I've never been one to shy away from praising Microsoft when I think that praise is due. My colleagues can tell you that I still insist Windows ME was a decent operating system and I've loved my Vista install since the first day I used it. I've also been quick to commend Microsoft when something is patched quickly and an issue is resolved. But, I'm not just another "Yes-Man".

Last night Jabulani Leffall referred to me as a 'security gadfly'. I had to look it up, discovered that it meant a pest, and was a little shocked. However, it was quickly pointed out by several people that gadfly also refers to someone not afraid to ask the difficult questions. I thought about that and really liked the term. I like to think that I'm not afraid to ask the difficult questions, and when I think about it, sometimes the responses I get to emails to secure@microsoft.com make me feel like they consider me a pest.

Why all this back story? Because I want to ask the difficult question with regards to MS09-032. It's a question I asked with MS09-008, and should have asked with MS08-032 (and I'm sure a few others).

That question is, when did it become acceptable for a mitigation to be issued as a patch? Forget the root issue, or the results and potential outcome... why does Microsoft continue to get away with this and why aren't we questioning them repeatedly? The CVE for MS09-032 as many people have discussed recently is CVE-2008-0015, it was assigned Dec. 13, 2007. That's 20 months ago... aka a very long time. Yet in all this time, the best they could do was a mitigation? Why not a patch to the affected DLL? The advisory contained the mitigation in FixIt package a few weeks ago, why rerelease that detection as a security bulletin? And a security bulletin that was simply a cumulative update to ActiveX killbits, something that is released every month as a "Security Advisory" suddenly became a "Security Bulletin" this month and I want to know why.

The (seemingly) obvious answer, at least in my eyes, is that this was entirely a marketing ploy. I've noticed that the Security Bulletins (the so-called "For IT Professionals" version) have become more marketing speak and less technical description with every Patch Tuesday. In this case the entire bulletin stinks of marketing speak. So why does Microsoft continue to get away with this? Why can't we put our collective foot down and put a stop to this?

It's actually quite simple to determine the difference between a patch and a mitigation. It becomes even easier if we think of the patch as the solution to the problem. The patch makes the problem go away, end of story. A mitigation doesn't solve the problem... it simple silences it temporarily, it is possible (under the right circumstances) for that problem to come back. A mitigation is not a silver bullet for the problem, and releasing Security Bulletins that contain mitigations is misleading to the every day user.

Let's take this to a completely different place. Imagine you're driving down the road and suddenly get a flat. You pull over and pull off the tire and head to the trunk to pull out your spare... a doughnut. The doughnut will keep you driving, but at a reduced speed and probably not as smoothly. It's probably not ideal but it's a stop-gap solution to your flat tire and will serve you well until you can buy a patch kit or replace the tire (depending on the situation).

In the above scenario, the doughnut is your mitigation and the patch kit/new tire is your patch. Imagine if you were told that getting a flat tire required you to permanently drive around with that doughnut... I doubt you'd be very happy, especially if you're a highway driver. So why should we be happy accepting mitigations as patches, especially if we're in a multi-user environment?

I think it's time that we put a call out to Microsoft, and any other vendor utilizing this practice, and insist that when they call something a patch, it actually be a patch.