Yoz Grahame's Cheerleader: Patching the patchmen

December 19, 2003

Patching the patchmen

You've probably already seen the "open source" patch to Internet Explorer which fixes the recently-found URL spoofing vulnerability.

You may also have seen that this patch has a few nasty holes of its own and calls home occasionally (though only when it hits an exploit attempt, so I think that's reasonable), thus prompting fears that Microsoft pay point at this as an example of poor open source code quality.

However - and this is the killer point - the patch has been patched by someone else, namely Paul Hsieh (code diffs here). Now, it may be illegal (the reason that I quoted the words "open source" in the link to the patch above is that the first patch has a few distinctly non-open clauses regarding its distribution) but if there's a single winning argument you can make in this whole story for the open source security model, this is it.

This has fascinated me because I'm one of the people who, despite being an open source fan, thinks that Microsoft sometimes gets a raw deal about buggy code and patches (as I've commented here and here - quick summary: MS has to push its patches through a longer QA system for fear of 1% of installs breaking and clobbering a million machines). However, recently the sheer number of unpatched holes in MSIE has become ridiculous and it's time to give up on it. Frankly, the only real patch is to move to Firebird.

Posted by Yoz at December 19, 2003 02:58 PM | TrackBack

Comments

"MS has to push its patches through a longer QA system for fear of 1% of installs breaking and clobbering a million machines"

It's almost a shame that MS doesn't use the bleeding edgers on the internet for QA. Imagine if the "Automatic Update" had an option along the lines of "I'm prepared to accept patches during a testing period and issue bug reports if problems arise".

The analog in Debian GNU/Linux is setting your machine to "unstable/testing/stable", where each is a trade-off between newness and stability(stability here meaning general use for a period without critical bug reports).

So when I run "unstable", I'm contributing in some way to those that wait for the tested updates.

(As far as I know, MS might already have that, if so ignore me...)

Posted by: Lee Maguire on December 19, 2003 05:15 PM

What -- I only get the distinction of being called "someone else"? Sheesh ... and here I was thinking writing OS code would make me famous ... :) Anyhow the bug I solved is a very common problem with string handling in the C and C++ languages in general. For more information on safe string handling in C/C++ in general please visit the following:

http://bstring.sf.net/
http://www.pobox.com/~qed/userInput.html

Posted by: Paul Hsieh on December 21, 2003 03:28 PM

Ahem - my grovellingest apologies. Fixed. :)

Posted by: Yoz on December 21, 2003 04:15 PM

"Frankly, the only real patch is to move to Firebird."

I agree whole-heartedly with that.

Posted by: Muddy on December 21, 2003 06:58 PM

This while thing is rather weird... I do not dare to apply any of these patches... using opera is the real solution for me and reveals PayPal-hoaxes as I received tenth alike only today!

regards,christoph

Posted by: Christoph C. Cemper on December 26, 2003 12:44 AM

This whole thing is rather weird... I do not dare to apply any of these patches... using opera is the real solution for me and reveals PayPal-hoaxes as I received tenth alike only today!

regards,christoph

Posted by: Christoph C. Cemper on December 26, 2003 12:45 AM

it seems that i am visiting another blog page instead of going there where i wanted to go but, however, its not my view here. Let's think about the comments which reveals something different and u can also take a look on your own webblog page and judge if it is really good for ur website or not. If it is, then, its okay. However, my friend u have developed this webblog with very reasonable layouts and deep thinking. Really, its great and appreciable. Thanks.

Posted by: software development bruxelles on January 5, 2005 04:59 AM

Posted by: nQlMRgCGWa on January 25, 2006 02:02 AM

watches
watch
replica watch
citizen watch
jewelry watch
man watch
seiko watch
fossil watch
watch music video
omega watch
heisman watch
watch tv
pocket watch
watch free movie online
swiss army watch
football ticket
watch winder
nba ticket
cartier watch
price watch
tag heuer watch
tag watch
casio watch
wrist watch
gucci watch
breitling watch
watch free movie
invicta watch
kenneth cole watch
bulova watch
nixon watch
guess watch
timex watch
womens watch
automatic pilot productpage watch
hockey ticket
swiss watch
swatch watch
tissot watch
watch repair
watch music video online
watch tv on the internet
designer watch
celtic productpage watch
watch band
anne klein watch
world of watch
michele watch
nike watch
basketball ticket
atomic watch
lady watch
third watch
skagen watch
watch tv online
watch free tv online
woman watch
hamilton watch
rado watch
luxury watch
fake watch
esq watch
geneva watch
pulsar watch
discount watch
watch movie online
diesel watch
relic watch
diamond watch
night watch
elgin watch
raymond weil watch
dive watch
watch free music video
whale watch
croton watch
dkny watch
concord watch
vintage watch
watch battery
watch box
wholesale watch
iwc watch
jacob watch
santa watch
oris watch
watch cases
luminox watch
mickey mouse watch
market watch
watch movie
freestyle watch
watch strap
coach watch
longines watch
citizen eco drive watch
army watch
used rolex watch
gold watch
antique watch
military watch
http://www.azbrandwatches.com
www.azbrandwatches.com