4 ms·

> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compat

> A couple of lines to fix the bug, in theory Yes that's all it takes. No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. None of the work on the installer or updater. No release notes or other communication to the community. Just a couple lines of code. Easily done before morning coffee.

mosselman 9y ago
Luckily 'they don't care about security at all'. They just looked into it for fun when the report came in.
dspillett 9y ago
> code reviews, security review, integration testing, quality assurance testing, compatibility testing, Valid counter-criticism of the "just a couple of lines of code" line generally, but four months is a long time since disclosure and that is a lot of morning coffees.
- cptskippy 9y ago
  I wasn't defending Microsoft, just responding to the trivialization the op made. According to the article, Microsoft is dedicating resources to a new client which won't exhibit the flaw. So I guess that means either they examined the flaw and determined it wasn't a high enough risk to warrant patching, or they don't care. Dealer's choice I guess. Maybe the number of people using Skype these days is insignificant? I tried to use it about a year ago and noped the hell away after 5 minutes.
enzanki_ars 9y ago
As others have already noted, yes, it’s a pain ship fixes in a company setting, and I fully understand that. On the oth r hand, 4 months for no fix is inexcusable.
vorpalhex 9y ago
> No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. If this was a small startup, I can absolutely see those being hurdles. This is Microsoft on a product they've had for 20+ years that is a major part of their platform - those things should be mostly automated and well oiled machines. A mature enterprise level company has no excuses for "QA is hard!" or "We can't validate patches!" for a product they sell. I don't expect them to get this out in ten minutes, but they should be able to manage a patch in 24 - 72 hours for a fairly critical and relatively easily solved security bug.
- Quarrelsome 9y ago
  I'm guessing if they fix this bug the simple way they break the entire product and the proper way is many months of work (entire eco-system restructure).
- BoorishBears 9y ago
  Ironically I would comment exactly what you did with, but the roles reversed: “If this was a small startup I couldn’t see those being hurdles but at a behemoth like MS with an almost 2 decade old product I can.”
- latencyloser 9y ago
  As a former Microsoft employee, my experience was that the longer a product was around, the harder it was to figure out who understood any part of it well enough to change something. I would guess I averaged about 10 lines a month on my project that had been around for decades. Making even slight tweaks required dozens of meetings, design discussions, functional and performance testing, etc. etc. It took an eternity.
  - patcheudor 9y ago
    Microsoft is still actively patching Skype. Here's an example of them patching what sounds like a similar DLL flaw just last year: https://www.cvedetails.com/cve/CVE-2017-6517/ https://www.cvedetails.com/cve/CVE-2017-6517/
  - 9y ago
orblivion 9y ago
I enjoyed your retort, but I'll note that it being "just a couple lines of code" at least should imply that this is no harder than other security fixes, which somehow do make their way out faster than main releases.
sp332 9y ago
I think this is a response to the headline, which specifically mentions a "massive code rewrite".
sodapopcan 9y ago
"Can't you just..."
- cptskippy 9y ago
  Like nails on a chalkboard.
corporatocracy 9y ago
Bureaucracy is hard, but so is losing clients or getting sued by an enterprise customer for negligence in handling a known security hole in a timely fashion. Corporations can become extremely agile when there's money on the line.
simooooo 9y ago
They currently can't get my messages to reliably send, stop my UI from turning to Korean, keep my pinned chat groups at the top, or make the answer call button work reliably. I wouldn't get your hopes up

mosselman 9y ago

Luckily 'they don't care about security at all'. They just looked into it for fun when the report came in.

dspillett 9y ago

> code reviews, security review, integration testing, quality assurance testing, compatibility testing, Valid counter-criticism of the "just a couple of lines of code" line generally, but four months is a long time since disclosure and that is a lot of morning coffees.

cptskippy 9y ago
I wasn't defending Microsoft, just responding to the trivialization the op made. According to the article, Microsoft is dedicating resources to a new client which won't exhibit the flaw. So I guess that means either they examined the flaw and determined it wasn't a high enough risk to warrant patching, or they don't care. Dealer's choice I guess. Maybe the number of people using Skype these days is insignificant? I tried to use it about a year ago and noped the hell away after 5 minutes.

enzanki_ars 9y ago

As others have already noted, yes, it’s a pain ship fixes in a company setting, and I fully understand that. On the oth r hand, 4 months for no fix is inexcusable.

vorpalhex 9y ago

> No code reviews, security review, integration testing, quality assurance testing, compatibility testing, or validation. If this was a small startup, I can absolutely see those being hurdles. This is Microsoft on a product they've had for 20+ years that is a major part of their platform - those things should be mostly automated and well oiled machines. A mature enterprise level company has no excuses for "QA is hard!" or "We can't validate patches!" for a product they sell. I don't expect them to get this out in ten minutes, but they should be able to manage a patch in 24 - 72 hours for a fairly critical and relatively easily solved security bug.

Quarrelsome 9y ago
I'm guessing if they fix this bug the simple way they break the entire product and the proper way is many months of work (entire eco-system restructure).
BoorishBears 9y ago
Ironically I would comment exactly what you did with, but the roles reversed: “If this was a small startup I couldn’t see those being hurdles but at a behemoth like MS with an almost 2 decade old product I can.”
latencyloser 9y ago
As a former Microsoft employee, my experience was that the longer a product was around, the harder it was to figure out who understood any part of it well enough to change something. I would guess I averaged about 10 lines a month on my project that had been around for decades. Making even slight tweaks required dozens of meetings, design discussions, functional and performance testing, etc. etc. It took an eternity.
- patcheudor 9y ago
  Microsoft is still actively patching Skype. Here's an example of them patching what sounds like a similar DLL flaw just last year: https://www.cvedetails.com/cve/CVE-2017-6517/ https://www.cvedetails.com/cve/CVE-2017-6517/
- 9y ago

orblivion 9y ago

I enjoyed your retort, but I'll note that it being "just a couple lines of code" at least should imply that this is no harder than other security fixes, which somehow do make their way out faster than main releases.

sp332 9y ago

I think this is a response to the headline, which specifically mentions a "massive code rewrite".

sodapopcan 9y ago

"Can't you just..."

cptskippy 9y ago
Like nails on a chalkboard.

corporatocracy 9y ago

Bureaucracy is hard, but so is losing clients or getting sued by an enterprise customer for negligence in handling a known security hole in a timely fashion. Corporations can become extremely agile when there's money on the line.

simooooo 9y ago

They currently can't get my messages to reliably send, stop my UI from turning to Korean, keep my pinned chat groups at the top, or make the answer call button work reliably. I wouldn't get your hopes up