Forum Moderators: open
[eweek.com...]
Microsoft officials say the company is prepping a patch for its Internet Explorer browser to plug the vulnerability exploited by the Download.Ject attacks in June. The patch is expected sometime next week, several weeks before the next scheduled batch release of security fixes.
.....
The forthcoming patch release is out of order, the company admits, revealing the critical nature of the patches as well as addressing the concerns expressed by customers over the recent issues with the browser. The last scheduled "Patch Day" was July 13, when the company released several "critical" updates.
Jennifer
....The patch is expected sometime next week, several weeks before the next scheduled batch release of security fixes....
That's the scariest thing: that security fixes are "scheduled" in batch releases....
Ewww....
(This message posted using Firefox/0.9.2) ;)
Jim
> Why do they wait for a certain date?
This is a direct response by Microsoft to complaints made by their corporate customers.
Microsoft-centric IT shops around the globe grew tired of a near 24/7 endless cycle of 'do we need it?', testing, patching, testing, patching, need it?, testing, patching... They have other important things to do too, ya know, like explain why you can't get to playboy.com or virus scan the system - again.
Microsoft, knowing very well that the complaints of lost productivity could end up equalling something evil - like looking at Linux, perhaps - responded by going to the once-a-month release schedule. The strain on IT departments has now been reduced. Every Patch Tuesday, they head over to Microsoft, look at the list(!) and grab only what they need. Multiple patches can be applied at once, then tested, reducing overall time spent patching & testing, increasing productivity and so on.
With this once-a-month schedule, you can now understand why there is such a big fuss when Microsoft releases a patch out of schedule. They are, in effect, telling IT departments to drop what they're doing right now, and fix another buffer overflow.
Consumer-level folk, which I imagine includes most of us here at WW, just have to go along for the ride. (If you don't like it, just start paying Micro$oft for 500-seat licenses of their wares...)
Personally, I much prefer the once-a-month schedule. It's much better than waking up (if you sleep), and heading over to the computer to ask, "What should I patch today?"TM ;)
The more I hear about Microsoft, the more I feel this over-sized giant has had its day.
Does this mean IE6 is now safe with JavaScript on?
