4 ms·
Yeah, this article is FUD. The Windows 10 piece is stupid - it's a pre-release OS, these things happen. It's why they haven't released the OS yet, so I'd say t
by exelius 12y ago
Yeah, this article is FUD.
The Windows 10 piece is stupid - it's a pre-release OS, these things happen. It's why they haven't released the OS yet, so I'd say their QA process worked. Pre-release OSes don't go through the same level of QA - if you don't like it, you should use a supported OS.
Second, with Exchange updates, there's kind of an unspoken understanding that there is no way MS can test every scenario their users will throw at Exchange. So updates are often released that can cause edge case issues, with the understanding that their large customers will test the updates in a test environment before deploying them. If issues come up, Microsoft can pull the update. These kinds of retractions are not uncommon with server software.
- Ded7xSEoPKYNsDd 12y agoHow long can you responsibly run Exchange on the internet after a security patch was released? The recent Drupal SQL injection [1] showed that attackers have databases of fingerprinted services, just waiting for an update that shows them how to exploit these systems. Reverse engineering the binary patches for Exchange and building a reliable exploit out of them probably takes longer than it did in the case of that SQL injection in Drupal. But how long a testing period is too long? 1: https://www.drupal.org/PSA-2014-003 https://www.drupal.org/PSA-2014-003
- exelius 12y agoIn the case of something like a corporate Exchange server, you can run an IDS/IPS system in front of them to block any specific exploits. Even then, enterprise configurations of Exchange are usually quite unique to the company, so there's a low likelihood of a security problem being exposed to the outside.