06.11.09
Microsoft’s Worst Patch Tuesday Ever, Intent to Shut Out the Security Industry
Summary: Microsoft unable to handle security; excludes third-party security vendors rather than assist them
IT IS well understood that Microsoft keeps a lot of the flaws in its software secret and it patches them secretly too [1, 2, 3]. So the latest reports about Microsoft patching 31 vulnerabilities must note that 31 is a lower bound, and that’s to be generous. On paper at least, this number is said to be the worst ever.
All told, June’s patch drop fixes a total of 31 vulnerabilities, a whopping amount of work for anyone who has to test and validate the fixes.
There is more coverage in The Register and in IDG, which says that “Microsoft sets record.”
Vista 7 will not be secure either. But in order to improve perception of security, Microsoft will distribute separately a ‘feature’ which is said to solve a problem that should not have existed in the first place.
Microsoft Corp is getting ready to unveil a long-anticipated free anti-virus service for PCs that will compete with products sold by Symantec Corp and McAfee Inc.
This is likely only to reduce security. It harms independent companies and thus slows down development. Internet Explorer 6 monoculture, for example, had a chilling effect on the Web. Only competition drives progress. █
aeshna23 said,
June 11, 2009 at 9:19 am
I feel Roy isn’t being fair for attacking M$ for launching a free anti-virus service. Don’t we attack M$ for requiring its customers to purchase an anti-virus service?
That said, it strikes me as a bad move on M$ behalf to do this now. It means M$ has to pay to provide a service other firms were already providing. And M$ is short of cash and the BING thing is a certain money loser. I’m starting to believe that it’s not Linux that will defeat M$, but M$ will just commit suicide. Does anyone have any clue why Ballmer would think providing a free anti-virus service now makes sense?
Roy Schestowitz Reply:
June 11th, 2009 at 11:07 am
aeshna23, just to put things in context, see that last sentence. The argument comes from security vendors themselves.
Without real competition (e.g. in Web browser, as many won’t bother buying the equivalent of Opera), there will be a poorer outcome for all to suffer from. The Web we all share will be less secure, not just less standards compliant.