Re: Update on wide-spread NewTear Denial of Service attacks

Russ (Russ.Cooper@RC.ON.CA)
Wed, 04 Mar 1998 16:43:25 -0500

If every single patch/fix/hotfix for NT was fully regression tested
before being released, such fixes would not see the light of day, let
alone a customer's machine, for months.

Microsoft releases regular patch kits, which are fully regression
tested, called Service Packs, which incorporate all the hot fixes
released since the last one. I would much rather have Microsoft say they
don't know if the fix will work in all environments, but make it
available to me to try, than to have them wait for the full testing you
call for.

As it is, a lot of machines withstood the attacks since Sunday because
their admins could determine whether their machines worked with the
interim patch (from January) rather than waiting for the next Service
Pack.

For years people complained that Microsoft wasn't responsive enough to
security issues and now, when they make patches available in days, it
seems like you're asking them to go back to their old ways.

Nobody does full regression testing on an OS patch that's available in
days, nobody. The warning is a simple reminder its not possible.

Do you want them to clam up again or do you expect them to test
thousands of applications/services in 2-3 days, which is it? Personally
neither is a good option in my book.

Cheers,
Russ
http://www.ntbugtraq.com