June 20th, 2007
Beware of undisclosed Microsoft patches
My blogging colleague Ryan Naraine offers up some interesting food for thought regarding Microsoft’s philosophy behind disclosing (or not disclosing) all of the vulnerabilities it is fixing via its patches.
Microsoft is, admittedly, silently patching certain vulnerabilities. The practice isn’t unique to Microsoft, as Naraine notes. But it is controversial. Microsoft says it is doing this to thwart “the bad guys.” But the silent patching also makes IT administrators’ jobs more complicated.
From Naraine’s blog post:
“You’re not fooling exploit writers with silent fixes. You’re only fooling your customers,” says Marc Maiffret, co-founder of eEye Digital Security.
Forget for a moment whether Microsoft is throwing off patch counts that Microsoft brass use to compare its security record with those of its competitors. What do you think of Redmond’s silent patching practice?
Mary Jo has covered the tech industry for more than 20 years. Don't miss a single post. Subscribe via Email or
RSS. You can also follow Mary Jo on Twitter.
Got a tip? Send Mary Jo your rants, rumors, tips and tattles. For disclosure on Mary Jo's industry affiliations, click here or to see Mary Jo's full profile click here.
