Adobe's quarterly patch cycle to commence Tuesday
'Critical' fix for some, but not all
Adobe Software's new quarterly patch cycle will commence on Tuesday with an update that patches a severe vulnerability in some versions its Reader and Acrobat products.
The program is part of a push by Adobe to beef up security after complaints earlier this year that the software maker was too slow in plugging security holes in its software, which runs on the vast majority of machines running Windows, Mac OS X and Linux. The quarterly release, which will coincide with Microsoft's Patch Tuesday, is designed to life easier on people administering large fleets of computers.
Up to now, Adobe has issued security updates on an ad hoc basis that frequently fixed a critical vulnerability in one version but not others.
Tuesday's inauguration will include a patch for versions 7.x, 8.x and 9.x of Adobe Reader and Acrobat for Windows and Mac. Fixes for Unix versions of the programs will come later. This would appear to be at odds with an announcement made last month, in which Adobe promised to release patches for all major supported versions and platforms of Reader and Acrobat on the same day. Adobe's blog post announcing next Tuesday's patches didn't explain the discrepancy.
"Adobe considers this a critical update and recommends users be prepared to apply the update for their product installations," the advisory, posted to Adobe's product incident response team blog, stated.
The release means PC owners will have an even bigger patch burden to shoulder this Tuesday. Microsoft on Thursday announced a bumper crop of patches, six of which are rated critical, the company's highest severity level.
In addition to a regular patch releases, Adobe's new security initiative involves a new push to eradicate security bugs in existing products by combing through its existing code base for exploitable flaws. Previously, the company's Secure Development Lifecycle emphasized ways to build security into products that were under development. ®
Re: "a vastly overbloated POS"
Pun intended? As far as I can see, most of the recent extensions to Acrobat have been to enable various forms of web-like behaviour (like form filling) rather than the more mundane business of presenting documents. Memo to Adobe: this is a document reader, not a portal to an online shopping experience.
My guess is that someone at Adobe looked at Microsoft's attempts to turn IE6 into a "platform" and thought "we could do that", without realising that "that" was possibly the worst "role model" ever for a piece of software. The result is indeed a POS, but not the POS that Adobe intended.
Oh this is going to be fun
My experience of Adobe products is that they make perhaps the worst updating software in the World.
Inevitably you need to update the updater. It takes pretty much forever to get the file no matter how fast your connection. You start the updater updater - at which point you have to quit the application you've been trying to use.
It installs. Then you try to run the new version of the updater which lists a dozen different patches. You find the one with the lowest version date, it downloads (slowly), starts running, then complains this update isn't compatible with the existing version of the application.
So you exit the updater, go to the Adobe site, battle your way through layer upon layer of nonsense to get files whose names seem to be plucked from the thin air. Download those - and it's still only an hour since you fired up the original application.
Run the installer which works for a while, the progress bar gets about half way - and then it freezes - for hours. Quit the updater and try to run it again - oh but it can't because the update has been applied!
Too much trouble. I need to do some work. Start the original application again, the updater fires up to say there are patches which need to be applied - including the one you supposedly just installed. At which point you kill the updater and disable it from ever running again figuring that having a broken version of the application vulnerable to attack is much less stressful than trying to do things Adobe's way.
Oh and that's on a Mac, god only knows if it manages to be worse on Windows, but I find it hard to believe Adobe could resist additional laughs by buggering around with the Registry.
Why not go for shit
And stop implementing this shit that means you have to sort the shit out after you have shat on it.
Hint... like it's bad enough I have to go de-construct some twats warpdom down to a text file before I can consider dealing with it.
Aww stuff it I think I'll go cook some comfort food.