Microsoft Explains and Defends Silent Fixes

Page 1 of 3 123 LastLast

    Microsoft Explains and Defends Silent Fixes


    Posted: 17 Feb 2011

    Microsoft has detailed its policy of patching in-house discovered bugs silently and tried to answer the most frequently asked questions regarding this procedure.

    The fact that Microsoft doesn't disclose all patched vulnerabilities in Security Bulletins is not a secret. This was admitted by the company in 2006.

    This somewhat controversial policy applies to bugs discovered during the "Hacking for Variations" (HfV) process, which aims to limit the number of similar flaws in a product.

    When the company receives reports of a vulnerability, it also inspects the source code for similar bugs and runs a plethora of tools, including fuzzers, against the vulnerable component.

    Any flaw discovered in this way is considered a variant of the originally reported vulnerability and it doesn't get publicly disclosed, nor does it receive a CVE identifier.
    Microsoft Explains and Defends Silent Fixes - Softpedia
    Posted By: JMH
    17 Feb 2011



  1. Posts : 612
    MS Windows 7 Home Premium 64-bit SP1
       #1

    Dear JMH,
    I guess you are the person to answer two tiny doubts of mine!
    1) Why did Microsoft allow it's customers a certain degree of free reign in allowing updates 1)unhindered installation,2) download, i will decide what to install and 3) i will decide whether to install or not( is option 3 there?)

    2) On super Tuesdays, what % of users generally allow all downloads to be downloaded AND installed (You may give a rough restimate, lest we rust!)

    3) Do you consider the under cover fixes are to avoid loss of face?
    Regards,
    Sreedhav:)
      My Computer


  2. JMH
    Posts : 7,952
    Win 7 Ultimate 64-bit. SP1.
    Thread Starter
       #2

    All of your questions pertaining to Microsoft's motives can only be addressed by Microsoft.
      My Computer


  3. Posts : 612
    MS Windows 7 Home Premium 64-bit SP1
       #3

    JMH said:
    All of your questions pertaining to Microsoft's motives can only be addressed by Microsoft.
    Dear JMH,
    I am sincerely sorry for the ill-directed queries! I can only crave your pardon! I hold you in the highest regard!

    Regards,
    Sreedhav
      My Computer


  4. Posts : 2,009
    Windows 7 Ultimate x86
       #4

    See...as long as those fixes are tested sufficiently enough to make sure they wouldn't crash my computer or cause any kind of unwanted behavior, i don't mind them being pushed on me.
    But if they ever affect me in an undesired way you can bet your boots, Microsoft gets a special entry in my HOSTS

    -DG
      My Computer


  5. Posts : 8,398
    ultimate 64 sp1
       #5

    i really like the word 'fuzzer' - first time i've come across it - thanks JMH!

    my next kitten may be in need of that name :)
      My Computer


  6. Posts : 872
    Windows 7 Home Premium x64
       #6

    I think not disclosing the extent of all patched vulnerabilities has some security benefits. If the hackers can just pull up lists of all the vulnerabilities you fixed, they would be able to create exploits for new vulnerabilities that much faster.
      My Computer


  7. Posts : 342
    Windows 7
       #7

    hmm...this is a very slippery slope

    As consumers do we have the right to inquire as to what these fixes are? And if so - how does that protect against hacking - for a hacker could ask the same.

    If they can do this without warning/liability who knows what they can put on personal, public, and corporate machines/servers without permission.

    And what happens if they damage the OS/machine(s)?

    Is the enduser SOL?
      My Computer


  8. Posts : 25,847
    Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
       #8

    I have no problem with the way Microsoft does it. Most of us wouldn't know what to do with the fine code that might be included. Giving all the fine details might also give some one access to the operating systems code with which it was created by it's owners.
      My Computer


  9. Posts : 1,403
    Win 7 Ultimate 32bit
       #9

    As consumers do we have the right to inquire as to what these fixes are?

    Yes and No

    Remember, you are renting the Windows OS, you do not own it.


    And if so - how does that protect against hacking - for a hacker could ask the same. ---- Yes

    If they can do this without warning/liability who knows what they can put on personal, public, and corporate machines/servers without permission.


    There are limits and protections that they must adhere to.
    They can't just drop a keylogger or something on your system.


    And what happens if they damage the OS/machine(s)?


    The end user is not necessarily SOL, if they ahve a legitimate copy of Windows, you can contact MS for help if an update does in fact break the OS. I do believe this does fall under the level of support they do provide under the Mainstream support period.


    However, if they did do anything that would spy on or compromise a system, believe me, people are watching and it would spread like wildfire. MS would lose in the end.

    There are alternatives, not excellent ones, but they do exist.
    Mac and Linux would welcome the change.
      My Computer


 
Page 1 of 3 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:21.
Find Us