4 ms·

Why can't we just have the choice to apply as soon as it's ready? If you don't want to apply the patches as soon as they're released, then you'd be more than w

by jenscow 12y ago

Why can't we just have the choice to apply as soon as it's ready? If you don't want to apply the patches as soon as they're released, then you'd be more than welcome to put them on hold for 4 weeks yourself when it's more convenient.

acqq 12y ago
This time, the "ready" will be the following Tuesday. Google didn't respect this, effectively providing the 0-day to the world. There are bad guys looking for 0-days out there. If they learn about the vulnerability from the patch, at least the world has the patch before the bad guys do. Now it's the opposite. Edit: See _wmd's explanation about the technical details of all this in the same level of the answers.
_wmd 12y ago
Basically because bindiff (http://www.zynamics.com/bindiff.html http://www.zynamics.com/bindiff.html ). The moment an updated binary is available, the clock starts ticking towards a vulnerability being reverse engineered from the update. A few years back, there was a huge amount of research in the infosec community whose goal was to automate extraction of these vulnerabilities (yes really - a robot automatically producing 0-day given an updated binary). Symbolic execution trickery aside, this remains a straightforward task for a reverse engineer to manually perform given a set of debug symbols (which Microsoft supply for developers). Your options become either to release an update the moment it's tested, immediately making vulnerable customers who have a change management policy (usually also the biggest and juiciest targets - fortune 500s including ironically the likes of Google), or delay any release until some coordinated date, giving everyone an equal and predictable opportunity to cope with the exposure, which is how Microsoft do it.
- wglb 12y ago
  This entire discussion presumes that this bindiff method of discovering the bugs in Windows is the only method available to attackers. What are the chances that attackers or other agencies already know of these vulnerabilities and are exploiting them? Microsoft's delays extend the time that the silent attackers have.

by jenscow 12y ago

acqq 12y ago

This time, the "ready" will be the following Tuesday. Google didn't respect this, effectively providing the 0-day to the world. There are bad guys looking for 0-days out there. If they learn about the vulnerability from the patch, at least the world has the patch before the bad guys do. Now it's the opposite. Edit: See _wmd's explanation about the technical details of all this in the same level of the answers.

_wmd 12y ago

Basically because bindiff (http://www.zynamics.com/bindiff.html http://www.zynamics.com/bindiff.html ). The moment an updated binary is available, the clock starts ticking towards a vulnerability being reverse engineered from the update. A few years back, there was a huge amount of research in the infosec community whose goal was to automate extraction of these vulnerabilities (yes really - a robot automatically producing 0-day given an updated binary). Symbolic execution trickery aside, this remains a straightforward task for a reverse engineer to manually perform given a set of debug symbols (which Microsoft supply for developers). Your options become either to release an update the moment it's tested, immediately making vulnerable customers who have a change management policy (usually also the biggest and juiciest targets - fortune 500s including ironically the likes of Google), or delay any release until some coordinated date, giving everyone an equal and predictable opportunity to cope with the exposure, which is how Microsoft do it.

wglb 12y ago
This entire discussion presumes that this bindiff method of discovering the bugs in Windows is the only method available to attackers. What are the chances that attackers or other agencies already know of these vulnerabilities and are exploiting them? Microsoft's delays extend the time that the silent attackers have.