3 ms·

We've already got a way to patch zero days at the system level even if you use local NuGets. Fear not! This exists today, in fact.

• lloydsparkes 12y ago
  How is this possible?
  • hokkos 12y ago
    It is enabled for .Net 4.5.1 as explained here : http://blogs.msdn.com/b/dotnet/archive/2014/01/22/net-4-5-1-supports-microsoft-security-updates-for-net-nuget-libraries.aspx http://blogs.msdn.com/b/dotnet/archive/2014/01/22/net-4-5-1-...
    • bruceboughton 12y ago
      Will patches be installed on servers that have never run the application but have it deployed, such as DR servers? The mechanism describes seems to imply they won't as Microsoft Update won't know the vulnerable assembly is sitting on the machine waiting for a failover.
      • jameshart 12y ago
        Same applies if I have an old build of an application which I push; it'll be vulnerable until Windows Update kicks in to patch it.