Microsoft to Offer Patches to U.S. Govt. First

I see it from the point of view that presumably if MS is able to offer a patch to the US government that means that the patch is ready to be released. So I take it from that that normal users are not good enough to receive patches on time because it can't possible take a month to get the patches onto windows update or whatever distribution media.

The conspiracy theory side of my starts to think that they're deliberately going to release patches late so that the US government can break into ppls computers easier :P

ac

Ah, but they don't say that, do they? I bet the US govt is getting the patch that hasn't been seriously beta tested...as just mentioned...free beta testing with MY tax dollars, damnit!

The life you know, all the stuff you take for granted it's not going to last,
Imagine a world of permanent darkness, where machines control mans destiny...

Rise of the machines, "Terminator" hehe

This is simple lipservice to make MS look extra patriotic.

Two important things to consider:

1. Microsoft Products are not found on any government systems that are used to secure anything important.

2. "Microsoft will give the U.S. Air Force versions of software "patches" to fix serious security vulnerabilities up to a month before they are available to others"

We can draw a few conclusions from this data. First, who cares if the systems are secure, their exposure factor is practically nil. Second, these priority patches are likely to be incomplete, in that they only work for a pre-defined set of configurations. A universal patch may be one in the same, may follow in an hour, a day, but no more than a month.

Note, I make no mention of exotic government developed viruses, no untested software, and nothing implying the insecurity of the US's nuclear arsenal. Why? Ockham's razor aka "the economy principal" look it up if you don't know.

catch

Be careful when using Occam's razor, it will cut you quite quickly. It *might* be that MS is just wanting to do something nice for Uncle Sam, but I seriously doubt that too.

Personally, I see one of two economic possibilities - and going by that same razor and least hypothesis, I find:

Either MS is out to get its software on all government machines and not just the unimportant ones, thereby making huge profits, or they're using the government for a beta testing platform since they're on unsecured machines anyway, and there's some pretty damn good techies employed by the feds.

Both reasons wind up making $ for MS, either in the form of higher sales or in free research.

What I most question is what does the government get out of the deal other than an early patch?

Well, I have developed beyond medaeval philosopy.............."Occam's razor"............jeez!.........this IS the 21st. Century is it not?

Quote:

---

For example, through two data points in a diagram you can always draw a straight line, and induce that all further observations will lie on that line. However, you could also draw an infinite variety of the most complicated curves passing through those same two points, and these curves would fit the empirical data just as well. Only Occam's razor would in this case guide you in choosing the "straight" (i.e. linear) relation as best candidate model. A similar reasoning can be made for n data points lying in any kind of distribution.

---

So anyone with even a modicum of lateral thinking capability (thinking outside the box) will be using Gillette for a shave, not Occam :D

|3lack|ce seems to have cut a lot closer to the chase, in that I strongly suspect that it is a Microsoft aggrandisement scheme..................was it not only a few weeks ago that we heard that the US military were ordered NOT to accept "free trial" MS Office software?

:)

Ockham's Razor simplified: "If you live in the US and you hear hooves, think horses, not zebras." that is all things being equal, the simplest solution is most likely the correct one. Is it always the correct one? Nah, but most times it is. (expanded as: http://phyun5.ucr.edu/~wudka/Physics...ww/node10.html )

http://pcp.lanl.gov/OCCAMRAZ.html - You should be negged Nihil for misusing a quote out of context to make a different point, but I am feeling nice. Please use data more appropriately in the future.

Let's look more at other possibilities presented:

Quote:

---

Either MS is out to get its software on all government machines and not just the unimportant ones, thereby making huge profits

---

This would take a dramatic change (http://www.trustedsystems.com/b-level.htm ) in Windows. Important (ie. high assurance) systems need to met specific requirements, it is more than just having the right marketing technique. Microsoft knows this, the US government knows this, many outsiders do not know this and thus what may seem like a viable possibility is in fact... not.
Next on the docket:

Quote:

---

or they're using the government for a beta testing platform since they're on unsecured machines anyway, and there's some pretty damn good techies employed by the feds.

---

The government actually has very few "good techies" for the simple reason that government pay is garbage. They do however have many brilliant researchers working for them directly (national labs folks) and contracted (MITRE among others) but these people would be in no way dealing with the modification of commercial off the shelf software.
Furthermore, (and this is key) what happens if say VISA gets compromised by an exploit in-between the government release and the commercial release? Microsoft is in huge trouble... unless as I stated the government patch is only targeted at specific pre-defined configurations with a general purpose patch to follow.

Basically all Microsoft has done is developed a new method of releasing patches. This way organizations that follow the configuration guidelines will get faster patching than the current system and organizations that have poor or exotic configurations stay on the current system. This gives Microsoft greater implied control over end systems which will ensure that a greater number of systems are configured in a secure manner (with the reward of more rapid patching) and this in turn will lower the number of Microsoft compromises giving the appearance of greater security.

Why start with the government? Because an initial large client that doesn't respond to typical advertising is much cheaper than a huge campaign to get the word out to corporate America.

cheers,

catch

It would seem to me that a lot of people are making assumptions and comparisons without really understanding how the current MS patch process works. I've posted this before, but I'll go ahead and post it again.

There are basically three stages to a patch in the MS way of doing things. A service pack is moreso just a collection of patches that has been through more testing.

dev patch- the patch, as created by the developers, that they believe will fix the problem. Very little, if any, testing has been done on a patch at this particular part of its life-cycle.

buddy patch or buddy drop- This is the stage that indicates that the patch has been tested to fix the problem in the MS labs, and it does not appear to cause any major issues. If you call MS and report a new bug to them they will ask you to apply a buddy patch to help them test that it actually fixes the problem before giving the hotfix an official status. I never install buddy patches as they have not been fully regression tested and if your environment is even slightly different than what was tested in the lab you can have major issues. I would guess that this is the stage the patches will be in when the US government gets them. For the issues that I have reported to MS, and subsequently received a patch for, I would say that a patch is probably going to spend anywhere from 2-6 weeks in the buddy drop status. Depending on how quickly it can be tested.

Official hotfix- The patch has been tested but it is not recommended that you install the patch unless you have experienced the issue, or if not installing the patch results in a security risk. The biggest issue with this level of a patch is even though it has been tested it has not been tested as much as say a service pack, or a .0 release.

Service packs- a collection of hotfixes that have been fully tested to insure interoperability with one another. Even though this is the most tested form of a patch you could still have issues.

I guess that the buddy drop will be what the government is getting mainly because MS does not hold up critical hotfixes once they are ready to be deployed. The only case where they would hold one up would be if it was finished shortly before the official MS Patch Tuesday for that month. If you have a premier contract and you are having issues and MS has a buddy patch available for that issue, they will offer it to you. Even if that means that you get a security patch weeks before it is going to be released.

If they are indeed getting buddy patches I have no problem with that. If, however, MS is holding up production ready patches just to let the DoD servers get a leg up on everybody else I would have an issue with that. I have no problems with patches being distributed to the critical infrastructure stuff first, for instance the Cisco SNMP patches from then end of 2003. I just think this should be done an a per case basis.

MS just wants to stop or more appropriately slow the infection of open source and linux. And continue to reap the huge licensing contracts over concerns of security and financial backing.???