From: Mike N. 

On Wed, 10 Jan 2007 19:15:37 -0500, "Geo."  wrote:

>Ok so patch tuesday comes, you do your update, and tomorrow you find an app
>that doesn't work anymore. Was it a .NET patch or one of the other patches,
>next monday you find a second app that's not working, same question except
>this time was it .NET 1.0 patch or .NET 2.0 patch or both or neither?

   It's pretty simple to find out if an app uses NET 1.0 or NET 2.0.    The
level of difficulty in pinpointing the conflicting patch is the same as if
there were 4 system DLLs patched.   Roll them back one at a time.

>>   The difference from Java is that the version granularity is much
>> coarser.   There is V1.0, V1.1 and V2.0.  None of this java junk of 2.00.1
>> leaving an unpatched 2.00.0 in place on your system; the libraries are
>> patched in place.
>
>I'm not sure I understand, what's the difference between having two
>applications, one which requires java 1.x and the other java 2.x and having
>two applications one that requires .NET 1.0 and one that requires 2.0?

  The scenario you use is exactly the same as Java.   But Java also has the
annoying problem of
   App A requires Java 1.1.5.4.9 exactly
  App B requires Java 1.1.5.2.0 or below
  App C requires Java 1.1.7.2.4 or higher.

   So you can end up with dozens of versions installed.   Add this to an
automatic Java update procedure that leaves the exploitable versions laying
around, and it's a security nightmare.   That's why it's different than
Windows Update for .NET.   If you have Java installed and you have been
doing updates, check the control panel Add/remove versions and it will wake you up.

--- BBBS/NT v4.01 Flag-5