Actions

Journaux











Microsoft offre les informations sur les patchs plus rapidement pour les premiums

Écrit le 14/09/2004 @ 18:35 par Drizzt

Informatique - SécuritéSelon cet article de SlashDot, Microsoft annoncerait les patch pour les clients premiums avant les autres, leur laissant donc planifier
leurs mises à jour de sécurité avec plus de clairvoyance.

Il semblerait que la pratique soit aussi adoptée par le US-CERT.

Dernière modification le 18/09/2004 @ 14:02 par Drizzt

Commentaires

Commentaire par Nick  Score: 2
Écrit le: 14/09/2004 @ 17:59

Il semble y avoir eu confusion sur Menzonet comme sur Slashdot.
Ce n'est pas l'update qui est donné avant, c'est un avertissement qu'un update s'en vient pour préparer les IT aux updates qu'ils auront à faire (engager plus de staff, ne pas prendre de congé, etc.).

Lu sur Slashdot

If you actually read the article, you would know that they aren't actually offering patches early to their premium customers, they are only letting them know that patches are on the way. Everyone in the world gets the patches at the same time. Premium customers are at the same risk as we are. The reason for the "heads up" is so that IT managers can get ready for the huge task of updating every machine they manage. Individuals have only their own computer, or at most a handful of others. These patches are usually expected anyway. And you can find a "heads up" of your own just by reading tech news sites online.



Lu sur InternetNews

Microsoft said the program is designed to provide very limited information in a brief e-mail three business days before the anticipated release of monthly security bulletins. It also said the notification is to assist customers with resource planning for the monthly security bulletin release.

Microsoft insisted the information provided in the notice was "very basic in nature" and intended only to provide general guidelines concerning the maximum number of bulletins that may be released, the anticipated severity ratings, and an overview of products that may be affected. "The information is purposely not specific and does not disclose any vulnerability details or other information that could put customers at risk."

However, the availability of advance notice for high-end customers isn't likely to sit well with most Microsoft customers who must wait for the public release of bulletins on the second Tuesday of every month.

The move could also raise the ire of independent security researchers who detect software flaws and work privately with Microsoft ahead of coordinated public disclosure.

While Microsoft has typically provided warnings ahead of time to ISVs if a patch will disrupt a specific application, advance notice of specific software patches are never released.

In the notice, which was seen by internetnews.com, Microsoft said it was intended to "help our customers plan for the deployment of these security updates more effectively. The goal is to provide our Premier customers with information on soon-to-be released security updates."

However, Gartner security analyst John Pescatore described the pre-release of security information to high-end customers only as "an extremely dangerous practice."

"I know that Microsoft provides some advance warning to the Department of Homeland Security on things that could affect critical infrastructure. But I've never seen Microsoft give advance information only to customers who pay. That would be a terrible thing to do," Pescatore said.



En espérant clarifier un peu la situation

Commentaire par Drizzt  Score: 2
Écrit le: 14/09/2004 @ 18:30

C'est ce que j'ai cru comprendre moi aussi par après.. mais je n'ai pas trop eu le temps de changé l'article..

Merci pareil Smile


Tous les blogs
<< Security Update 2004-09-07 V. 1.1 | Retour aux blogs | Le Canada champion du monde au hockey! >>
Blogs de la même catégorie
<< Archivage de données | Code pour exploiter la faille JPEG dans GDI+ disponible >>