Hacker News Reader

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches.

Which is a dumb policy for security patches. When its fixed it should be released.

> If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).

Google doesn't dictate Microsoft's patch releasing policy. 90 days are 90 days. Microsoft doesn't have "only 60 days", they have 90 days like anyone else, and they chose to miss it by adhering to a policy of their own choosing that makes security patches less timely.

The whole purpose of a fixed 90-day window is to give reasonable time to fix a security vulnerability but also to create pressure to do so timely. Making exceptions for vendors to accommodate existing policies that make security fixes less timely would both increase the effort for Google (as a fixed time window is always easier to implement than one that varies with each vendors policies) and undermine the whole purpose of the 90-day timeline.

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them.

Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

I wanted to say this, but evidently it was pointless given that seemingly 80% the people on this thread have absolutely no understanding of change management whatsoever, or more importantly the problems you might face when customers have your update infrastructure indirectly linked to national grids and industrial automation. Clearly Microsoft should just release Windows as a repo on GitHub and push fixes to master.

I agree with you and mentioned elsewhere in the thread that patch Tuesday was one of the best moves MS made when they started taking security seriously. Enterprises could now schedule change management around the dates far out into the future which leads to a predictable update schedule downstream.

Before, many enterprises rarely patched because the testing involved was a huge pain and it fell outside what they typically planned for.

At a prior company managing firewalls for SMBs that didn't have room for patch management beyond "automatically apply patches", we loved the predictability of Patch Tuesday. Often we would purposefully schedule around it, so if PT did break something, we could point to the schedule and say "nope, we didn't change anything on the box that Tuesday."

Why can't we just have the choice to apply as soon as it's ready?

If you don't want to apply the patches as soon as they're released, then you'd be more than welcome to put them on hold for 4 weeks yourself when it's more convenient.

Basically because bindiff (http://www.zynamics.com/bindiff.html ). The moment an updated binary is available, the clock starts ticking towards a vulnerability being reverse engineered from the update. A few years back, there was a huge amount of research in the infosec community whose goal was to automate extraction of these vulnerabilities (yes really - a robot automatically producing 0-day given an updated binary). Symbolic execution trickery aside, this remains a straightforward task for a reverse engineer to manually perform given a set of debug symbols (which Microsoft supply for developers).

Your options become either to release an update the moment it's tested, immediately making vulnerable customers who have a change management policy (usually also the biggest and juiciest targets - fortune 500s including ironically the likes of Google), or delay any release until some coordinated date, giving everyone an equal and predictable opportunity to cope with the exposure, which is how Microsoft do it.

This entire discussion presumes that this bindiff method of discovering the bugs in Windows is the only method available to attackers.

What are the chances that attackers or other agencies already know of these vulnerabilities and are exploiting them?

Microsoft's delays extend the time that the silent attackers have.

This time, the "ready" will be the following Tuesday. Google didn't respect this, effectively providing the 0-day to the world.

There are bad guys looking for 0-days out there. If they learn about the vulnerability from the patch, at least the world has the patch before the bad guys do. Now it's the opposite.

Edit: See _wmd's explanation about the technical details of all this in the same level of the answers.

There is a thing here.

You apply a dozen different fixes and test. Something breaks badly. You now have a dozen different root causes to check when, if you applied one at a time and tested (or applied one at a time and let your users test it, which is more commonplace than it should - automated testing tools exist for a reason) you'd know what broke.

I'd prefer to have fixes available for rollout as soon as possible and to decide whether I deploy them or not based on my tests. Automatic mandatory deployment could be on a fixed schedule, for those who can't test or don't care much about it.

If you're in a situation where you test the effects of patches before applying them, then if Microsoft releases the security patch early, YOU have the option to wait and apply it on the regular patch day along with any other patches in the normal schedule.

Releasing the patch late (i.e., on patch day) makes that choice for everyone.

With the patch ready before the vulnerability release, there's no 0-day available to the all nefarious guys in the world. Now thanks to Google, there's one. (Edit: See _wmd's explanation about the technical details of this).

It's not that just the big companies are affected now: all users are.

Applying a patch to everyone at the same seems risky (not to mention scaling issues). Can't they stagger the patch, so if there is an issue with it then only some users have an issue instead of everyone.

If it was an important security patch for a bug that hadn't been publicly disclosed, rolling out to a few machines might be as good as disclosing the bug.

I don't think I'm exaggerating when I say that there is no other company in the world that understands the effects of releasing patches as much as Microsoft does.

Large enterprises already have centralized patch management, so they can decide how fast it gets pushed downstream to their users after MS releases the patch.

I wonder how people would have responded had the disclosure come from an independent security researcher instead of Google, knowing fully well that a patch is to be rolled out in 2 days.

> knowing fully well that a patch is to be rolled out in 2 days.

I haven't come across a source for that. Does one exist?

For all I know, Microsoft announced it in reaction to the publication, but I have no clue Google could have been made aware of it beforehand.

Edit: nevermind, I've found one.

> Which is a dumb policy for security patches. When its fixed it should be released.

You are new to IT aren't you?

No, and not even to enterprise IT that the policy supposedly serves.

Failure to blindly adhere to the common view isn't the same as being new.

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesday is a restriction that Microsoft imposes on itself and its users. They had advanced warning and an opportunity to work within the limits of their own policy or roll out an unscheduled update.

Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?).

Given that Microsoft had excellent reason to ask for an extra 2 days, I guess the real question is that for a data-driven organization, why Google think 90 days is such a good number in the first place, and why they insisted on sticking to it despite the asinine alternative (forcing tens of thousands of IT departments to coordinate an out of band change for a low severity bug).

A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process.

Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?

Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?).

This looks like a solution, but isn't. Perhaps Google's 90 day deadline is already a re-evaluation of a 60-day deadline that was made to accommodate holidays and companies with a once-a-month patch schedule. If Google's deadline was 120 and still hit two days before patch Tuesday, would you say the same thing but for 150?

(N.B. I'm not defending Google, just poking a hole in this particular idea.)

What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?

What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits.

Microsoft do issue out of band updates but they are very rare and for very serious issues.

It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled releases. It's also worth pointing out the enterprises time things on the patch Tuesday cycle. An earlier release causes all sorts of implementation problems, especially if only a day or two in advance. In all likelihood you wouldn't see many machines actually updated in that period, but cause significant extra grief.

Does it really matter if it's 90 or 92 day disclosure?

> Does it really matter if it's 90 or 92 day disclosure?

Yes. Google designed Project Zero to "pressure firms into dealing with security problems more quickly." A firm policy with unambiguous enforcement has its advantages. Muddying the 90-day deadline with questions about when (and for whom) to make exceptions weakens it. For example, in the future, I expect Microsoft will not wait the extra two days in the event of a security disclosure from Google.

One may disagree with the 90-day policy to begin with. I, for one, think it should have had an exception process built in. But while these are Google policies, not laws, I respect them for adhering to published protocol. Even when it was difficult.

I feel certain if this vulnerability had a higher impact (like remote execution) then it would have been over-ridden - or at least responded to quicker.

Or you could ask: do two more days of the bug being secretly exploited in the wild matter?

As opposed to 2 days of the bug being openly exploited?

Almost everyone was already enjoying 90 days of ignorance. And almost everyone could have enjoyed indefinite ignorance with the same relative safety if Google had waited for patch Tuesday.

I agree with this completely. Even if Google didn't know about patch days they should have allowed them two more days to release the patch since they asked for it. I would even say they could have given them another week window if they needed it. Releasing an exploit into the wild when you know a patch is coming is a really awe-full thing to do. If the tables were turned I wonder what Microsoft would have done here.

And the next company that comes along will ask for 3 days, and then 5 days, etc. Pretty soon we're back to serious bugs not getting fixed until the vendor feels like it. The power of a set timeline is the fact that its not up to the vendor when things happen. They have proven time and again that they won't fix things until they are forced to; this forces them.

It's just like being late for work. "But I was only 5 minutes late." Late is late.

It's a kind of thinking of the bureaucrat and not of an engineer. I'm the later, and in my areas of work the tolerance of 10% is the default, the tolerance of 20% or 25% is also natural, and only something more than that is something that is even worth the words.

As far as I know, some other engineering areas have even the safety factor of 2 or 3. That means, you expect the stress x, but your process has to sustain even 3 x.

Edit: Zero tolerances are never a good idea.

http://civilrightsproject.ucla.edu/research/k-12-education/s...

The last place I worked that cared if I was 5 minutes late to work was Wal-Mart when I was a teenager.

Microsoft was actually asking for 92 days to fix the bug, not 2 days...

Google gave them 90 days (by Google's policy). Microsoft had the fix, but asked for another 2 days in order to fit within their patching cycle. Google decided to take action outside of Microsoft's (well established) patch cycle.

Then again what does Google care, they don't use or support anything Microsoft, so it doesn't affect them.

Chrome runs on Windows.

As does Google Earth, Google Drive, the android development toolchain, and a handful of other desktop clients that I'm not going to bother to look up right now.

And Google gave them a 90 day deadline. Doesn't seem right not to extend it by only two days, especially if there was a holiday period in between.

Who is Google to dictate to Microsoft when to release their patches?

They're the ones doing the work of finding these vulnerabilities and being nice enough to report this to Microsoft (and the public) at all.

Exactly this. Too bad some people's hatred towards MS blinds them.

So you're saying Google should make an exception for Microsoft? Its bestest friend ever? What about Facebook? Apple? Oracle? Why not just stop throw the 90 day rule out the window at that point, to fit everyone's schedules?

It seems to me Microsoft is like that student who has 3 months to do a project, but waits until the last 2 days, and then asks the professor to give him some more time. It was Microsoft's responsibility to patch the bug at the last Patch Tuesday.

The "second-tuesday-of-the-month" policy is a completely arbitrary MS-only policy.

If Google (or any other group that discovers security issues) has to take into account every policy of every software producer it becomes utterly impossible to have any disclosure policy.

If MS wants to handicap themselves, that's their problem. The rest of the world doesn't have to bend to their will, those days are over.

Yes, this is about being an ass. And it's Microsoft that's being an ass by claiming the rest of the world should take into account their peculiar policy.

The patch-day policy is not for Microsoft, it's for sysadmins who maintain the installations.

Have you ever managed a nontrivial installation of user-facing desktop systems? 'Cause if not, declaring the policy of a predictable, telegraphed-well-in-advance day on which security patches will drop "peculiar" kind of just reveals where your head's at.

The rate at which security vulnerabilities are reported/abused isn't predictable.

Please don't sit on a fix until the time is more "convenient", give it to me now and let me be the judge on how important this security patch is to me.

Because the patch can easily be reversed into the exploit, it has to be convenient for everyone in the herd to apply it at the same time unfortunately.

The "90 days" policy is a completely arbitrary Google-only policy. There is no reason they couldn't wait a bit longer before disclosing.