REQUIRED Windows Patches?

Hey guys,

I just read this story, which I find absolutely ridiculous - I'd like to see what everyone else thinks about it:

Quote:

---

The next version of Windows, which analysts expect to be completed in late 2004, could be the first to let the Auto Update feature download patches from Microsoft without requiring the user's explicit approval.

---

Story found here: http://story.news.yahoo.com/news?tmp...1579_2003aug18


I believe that a user should stay updated with patches and such, but I firmly disagree with automatic updates by default. I need to be able to use download and install the patches myself - that way if something breaks, I know where to begin looking to find the culprit. I DO NOT want Microsoft doing all this for me while I'm away from my machine. This is absurd...

It's almost like a mechanic coming and picking up my car from work (without my knowledge), fixing (or breaking something else), then returning it to me. Yea, maybe he fixed the problem, but I would have liked to have known he was coming and what he was going to do - what if I get my car back, problem one is fixed but now all of the sudden I have problem two with no explanation.

More importantly, what if their site is compromised?

Quote:

---

Originally posted here by MsMittens
More importantly, what if their site is compromised?

---

Good point MsMittens, I hadn't even thought about that aspect of it. But you are right, if the update site was compromised, then what? It makes this issue even more ridiculous...

I can understand MS's eagerness to deliever patches to Windows machines, but this is NOT the way to go. Patch management is a reality that users are just going to have to get used to - I don't think that security could ever be improved to the point where a piece of software is 100% secure out of the box, so there will always be patches and updates. But in the end, the user needs to be in control of those updates - not MS.

I honestly don't think it will ever be out of the users control. The fact of the matter is that M$'s updates have a very long and proven history of hosing up servers under certain conditions, and I don't expect this to magically change. IMHO, this alone would be a show stopper if M$ decided to make the updates without input from the user...

IMHO, my input would then change to ... linux.

/nebulus

The last thing any Windows sysadmin is going to want is an OS which patches itself automatically.

When running production machines (Workstations as well as servers, but mainly servers), it is *vital* to test any change of software, no matter how insignificant, in a staging environment.

If Microsoft made it automatically update without asking for confirmation, applications could break at the weekend, while the sysadmin was on holiday, etc, and remain broken until someone noticed.

It's happened numerous times - some M$ patch killing your most important application. M$ have a long history of releasing broken patches that make things worse.

This is why any prudent sysadmin wants to test *any* patch - no matter how insignificant - first.

Of course production web / email servers would not normally have enough network access to obtain the patches anyway - as any prudent network admin will put them in a DMZ where egress is forbidden.

Slarty

90% of the machines I have de-Blasted this week Had NO Patches installed.. .. xp machines pre Sept 2002.. no Sp1.. Perhaps Autoupdate on by default BUT selectable.. We have to account for the average ID-ten-T here..

Quote:

---

Windaz updates?.. I have a Virus program!

---

most home users don't want to think about these sorts of problems.. they just want their computer to do a task..
Using acomputer when you are extreemly security concious is like driving a Car.. and having to manually feed the fuel into the Carbie, open the thermostat when the coolant is to hot, and swithc the Alternater charge o/p on and off to prevent battery overcharging.. You wouldn't consider that while driving a car.. it is the same with Home PC users and computer security..

I don't like the Idea of mandatory Updates, I would prefer to test on a non-production machine B4 mass installation..

Cheers

I think you might have miss-interpreted this article and what MS are trying to do.

They are aiming for home users with this, and are saying that if you go for a default instal, then MS will automatically install patches, and turn the XP firewall on, which in my view is a good idea for your average home user. Which is not the same thing as saying you can't change this setting if you have some IT expertise.

For a corporate user running e.g. Win 2K/XP or 2003 you will be able to stop automatic updates happening very easily - if not fire your Sysadmin.

I also doubt that the windowsupdate site (the real one) will get compromised - sure it might get taken offline by a DDoS attack, but that isn't quite the same thing, is it?

Darkes,

I'd disagree. Anyone can be compromised. It is a question of a) how often and b) how public they make it. Microsoft itself hasn't kept it's own servers up-to-date and it got hit by the Sapphire worm last year. While it's helpful to aid the home user, I think it would be better if home users were "forced" (gently) to learn more about the machines they run at home.

Attitudes of "I have nothing important to steal", "I'm just a home user", etc. are the reason that machines remain unpatched and lack anti-virus software.

In my opinion, I think power should be returned to the user to be more proactive about their activities online. Our society has accepted that someone else will "do it all for us" and that there is a "be-all, end-all" solution for everything. Events within North American society (obesity, rising car usage, less interaction with neighbours, less community interaction, etc.) suggest this will continue. Computer manufacturers, Microsoft in particular, is encouraging the user to be more "stupid" about their machines and less interested in learning even a little about how they work.

Hopefuly we can still turn off auto update. most patches from MS I have applied have broken something, includeing this RPC patch.

I am all in favour of life being made easy for the "home User"........but this looks more likely to be Microsoft trying to make life easy for their support people?

Apart from the very good objections already raised in this thread, these routines tend to cut in when you are busy doing something else, and are quite likely to cause them to crash. At least on low end systems.

Another thing, not everyone has superfast broadband connections or free internet connection, so they may want to time updates carefully? Over here (England) there is also the problem of excess traffic on Telcos/ISPs when school is out. You can't expect a download to last more than 45 minutes some days :) . I prefer to do that sort of thing late at night, when the rates are lower and most of the younger users are in bed.

I have also noticed in the past that a number of large windows updates relate to things that I don't use.......................so I wouldn't want them anyway?

Just a couple of thoughts.............

Cheers

4 words to add to this discussion...

XP service pack 1...

i would certainly rather MS didn't automatically update my box, after SP1 froze midway my machine couldnt boot and i had to do a recovery from my install cd, so long as i have my linux firewall and anti virus up to date im happy, security patches or not

Win2K SP3 added the new Automatic Updates process that ships with XP.
With this version, you can currently set it to "Automatically download the updates, and install them on the schedule that I specify", then you select which day of the week (or Every Day) and a time for this to happen.
Sure, it is not enabled by default, and maybe that is what is being thought for Longhorn. But I'm sure as heck not going to run it that way!
I am not the best fan of the whole Automatic Updates process anyway. I prefer to schedule patch maintenance times, then I download and install patches that have been out for a while. I NEVER run a patch that just came out. I have seen several patches that were recalled due to problems.
To let a system automatically download and install its own patches in the middle of the night will just lead to phone calls in the middle of the night when the server does not come back up!

Never heard anything so ridiculous. Microsoft never fails to piss people off. Everyone wonders why Microsoft is a target... self-inflicting moves like this makes it pretty obvious

With respect, I think a lot of people are missing a few issueshere.
I would always expect MS to give anyone who knows what they are doing an option to disable this - if not then, yes, MS has got it wrong.

But on a PC sold in a high street store (especially 3-5 years ago) ??
A lot of this depends on how old you are - let's take an arbitrary age of say, 35 years old.
If you are over 35 (or whatever), then you expect your PC to work like any other household appliance. We all know that this isn't the case at the moment.

I'm speaking from personal experience here, as I have fixed several PCs over the last year for friends & family (I happen to be in the 35+ age range, but have worked in the IT industry since university). One quote that I thought summed everything up was:

"I expected this to work like my lawnmower - why doesn't it do what is says on the box?"

To which I replied that this was a bad analogy, and in fact your PC was more like a dodgy second hand car, which needed a mechanic to fix it (it was infected with bugbear at the time). As I've done that, why don't you let me give you some driving lessons :D

Darkes,

Fair enough but how many lawnmowers do you know that go back to John Deer and get themselves repaired? The reality is that if you want your mower repaired (and sometimes they do need repair -- new blades, engine tune-ups etc.) you take it in.

Computer "heal thyself" is not a reality -- at least not yet. And I don't think it will or should be one for a while. One of the problems is the reality of poor software. I think MS is opening itself up to more problems than solutions. The idea is good in the sense of helping users keep up-to-date. However, it assumes that everything will go smoothly. I remember the SP6 update for NT. A friend was a Lotus Notes admin and had decided to wait. She was one of the few smart ones. Many lost their Notes installs due to this patch, which had never been tested by MS in that kind of environment. MS cannot test patches for every conceivable setup.

I think perhaps better notifications (more details as to why they need the latest updates rather than just "There is a new update. Click here"). RH's update actually will tell you what the updates are for, what thingy they fix and why it needs to be fixed. Educate the user. That is far more powerful than any update mechanism is by itself.

IMHO.

Again, I don't agree with MsMittens.

I would never dream of applying any MS patches to a live system that I support on a professional basis. On the other hand, how much damage has been done to home users by automatically applying critical updates? Worst case scenario afaik - it slows your PC down.

Home users running a networked version of Lotus notes - not very likely !!

MS issuing warnings about what the update does is going to be completely meaningless to a large number of people, who do at the moment reject the MS updates. I know someone who rejected the MS update to fix the LovSan hole (RPC/port 135 loophole), because they thought it must be a virus that was issuing the message .... and yes, they are infected :)

I try my best to educate the end users that I deal with, but some have no interest at all, so I end up wasting my time.

Funny. This new direction contradicts two MS products SMS and SUS. Are they going to strip capabilities out of these tools? WTF is Billy up to now? I know that if I shelled out 300K for SMS and then found out that patch management fell to the wayside, I'd be *quite* pissed.

I have to agree with darkes. Most of Worms and Virus are keep alive by home user who does not keep their anti-virus and windows up to date. Before MsBlater worm, I always disable windows update features in machine I was installing for friends and neigh Bourg but I really start to think I should turn in on even if I have to reboot their machine while their are working. Maybe Microsoft could have a brain and put option to install update only when the user shutdown down is computer. This way, it's would be almost invisible to the user. With ATX computer, the time is take for a computer to shut down is not important since it request no user input. Forcing a update to be install before shut down don't slow down the user in is work and he's won't bug him for a reboot in the middle of a working session.

For corporate user, automatic update shouldn’t be use. Windows 2003 servers have nice features to push update to computer. But for home user, automatic update must get better.

Quote:

---

Originally posted here by darkes

Home users running a networked version of Lotus notes - not very likely !!

---

If I suggested they would, I apologize. It wasn't my intent to suggest that but rather use it as an analogy as to the problem with autoupdating without question. Personally, I think that users will not know what to do as they will not know what has happened.

An autoupdate of AV is usually a simple update of the virus dat file.

An autoupdate of an OS could change anything. Problems that occur may leave users unawares as they will not know what has been updated/changed.

As for users not wanting to know, they are always like that. People are making assumptions based on what they are told. And that lies, IMHO, with MS and their idea that an OS should be "problem free" and shouldn't require greats amounts of learning to use. MS propogates that anyone can use their OS without any manuals or understanding of computers. And they do this not for the betterment of society but to sell more. The less you investigate and ask questions, the more they can sell.

Will this change? Probably not.

Will autoupdate without question fix this? No. I don't think this is the solution for long-term issues. (Case in point: the recent sobig.f variant is running more rampant than ever before even with autoupdate AV -- on those machines that have it).

Is there a solution to this? I don't know.

Will darkes and I ever agree? No. So the closest we can get is to agree to disagree.

In My less than perfect world Users dont care about updates and dont want to know what they are all about and i have to live with the fact that if an update isent done in under 5 mins some bastard is gona complain about it. And i think that setts a standard fore the average home user...if its not done in 5 min. its not worth doing before some one is throwing a virus at them...ore pointing a gun.. Some ppl just dont se the point before its to late.

Auto-updates of virus scanning software is not just a change to the .dat files. In most cases the scanning engine is updated as well(if an update is available). In McAfee I have seen atleast 4 different instances where a scan engine update caused problems to the system. So it is the same thing. The biggest issue here is that the common everyday computer user will never patch their systems.. They don't understand why they need to, and they also don't know how to. Even though it is as simple as clicking on the "windows update" button.

I think the really funny thing is that people think it will make a difference if the system updates itself automatically as opposed to a user who knows nothing installing the patch. It gets you the same thing. The user still doesn't really know what is going on. And you will never educate everybody to the level that they need to be educated to. So I say this is a great thing. So if the system crashes after they manually install a patch are they really going to know what to do to fix it? No.. They are not going to know what to do. So what difference does it really make if the system updates itself automatically. I've talked to several co-workers of mine that know very very little about computers, and they all say that had they known that they could turn the auto-update feature on to automatically update, that they would have done it. In all of the cases I told them how to do it and they all went to their machines that have auto-update and enabled it. To the non tech savy computer user the system taking care of itself is a good thing.

It is pretty obvious that they would not take away the ability of the informed user to turn off the auto-update features. For the users who don't know how to manage their systems, having it done automatically is a great thing. It works for my employer of 80k people. Sure problems happen. But the occasional problem here and there is a lot better than having hundreds/thousands of systems infected by something that had a fix available weeks if not months prior.

Just had another thought on this.. Given that XP and the newer OS's have the system rollback functionality it would not suprise me one bit if MS dramatically improved this particular function of the OS so that the average home user would be able to easily identify if their system had been patched automatically, and give them the ability to easily back out of that patch. If the tools are built properly this is easily something that a tech person from Dell, etc... could do over the phone.

Also, about the SMS issue. I don't think this competes with SMS at all as automatic windows updates will only install MS patches and things like that. There are always been tools that are not as expensive as SMS that allow you to blow hotfixes out to a large group of systems. SMS/Tivoli is still critical to deploying major software updates and application packages inside of an enterprise environment. I don't see how this interferes with SMS at all.

Hi Folks,

I think that this is a most interesting thread......should be sticky for a while..............a lot of us work in some sort of support role; either that is our job, or how our friends and family perceive us?

We will come across all sorts of problems, many of which are related to software or hardware incompatibilities?.............I personally rate virus/malware attacks at around 40% of incidences.

As people have already said......education is a big problem........I meet this all the time....Microsoft will not beat this...autoupdate will not..........IF THE SOFTWARE WAS FIREPROOF... IT WOULD NOT BE AN ISSUE?...............if you issue software before it is "ready", then you are bound to have problems..................

Nice posts folks!

cheers

It is not a matter of releasing software before it was ready.. If that was the case no company would have any released software on the market as all software has bugs..

mohaughn

You are quite right...........but they do issue the software................so it has "bugs"....hey, I understand, and have no problems with this

cheers

I agree with mohaughn. Your average home PC owner has no idea what is going on, and is almost certainly running some flavour of Windows - in many cases a completely unpatched version of Win98/ME or WinXP.

So the brutal choice is should updates happen automatically or not?
Obviously this process is far from perfect, but to repeat the point I made earlier, to date I have seen no serious side affects from the home PCs that I have fixed for friends & family.
I would far rather they got the odd dodgy update from MS, rather than leave themselves exposed to the latest worms & viruses.

Curiously, there is a simple roll back process for a lot of MS updates, under the simple Add/Remove programs option (as well as System restore, of course).
I always make a point of leaving them with a simple list of do's and don'ts and to email me if they are unsure about something.

I think there are those who would like the auto-update and would think it was a great upgrade for thier computer. If windows can have its way with your system so can others. Would there be a way to piggy back into a system on an update? There would have to be a hole in the firewall to let ms update in. For the average user, ms would have to set that hole up for them. The 2 xp's I have in my house came with firewalls. All's a use has to do is set it at default and ms would have it's way. Hmmm, I don't like that idea at all. Sounds like a majer FUBAR waiting to happen.
The rollback feature was a real help to a friend of mine. He was downloading some software from his 98se and messed it up. His wife was pissed off about spending all that money and breaking the computer. He shut it down and went to bed. He says he couldn't sleep all night because he thought he broke the machine. In the morning he went back to try and fix it, and found it was right back were he started. You talk about a happy gent. That rollback feature saved his hide.
Some of the new features are great, but the auto-update is one that sounds like trouble.

I rather have home user who doesn't know anythink about Windows Security/Patch call me when a automatic patch broke their system rather that get alot of call when a big worms get out specially since patch rarely broke home user system because they basically use Windows for Internet and Office.

You wouldn't have to punch a hole in a firewall to make auto-update work. As it is basically just a port80 HTTP call, most NAT firewalls will allow that type of communication to happen anyway. As long as the computer inside the firewall begins the communication, which it does, the firewall will not block any traffic.