Microsoft's Security Bulletins Will End In February

Remember how Microsoft switched to cumulative updates? Now Computerworld points out that that's bringing another change. An anonymous reader quotes their report: Microsoft next month will stop issuing detailed security bulletins, which for nearly 20 years have provided individual users and IT professionals information about vulnerabilities and their patches... A searchable database of support documents will replace the bulletins; that database has been available, albeit in preview, since November on the portal Microsoft dubbed the "Security Updates Guide," or SUG. The documents stored in the database are specific to a vulnerability on an edition of Windows, or a version of another Microsoft product. They can be sorted and filtered by the affected software, the patch's release date, its CVE identifier, and the numerical label of the KB, or "knowledge base" support document.
Redmond Magazine reports that Microsoft still plans to continue to issue its security advisories, and to issue "out-of-band" security update releases as necessary.

Anybody used the new REST API?

[raymorris]

Has anyone used the new REST API they are replacing bulletins with? I've had trouble finding information about it, other than being told it's in no way RESTful.

Backwards, POST can't be cached, GET can

[raymorris]

Probably a typo, you listed it backwards. GET is cacheable, POST is not, by definition.

GET puts the parameters in the URL specifically so that a cache can return the proper resource based on the URL - users.doc?page=2 will return the second page of users.

POST *creates* something on the server or otherwise alters it, so just returning a cached response without sending the post to the origin isn't the same at all. You can't cache create_user.do, you actually have to send the command to the server each time

Re:

[poofmeisterp]

Probably a typo, you listed it backwards. GET is cacheable, POST is not, by definition.

GET puts the parameters in the URL specifically so that a cache can return the proper resource based on the URL - users.doc?page=2 will return the second page of users.

POST *creates* something on the server or otherwise alters it, so just returning a cached response without sending the post to the origin isn't the same at all. You can't cache create_user.do, you actually have to send the command to the server each time you want to create a user.

With the introduction of quantum computing, yes, POST will be able to be cached. Or not cached. Or cached a little. *failed drumroll*

Ah yes

[Anomalyst]

Change for the sake of change, lacking any legitimate reason (aside from additional revenue, I have no doubt access is replete with [self aggrandizing] banners and such). It's not better, just different..

Re:

[Anonymous Coward]

It is better, you can access it across REST API, integrate your own interface and watch exactly what you want to watch. We are looking at integrating it into our alerting system to trigger alerts for individual teams based on their area of responsibility. This is much better than trawling through bulletins.

Re:Ah yes

[jellomizer]

So offload the work from people who are security and system administration midended and dump it on the other teams who are focused on meeting the business objectives. So this way more security holes get put in but that is fine because it is the other departments fault.
Just because the staff may have the ability to monitor such stuff it doesn't mean they have the time and resources to actually do the job.
Hey it may work at your organization but you are crossing on of the pet peeves I have at may work where the System Administration dumps edicts and their jobs to the App teams while the App teams also have a full work load.

Re:Ah yes

[arglebargle_xiv]

Change for the sake of change, lacking any legitimate reason

There's a perfectly legitimate reason for doing this. As everyone knows, Windows 2000^H^H^H XP^H^H^H Vista^H^H^H 7^H^H^H 8^H^H^H 10 is the most secure version of Windows ever, so there's no need for security bulletins any more because it's so secure.

Re:

[ElizabethGreene]

Security bulletins aren't a great way to track how secure or insecure software is. The best way to do that is with the CVE [wikipedia.org] system. Microsoft (and most other vendors) log publicly and privately reported vulnerabilities as CVEs and link to the CVE when describing vulnerabilities.

My hope is that this change will eliminate some of the pain of running down security bulletin data. Right now if someone asks you if you are patched against MS16-040 you have to go look that up, look up each individual KB inside t

Re:

[arglebargle_xiv]

It depends on how they track the issues. At the moment when you're offered update XYZ, which always comes with zero information as to what it does ("this is to address security and stability issues" or whatever), you can click on a link, and then another link, and then scroll down, and then expand some text, and them click on yet another link, and maybe find out what it is the update is addressing. If you can still go from totally-zero-information to at least some information, whether it's a bulletin or C

What ??

[ddtmm]

I have no idea what this means

Re:

[SeaFox]

I have no idea what this means

Sounds like beginning in February, you'll be able to use that line a whole lot more -- as to why an update was sent out.

Abuse?

[Anonymous Coward]

It's Microsoft, so it is probably a way of delivering abuse.

Re:

[poofmeisterp]

It's Microsoft, so it is probably a way of delivering abuse.

...so fixes can be out out so they can be abused... so...

How does this profit Microsoft?

[mmell]

It's going to cost enterprises money to adapt to this change - whether it's for the better or not - because they have to spend time and effort evaluating and redesigning their patch and security management stances.

OTOH, they did manage to make the famous "patch Tuesday" and equally infamous "exploit Wednesday" go away . . . then again, nowadays it seems like every day is "exploit Wednesday".

Detailed?

[aliquis]

All I've ever seen in Windows is kinda "we've patched a bug in Windows ..." and then you could click some link and then you got about the same information and no real details whatsoever.

Maybe a bit more detail than what I said but .. nothing really worth mentioning or interesting.

Re:

[Motherfucking Shit]

Usually the "This update fixes yet another gaping hole that will allow anyone to take over your computer" blurb contains a reference to a vulnerability ID like "MS17-004," and then it's on you to go searching for the detailed bulletin [microsoft.com]. It's a pain in the ass but the details are out there.

Re:

[aliquis]

Maybe this is the stuff I've seen?
https://support.microsoft.com/... [microsoft.com]

Re:

[aliquis]

The worst window "feature" of them all is the fucking enforced reboot of your machine to install their damn upgrades.

Re:

[ayesnymous]

They used to provide very detailed patch bulletins, but they stopped doing it maybe 5 or so years ago.

Not that I care

On my Windows 7 machine, every cumulative security update since last October has failed anyway. I was told that it might have to do with the fact that it's a dual boot system. Be that as it may, since I use Linux for main work it doesn't matter that much, I will just make sure that I never use Windows for any payments or passwords and let Windows slowly 'phase out'. (Unfortunately, I cannot give it up entirely, because I'm using a lot of commercial Windows-only audio software.)

Not surprising

[quonset]

With each iteration of Windows Microsoft has made it more and more difficult to find and change settings on your own machine, even going so far as to move settings from one area they've been in for the longest time to a completely different and unrelated section

Now comes the updates. In the past one could easily find what the update entailed by reading the update itself (not always helpful) or by clicking the link Microsoft provided. Instead of that easy process one will now have to jump through hoops to find what they want.

Considering how often we hear Microsoft's software is supposed to make life easier, they sure seem to be going out of their way to make it more difficult.

Re:

[poofmeisterp]

With each iteration of Windows Microsoft has made it more and more difficult to find and change settings on your own machine, even going so far as to move settings from one area they've been in for the longest time to a completely different and unrelated section

Now comes the updates. In the past one could easily find what the update entailed by reading the update itself (not always helpful) or by clicking the link Microsoft provided. Instead of that easy process one will now have to jump through hoops to find what they want.

Considering how often we hear Microsoft's software is supposed to make life easier, they sure seem to be going out of their way to make it more difficult.

I think the second line sentences are a way of saying, "A way for Microsoft 'to just get you to install their fucking update or whatever they call an update and stop spending time finding out what it is and making choices as to whether or not you want them. Just fucking do it, already.'"

Am I wrong? :)