Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 0day exploit goes wild, and so do Microsoft marketers

arstechnica.com

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#21

Post by baldfat »

aao wrote: post #12
nxc18 wrote: post #6

He asked a PR person, probably one with little security background (how many security people do you know who went into PR?) gave the stock answer which does happen to actually be good security advice: run the latest supported version with patches. The reporter was just butthurt about not getting a scoop and decided to write an article complaining about PR practices in place of an actual story. Really like the click b…

It's a rant about PR bullshit, specifically this: >Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible, EDIT and this >The time has come for Microsoft vulnerability disclosure communications to mute the marketers and let the security engineers do the talking instead. I found it funny to be honest

I am still shocked that Windows was recoverable from the fiasco of XP security problems. They have gotten exponentially better in security over the years.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#22

Post by cmdrfred »

kybernetikos wrote: post #16
test1235 wrote: post #13

Earlier quoted context omitted.

>assuming that the fix is just a few lines of code

Even assuming that, there could be a massive testing load to ensure that those few lines of code don't mess up something tangentially related, or cause new security issues of their own.

Microsoft fired it's QA department so that doesn't seem to be a reasonable explanation either.

http://www.computerworld.com/article/2878026/microsoft-to-bu...

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#23

Post by simion314 »

kybernetikos wrote: post #16
test1235 wrote: post #13

Earlier quoted context omitted.

>assuming that the fix is just a few lines of code

Even assuming that, there could be a massive testing load to ensure that those few lines of code don't mess up something tangentially related, or cause new security issues of their own.

Assuming you just need to add a check for null pointer and that this bug is very critical like hackers are exploiting it, assume engineers create a fix and are 100% it is safe, hopefully there was no other component that was depending on the broken code , how much it will take to fix it, maybe there is somewhere a history of critical bugs , with the date of when it was found and when it was fixed then we can find the time interval.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#24

Post by tedunangst »

pdimitar wrote: post #20
UnoriginalGuy wrote: post #19

Earlier quoted context omitted.

> IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. Except the researcher themselves knew it was one more week, and not "several years." You cannot claim they were ignorant if their own statements shows that they were not.

You might be right. But they only claimed it, didn't they? I personally like Windows 10 a lot and I applaud any effort to turn it into a long-term stable OS.

Well, if MS claims the patch is coming in one week, one approach might be to wait one week and then release the exploit. Works out regardless of the accuracy of the claim.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#25

Post by cptskippy »

baldfat wrote: post #21
aao wrote: post #12

Earlier quoted context omitted.

It's a rant about PR bullshit, specifically this: >Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible, EDIT and this >The time has come for Microsoft vulnerability disclosure communications to mute the marketers and let the security engineers do the talking instead. I found it funny to be honest

I am still shocked that Windows was recoverable from the fiasco of XP security problems. They have gotten exponentially better in security over the years.

The NT Kernel is a very secure and resilient design, it was just mucked up over the years with Win32 blurring the lines between the kernel and userland. MinWin was an internal project that started in Windows 7 where the tendrils of things like Win32 were extricated from the kernel. In addition to improving security, this also enabled things like multi-platform support and headless servers.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#26

Post by tveita »

tedunangst wrote: post #24
pdimitar wrote: post #20

Earlier quoted context omitted.

You might be right. But they only claimed it, didn't they? I personally like Windows 10 a lot and I applaud any effort to turn it into a long-term stable OS.

Well, if MS claims the patch is coming in one week, one approach might be to wait one week and then release the exploit. Works out regardless of the accuracy of the claim.

«He told Ars that the software maker initially planned to patch the flaw in December but later decided to delay the release until February so it could be included with other planned SMB fixes.» «it is not the first time Microsoft sits on my bugs»

So they already reneged once on this bug which fits into a previous pattern. If that is right putting pressure on them sounds entirely justified and not at all petty.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#27

Post by eli »

pdimitar wrote: post #17
cujo wrote: post #15

Earlier quoted context omitted.

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

There are very competent people on this planet who make a very good buck out of zero-days (not to mention remotely control users' machines, and steal data). IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. It definitely puts pressure on MS but I don't think that's bad. Corporations have demonstrated time and again that the only way to get them to move is…

Just because there are other people who act totally unethically doesn't mean you get bonus points for doing kinda the right thing.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#28

Post by mlmlmasd »

cujo wrote: post #15
ohitsdom wrote: post #14

The researcher disclosed the bug one week before Microsoft is scheduled to patch it. I'm sure MS isn't thrilled, but they did drag their feet: "I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, t…

The researcher sounds really petty. They're patching it, but not on this person's schedule so he's causing microsoft and USERS problems they didn't have before. If they weren't patching, I'd understand, but this isn't the right way to get attention in my book.

> so he's causing microsoft and USERS problems they didn't have before.

He's not causing problems, he's solving them.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#29

Post by pdpi »

tedunangst wrote: post #24
pdimitar wrote: post #20

Earlier quoted context omitted.

You might be right. But they only claimed it, didn't they? I personally like Windows 10 a lot and I applaud any effort to turn it into a long-term stable OS.

Well, if MS claims the patch is coming in one week, one approach might be to wait one week and then release the exploit. Works out regardless of the accuracy of the claim.

Patch Tuesday is the second Tuesday of each month. Unless something odd happens, you can count on the fix being out a week from tomorrow. There's also a justification for this — they sat on it because they were releasing other SMB-related patches on the February Patch Tuesday. I don't really think anybody can reasonably argue that MS would not release the fix next week. But that's not the point.

This bug was reported in December, and there's no reason to believe that they didn't have a patch in time for inclusion in the January Patch Tuesday. They chose to withhold that patch due to non-technical, apparently PR-related, reasons, and the researcher in question is complaining that this has happened before with other bugs reported by him. That's a pretty cavalier approach to security, and early disclosure is the only way the researcher can punish MS for it.

Re: Windows 10 0day exploit goes wild, and so do Microsoft marketers

#30

Post by mlmlmasd »

eli wrote: post #27
pdimitar wrote: post #17

Earlier quoted context omitted.

There are very competent people on this planet who make a very good buck out of zero-days (not to mention remotely control users' machines, and steal data). IMO the researcher didn't want that particular vulnerability to dwell on somebody's todo list for several years. It definitely puts pressure on MS but I don't think that's bad. Corporations have demonstrated time and again that the only way to get them to move is…

Just because there are other people who act totally unethically doesn't mean you get bonus points for doing kinda the right thing.

MS is acting 'totally unethically' by not patching this bug immediately and rewarding the researcher.
Post reply on HN