December 2007's Patch Tuesday's Going to Be Big - Really Big

Tuesday, December 11, 2007, is the last 'Patch Tuesday' of the year, and Microsoft's getting ready to hand out significant security fixes for Windows 2000, XP, Vista, Windows Media Format runtime, Internet Explorer, and DirectX. Here's what to expect.

A Trio of Critical Patches

First up is a remote code execution patch for DirectX versions 7.0 (Windows 2000) through 10.0 (Windows Vista). Multimedia users will also need to get patching with a remote code execution patch for Windows Media Format runtime for all Windows versions from Windows 2000 and Windows XP to Windows Vista). Third on the list of "must squash now" bugs is yet another remote code execution patch for Internet Explorer versions for Windows 2000, XP, and Vista all the way back to the pre-Cambrian version IE 5.01 SP4 and all the way forward to IE7 for Windows XP and Vista.

As a security expert interviewed by InfoWorld points out, these fixes are designed to prevent attacks that take advantage of users' desires to view online multimedia content, which would be just about everyone that reads this page (and uses Windows).

A Quartet of Important Patches

Patch Tuesday will also roll out a quartet of so-called 'important' patches for Windows:

• Remote code execution fix for Windows Vista
• Remote code execution fix for Windows 2000 SP4 and Windows XP
• Elevation of privilege fix for Windows Vista
• Local elevation of privilege fixes for Windows XP SP2 and Windows Server 2003.

Critical, Important, What's the Difference?

A 'critical' patch blocks Internet worms that don't require you to click, open, or view an attachment or website to start. An 'important' patch blocks attacks that compromise local systems.

Details to Follow

Once 'Patch Tuesday' arrives, we'll have more details on these and other non-security updates for your Redmond-powered PC. In the meantime, think before you click.

------------------------------------------------------

Know a Windows Vista newbie? Help a new Vista user get up to speed with Mark's book Maximum PC Microsoft Windows Vista Exposed. It's a great introduction to what's new and different in Windows Vista, and it's available from Amazon.com and other fine bookstores.

READ MORE -
December 2007's Patch Tuesday's Going to Be Big - Really Big

Microsoft Patch Tuesday Knocks Out Skype - What Can We Learn From This?

If you rely on Skype, the popular P2P VoIP telephone system, you discovered last week that you couldn't. As discussed by our own Nathan 'Butters' Edwards, Skype's network troubles also temporarily iced the Maximum PC podcast, delaying it until tomorrow.

P2P Network Minus Working Clients is a 'Notwork'

What happened? Skype's own Heartbeat blog tells the story. Because Skype is a P2P network, it depends upon users' PCs to relay VoIP calls to other users' PCs. If a few users are offline, it's no big deal. But if a lot of Skype users are offline, the network becomes unreliable. What took down Skype last week? It was tag-teamed to the mat by a combination of Microsoft's Patch Tuesday and a bug in Skype's VoIP software's self-healing feature.

Patch Tuesday and the Skype Outage

Microsoft's Patch Tuesday, the second Tuesday of the month, is the date that Redmond releases critical security patches. This month's Patch Tuesday (August 14th) included six critical patches (as well as three important patches) affecting several of Microsoft's crown jewels: Windows XP, Windows Vista, Office, XML Core Services, and Internet Explorer.

It takes a couple of days for Windows Update to propagate the patches to Windows users, and by Thursday, August 16th, lots of Skype users' PCs were dutifully downloading the appropriate security patches, installing them, and rebooting - and in the process, crippling the Skype network. The network has recovered, and thanks to this event, Skype has discovered a bug in its software's self-healing feature - and is working hard to fix the problem.

Lessons for Non-Skype P2P Users

So, what's the bigger meaning for those of us who don't use Skype? if you use any type of P2P software, you should be finding out if your P2P provider is ready for the next big "Patch Tuesday" (or any other type of massive shutdown of its network). Assuming that P2P network providers are paying attention, expect to see updates designed to head off this type of problem. Apply them to help stay out of problems.

Is it Time to Kick Automatic Updating to the Curb?

What about the rest of us? Automatic rebooting after automatic patching by Windows Update can send PCs off to la-la land until you log in again. While your system's offline, you too can experience the joy of fouled-up automatic updates by applications, outages in online gameplay, halted P2P downloads, no access to your PC from remote access services like GoToMyPC and more. If you've ever been inconvenienced by Windows Update's automatic reboot after installation, consider doing what I do: change Windows Update's default behavior. Instead of automatically downloading and installing updates and rebooting , set it to automatically download updates, but not install them until you say so. That way, you decide when your system can be offline during the reboot process. As Skype demonstrated last week, millions of rebooting PCs can't get anything done - and may prevent you from getting stuff done as well.

Redundancy Is Vital for All Technology Users

As TMC.net's Rich Tehrani points out, having redundant services for voice and data, backup, and every other technology-based product and service you use is a critical requirement for business. Even if you never make a dime from your PC, there's also a lesson for home computer users like you (and me). Whether you're calling your girlfriend to set up a big date, setting up a friendly deathmatch, storing your digital photos or music, or writing the great American novel, you'd better have a "plan B." Skype's downtime demonstrates most vividly that putting all of your technology eggs in one basket is like putting them in a basket without a bottom.

READ MORE -
Microsoft Patch Tuesday Knocks Out Skype - What Can We Learn From This?