Patch Monday

Topic

New Reply

I’m fed up with the botched patches. In September we’ve had TWELVE recalled and re-worked patches that were sent down the Automatic Update chute.I hav
[See the full post at: Patch Monday]

Reply | Quote

Replies

Interesting proposal.

I didn’t understand until page 2 that by “volunteers” you meant everyone: “Why not give everybody and his brother an early crack at them”.

I think one day is too short a time, resulting in manic activity: “Manic Patch Monday”. I understand the short time, if the patches are opened to everyone, to discourage reverse engineering, already in “Exploit Wednesday”.

However, even NOW, Microsoft does NOT listen to security warnings even months in advance, from security experts and others in the IT field. Even if they set up dedicated “channels” of communication to receive bug reports, is 24 hours enough for the volunteer to test, then report, and finally for Microsoft staff to sift through reports? Not to mention spiteful hackers may plug these channels with DOS attacks.

I would modify your proposal: in addition to your Manic Patch Monday, add a Fixit Friday, to open the patches to a screened group of TRUSTED volunteers and partners. Then they have 3-4 days to test and report back to Microsoft through trusted channels.

Volunteers can include academics and trusted white hat hackers. “Partners” can include antivirus and security companies and software companies Microsoft already works closely with anyway; patches would be delivered specifically to key trusted personnel within each company (CIOs, et al).

The pro is extra time to work over the weekend; the con is companies will literally be (paying for) working overtime to test the patches.

Maybe add a reward for each bug found, such as Microsoft recently offered for reporting security flaws. The money would be small compared to the loss of reputation (? if any further drop is possible) for Microsoft – and more importantly, the losses in productivity for users and the business world from botched updates.

Reply | Quote