WARNING: Adobe Reader risks

Adobe have joined the mob of Software Houses pushing
betas on an unsuspecting public without adequate warning.

The Adobe Reader link off Adobe's main page now tells you
that Adobe Reader 9.0 and Adobe Air are the latest download,
without informing you there has been a version update. The
page looks identical to the old 8.1.2 page - there is NO
NOTIFICATION of a major version change.

What they DON'T tell you until the product is installed is these
items are still in beta. You find that out once the download is
installed.

Furthermore, when you go to the Downloads page at the
Adobe site and select the Reader 8.1.2 download, it takes
you back to the 9.0 page and offers you the 9.0 download.
There is no way to get the 8.1.2 package back.


At this point, I don't know if the webpages are inaccurate or
the product is still beta. And the only reason I'm posting this
here is because I don't have any idea how to let people know
about this in a widespread manner - other than this newsgroup.

The security and system integrity risks of using beta software
are well known to members of this newsgroup. As a result of
this irresponsible action on Adobe's part - without any kind of
explanation or rationale for their action - I now recommend the
same caution when dealing with Adobe on software matters
as I would in dealing with shady or corrupt software
manufacturers.


Best I can do for now. <tm>


Bill

> The Adobe Reader link off Adobe's main page now tells you
> that Adobe Reader 9.0 and Adobe Air are the latest download,
> without informing you there has been a version update. The
> page looks identical to the old 8.1.2 page - there is NO
> NOTIFICATION of a major version change.
>
> What they DON'T tell you until the product is installed is these
> items are still in beta.

Acrobat Reader v9 is not a beta build, although it does include access to
Adobe.com (beta)
http://blogs.adobe.com/adobereader/2...is_here_1.html

> Furthermore, when you go to the Downloads page at the
> Adobe site and select the Reader 8.1.2 download, it takes
> you back to the 9.0 page and offers you the 9.0 download.
> There is no way to get the 8.1.2 package back.

Acrobat Reader v8.1.2 has been superseded by v8.1.2 Security Update 1
http://www.adobe.com/support/securit...apsb08-15.html
http://www.adobe.com/support/downloa...jsp?ftpID=3967

That being said, what does all this have to do with Windows Update, Bill?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Bill Drake wrote:
> Adobe have joined the mob of Software Houses pushing
> betas on an unsuspecting public without adequate warning.
>
> The Adobe Reader link off Adobe's main page now tells you
> that Adobe Reader 9.0 and Adobe Air are the latest download,
> without informing you there has been a version update. The
> page looks identical to the old 8.1.2 page - there is NO
> NOTIFICATION of a major version change.
>
> What they DON'T tell you until the product is installed is these
> items are still in beta. You find that out once the download is
> installed.
>
> Furthermore, when you go to the Downloads page at the
> Adobe site and select the Reader 8.1.2 download, it takes
> you back to the 9.0 page and offers you the 9.0 download.
> There is no way to get the 8.1.2 package back.
>
>
> At this point, I don't know if the webpages are inaccurate or
> the product is still beta. And the only reason I'm posting this
> here is because I don't have any idea how to let people know
> about this in a widespread manner - other than this newsgroup.
>
> The security and system integrity risks of using beta software
> are well known to members of this newsgroup. As a result of
> this irresponsible action on Adobe's part - without any kind of
> explanation or rationale for their action - I now recommend the
> same caution when dealing with Adobe on software matters
> as I would in dealing with shady or corrupt software
> manufacturers.
>
>
> Best I can do for now. <tm>
>
>
> Bill

Hi, PA Bear. The linkage, is that Adobe Reader V8.1.2 Security
Update 1 is actually a Microsoft KB update. If you check
Add/Remove after Reader V8.1.2 Security Update 1 is installed,
you will see it refers to MS KB403742 as the required fix.

I assume from this that KB403742 is what is actually being
referenced by Adobe's fix, but this is also incompletely and
imperfectly documented.


The problem is that historically, Adobe have left behind old
product installation "mortal remains" when doing updates using
their reader-based update procedure. As a result, the best fix
for problems with Adobe Reader has been to uninstall the old
product using Add/Remove and then go to Adobe's website
and get their latest-'n-greatest. That's what I did, which caused
me to run into the problem described in my original post.

However, in this case, you end up with an installation of a newer
product and a website reference when checking the new product
indicating that the new product is still a beta release. Ergo, this
thread.


My solution to the problem, at least in the short term, is to use the
Update procedure on an *existing* V8.1.2 installation to get the
V8.1.2 Security Update 1 - bypassing the Adobe website that
gives you V9.0 without properly warning you that a major version
update has occurred.

As detailed above, and to reiterate, the linkage with this newsgroup
is that V8.1.2 Security Update 1 is actually an MS KB403742 update.


Best I can do for now. <tm>


Bill



PA Bear [MS MVP] wrote:
>> The Adobe Reader link off Adobe's main page now tells you
>> that Adobe Reader 9.0 and Adobe Air are the latest download,
>> without informing you there has been a version update. The
>> page looks identical to the old 8.1.2 page - there is NO
>> NOTIFICATION of a major version change.
>>
>> What they DON'T tell you until the product is installed is these
>> items are still in beta.
>
> Acrobat Reader v9 is not a beta build, although it does include
> access to Adobe.com (beta)
> http://blogs.adobe.com/adobereader/2...is_here_1.html
>
>> Furthermore, when you go to the Downloads page at the
>> Adobe site and select the Reader 8.1.2 download, it takes
>> you back to the 9.0 page and offers you the 9.0 download.
>> There is no way to get the 8.1.2 package back.
>
> Acrobat Reader v8.1.2 has been superseded by v8.1.2 Security Update 1
> http://www.adobe.com/support/securit...apsb08-15.html
> http://www.adobe.com/support/downloa...jsp?ftpID=3967
>
> That being said, what does all this have to do with Windows Update,
> Bill?
>
> Bill Drake wrote:
>> Adobe have joined the mob of Software Houses pushing
>> betas on an unsuspecting public without adequate warning.
>>
>> The Adobe Reader link off Adobe's main page now tells you
>> that Adobe Reader 9.0 and Adobe Air are the latest download,
>> without informing you there has been a version update. The
>> page looks identical to the old 8.1.2 page - there is NO
>> NOTIFICATION of a major version change.
>>
>> What they DON'T tell you until the product is installed is these
>> items are still in beta. You find that out once the download is
>> installed.
>>
>> Furthermore, when you go to the Downloads page at the
>> Adobe site and select the Reader 8.1.2 download, it takes
>> you back to the 9.0 page and offers you the 9.0 download.
>> There is no way to get the 8.1.2 package back.
>>
>>
>> At this point, I don't know if the webpages are inaccurate or
>> the product is still beta. And the only reason I'm posting this
>> here is because I don't have any idea how to let people know
>> about this in a widespread manner - other than this newsgroup.
>>
>> The security and system integrity risks of using beta software
>> are well known to members of this newsgroup. As a result of
>> this irresponsible action on Adobe's part - without any kind of
>> explanation or rationale for their action - I now recommend the
>> same caution when dealing with Adobe on software matters
>> as I would in dealing with shady or corrupt software
>> manufacturers.
>>
>>
>> Best I can do for now. <tm>
>>
>>
>> Bill

> Adobe Reader V8.1.2 Security
> Update 1 is actually a Microsoft KB update.

The security bulletin
http://www.adobe.com/support/securit...apsb08-15.html is not a
Microsoft KB or page.

I can't find hide nor hair of KB403742, Bill. Got a link? Are you thinking
of a MS Security Advisory
(http://www.microsoft.com/technet/sec...archive.mspx)?

> ...As a result, the best fix
> for problems with Adobe Reader has been to uninstall the old
> product using Add/Remove and then go to Adobe's website
> and get their latest-'n-greatest. That's what I did, which caused
> me to run into the problem described in my original post.

What problem, and how does all of this pertain to Windows Update?
--
~PA Bear


Bill Drake wrote:
> Hi, PA Bear. The linkage, is that Adobe Reader V8.1.2 Security
> Update 1 is actually a Microsoft KB update. If you check
> Add/Remove after Reader V8.1.2 Security Update 1 is installed,
> you will see it refers to MS KB403742 as the required fix.
>
> I assume from this that KB403742 is what is actually being
> referenced by Adobe's fix, but this is also incompletely and
> imperfectly documented.
>
> The problem is that historically, Adobe have left behind old
> product installation "mortal remains" when doing updates using
> their reader-based update procedure. As a result, the best fix
> for problems with Adobe Reader has been to uninstall the old
> product using Add/Remove and then go to Adobe's website
> and get their latest-'n-greatest. That's what I did, which caused
> me to run into the problem described in my original post.
>
> However, in this case, you end up with an installation of a newer
> product and a website reference when checking the new product
> indicating that the new product is still a beta release. Ergo, this
> thread.
>
>
> My solution to the problem, at least in the short term, is to use the
> Update procedure on an *existing* V8.1.2 installation to get the
> V8.1.2 Security Update 1 - bypassing the Adobe website that
> gives you V9.0 without properly warning you that a major version
> update has occurred.
>
> As detailed above, and to reiterate, the linkage with this newsgroup
> is that V8.1.2 Security Update 1 is actually an MS KB403742 update.
>
>
> Best I can do for now. <tm>
>
>
> Bill
>
>
>
> PA Bear [MS MVP] wrote:
>>> The Adobe Reader link off Adobe's main page now tells you
>>> that Adobe Reader 9.0 and Adobe Air are the latest download,
>>> without informing you there has been a version update. The
>>> page looks identical to the old 8.1.2 page - there is NO
>>> NOTIFICATION of a major version change.
>>>
>>> What they DON'T tell you until the product is installed is these
>>> items are still in beta.
>>
>> Acrobat Reader v9 is not a beta build, although it does include
>> access to Adobe.com (beta)
>> http://blogs.adobe.com/adobereader/2...is_here_1.html
>>
>>> Furthermore, when you go to the Downloads page at the
>>> Adobe site and select the Reader 8.1.2 download, it takes
>>> you back to the 9.0 page and offers you the 9.0 download.
>>> There is no way to get the 8.1.2 package back.
>>
>> Acrobat Reader v8.1.2 has been superseded by v8.1.2 Security Update 1
>> http://www.adobe.com/support/securit...apsb08-15.html
>> http://www.adobe.com/support/downloa...jsp?ftpID=3967
>>
>> That being said, what does all this have to do with Windows Update,
>> Bill?
>>
>> Bill Drake wrote:
>>> Adobe have joined the mob of Software Houses pushing
>>> betas on an unsuspecting public without adequate warning.
>>>
>>> The Adobe Reader link off Adobe's main page now tells you
>>> that Adobe Reader 9.0 and Adobe Air are the latest download,
>>> without informing you there has been a version update. The
>>> page looks identical to the old 8.1.2 page - there is NO
>>> NOTIFICATION of a major version change.
>>>
>>> What they DON'T tell you until the product is installed is these
>>> items are still in beta. You find that out once the download is
>>> installed.
>>>
>>> Furthermore, when you go to the Downloads page at the
>>> Adobe site and select the Reader 8.1.2 download, it takes
>>> you back to the 9.0 page and offers you the 9.0 download.
>>> There is no way to get the 8.1.2 package back.
>>>
>>>
>>> At this point, I don't know if the webpages are inaccurate or
>>> the product is still beta. And the only reason I'm posting this
>>> here is because I don't have any idea how to let people know
>>> about this in a widespread manner - other than this newsgroup.
>>>
>>> The security and system integrity risks of using beta software
>>> are well known to members of this newsgroup. As a result of
>>> this irresponsible action on Adobe's part - without any kind of
>>> explanation or rationale for their action - I now recommend the
>>> same caution when dealing with Adobe on software matters
>>> as I would in dealing with shady or corrupt software
>>> manufacturers.
>>>
>>>
>>> Best I can do for now. <tm>
>>>
>>>
>>> Bill

Bill Drake wrote:

> Hi, PA Bear. The linkage, is that Adobe Reader V8.1.2 Security
> Update 1 is actually a Microsoft KB update. If you check
> Add/Remove after Reader V8.1.2 Security Update 1 is installed,
> you will see it refers to MS KB403742 as the required fix.

No, it just refers to KB403742. I believe this is an ID number internal to
Adobe. AFAIK, Microsoft don't actually have any property rights to the letters
"KB" so there's no particular reason Adobe can't use them.

Harry.

Hi, Harry. If this is truly an internal Adobe reference - it is the
first I have heard of Adobe using the same system as MS.

And if so, this is again utterly irresponsible without proper
documentation of the whys and wherefores. It makes no
sense at all for Adobe to use something which looks so much
like the MS System - all the way down to the exact same
format and six-digit-number. The potential for confusion is
way too high.

I stand behind my original warning and my rationale for
making the post here.


Bill



Harry Johnston [MVP] wrote:
> Bill Drake wrote:
>
>> Hi, PA Bear. The linkage, is that Adobe Reader V8.1.2 Security
>> Update 1 is actually a Microsoft KB update. If you check
>> Add/Remove after Reader V8.1.2 Security Update 1 is installed,
>> you will see it refers to MS KB403742 as the required fix.
>
> No, it just refers to KB403742. I believe this is an ID number
> internal to Adobe. AFAIK, Microsoft don't actually have any property
> rights to the letters "KB" so there's no particular reason Adobe
> can't use them.
> Harry.

<snipped>
Archived indefinitely:
http://groups.google.com/group/micro...d50c47ba538944



Bill Drake wrote:
> Hi, Harry. If this is truly an internal Adobe reference - it is the
> first I have heard of Adobe using the same system as MS.
>
> And if so, this is again utterly irresponsible without proper
> documentation of the whys and wherefores. It makes no
> sense at all for Adobe to use something which looks so much
> like the MS System - all the way down to the exact same
> format and six-digit-number. The potential for confusion is
> way too high.
>
> I stand behind my original warning and my rationale for
> making the post here.


Same "system"?

KB stands for "Knowledge Base" and almost any software (and even hardware -
computing or not) manufacturers' have a knowledge base of
problems/fixes/etc. Some call it knowledge base and use "KB" and some call
it something else (FAQs, Stuff you need to know, etc.)

In any case, the article you seem to be referring to:
http://kb.adobe.com/selfservice/view...nalId=kb403742

Is clearly part of the Adobe "kb" system (notice the "kb.adobe.com"
address.)

Microsoft does _not_ have a KB article by that number:
http://support.microsoft.com/kb/403742
(Microsoft KB articles can be referenced by
http://support.microsoft.com/kb/###### <-- sub in MS KB Article Number for
######)

However - Adobe has many other articles in their KB, which you can search
using:
http://kb.adobe.com/selfservice/microsites/microsite.do


As for "It makes no sense at all for Adobe to use something which looks so
much like the MS System - all the way down to the exact same format and
six-digit-number" <-- not *exactly* the same format, perhaps they worked
their way *up to* a six digit number. There's only so many ways you can do
a good knowledge base system and have it work...

If you are confused - you obviously did not read and comprehend the entirety
of the situation. Many fiction books (paperbacks) are about the same size,
they mostly have covers, page numbers, title pages - many have dedication
pages and most have a UPC code on the back cover that allow them to be
scanned for identification and charged for purchase. They come from many
different publishers, many different subjects are contained within created
by many different authors and are sold in many different places possibly at
many different prices despite the recommendation of the UPC code that may be
on the back cover recommending a certain price but having the *same number
of digits* in the system as the other books. However - if you look at the
title, the author, the subject etc - you can see the differences quite
clearly.

In the end - you seem to have a complaint about Adobe... You do not seem to
have a complaint about "Windows Update".

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

What Shenan said.

Bill Drake wrote:
> Hi, Harry. If this is truly an internal Adobe reference - it is the
> first I have heard of Adobe using the same system as MS.
>
> And if so, this is again utterly irresponsible without proper
> documentation of the whys and wherefores. It makes no
> sense at all for Adobe to use something which looks so much
> like the MS System - all the way down to the exact same
> format and six-digit-number. The potential for confusion is
> way too high.
>
> I stand behind my original warning and my rationale for
> making the post here.
>
>
> Bill
>
>
>
> Harry Johnston [MVP] wrote:
>> Bill Drake wrote:
>>
>>> Hi, PA Bear. The linkage, is that Adobe Reader V8.1.2 Security
>>> Update 1 is actually a Microsoft KB update. If you check
>>> Add/Remove after Reader V8.1.2 Security Update 1 is installed,
>>> you will see it refers to MS KB403742 as the required fix.
>>
>> No, it just refers to KB403742. I believe this is an ID number
>> internal to Adobe. AFAIK, Microsoft don't actually have any property
>> rights to the letters "KB" so there's no particular reason Adobe
>> can't use them.
>> Harry.

I disagree as far as the rationale is concerned. I understand
that there are similarities between KB systems and the
methodology is similar between all. The same is true of
cosmological star catalogs.

However, nobody in the Astronomy department would
consider it responsible to use the same star-catalog name
for two different star catalogs. It's confusing and stupid,
so different star catalogs have different names.


If Adobe want their stuff to be easily differentiated from
Microsoft's - to prevent the very trap into which I fell - then
they should at least have the form of AKBxxxxxx or have a
different numbering system such as KBXXX-xxxx. This only
makes sense.

Regardless, this is deviating from the purpose of this
newsgroup.


EOT


Bill



Shenan Stanley wrote:
> <snipped>
> Archived indefinitely:
> http://groups.google.com/group/micro...d50c47ba538944
>
>
>
> Bill Drake wrote:
>> Hi, Harry. If this is truly an internal Adobe reference - it is the
>> first I have heard of Adobe using the same system as MS.
>>
>> And if so, this is again utterly irresponsible without proper
>> documentation of the whys and wherefores. It makes no
>> sense at all for Adobe to use something which looks so much
>> like the MS System - all the way down to the exact same
>> format and six-digit-number. The potential for confusion is
>> way too high.
>>
>> I stand behind my original warning and my rationale for
>> making the post here.
>
>
> Same "system"?
>
> KB stands for "Knowledge Base" and almost any software (and even
> hardware - computing or not) manufacturers' have a knowledge base of
> problems/fixes/etc. Some call it knowledge base and use "KB" and
> some call it something else (FAQs, Stuff you need to know, etc.)
>
> In any case, the article you seem to be referring to:
> http://kb.adobe.com/selfservice/view...nalId=kb403742
>
> Is clearly part of the Adobe "kb" system (notice the "kb.adobe.com"
> address.)
>
> Microsoft does _not_ have a KB article by that number:
> http://support.microsoft.com/kb/403742
> (Microsoft KB articles can be referenced by
> http://support.microsoft.com/kb/###### <-- sub in MS KB Article
> Number for ######)
>
> However - Adobe has many other articles in their KB, which you can
> search using:
> http://kb.adobe.com/selfservice/microsites/microsite.do
>
>
> As for "It makes no sense at all for Adobe to use something which
> looks so much like the MS System - all the way down to the exact same
> format and six-digit-number" <-- not *exactly* the same format,
> perhaps they worked their way *up to* a six digit number. There's
> only so many ways you can do a good knowledge base system and have it
> work...
> If you are confused - you obviously did not read and comprehend the
> entirety of the situation. Many fiction books (paperbacks) are about
> the same size, they mostly have covers, page numbers, title pages -
> many have dedication pages and most have a UPC code on the back cover
> that allow them to be scanned for identification and charged for
> purchase. They come from many different publishers, many different
> subjects are contained within created by many different authors and
> are sold in many different places possibly at many different prices
> despite the recommendation of the UPC code that may be on the back
> cover recommending a certain price but having the *same number of
> digits* in the system as the other books. However - if you look at
> the title, the author, the subject etc - you can see the differences
> quite clearly.
> In the end - you seem to have a complaint about Adobe... You do not
> seem to have a complaint about "Windows Update".
>
> --
> Shenan Stanley
> MS-MVP

Shenan Stanley wrote:

> In any case, the article you seem to be referring to:
> http://kb.adobe.com/selfservice/view...nalId=kb403742

Huh. OK, I was wrong - it isn't an internal code after all. I don't think much
of their search engine; when I fed it this number it returned no matches.
Feeding it the entire code (including the prefix kb) works but it didn't occur
to me to try that at the time.

Harry.