Never mind that scheduled updates for high impact vulnerabilities has seen the community release their own unapproved patches; a really bad precedent which will likely lead to backdoored patches from unknown vendors eventually.Automatic updates
The Microsoft Update process, which leverages Microsoft’s Windows Update Service, has
received acknowledgement from the software industry as being a model process: “This is one
of those instances, and they happen more often than you’d think, where Microsoft sets the
tone for the rest of industry. They didn’t invent the security advisory, and heaven knows they
wish they didn’t have to be so expert in it, but they listened to their customers and they have
the process down”4. Much like its Linux competitors, Microsoft offers software patches for both
security and feature enhancement.
Unlike its Linux competitors Red Hat and Novell, Microsoft releases monthly, scheduled,
cumulative updates ensuring all customers who update are fully up to date even if they’ve
missed an update in the past. For enterprise customers, Microsoft offers the Advanced
Notifi cation Program, which alerts your system administrators about what updates are included
and what issues are addressed three days before we release each update. For critical
security updates, Microsoft proactively contacts customers to ensure they are aware of the
availability of the update and the nature of the fi x and to encourage responsible updating and
secure computing.
In addition to the scheduled, cumulative updates, Microsoft provides hotfi xes on an ongoing
basis for specifi c issues that we identify internally or that result from customer requests. These
hotfi xes are then also included as part of the monthly patch. As necessary, Microsoft also
releases critical security updates as they are available.
With Novell’s SUSE Linux, Novell rolls out updates as they approve them; the updates are not
tied to a standard release schedule. Novell notifi es administrators through their update tool,
YaST, as updates are released. Administrators can pick and choose which updates to install.
In the Red Hat update model, if you do not automatically update your system with the Red Hat
Up2Date tool, you receive errata update notices from the RHEL mailer, which outlines new,
approved open source community and Red Hat–developed patches. As with Novell’s SUSE
Linux, Red Hat does not release updates on a fi xed schedule. Instead they release them on an
“as available” basis.
Slow == Better. It's right there in black and white
Oh yeah, extra points to them for trying to make people think that if you miss an up2date/yum update you won't get it next month (or whatever day you decide to patch).
