Dvorak on patching

John Dvorak has a rant on patching and the state of IE that has a statement that is somewhat misleading in my opinion. In speaking of the announcement this week of 10 security updates for Windows and IE, Dvorak said:

It would be nice if there were more options than patching software, but unless you are willing to get a Macintosh or run a Linux computer you are just going to have to patch your machine over and over, probably weekly. And these patches are almost always necessary.

I sincerely hope that Dvorak isn't suggesting that Mac and Linux users don't need to patch their machines. In fact, perusing the archives of the SANS.org @Risk security newsletter makes it clear that there are plenty of vulnerabilities being found in Linux, Mac OS X, and other *nix operating systems.

I can certainly sympathize with Dvorak's point about the pain of keeping up with patches, but I don't think it helps anyone to suggest that this is a Windows-only problem. There's no such thing as an operating system that doesn't require patches. What's important is trying to make it easier for users to keep their machines up-to-date. Windows XP Service Pack 2 is an important step in the right direction on that front. It's true that there have been some compatibility issues with SP2, and hopefully we'll be able to resolve those. But it also includes a number of changes that can help preemptively prevent vulnerabilities from being exploited. It also strongly recommends that users enable automatic updates, which can greatly simplify the process of keeping a computer updated for end users.

Dvorak is right to keep the heat on Microsoft on security...not because I think the company I work for is doing a bad job...but because the more pressure that's applied, the better when it comes to security. Where I disagree with Dvorak is his presenting a misleading picture of other operating systems as not requiring regular patching. It's not true, and he does a disservice to his readers by leaving that impression. I'm all for pushing hard on security...I'd just like it to be fair and accurate.

Comments

• Anonymous
  October 13, 2004
  Good points.
  
  The other thing I noticed about Dvorak's article is that he refers to "patch Tuesday" and applying patches weekly. He doesn't seem to recognize that Microsoft doesn't actually release patches every Tuesday but only the second Tuesday of the month. Ten patches a month is a lot better than ten patches a week!
  
  See also:
  http://www.microsoft.com/technet/security/bulletin/revsbwp.mspx
• Anonymous
  October 14, 2004
  The comment has been removed
• Anonymous
  October 14, 2004
  Dvorak has a point regarding quality. When patches are released, they should work. Not partially, but always. My primary development PC is offline due to the patches that were released on 10/13. It's hanging at the Initializing installation prompt and no one at Microsoft has been able to help.
  
  This is the first time I've had a problem with a patch, but I now understand why other users have expressed extreme frustration with the process. If patches are going to be released and deemed critical, they should be of the highest quality, tested thoroughly and supported promptly. Right now, the call queue for the Windows Update group is between 1 and 3 days.
• Anonymous
  October 20, 2004
  The comment has been removed
• Anonymous
  October 30, 2004
  Well done N !! I had same problem with hanging on "Initializing installation ...".
  I tried uninstalling SP2 and re-installing but no effect. Then I found your suggestion with SFC /SCANNOW and disabling the System Restore utility. It worked a treat. Updates now working again. Brill !! Thanks.
  PDR