[Full-disclosure] Re: what we REALLY learned from WMF



It's easy for us on this side to Monday morning quarterback and say "oh make it so". There are times too that I go...okay ...come on ...how many days has it taken for that to get fixed? But then again, I don't write code, I don't track back dependencies, I don't ensure umpteem languages still work and all the other interconnectivity between programs and code still function.

It's easy to say this stuff on this side.... but understand that the mere release of a beta patch puts in jeopardy all of the consumer home machines and small businesses that have no admin to protect them and take mitigation measures.

What "I" really learned from this is to decide my "OWN" risk tolerance and stop listening to all the sites and blogs and news reports and what not that spread a lot of FUD and misinformation and used this many times as a PR vehicle. Only I know what risk I will tolerate. That's what I learned from this.

Susan

Gadi Evron wrote:

Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:

Don't release a beta patch ....

1. it would get patches into reverse engineering faster [hello look what happened to the leaked patch]

and 2.

Don't ask for an untested patch if you are not willing to be there in the newsgroups, communities and listserves helping the dead bodies after a bad patch sir.

Do you do/handle change management in your firm? Even in my small firm I could not handle the 'any time/any day' that patches used to come out before.

Be careful of what you ask for sir...because if you get what you want.... ensure your firm has the resources to test/deploy/change management on a 24 hours a day 7 days a week schedule because exploits can be built in less than 20 minutes.

If the security issue has been responsible disclosed, there is a process that is needed to build a patch and test the patch. Some issues take more than 'days' sir. And testing takes time as well, sir.

For my community I want tested patches sir, and I will argue until doomsday on that point. Don't hurt my community with a bad patch or a beta patch, sir.


I quite agree, I disagree on the amount of time it currently takes for any vendor to release patches. Apparently we "Got used" to slowness, false positives and many other ills. Maybe it's time that changed?

    Gadi.


--
Letting your vendors set your risk analysis these days? http://www.threatcode.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • [Full-disclosure] Re: what we REALLY learned from WMF
    ... Don't ask for an untested patch if you are not willing to be there in the newsgroups, communities and listserves helping the dead bodies after a bad patch sir. ... Even in my small firm I could not handle the 'any time/any day' that patches used to come out before. ...
    (Full-Disclosure)
  • [Full-disclosure] Re: what we REALLY learned from WMF
    ... Don't ask for an untested patch if you are not willing to be there in the newsgroups, communities and listserves helping the dead bodies after a bad patch sir. ... Even in my small firm I could not handle the 'any time/any day' that patches used to come out before. ... Microsoft wants to, it can. ...
    (Full-Disclosure)
  • 9_Recommended error codes (specifically return code 5)
    ... * "return code 2" indicates patches are already installed. ... * "return code 25" means a patches requires another patch that is not yet installed. ... With or without using the save option, the patch installation process ... Installing 114008-01... ...
    (SunManagers)
  • Re: [PATCH] ext4: memory leakage in ext4_mb_init()
    ... one of the important parts of a patch is that the patcher ... If you are not able to deal with all patches received, ... stock kernel, is buggy, and end users have to face panic. ... Ext4 is actually quite stable at this point. ...
    (Linux-Kernel)
  • Re: This is [Re:] How to improve the quality of the kernel[?].
    ... The -mm kernel already implements what your proposed PTS would do. ... If patch have no TS ID, ... Thus i can apply for example lguest patches and implement and test new ... How many open source projects use Bugzilla and how many use the Debian BTS? ...
    (Linux-Kernel)