Tick-tock...

[moxnix]

Sorry jinxy, I just checked and:

The Windows Security Update CD is no longer available
We're sorry, but the Windows Security Update CD is no longer available for ordering. Please visit our Protect Your PC page for more information about improving your computer's security.

From: http://www.microsoft.com/athome/secu.../cd/order.mspx

[jinxy]

and SuSe and RH are doing the same

There linux distros, they are free, you only pay for the support package.

get bloody real.. the OEM..the system builder is at the edge here and needs to have the systems patched b4 sale.. but that won't happen.. the home PC market is so tight on margins, no retailer will risk wasting the half hour to install updates

You miss what I said here, Microsoft should re-call all copies of it's Os's that are under parr. Then replace with upto date. Oem or any manufaturer would not have to waiste time as they would have the correct level of patch to install.

Don't give me, it could be in stock for months befor the sell bollocks. That model does'nt make that much money and very few use it, Dell comes to mind here

by not being a bloody lazy cheap skate when buyimng the computer and paying a little extra for the right advice

Good advice should cost nothing and should be freely given. It never happens. You go by a new pc in any shop, the chances are you will speak to a spotty faced **** who does not know one end of a pc from the other. But he will shore as **** know what system gives him the most commision.

I have seen your post's here Undies, for a fair amount of time and I respect you for your knowledge. I can also believe that you will be truely honest with a customer, I get the impression you are involved in the trade. However I have first hand knowledge of the total incompetence, in general of the idiots who sell pc's, at least over here.

[Ghost_25inf]

Thats why I order all the latest patches instead of dling them. I recently reloaded my parents PC and as soon as I got online the Antivirus started popping up with new viruses that it was removing. I got tired of that happening so I ordered the disk from Microsoft for free. on top of that its better to have the disk on hand than run to the site every time. I saw in borders a PC mag was selling the SP2 patch with the mag for $14.00, I thought that was crazy.

[Und3ertak3r]

Whoooooo ****.... blew my stack at Jinxy sorry. mate.. Time for und3rtak3r to take a break..

yes..i have deleted the contents of this post... and if Jinxy read the original.. I am truley sorry..

no excuses..

[Und3ertak3r]

PC mag was selling the SP2 patch with the mag for $14.00, I thought that was crazy.

except in Australia.. all the mags supplied the SP2 WITH their regular cover disks, and some that don't normaly have Cover CD's supplied it AT NO EXTRA COST to the regular Cover Price..

[Vorlin]

Originally posted here by jinxy

So how does joe blow learne he can contact Microsoft and get these for free, if he can aford the international call.

Your average "Joe Blow" isn't up-to-date on technology, isn't savvy nor ever will be on computer software, doesn't have the first iota of a clue considering the internet and definitely isn't wanting to spend one dollar more on anything involving that computer he/she/it just got from Best Buy.

And in light of all that...which took me the entire 17 years I've been in the field overall, I have no sympathy for them. I educate those around me who pay attention to what I say and ignore those who say "yeah yeah, but how can I get X easier or without paying anything". Let the internet sort them out, as it will...

[ZomBieMann77]

Thats why I order all the latest patches instead of dling them

Dont rely to heavily on those CD's. By the time they get to the outbound mail room they are allready out of date. Im not saying they arent good to have but by the time they get to you when newly released it could very well be too late.

[MrLinus]

An alternative is making your own CDs from a secure, already patched machine. The issue of patch management is still one that's out there and it's still a matter of playing catch-up. There are a couple of things however that should be noted: 1) While most home users who aren't technically savvy might attach a system that's not patch, no corporate environment should be affected by this 2) as noted earlier, a simple but effective SOHO router/switch (for about $50USD) can help mitigate some of the risk for even an unpatched system.

Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

[Riotgirl]

Originally posted here by MsMittens
[B]An alternative is making your own CDs from a secure, already patched machine. The issue of patch management is still one that's out there and it's still a matter of playing catch-up.

Interesting discussion, especially because the media are so focused on virii, trojans and those oh! so pesky script kiddies but don't focus on the real threat (to an unpatched, unfirewalled system): worms. My knowledge on the subject is hazy, although I've read a primer or two and need to sit down and read a fantastic PDF from a link on AP all about virii and worms. The thought that there are worms and bots looking for unpatched, vulnerable boxes is frightening - since they are automated - because at least the other vectors require some degree of interaction.

Nice idea, MsMittens, and something I was thinking as I was reading the thread. Buy some brand quality CD-R's and download OS patches, Ad-aware, Spybot, Hi-Jack Thisk, AV and a firewall (update for each application iteration) and should one's box ever require a format or purchases a new box (or a friend or relative), then you have a solution to hand. Providing one has broadband connection, I reckon maybe half an hour of one's time? Someone with an entreprenurial spirit could even offer a service in their local neighbourhood.

Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

Again, would be interesting to see the results to ascertain not only time of compromise but also vectors of attack and types of attack.

Regards,
Riotgirl

[RoadClosed]

Has anyone actually setup a "honeypot" (that is, just built a box, unpatched) to see if the system is compromised within the time identified?

Could of sworn HTRegz or someone posted that a few weeks ago?