• E-mail this page
• |  Print this page
• | 
• | 
• | 

When Is A Security Update Not A Security Update?

Question: when is a security update not a security update? Answer: when it's an update to Internet Explorer. Microsoft Tuesday released an update to IE that forces the user to explicitly approve the execution of some Active-X controls. That's a security update in my book. Microsoft is splitting hairs by saying it doesn't protect the browser. It protects the user, and that's what's important.

I'd like to take some credit for the change. After all, just a couple of weeks ago in my email newsletter I ranted about Microsoft's scripting addiction. Unfortunately, it was just good timing. Microsoft had announced it was going to do something like this back in December, when it told developers that controls loaded by the APPLET, EMBED, or OBJECT elements would be disabled unless the user turned them on. (Any guesses on which three Active-X elements are most often used by malware writers?)

Another reason Microsoft might have said it was a non-security update was because it came out of the regular it's-that-Tuesday-again-so-it-must-be-time-to-patch-Windows cycle. But on the other hand, fixes released out of cycle have been for really critical problems. So draw your own conclusions.

I say it's a security fix, and a critical one, and it's high time for it.

« Microsoft Invents E-Mail You Use With Your Feet | Main | Microsoft Will Stumble On Windows Vista And Office 2007 »