Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft Rushes Internet Explorer Patch

CmdrTaco posted more than 5 years ago | from the open-source-is-faster dept.

Internet Explorer 376

drquoz writes "Last week, it was reported that a critical security flaw was found in Internet Explorer. On Tuesday, experts were advising users not to use IE until a patch could be released. On Wednesday, Microsoft released the patch. An interesting quote from the article: 'Kandek suggests that Microsoft is at a disadvantage in updating Internet Explorer because its browser doesn't have a built-in update mechanism like other browser makers. Mozilla, for instance, just released Firefox 3.05 to Firefox users through its auto-update system.'"

cancel ×

376 comments

Sorry! There are no comments related to the filter you selected.

I am the bug, this is my FP.!! (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#26159553)

I am the bug, this is my FP.!!

Re:I am the bug, this is my FP.!! (1, Funny)

MikeDirnt69 (1105185) | more than 5 years ago | (#26159815)

Can we patch FPers?

Re:I am the bug, this is my FP.!! (0, Offtopic)

PincusJr (1310977) | more than 5 years ago | (#26160151)

Yes, but you need the Greasemonkey plugin :)

No patches needed for Ninnle! (-1, Redundant)

Anonymous Coward | more than 5 years ago | (#26160303)

If more people used the new Ninnle Internet Explorer port, there would be no need for constant patching, as Ninnle is ultra-secure. Switch to Ninnle for a secure browsing future! Switch to Ninnle Linux for an even more secure and stable computing experience!

Doesn't have a built in update mechanism? (2, Insightful)

JeffSpudrinski (1310127) | more than 5 years ago | (#26159561)

Sorry...but, "huh?"

Tools-Windows update. Or it is updated automagically if you have auto updates turned on.

I did RTFA, but I still didn't understand that comment.

-JJS

Re:Doesn't have a built in update mechanism? (4, Informative)

initialE (758110) | more than 5 years ago | (#26159777)

Firefox updates upon the point of relaunch. There is no need to restart windows. Also it remembers the context of every session in every tab, so you can continue where you left off.

Re:Doesn't have a built in update mechanism? (5, Informative)

buddyglass (925859) | more than 5 years ago | (#26159923)

True, true, and true. But that doesn't change the fact that IE only runs on Windows and 99% of Windows users have Automatic Updates turned on, usually checking weekly. So you're usually looking at a max "lag time" of seven days before an IE user gets the patch. And that assumes the worst possible case: the patch releases right after that user's computer was updated, and they use their computer (and IE) every day.

Re:Doesn't have a built in update mechanism? (5, Insightful)

markkezner (1209776) | more than 5 years ago | (#26160295)

While I would agree with you in theory, your ideas don't match up with what I've seen in the real world.

Until recently I worked in a mom and pop PC repair business. About 9 out of 10 systems I worked on were out of date, typically by a few months. I don't know for sure, but my guess is that users are switching auto-update off because can't be bothered with 'nag' messages from their software.

Granted, the machines I saw were generally dying, so it may not be a fair cross-section of home computer users. Still, the idea that 99% of home users should have new patches within a week flies in the face of what I saw every day.

Re:Doesn't have a built in update mechanism? (1)

ianare (1132971) | more than 5 years ago | (#26160301)

True, but I have seen many setups with automatic updates turned on, but IE6 being used. You have to explicitly select IE7 to install. So even if their system is updated, they are still exposed to many more problems.

Re:Doesn't have a built in update mechanism? (0)

jmn2519 (954154) | more than 5 years ago | (#26160443)

Not true, internet exploder runs on the mac.

No, !7-Day lag time (1)

penguin_dance (536599) | more than 5 years ago | (#26160477)

There is not a 7 day lag time, at least on Vista. I got a notice of new updates Tuesday, ran it yesterday and immediately after installing those, it popped up with another, new update--the IE patch. I always get a notice the day any patches or updates are released.

I think Windows/IE's biggest problem is that they want to authenticate that the version the user has is legal. That's understandable for an anti-pirating measure, but what it ends up doing is leaving thousands of computers open to vunerabilities that they can then pass on to even legitimate users. And in particular, businesses, who don't use automated updates and where there is a delay in applying patches.

Re:Doesn't have a built in update mechanism? (0)

Anonymous Coward | more than 5 years ago | (#26160359)

Interesting. I've installed this IE patch on upwards of 50 systems now (both XP and Vista) and although XP needed a reboot, none of the Vista ones have. Not sure what the point is about that.

I'm also interested in when Firefox's auto update (which works fine on Windows - I am running 3.0.5 now on my personal boxes) is going to work on Ubuntu. Last I saw, I had to use the Ubuntu updater to get this. Same as on Windows for IE where you JUST USE WINDOWS UPDATE ALREADY.

Re:Doesn't have a built in update mechanism? (4, Informative)

MikeBabcock (65886) | more than 5 years ago | (#26159797)

The automatic update system in Windows is far from perfect, and doesn't allow users the granularity of saying "yes, update my browser but no, leave the rest of my system alone."

Also, telling it you want to be notified of available updates (similar to Firefox's behaviour) is nowhere near as convenient as the way Firefox handles simply installing its own update and then restarting with your windows and tabs reopened to where you were last.

Re:Doesn't have a built in update mechanism? (4, Informative)

Culture20 (968837) | more than 5 years ago | (#26159869)

The automatic update system in Windows is far from perfect, and doesn't allow users the granularity of saying "yes, update my browser but no, leave the rest of my system alone."

I'm more of a Linux man, but I know this is wrong. If you set auto updates to download and notify for installation, you can choose which updates to apply.

Re:Doesn't have a built in update mechanism? (1, Informative)

Anonymous Coward | more than 5 years ago | (#26159941)

I'm more of a Linux man, but I know this is wrong. If you set auto updates to download and notify for installation, you can choose which updates to apply.

We are talking about auto-update. So no, you can't tell the system to auto-update IE, but don't touch MDAC or WGA or those mistranslated language packs.

Re:Doesn't have a built in update mechanism? (1)

joeytmann (664434) | more than 5 years ago | (#26160053)

Well the inherent problem with auto updating IE is its tight intergration into the OS. Were IE more like a regular browser the mechanisims would be different for doing updates. While Windows Update service isn't perfect I wouldn't say Firefox auto update is either. You can choose not to auto update if you wish. So which is worse, choosing to update or to not update?

Re:Doesn't have a built in update mechanism? (2, Informative)

BlackSnake112 (912158) | more than 5 years ago | (#26160299)

Yes you can. The auto update settings: 1. download and install everything. Or 2. download and tell me there are updates ready to be installed. Or 3. do not download but tell me there are updates.

With 2 or 3 you can pick the updates to install. You click on the update icon in the lower right on the task bar (unless you moved it to a different location). Choose custom install. Do not select express. Express will install everything. Custom will let you pick which ones to install. With 2 if you just shut down and get the option: install updates and shutdown, all the updates at that time will be installed and the computer shuts down. Some of the updates (usually on vista) finish on the next power on. Yes you can choose which updates to install. But you have had to change it from the default (option 1) to do so.

Re:Doesn't have a built in update mechanism? (1)

morgan_greywolf (835522) | more than 5 years ago | (#26159969)

Correct, but there is a caveat. If you turn on Windows automatic updates, the default is to always download and install updates. You can tell it only download and notify you of new updates, but this also relies on the user being able to discern which updates are for IE and which are for the rest of the system.

Most users aren't that bright. Hell, most users aren't bright enough to set automatic updates to 'download and notify'. Seriously.

With Firefox, the automatic updater only updates Firefox and extensions.

The point is, there is no separate auto-updater just for IE.

Re:Doesn't have a built in update mechanism? (4, Insightful)

Joe U (443617) | more than 5 years ago | (#26160095)

If the user isn't bright enough to read the patch list, then why are you trusting them to selectively patch the OS?

Set windows update to automatic and be done with it.

I have yet to run into an average user with a properly working computer who has had a problem with something pushed through Windows Update.

Re:Doesn't have a built in update mechanism? (1)

morgan_greywolf (835522) | more than 5 years ago | (#26160127)

Hmmmm? Wasn't there an update to WGA pushed through a year or two ago that broke everyone for a day?

Re:Doesn't have a built in update mechanism? (1)

Joe U (443617) | more than 5 years ago | (#26160389)

I remember something like that, I think it was a validation server issue and WGA was returning bad data for unactivated copies of Windows. It only affected retail users if I remember correctly, so basically those who built their own computers AKA someone who would know about patches and not an average user.

Re:Doesn't have a built in update mechanism? (1)

ciderVisor (1318765) | more than 5 years ago | (#26160253)

Most users aren't that bright. Hell, most users aren't bright enough to set automatic updates to 'download and notify'. Seriously.

I look upon myself as brighter than 'most users', but I just install every update to Ubuntu and FF plugins without question. With updates arriving seemingly every second day, I do a lot of approving without examining the details.

Re:Doesn't have a built in update mechanism? (4, Insightful)

prefect42 (141309) | more than 5 years ago | (#26160037)

With Vista they've made it doubly annoying, as Windows Defender gets updates *all* the time. So if you've got it set to notify, you get a whole lot of nagging. If only you could pre-approve Windows Defender updates...

Re:Doesn't have a built in update mechanism? (5, Funny)

rlp (11898) | more than 5 years ago | (#26159951)

doesn't allow users the granularity of saying "yes, update my browser but no, leave the rest of my system alone

Indeed, you can't have it automatically update a critical browser flaw, but say 'no' to the 1673rd revision of "Windows Genuine Advantage".

Re:Doesn't have a built in update mechanism? (1)

enharmonix (988983) | more than 5 years ago | (#26160035)

The automatic update system in Windows is far from perfect...

I'll agree with you there. A lot of times it forces a reboot when really all it needs to do is restart a program or service.

[It] doesn't allow users the granularity of saying "yes, update my browser but no, leave the rest of my system alone."

Mine does. Go to Control Panel > Automatic Updates and pick "Download updates for me, but let me choose when to install them."

Re:Doesn't have a built in update mechanism? (1)

5KVGhost (208137) | more than 5 years ago | (#26160081)

Well, Firefox's update system is hardly perfect either. If you run with the default settings it suddenly, without notice, declares that it's installing an update (why? what's changed?). And it's likely to disable a raft of plugins in the process. Of course this behavior can be changed, but so can the automatic settings for Windows Update.

FF's approach is also not optimal if you're administering more than a handful of machines.

Re:Doesn't have a built in update mechanism? (1)

davolfman (1245316) | more than 5 years ago | (#26160275)

Yes it does. Expert install lets you choose which updates you want.

Re:Doesn't have a built in update mechanism? (1)

Shados (741919) | more than 5 years ago | (#26160449)

Err? When there are updates, I can cherry pick which ones I want from a list with checkboxes, and click "Install", and do so ONLY for the ones I want. Some non-security related updates are irrelevent to me, so I left them to rot for months... I can even hide them so it never asks me about them ever again.

Are you talking about something else, or..?

Re:Doesn't have a built in update mechanism? (3, Insightful)

EricX2 (670266) | more than 5 years ago | (#26159801)

But does it check when you launch IE and install updates if they are available?

Re:Doesn't have a built in update mechanism? (1, Informative)

ascendant (1116807) | more than 5 years ago | (#26160537)

no, and neither does firefox, FYI. You clearly don't understand how the FF update mechanism works.

It checks while you browse. And downloads it. During the last session. Then prompts you at the start of the next session.

Re:Doesn't have a built in update mechanism? (2, Funny)

Anonymous Coward | more than 5 years ago | (#26159867)

Sorry...but, "huh?"

Tools-Windows update. Or it is updated automagically if you have auto updates turned on.

I did RTFA, but I still didn't understand that comment.

Clearly the article doesn't believe the microsoft line about IE being an integral, inseparable part of windows.

Re:Doesn't have a built in update mechanism? (1, Interesting)

Anonymous Coward | more than 5 years ago | (#26160167)

As Microsoft announced they will do Windows updates on Patch Tuesday, many people set Windows to check for updates once a month. They'd miss the updates until the next monthly schedule. As we've seen, if "experts" didn't advise people to stop using IE because of a specific flaw, this patch would have been released next month.

I like to think of this patch as a little present to administrators who wanted some overtime before Christmas.

While I don't have a lot of love for Microsoft, they got criticized by corporate types when they patched too frequently. They then get criticized for patching more frequently than once a month. Seems the only way out of that is to have the corporations use computers that load an OS on boot. It'd be cheaper and more secure anyway.

Re:Doesn't have a built in update mechanism? (0)

Anonymous Coward | more than 5 years ago | (#26160347)

[citation needed]

Re:Doesn't have a built in update mechanism? (0, Troll)

clintre (1078849) | more than 5 years ago | (#26160249)

Yeah and then reboot you PC for a stupid browser patch!

Homosexuality (-1, Troll)

Anonymous Coward | more than 5 years ago | (#26159563)

Homophobia [goatse.fr]

Interesting... (4, Insightful)

nhaines (622289) | more than 5 years ago | (#26159567)

Internet Explorer may not have an auto-update system, but Microsoft Windows has an update system rivaling that of Ubuntu and OS X in automaticness, if not scale.

Since Windows encourages users to allow automatic updates installed at 3am every morning and also by default installs any pending critical updates at system power down, it doesn't seem like any supported version of Internet Explorer should remain unpatched for too long.

Re:Interesting... (2, Interesting)

Yvanhoe (564877) | more than 5 years ago | (#26159617)

I even find it awkward that no popular linux distribution checks and proposes security updates at bootup.

Ubuntu has update notification (5, Informative)

tepples (727027) | more than 5 years ago | (#26159689)

I even find it awkward that no popular linux distribution checks and proposes security updates at bootup.

I have an ASUS laptop that runs Ubuntu 8.04. I turned it on, turned on the Wi-Fi radio, and started Firefox to look up something about reenactment costuming. After a few minutes, I noticed the update icon in the tray. One of the updates was Mozilla Firefox 3.05. I clicked download and apply, and it was done. So yes, Ubuntu automatically "checks and proposes security updates".

Re:Ubuntu has update notification (1)

Hordeking (1237940) | more than 5 years ago | (#26159905)

I even find it awkward that no popular linux distribution checks and proposes security updates at bootup.

I have an ASUS laptop that runs Ubuntu 8.04. I turned it on, turned on the Wi-Fi radio, and started Firefox to look up something about reenactment costuming. After a few minutes, I noticed the update icon in the tray. One of the updates was Mozilla Firefox 3.05. I clicked download and apply, and it was done. So yes, Ubuntu automatically "checks and proposes security updates".

Reenactment costuming? Are you Amish or something?

Re:Ubuntu has update notification (1)

nschubach (922175) | more than 5 years ago | (#26159937)

Also, I'm pretty sure I just selected an option to automatically install security updates in my Ubuntu 8.10 build ... I could have been dreaming, but I'm pretty sure I was wide awake.

Re:Ubuntu has update notification (0, Troll)

Cowmonaut (989226) | more than 5 years ago | (#26159991)

That was Firefox, not Ubuntu checking. Firefox does that automagically. Ubuntu did not do anything.

Wrong (4, Informative)

Nicolas MONNET (4727) | more than 5 years ago | (#26160213)

Firefox doesn't do tray icon notifications. And distribution-provided Firefox packages disable the auto-update, which wouldn't succeed anyway as the user running FF is not supposed to have write access to /usr. Instead, the distrib's auto-update mechanism handle it (apt for Ubuntu/Debian, yum for RedHat/Fedora, emerge for Gentoo, yast IIRC for Suse and so on). This is better on many levels, since it prevents a user process from altering the binary.
But you can also download the official Linux tarball and deploy it to your home directory; the FF update mechanism will handle it.

Re:Ubuntu has update notification (0)

Anonymous Coward | more than 5 years ago | (#26160311)

Ubuntu does exactly what he described.

Re:Ubuntu has update notification (1)

phoenix.bam! (642635) | more than 5 years ago | (#26160337)

No, you are completely wrong. Firefox's built-in auto update is disabled on Ubuntu. There is a built in update service which notifies you of updates automatically, pretty much the same way that windows does.

Re:Ubuntu has update notification (1)

zbuffered (125292) | more than 5 years ago | (#26160255)

I bet you have two blue arrows that point to each other in your tray. If Ubuntu checked and applied security updates at startup, you wouldn't need to reboot after applying them. I think that's what he's saying.

Re:Ubuntu has update notification (1)

Mr. Picklesworth (931427) | more than 5 years ago | (#26160383)

You never need to restart after a security update anyway. Most of the updated software restarts itself via package install scripts. It is a rare event such does not happen (kernel / driver updates, essentially). Sometimes logging out and in is a decent measure to be certain.

Re:Interesting... (1, Insightful)

Anonymous Coward | more than 5 years ago | (#26159739)

I can think of distros that check & prompt on your desktop.
Mandriva's had an Updates system tray utility for a while now.

Come to think of it, Linpus Linux Lite on the Acer Aspire One also auto-checks and prompts for software updates.

But does Windows/any OS have an option to prompt/auto patch at boot up, rather than after a user's actually logged in and known to be present?

These Novell Netware XP machines apply updates when we start work, not sure if it's before or after login, but having to reboot can be annoying if you've just got starting IM-ing hard to catch people

Re:Interesting... (0)

Anonymous Coward | more than 5 years ago | (#26159943)

Ubuntu and Fedora both have automatic update options. Have you ever used linux? No offense, but thinking about it, I think SUSE and Mandriva (Mandrake) both also had auto update checks.

Now at the server level, that is a matter of change/patch management that should not happen automatically. Redhat uses whats called a satellite server to push updates to the RHEL servers as necessary.

Re:Interesting... (0)

Anonymous Coward | more than 5 years ago | (#26159993)

I even find it awkward that no popular linux distribution checks and proposes security updates at bootup.

Ummm, have you used Fedora from Redhat? not only does it check for updates, by default it sends you a nag email every hour if updates are pending.

Re:Interesting... (1)

morgan_greywolf (835522) | more than 5 years ago | (#26160063)

What are you talking about?

The following extremely popular distros all have an automatic update system installed by default:

  • Ubuntu and all its incarnations, Kubuntu, Xubuntu, etc.
  • Mandriva
  • Fedora Core and Red Hat Enterprise Linux (all versions)
  • CentOS
  • OpenSuSE and SuSE Enterprise Server
  • Debian (I think Debian has the Synaptic updater that's in Ubuntu?)

Re:Interesting... (1)

the_womble (580291) | more than 5 years ago | (#26160173)

I even find it awkward that no popular linux distribution checks and proposes security updates at bootup.

Can you tell us what distro does not check for updates?

Re:Interesting... (1)

ianare (1132971) | more than 5 years ago | (#26160413)

One set by the user not to.

Re:Interesting... (0)

Anonymous Coward | more than 5 years ago | (#26160207)

It's possible I don't understand the point you're trying to make but Fedora has a daemon that checks for updates at bootup: yum-updateonboot and yum-updatesd.

Re:Interesting... (3, Informative)

Zonk (troll) (1026140) | more than 5 years ago | (#26159871)

Internet Explorer may not have an auto-update system, but Microsoft Windows has an update system rivaling that of Ubuntu and OS X in automaticness, if not scale.

Since Windows encourages users to allow automatic updates installed at 3am every morning and also by default installs any pending critical updates at system power down, it doesn't seem like any supported version of Internet Explorer should remain unpatched for too long.

Ubuntu and Mint, at least, check daily. In Ubuntu when there are security updates you see a red arrow in the notification area, when non-security updates are available you see a orange sun(?). Also, if you go to "System"->"Software Sources" and then the "Updates" tab you can set it to apply security updates automatically (this really should be default, IMHO).

I still think Ubuntu's update system rivals Windows and OS X as it not only updates the base OS and OS vendor applications, it updates everything on the system.

"Microsoft is at a disadvantage ... " (4, Informative)

El Cabri (13930) | more than 5 years ago | (#26159587)

I found this this morning in my Windows Updater log :

"
Security Update for Internet Explorer 7 in Windows Vista (KB960714)

Installation date: 12/18/2008 3:01 AM
"

IE autoupdating.. (4, Insightful)

skgrey (1412883) | more than 5 years ago | (#26159595)

If Microsoft had the same reputation that Mozilla did for their updates not screwing the pooch then maybe I would consider using that kind of auto-update feature.

Then again, I only use Firefox, and would never consider using IE. At one point do even common household users realize that IE is not the way to go?

Re:IE autoupdating.. (4, Interesting)

djmurdoch (306849) | more than 5 years ago | (#26159973)

Then again, I only use Firefox, and would never consider using IE.

It's harder to avoid than you seem to think. If you use Windows help to view .chm files, you're using IE. Usually they stay local, but many help files do include
links to web pages, and then you're out in the real world.

Re:IE autoupdating.. (0)

Anonymous Coward | more than 5 years ago | (#26160007)

What are you smoking?

I work at a University and we have over 5,000 desktops pointed at a WSUS server and in the 5 years that I have run the WSUS server we have had only 1 update that was automatically applied and caused problems. That 1 problem update was Windows Desktop Search and was not even supposed to be approved, but MS marked it wrong. 1 problem if 5 years, yea what a terrible record.

Firefox updated? (5, Insightful)

Henry V .009 (518000) | more than 5 years ago | (#26159599)

No -- Firefox is at the disadvantage. If you're a single user running as administrator, its auto-update is great. However, the users (all running limited accounts) on our Windows/Samba network will have to wait until I install the new update manually because there is no built in mechanism for administrators to push out updates.

And should I use my cobbled together scripts to push out a security update for Firefox on the last day of finals when it might break everything, or should I wait until Monday?

On the other hand, the WSUS server that I set up worked exactly like it was supposed to last night.

Yes, but (2, Interesting)

Reality Master 201 (578873) | more than 5 years ago | (#26159839)

Most people aren't in your situation or that of your users. Most people are surfing the web on their personal computers, and so automatic updates will work just peachy for them.

Re:Firefox updated? (4, Interesting)

denis-The-menace (471988) | more than 5 years ago | (#26159847)

You are right.
The strange thing is that some FF updates do get installed with XP's "Limited User" accounts but some just fail.
No rhyme, no reason.
For those that failed I had to log on with an Admin account and let the FF update install.

FF needs a updater service that runs in the System context so that all FF updates can get installed without the user being logged on as an administrator.

Re:Firefox updated? (5, Insightful)

Anonymous Coward | more than 5 years ago | (#26159967)

FF needs a updater service that runs in the System context so that all FF updates can get installed without the user being logged on as an administrator.

No, I don't want another mysterious service that runs in the background doing whatever it feels like without explicit approval.

Firefox for windows needs to start deploying the program as a regular .msi file (like most windows applications) so that all the existing application deployment tools will work. That will go a long way to boosting firefox among businesses & large organizations.

Dear God, No (3, Insightful)

TheNinjaroach (878876) | more than 5 years ago | (#26160093)

FF needs a updater service that runs in the System context so that all FF updates can get installed without the user being logged on as an administrator.

I would never enable that feature on my PCs. The last thing I want Firefox to do is join the ranks of Flash, Java, Adobe Reader and iTunes with nagging auto-update services that always run in the background. Often the updates aren't even critical, I think many of those 'features' are pushed by marketing departments who want to plaster your desktop with as many of their logos as possible.

Re:Firefox updated? (0)

Anonymous Coward | more than 5 years ago | (#26160097)

It fails because people do not understand Windows Security.

Everything in Program Files is read only to non-admins unless the coders specifically included security adjustments for the install process. The same for the HKEY_LOCAL_MACHINE registry hive. If the update tried to change files in those locations and not in the User Profile folders it would fail. User profiles a user is quite free to change and write too, same with the user registry keys and these are the proper location for non-system data to be stored.

What it is is bad programming and design, not an issue with Windows. You can change this if you want, Right click on the folder in Program files and properties and change the security permissions and you can do the same with individual registry keys and hives. This is the method I use when a program wants admin rights to avoid giving it. If there is still something hanging out there you can use the sysinternals tools and watch the registry and filesystem live

Re:Firefox updated? (0)

Anonymous Coward | more than 5 years ago | (#26159947)

Then you probably need to work on your WSUS and policies - FF updates work ok for our users in our huge organisation.

WSUS? (1)

Nicolas MONNET (4727) | more than 5 years ago | (#26160319)

What is that thing, another overpriced piece of proprietary bloatware?
On RPM based Linux distribs, it's trivial to create an RPM package of any bunch of file you have. A simple .spec file need not be more than a dozen lines to achieve this. Rpmbuild it, and voila, you've got a new package that you can push any number of ways. Just create a yum repository, again, quite a basic thing to do, and on the next update request it will be installed.
So what's preventing you from doing that with FF and WSUS? FF is almost entirely self-contained, no need for esoteric DLLs, you can basically just push the folder to your "Program Files" dir.

Re:Firefox updated? (0)

Anonymous Coward | more than 5 years ago | (#26160417)

Package the update in an msi? Also, in a corporate environment, I'm surprised you support firefox.

IE updates (1)

wcrowe (94389) | more than 5 years ago | (#26159615)

...because its browser doesn't have a built-in update mechanism like other browser makers

At first I thought, "this isn't right", but then I realized that IE updates along with the general Windows update, and not by itself. Perhaps this is because Microsoft so tightly binds IE to the operating system that it doesn't think of it as a separate product?

Re:IE updates (5, Insightful)

BotnetZombie (1174935) | more than 5 years ago | (#26159677)

Tightly bound indeed. I've been postponing the inevitable reboot all day long (GMT here). It's ridiculous to need a reboot just for a browser update.

Re:IE updates (0)

Anonymous Coward | more than 5 years ago | (#26159911)

I didn't have to reboot when I applied the update. Then again, I didn't try to leave IE open when patching IE.

Re:IE updates (5, Funny)

Civil_Disobedient (261825) | more than 5 years ago | (#26159699)

Perhaps this is because Microsoft so tightly binds IE to the operating system

Not perhaps.

I believe the engineering term is "reap what you sow, bitches."

Re:IE updates (1)

Cowmonaut (989226) | more than 5 years ago | (#26160061)

No joke. I just love how some key menus that are LOCAL use IE. For example, on Windows XP the User Accounts option in Control Panel. The window that opens is not Windows Explorer but Internet Explorer. Interestingly, if your security settings are too tight you can't use that menu at all. You'd have to manage the users manually.

Re:IE updates (1)

Shados (741919) | more than 5 years ago | (#26160351)

Pretty much the totality (with one or two exceptions) of Microsoft's products update via Windows update, From Internet Explorer, going to SQL Server, passing by MS Office. Even SQL Server's Book-Online and some built in games updates via Windows Update

Windows Update? (3, Interesting)

Farmer Pete (1350093) | more than 5 years ago | (#26159657)

I wonder how many exploits will be found in IE before they are all gone. I mean, logically, there has to be some point in the future when IE7 is totally exploit free. To bad that the cycle of software replacements wont let that happen. Given enough time, IE7 and WinXP could be some of the toughest software in existence.

Re:Windows Update? (1)

DanJ_UK (980165) | more than 5 years ago | (#26160011)

(XP) - Doubtful if Microsoft continue their push on not-supporting XP further while their best alternative is a pile of shite. It's driving more people to pirate XP resulting in less secure system setups - this being something I've personally witnessed from the droves of people (friends etc) contacting me to be their personal tech support gimp.

"Experts Advising Users Not To Use IE" (3, Interesting)

Skeetskeetskeet (906997) | more than 5 years ago | (#26159683)

This is the best advice the experts have given in years.

Why not windows update? (1)

sleeponthemic (1253494) | more than 5 years ago | (#26159687)

Reality is, most IE users have no idea there is a flaw and no idea there is a patch. So the lack of in browswer auto download basically means that nothing has been achieved for "most" of their user base.

One thing I do notice about the less savvy users is that they do mostly trust windows update.

Re:Why not windows update? (1)

nschubach (922175) | more than 5 years ago | (#26159975)

Trust is an understatement.

Re:Why not windows update? (2, Insightful)

Fred_A (10934) | more than 5 years ago | (#26160219)

One thing I do notice about the less savvy users is that they do mostly trust windows update.

On the other hand, what else could they trust ?
They have no idea how their computer works, certainly aren't interested in figuring it out, so they trust their vendor. Makes sense.

It's probably safer than they trusting random sources on the Web where they don't have the know how to separate the wheat from the chaff.

Ideally they should have an administrator taking care of this for them. But in the real world we all know this won't happen. Especially with home users.

Autoupdate is a ghastly bandaid (4, Insightful)

fuzzyfuzzyfungus (1223518) | more than 5 years ago | (#26159705)

Per application autoupdates are a horrendous pain. Each one has its own, completely idiosyncratic configuration mechanism, its own schedule, and its own behavior. A lot of them will run(but fail in various annoying ways) under limited user accounts, and they are utterly useless in an environment where firewalls or similar block application downloads on client machines.

I can understand why companies use them, since the alternative typically involves things sitting unpatched for ever and ever; but the whole thing is a mess. Hurray for package management.

Re:Autoupdate is a ghastly bandaid (0)

Anonymous Coward | more than 5 years ago | (#26160251)

And that is the very reason that I'm running MSIE at the office. I LOVE Firefox, but as long as the update procedures are not standard, I 'm not even considering installing it in a corporate environment.

I wonder why (1)

BuhDuh (1102769) | more than 5 years ago | (#26159721)

Microsoft could not check whether mshtml.dll was actually in memory before they insisted on a reboot?

what about acid3 test? (1)

hort_wort (1401963) | more than 5 years ago | (#26159729)

Too bad the new Firefox update still gets 71 on the acid3 test. I was all excited to see if it went up with the latest patch. :(

Re:what about acid3 test? (1)

enharmonix (988983) | more than 5 years ago | (#26159935)

Too bad the new Firefox update still gets 71 on the acid3 test. I was all excited to see if it went up with the latest patch. :(

I'm using the new Opera (unless you're a web dev, my company only allows IE6 or Opera). It supposedly aced the acid test and I've gotta tell you, /. sure works a lot better in Firefox.

Re:what about acid3 test? (0)

Anonymous Coward | more than 5 years ago | (#26160125)

Newsflash: no-one cares

System reboot required (1)

El_Muerte_TDS (592157) | more than 5 years ago | (#26159755)

Internet Explorer is at a disadvantage that is requires a system reboot in order to apply updates.

no update.. (1)

arse maker (1058608) | more than 5 years ago | (#26159757)

Yeah, MS has no way to update software on their operating sytstem.. oh wait... the amonia just wore off. They do. Somewhat like their regular security updates they release for IE.

If only they had a seperate update for every program.. with all that hassle.. maybe they could not be disadvantaged?

Absolutely terrible PR = Good news (1)

biscuitlover (1306893) | more than 5 years ago | (#26159769)

I've been amazed by the extent to which this issue has permeated the mainstream media - here in the UK it's been home page material for the BBC [bbc.co.uk] , The Guardian [guardian.co.uk] , The Times [typepad.com] and a number of others.

One - this is really terrible PR for Microsoft. Two - this is really good news for the web as a whole (obviously not including anyone affected by the exploit), as anything that increases public awareness of security issues and alternative browsers has to be a good thing. I just hope it makes a difference.

Huh? (4, Insightful)

I.M.O.G. (811163) | more than 5 years ago | (#26159781)

IE is at a disadvantage because it doesn't have a built in update mechanism? Seriously?

IE updates are managed thru a single interface, windows update, and windows update is actually one small thing windows gets mostly right. I don't want every god awful program under the sun phoning home ON ITS OWN to god knows where and updating itself without my knowledge.

However I do want a convenient method to make sure I'm getting updates I may need from a trusted source. Windows update is better than programs phoning home on their own. Short of having an update repository for 3rd party apps like Linux distros do things, thats about the best you can hope for...

That is, unless you like the google software updater, apple software updater, etc, running all the time soaking up resources and generally being non-value added.

Re:Huh? (0)

Anonymous Coward | more than 5 years ago | (#26159979)

Or even worse than soaking up resources, suggesting new software once a week, like apple software updater. It always suggests that I need iTunes, and it always selects it by default.
If I'd wanted iTunes, I would have downloaded iTunes and not gone to the extra hassle of trying to fine Quicktime without iTunes. I don't know how it is now, but when I downloaded, it was a hassle to find these two separated.

Apple fixed that (4, Funny)

apparently (756613) | more than 5 years ago | (#26160419)

Or even worse than soaking up resources, suggesting new software once a week, like apple software updater. It always suggests that I need iTunes, and it always selects it by default. If I'd wanted iTunes, I would have downloaded iTunes and not gone to the extra hassle of trying to fine Quicktime without iTunes. I don't know how it is now, but when I downloaded, it was a hassle to find these two separated.

Apple has resolved this issue. Now they try to install Safari in addition to Quicktime and Itunes.

Re:Huh? (1)

djmurdoch (306849) | more than 5 years ago | (#26160057)

Does MS offer a way for Google, Apple, etc. to register that they've got an update available, so they could use the standard update mechanism, instead of writing their own?

Not that Apple would choose to use it: they like to mix ads in with their updates, but I can see some other projects taking advantage of this.

Re:Huh? (1)

Tridus (79566) | more than 5 years ago | (#26160117)

Oh, but it's Apple/Google/Whatever, so it must be good! I mean who needs one updater talking to one central location for updates when you can have 50 updaters talking to 50 locations for updates instead?

Nevermind that WU installed this patch on my machine last night, because that's not the point.

Now its BattleShip time (0)

Anonymous Coward | more than 5 years ago | (#26159917)

Lets play battleship.....

IE7

Hit on a US Submarine!

Hold on (0)

Anonymous Coward | more than 5 years ago | (#26159997)

So the day the zero day was announced slashdot complained there wasn't a patch and MS weren't going fast enough. Today slashdot is complaining that the patch was rushed.

Tomorrow Microsoft blamed for water being wet, pope being catholic and bears leaving poo in the woods.

Re:Hold on (1)

AndrewNeo (979708) | more than 5 years ago | (#26160373)

You must be new here.

all browsers suck (0, Troll)

juenger1701 (877138) | more than 5 years ago | (#26160019)

yea and waiting 5 min for firefox to load because it updated again when you want to check something that takes 30 seconds isn't annoying as hell course most of the new shit in firefox 3 annoys me and just like microsoft i can't turn the fucking "features" off

all browsers suck this is a fact of life

Reboot? Why? (4, Interesting)

clintre (1078849) | more than 5 years ago | (#26160191)

The bad thing about IE not having the built in updater is that this patch required a freaking reboot for a browser patch!!

That is just stupid.

The great thing about this fiasco is that I was able to convince several people who had been un-willing to move to Firefox or Opera to now do so.

Thanks Microsoft!

"Firefox issues eight patches" (2, Informative)

apparently (756613) | more than 5 years ago | (#26160479)

The great thing about this fiasco is that I was able to convince several people who had been un-willing to move to Firefox or Opera to now do so.

Mozilla has issued eight patches for its Firefox Web browser, three of which fix problems classified as critical. [pcworld.com]

Man, you really showed them.

How does Firefox update itself (2, Interesting)

Skapare (16644) | more than 5 years ago | (#26160483)

... if it is running in a restricted userid?

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>