacting we should stay calm, discuss its implications maturely, and see what it means and how the rest of the world reacts. The most important parts of the world to focus on are: Europe, Asia, Australia, Africa, South America and Canada. Only time will tell what that decision really means and which F/OSS O/S will benefit the most where the national security is the top priority.
    • Parent: "The most important parts of the world to focus on are: Europe, Asia, Australia, Africa, South America and Canada."

      That only leaves the USA which this article is largely about and Antarctica which AFAIK is owned by everyone and doesn't have its own government that may require Microsoft software.
    • We can only hope that our European and Asian brothers and sisters...
      ...care about our interests as much as you care about theirs. :-P
    • Re:Great (Score:2, Interesting)

      by marcosdumay ( 620877 )

      Yes, governmetn transition doesn't happen overnight. 2006 - 2007 is a very short time for that, you should increase that to 2007 - 2009 or something like that.

      To cite a real case, Brazil started its transition in 2002. Today there has been no significant mode to Linux yet. Instead, almost al the public douments have been translated from M$ ofice to a more open format. A lot of time was spent discussing what is a 'open format' and generating policies. To make the long story short, 2 years after the decisio

  • Impending Doom? (Score:3, Insightful)

    by PepeGSay ( 847429 ) on Saturday March 12, 2005 @08:27AM (#11919005)
    Let's have a modicum of sense here. We are all going to die sometime... Microsoft has all the earmarks of a company that will live to a ripe old age though.
  • Machiavelli (Score:5, Insightful)

    by bitswapper ( 805265 ) * on Saturday March 12, 2005 @08:29AM (#11919013)

    So, if you're a foreign government, the US government has one month to break into your unpatched systems. Or, if you're anyone the US government doesn't like, the CIA, FBI, HLS, etc., has a month to hack your unpatched systems.

    I give Microsoft credit for possessing at least a basic understanding of Machiavelli.

  • by Alain Williams ( 2972 ) <addw@phcomp.co.uk> on Saturday March 12, 2005 @08:31AM (#11919025) Homepage
    Does this not open M$ to the charge of willfully withholding security patches from everyone else by a month ?
  • Whoah slow down there people I think when Microsoft mean 'Patches' I think they mean their new cyber buddy aka 'Rambo-Clippy' but with new and improved PTBSD (Post Traumatic Blue Screen Disorder). Patches is gonna open up a whole lotta online whoop-ass on hackers and other terrorists.

    'Patches' is a mean son'ova' gun who uses rattle snakes as condoms and pisses napalm. I for one am glad to have this online hero on our side.

  • This merely insults everyone else... perhaps adding to the incentive to look elsewhere for their computing needs.
  • I feel sorry for Uncle Sam. They get to experience the bugs of Microsoft's patches first and we'll probobly get less screwed up patches. Brilliant.
  • So how will they or it?
    A) They deliver beta-patches to the DoD
    or
    B) They deliver final patches to the DoD and delay them for a month before public release

    Obviously both cases are a desaster:
    A) We all know how buggy Microsoft's final software is, I can't imagine how someone can use their beta patches in a critical desaster.

    B) Telling the government about security issues first and delaying patches for the general public is bound to cause an uproar. They are already quite slow when it comes to releasing patch
  • Other than stroking some Air Force egos, what does this accomplish?

    If a patch is good, and reliable, send it to everybody. The more people that are patched, the better.

    If a patch is bad, do we want military computers testing the fix first?

  • The US Military will beta test Microsoft security patches.
  • A bit off topic...we know the military uses LINX and all sorts of UNIX.

    Does the military use OS X? It would seem to me that OS X would be a great alternative to Windows based systems since most of their software is custom anyhow.
  • by fuzzy12345 ( 745891 ) on Saturday March 12, 2005 @08:47AM (#11919101)
    I've wondered about the legality of such behaviour. At the point where a company knows its product has a vulnerability, has a fix for that vulnerability, and deliberately withholds the fix from customers, knowing that some of them are likely to be hacked and suffer losses, is it not negligent?

    This would likely vary from jurisdiction to jurisdiction. Anyone got an amateur/professional legal opinion?

  • for patches that don't work, work properly, or goes "boing."

    for doing Microsoft's work of verifying stability...

    No small amount at Government charge-out rates, at some factor higher than "normal" copnstractor rates. Imagine the thousands of Gov. admins spending their time, your dollar, to do MS's work, for what they charge the Gov., us, a premium.

    And I happen to be OK with Microsoft...
  • Reuters reports that 'Microsoft is to give the U.S. government priority in fixing security holes in Windows and other software

    Translate to:

    Microsoft confirm that businesses are second rate customers. Seriously, if it was a case of MS to reveal details of vulnerabilities to US Military first I could understand it but giving them the patches first? When a new virus is released that exploits a hole I suspect the military are the least likely to bee the ones who end up DDoS'ing or spamming people as
  • But that means Microsoft won't release perfectly good patches to anyone else for a whole month.

    Doesn't that just add to the proof that MS treat their regular users like bitches.

    Yet another justification that anyone with a choice should be running Linux.
  • The reason they are doing this is really obvious: One of the obvious advantages to most Linux distributions is that they usually come out with patches within a day of vulnerabilities, and the patches are available immediately. Windows, on the other hand, patches once a week or once a month. Ovbiously, Linux looks better here. By offering the government a faster patch cycle, they are trying to compete with the Linux distributions and make themselves look better again.

  • So does this mean there'll be another month delay in getting patches to consumers?

    Scenario: - [zerohour] Exploit gains recognition
    - [+1 month] Microsoft releases patch to USAF
    - [+2 month] Microsoft releases patch to US Consumers

    Greeaaaat...
  • by RhettLivingston ( 544140 ) on Saturday March 12, 2005 @09:15AM (#11919225)

    First everybody (really, mostly IT professionals trying to balance benefit of patching versus risk and cost of patching) berated Microsoft for releasing patches too often. So, Microsoft responds and releases them once a month. OF COURSE that means they are holding onto patches for up to a month. The number of ignorant posts here that seem to think that this is an announcement that they are going to START delaying patches is just unbelievable. The industry already made them do that.

    This is just the natural next step in the social evolution of the situation. Now we've got the users who have a different benefit/risk equation demanding release of patches as soon as they are available. Its just the Air Force now, but it will eventually become a selectable option so that we can all choose our own poison.

    Personally, I've never had a problem with applying a Microsoft patch despite having 100s of applications on my machines including several large suites and a large proportion of open source. The problems seem to come mostly to people using low quality drivers or applications from a few companies that have questionable SW design practices like replacing core DLLs. I'd like the Air Force's option and suspect I'll eventually get it.

  • What about the goverment and people of other countries? They are not giving early patches to the "Government of The World", they are giving it only to USA. So now, all the US military system will be secure while the non-US military systems will be vulnerable. Although unintentional (or who knows), Microsoft is giving military advantage to USA and militarily deceiving (if that's a valid term) all other countries. I would want my country's goverment to consider Microsoft to be a military ally of USA giving U
  • OK.. I can see what they are thinking, I just don't know if it is right.

    I would deduce that they are thinking is this: Malicious H4x0rBoyz and script-kiddies don't do the real work of discovering vulnerbilities (real security professionals mostly do that), but just wait for MS to issue a patch or advisory and then build an expolit by reverse engineering the patch. Once the patch is announced, a race starts between crackers and admins to see who will test and deploy their respective patches-vs-exploits bef
  • I've heard some company (I think some embedded software company) spread FUD that the enemies of USA might purposefully introduce security holes in Linux to gain advantage over USA, so using Linux is not good for USA. But what's actually happening is almost the opposite. MS is giving patches early to USA so the systems of US enemies will still be vulnerable (but US goverment systems will be secure) and now USA will have the knowledge of how to exploit those systems. A reason for most countries not to use MS
  • How will the Law of Unintended Consequences manifest itself first?

    1) Honest government employees will upload patches to warez sites; private sysadmins will have to turn to piracy to protect their networks.

    2) Dishonest government employees will upload trojaned patches to warez sites; private sysadmins will have no way to compare them to the real MS patches until it's too late.

    3) Honest government employees will post exploit information to white-hat security lists; private sysadmins will have to make choic
  • There are lots of non-US-government systems that a re critical: hospitals, banks, air traffic control, etc.
    And anyways, the important patches non-a-days relate to keeping out Internet intruders. Hopefuly the miltary systems aren't on the public net!
  • delays (Score:4, Insightful)

    by Jesus IS the Devil ( 317662 ) on Saturday March 12, 2005 @10:12AM (#11919493)
    The real deal isn't that they're offering these updates to the government first, but rather, that they're DELAYING it from everyone else.

    This makes no sense, since a patch is a patch. Sure M$ might earn some brownie points from the government entities that get this priority, but the resulting backlash from everyone else will be worse.
  • ...either M$ will give patches to the govt. before they are fully tested and finished, or they will delay finished patches to the rest of the world despite a known vulnerability

    So which is it, Bill? And will you offer the same treatment to other governments worldwide? or will you tell them that you are deliberatly leaving them twisting in the wind with the rest of us, while the US Govt gets preferential treatment?
  • Doublethink (Score:3, Insightful)

    by Doc Ruby ( 173196 ) on Saturday March 12, 2005 @10:41AM (#11919647) Homepage Journal
    How can MS possibly justify holding back the patches to anyone? What does letting the rest of the world twist in the wind gain them, or even the government? This is obviously a ploy to gain favor with some stupid bureaucrats who can't tell that this adds absolutely no security to anyone. Because its realities have no other possible redeeming value, and a great deal of cost.
  • by JeffTL ( 667728 ) on Saturday March 12, 2005 @12:05PM (#11920094)
    Either Microsoft has been withholding patches from their paying customers and has decided to let a small segment (the federal government) go ahead and have them once they're ready, or they're foisting incomplete and buggy code onto the government, including the IRS.

    If you get audited this year, blame Microsoft.

On a clear disk you can seek forever.

Working...