Slashdot Mirror
Microsoft wants Automatic Update for Windows
Edward Dao writes "After the embarassment of last week's blaster worm, Microsoft is weighing the possibility of automatic update. Microsoft not only wants to upload the latest patch on to users' computer but also installing it for them." This will work out really well for everyone I'm sure. Yikes! Can I at least press 'Ok' first?
Of course, this will be implemented in such a way that implantinga fake RR for windowsupdate.microsoft.com into a local name serverallows Windows to download and run any file with a certian file name. This should make it far eaiser to fool Windows Update into installing Linux.
This will make Linux rollouts a breeze after buying all those Dells.
Imagine the possibilities!
Then again, the Microsoft Tax is cheaper then the SCO tax.
Wouldn't this clasify as a worm too? I don't want anything installed on my system without my permission too.
Nice to see that M$ is in the worm buiesness too.
If you RTFA you'd find that Microsoft is only "looking very seriously" at this idea,
that it would not apply to business users of XP (since they want careful control
of the patching of their machines), and that it would be possible to opt-out from
the automatic updates.
So if you are a business user you don't get automatic updates, if you are a home
user of XP that is technically savvy you can turn it off, and if you are a home
user who is not computer savvy then you are going to get automatic updates. This
latter group seems like the ideal set of people to get automatic protection.
John.
they want to reboot my computer without informing me?
Harder.. Better.. Faster.. Stronger
Well, we all know what a nice job Microsoft has done in the past of supporting individual machines.
Any sufficiently well-organized Government is indistinguishable from bullshit.
... how they will get people to activate the TCPA/Palladium features.
Now we know: MS will do it for you. How kind of them!
I know broadband usage is on the rise but really ... I use a modem. You know ... the kind that attaches to a phone line? Everytime I get online with my low bandwidth solution, I don't want my bandwidth eaten up by patches.
... no thanks.
Granted, by the time this is incorporated into the OS, phone line users may be in the minority but until then
KARMA TAG! You're it.
I think this is a good thing for the Internet community as a whole, it's no longer all the redhat 3.0.3 boxes being rooted, it's WinME, 2k and later in the majority that i've been watching over the past years.
if someone breaks into MS WindowsUpdate servers, he could install ANYTHING on millions of computers!
wow... scary...
Some of us are still on dialup, and an automagic update of Windows via 56K modem would literally take HOURS if the connection even holds at all. I don't think I should be forced into high-speed access just so I can update my Windows partition periodically.
Be excellent to each other. And... PARTY ON, DUDES!
You can do this already with Windows XP if you set it up to do so. In the system properties go to the Automatic Updates tab and then click on the radio button next to the bottom option, "Automatically download the updates, and then install them on the schedule that I specify".
Of course you'd have to be out of your gourd to do this regarding MS's history of untested patches. Also I noticed that MS is including driver updates in the critical updates as well (nVidia driver). I've NEVER installed a driver from MS on my computer and every time a customer of ours does it, it seems to totally screw up everything.
Duris MUD - The best pkill MUD. Ever.
so when a bad patch comes out all the windows pcs in the world will simultaneously crash. I hope its an opt in thing. When you first start your pcs it can ask yes or no. Regular joe can press ok but others can no and do it manually.
-- Karma Karma Karma Karma, Karma Chameleon - Boy George
so how are we supposed to know whether it's the worm or the update constantly shutting down your computer?
There's no way this new functionality could be buggy and exploited by viruses! ;)
How do you know Microsoft is automagically updating your system? I think the fact that it reboots ten times in a row is quite a giveaway...
In other news, Microsoft announces that after the embarassment of last week's blaster worm it will begin shipping quality OSes.
Oh, sorry. I was dreaming again.
automatic blue screens of death
In the past MS has packaged EULA updates along with software updates. I really wouldn't have too much trouble with this as long as they don't try to push EULA changes along with the update.
Sure, some people might want to turn it off, but by and large I think there would be less damage with it on. I rarely meet a person who even knows what MS Update *is* let alone have used it.
I wonder how well this would work on dialup though? It seems like the world is really leaving dialup folks behind. I have cable myself but know a lot of people on dialup either because high speed is not available to them or because they really don't need a fulltime connection, and are getting by just fine on a $5/month dialup plan.
doesn't M$ already give that option in their windows updater configuration wizard.
Besides, I don't believe we have much to worry about. Home users may think this is good, but the corporate world (I hope) should be against it. Just like the Windows activation key type crap to prevent piracy. M$ eventually caved on this. With any luck this will be the same. (God willing, otherwise we'll face another surge of updates to patch vulnerabilities for that stupid feature)
So what is it that you really want?
Manual updates? "LOLOLOL! M$ users are so stooopid that they can't do even that!".
Automatic updates? "LOLOLOLOLOL!!! You would let Microsoft to update your systems?! You fool! Why don't you download a Gentoo instead?!"
Systems that are secure and usable out-of-box? No such thing.
BOO! TERRO
So what's new about it? Windows Automatic Update already does this for you, and it will install the updates for you, you only need to agree to restart the computer once they are installed.
MSBlaster wasn't an embarrasment for MS, but for the lazy sysadmins who, with a month's prior notice and the patch to fix it, were still hobbled by the bug. If people who are in charge of systems and security spent more time patching and paying ATTENTION to things like Bugtraq and less time complaining about MS the world would be safer.
How is this bug more of a bummer than how gnuftp was compromised and potentially more damaging? Oh, don't hear people moaning about that on here now do you...?
The tale is telling, is it not?
I for one will sever my using Windows if they don't at LEAST tell you with a yes/no prompt that a service patch needs to be installed. I don't have a problem with a pop up message telling you that there is a service patch available, would you like MS to install it, but, if it were completely behind the scenes, I'd have to say NO. I don't put all the patches/updates in, because most have to do with outlook express and IE, BOTH of which I do not use, so why would I want to choke my ISP by installing useless stuff? At least give us the option of saying no.
They sure as hell better come up with a better solution than what they do now! It would really be nice if they would release patches that don't crash your system. Last time I tried to patch one of our servers, it "upgraded" some system files and wouldn't allow me to reboot (BSoD). Thank good for Google, since the knowledge base didn't have the answer on how to fix that "added feature." JB
Don't get off the boat. Absolutely, goddamn right.
I'll dress myself, thanks Clippy.
Who doesn't like free music?
Doesnt RedHat 9 have this functionality already. Im not running it myself, but Im sure my bosss just touted this feature?
Harder.. Better.. Faster.. Stronger
Resistence is futile, you will be patched...
And who will pay expenses when the system kills a critical server in our orginization? Who is responsible for damages when these packages explode? I'm not trolling at all, I'm very serious. I support a lot of Windows servers, and I know very well the damage that a service pack or hot fix can cause. This will be just one step closer to making people understand just how much MS wants to control everything. This is a rediculous solution to a problem they are not willing to correct. They should worry less about patching my servers (leave that to me) and worry more about producing code that is not vulnerable.
"Reality is a crutch for people who can't handle drugs" - George Bernard Shaw (1856 - 1950)
I have enough problems with spyware and adware on my PC, now I have deal with M$ bullshit also? KEEEERIIIST!!!
Now I can probably have some one from Lavasoft make a new program to compliment Ad-Aware--MS-Aware and keep those pesky service packs from coming.
This may seem like a bad idea to most people, but I mean when you think about it, with how often patches are released from Redmond, it's almost necessary.
Obviously you would have to enable this feature yourself, and you would have to have access to a list of any major changes that had been made to your system via this automation.
Still, on the other hand, with the DDOS attack against windowsupdate.com and the possibility of it serving trojaned files, this could still be a problem. It all depends really.
The obvious solution is for Microsoft to make Windows more stable and less vulnerable... naturally we've had to come up with more viable options!
the problem with the automatic updates, is that the funcitonality of software could change overnight, depending on who makes the changes. maybe Microsoft decides one evening that they don't like having a 'Start' button, and decide, for the good of the world, that it will now say 'Stop', and will be in the upper left corner, instead of lower left....
the point is -- no one could stop it, and would be stuck with the change, even if the change wasn't desired or warranted....
We're like rats, in some experiment! -- George Costanza
"I have always been a fierce enemy of the Microsoft update feature, because I just don't like the idea of someone else -- particularly Microsoft -- controlling my system," said Bruce Schneier, co-founder of Counterpane Internet Security Inc. "Now, I think it's great, because it gets the updates out to the non-technically savvy masses, and that's the majority of Internet users. Security is a trade-off, to be sure, but this is one trade-off that's worthwhile."
And that concludes our evaluation of Counterpane's security consulting services. Have a nice day. Don't let the door hit you on the way out, Bruce.
Edith Keeler Must Die
I think here the main problem is Home Users, many are not aware of windows update and more rarely use it. They already have the option in the "auto update" to automatically download and install updates, perhaps this should be a "default" for home users? (ofcourse those of you who know more about your system could easily disable it) This might also make M$ think twice and actually double test their updates before they get released? (maybe? hopefully? or unlikely?) Whats the biggest threat to Computer systems? the user or the software? (I lean towards the user)
Just tried the KB823980 (DCOM thingy) security patch ...
So how will they accomplish that in the middle of a user session?
zWhat would an EWOULDBLOCK block, if an EWOULDBLOCK could block would? -- me
1) WindowsUpdate needs to become MicrosoftUpdate. This would scan and offer patches for all MS software (OS, Exchange, SQL, IIS, Office, Visual Studio, ....). Also extend SUS to do the same.
...
2) Critical Update notification should be done the way OSX does it (with a little configging) -- instead of a tiny little innocuos icon in the system tray, put an obnoxious pop-up in the middle of the screen, with a big "Go Ahead and Install" button, with lots of skull & cross-bone icons.
3) Create patches using their own packaging structure: MSI. This allows for much simpler deployment and management, via Active Directory. No need to pay for SMS simply for patch deployment.
4) Supply MUCH MORE documentation to end users, discussing the importance of keeping one's machine patched.
5) Stop producing such buggy software! =}8v)
Just my $0.02
10b||~10b -- aah, what a question!
I have always disliked a software update feature. Since I use Macs, while the software update control is nice and very conveiniant (also much less likely to be hacked) I think that if someone WANTED to they could spread a virus through the system of Mac Users much more widespread than Windows users because of the inherent niavity/novice of a Mac User.
"A Security Update to the Network Control Panel" for example
That said, I also think the Mac web is great and would INSTANTLY pick up on it within a few hours and post to dozens of websites, whereas Windows users have to here from some paranoid or a "too late" IT staff.
Yell & scream & rant & rave... it's no use... you need a shaaaave ~ Bugs Bunny
Windows already has the ability to download and install patches automaticly. But not many people allow windows to be set to that setting or dont know about it.
But id rather know when its about to install a patch. Thats the setting i have mine set Too
In America we are imprisoned by our fear of them.
The main problem is people not knowing, or not caring about patching or updating the problems. This isn't something that's directly managable by MS. With an OS so widely used, how can updates be ensured to be installed on everyone's machine to stop spreading of viruses and exploits?
Some will say the user should have the choice... ok, so half the people who couldn't care less will still allow the spreading of the problems...
Some will say automatic background updating is the only solution... ok, so the majority of people still using low speed connections will bog down their systems, let alone major networks suddenly pulling huge bandwidth when every machine receives the command to update simultaneously...
And some still complain that even if the update is pushed and you need to say yes or no, it's still infringing on your privacy your own system...
Is there any way to implement a global, trustworthy, reliable patch service that is accepted by everyone? If not, there's no way to stop the virus spreading, work generating underground from having hay-days at the world's expense...
And this goes for any OS, not just Windows...
Microsoft is also considering whether to make the Auto Update mandatory earlier, through an interim upgrade known as a service pack.
This is a huge mistake. Talk about a support nightmare. I recently spent several hours trying to find out why my machine was freezing intermittently, only to find that Update 811493 was to blame. I uninstalled it and everything worked perfectly-- if they make it mandatory, and have a similiar problem what do we do? (Switch to Mac or Linux, right?)
For the record, there's still no way to tell Microsoft I NEVER want this update. If I use "auto update" at all it downloads it and wants to install. So, now I'm stuck using manual update or my machine might freeze up again.
Just great.
Would you trust this guy with your computer like that? HA! yah right..Look at that smile, pure evil I tell you.
[alk]
Most people are in far more danger of their computer being destroyed by a virus than they are of it being damaged by an automatic update.
If you think this is a bad idea, then you don't realize just how stupid the great mass of computer users are. I'm sure Microsoft will make this in a way that will allow anyone who knows what they are doing to turn this feature off. But it will kill viruses and worms that exploit windows holes, that's for sure. I can't recall one that's come out in years where the patch hadn't already existed, but that users were too stupid to download.
Besides, I'm sure that recent power outages spooked Microsoft for at least a few moments. They thought: Could this have been a computer problem? Not even Microsoft has that kind of money were it to be found liable.
Will Microsoft then fix everything they broke when they applied the patch? If Mr/Ms Home User isn't tech savy enough to apply the patch I rather doubt they are up to cleaning up the inevitable mess that Microsoft will create.
MS already has an automatic update option for those who choose it in the Automatic Updates control panel applet.
Users can choose to be notified when updates are available, they can be notified when they've been downloaded and are ready to install, or they can just have Windows download and install the updates automatically.
This isn't really news.
* NB: allowed, not required---it's your choice.
20 mil and I will! Learn Esperanto with 20M others.
Yikes! Can I at least press 'Ok' first?
That's one of the major problems. Windows has had an auto-update notifier for some years now. It checks windowsupdate regularly, and if a new critical patch is available, a dialog box asks if you want to download it. Most people have optioned to not do so.
IIRC, WinXP gives the option to make it download a critical patch without asking, but that's turned off by default.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
So what happens the auto updating feature get compromised somehow? Seems like the best way imaginable to spread a virus.
Isn't about time that we put the blame where it really belongs? On the damn ISPs! If we had decent email scanning and blocking of useless ports this shit wouldn't happen so much. Why does joe six pack need a port 135 open anyway. If you need the port you should ask to have it open otherwise most ports should be filtered by ISPs by default. Do that and hold ISP responsable when obvious virues pass through the smtp server and we wouldn't have a damn virus/worm problem.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
Now, just compromise the automatic-update machines, install trojan on updates, and
"Arise, my children! SkyNet is BORN! ph33r m3!"
If you were me, you'd be good lookin'. - six string samurai
...I can disable it for my corporate environment. Don't want my computers breaking from poor updates.
"Bill Gates wants to put his worm in your box"
I'm not necessarily for Automatic Updating, but it isn't such a bad idea. Working as a Security Officer for a web hosting company, this would sure make my life easier. The question is, would ALL of M$'s patches be self-installed, or simply ones they find so critical, that they need to resort to mass emailing. A graded system would be nice, perhaps tied into DShield; whereby as the threat increases, the possibility of self-installation increases.
!.sig
If you want real news, read fark. If you want stupid linux shit, read slashdot.
if (company_trusts_microsoft_code())
{
use_windows_OS();
allow_auto_updates();
}
else
use_some_other_OS();
/*
junk code
bitch();
moan();
flail_arms_wildly();
*/
Banu
I particularly like the bit "What we're finding now is that through a combination of the availability of broadband...." and the lovely "...not just by downloading the patches for them but installing them as well."
What about us poor saps who can't get Broadband? In the "rural" part of England where I currently live (13 miles from the centre of the sixth largest City in the UK) I can't get Broadband, and BT tell me my telephone exchange will probably *never* be upgraded! Also, the Cable Companies are all broke, so no luck there...
So, how would this help me if I had a Win box, and required 30+MB of patches every month? My internet connectivity is a dial-up connection, with a two-hour cut-off (quite normal for UK ISP's) so no help there.
Hang on - phew! just remembered - my Red Hat boxes, although needing occasional patching, give me the option to download the patches from elsewhere via FTP (like using a leased line at work!) and then burn them on to CD to run on my RH machines at home! I'm saved!
If only MS were so willing for us dumb-old home users - who, I believe, where hardest hit by Mr. Blaster and friends. Kinda reminds me why I don't use Windows on my home machines now....
-- Seamus
Automatic updates aren't the answer and you can bet that enterprises will rebel against it. There is already an auto-update feature that allows uses to configure how updates are processed. Either never getting the update, downloading but not auto-install, and auto-download and auto-install. That is more than enough.
End users have to become responsible to keep thier systems upto date. Keeping upto date is not Microsoft problem.
For companies, they have to get better at updating remote computers and there is already a cottage industry evloving around patching. But companies also need to have procedures for allowing remote computers to acces the internal network.
This is the same story over and over again from Microsoft.
The entire industry of proprietary software is based on control. A company or companies wish to have you pay them money, while they retain control over the entire product. You merely pay them more, continuously, for the use. And when it comes to major bugs in software updates, the "you will pay" philosophy will come to mean more than just cash.
There is no other way to have a safe and reliable system, no matter what the coding ideology behind it, than to have educated sensible users. It's simply not going to improve without that base.
The advantage to OSS of course, is that those educated users can do more with their systems. You're restricted under Windows or MacOS for example, to what those companies wish for you.
RST
Circa Windows 2000, service pack 3.
By default, this already happens.
The story here is that Microsoft backed off when privacy groups thought this was a crummy idea (especially with the EULA of SP3 and XP SP1, big-brother visions abound).
Now they are saying they'd consider giving you more control over this, and to, by default, accept security-relevant patches in this manner by default.
Also, (big item), they'll ship the machines with the firewall enabled. That alone is probably the best idea they've adopted under recent community pressure.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Heh. That's the most insightful line on Slashdot so far today.
I think this is smart business. Next I want my red stapler back and my upstairs cubicle. Thanks, Milton from "Office Space"
How can Windows be required to accept updates if the user can tell it not to? Somebody please enlighten me on the meaning of the word "required".
IFF (if and only if)...
they stuck to -security- patches
and those patches didn't break common configurations (anti msblaster didn't work on 2k sp2)
and there was user consent 'no, i dont want this particular patch for whatever reason'
and an opt-out a la 'never ask me again'.
then
i wouldn't see it as a bad thing, being on by default. maybe not turned on, on 'Server' installations, but certainly reasonable (given the above assumptions) for home installations
face it - automatic updates is how antivirus software works by default, more often than not.
users just can't be bothered to proactively look after their own gear.
and no matter how well you test - eventually you -will- have bugs, potential security issues, etc. these patches need to be distributed, and right now that isn't happening.
full-on autoupdate of drivers, service packs, compatibility patches, extensions, etc should remain very seperate.
but of course, we all have a good idea how likely the 'If's are.
// "Can't clowns and pirates just -try- to get along?"
is exactly why they can't seem to control a little virus. They give insecure programs the rights to do anything to your machine it wants.
I don't do windows. You shouldn't either.
* Check for warez/serialz -- disable them and alert the vendors. Vendors can subscribe to "MS Auto Alert" program.
* Check for downloaded MP3s (from a database of known MD5s) -- disable them and alert the record distributors. RIAA can subscribe to "MS Locked Tunes" for service.
* Check for P2P programs -- disable them and alert local gov't authorities. Gov'ts can give big grants to MS for this as part of their "Anti-Terror-and-Pro-Business-Computers" bill.
* Check for web/ftp/irc servers -- disable them and alert ISP as to uploading violations. ISPs can join the "MSN One-Stream" network.
* Check for NAT -- diable and notify ISP... part of the push towards "MS-IPv6-PLUS!"
* Check for competitors' products (DRDOS, Java, Mozilla, OpenOffice, etc) -- disable them and alert user that their software was incompatable with the latest service pack. This one is free for end-users!
Can I at least press 'Ok' first?
No, Then it wouldn't be automoatic. If microsoft owns the software and users just have permission to run it, then by the eula they could leagally do this now. Actually, I think it would be a really good idea for critical updates for microsofts software and microsoft's software only. Many times the driver updates they have on windows update for mycomputer are not the correct ones. I would be very upset if those were automatic.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Aren't there already tools for administrators to rollout patches en masse? Seems like we made use of that during the deployment of Windows2000, for that matter.
If that's all MS is "considering," well we all know what that means. That's a trial balloon floated to see what the reaction will be. But it sounds like MS wants automatic patching on every desktop. Good christ on a fucking biscuit! They get targetted one week and the next they want every system to be identically compromised!?
A few months back microsoft advised that you do not trust microsoft certificates. Now they want to do automatic updates without any verification by the user? That's scary!
I think this is great, most Windows-users don't know what Windows update is anyway. Of course it should only distribute critical updates.
You can already have Windows download and install the most important updates on its own. I have this feature enabled on an internal webserver at work, and it works very well. It downloads the patches as they become available, then it installs them att 3 AM when there's noone visiting the server anyway.
Corporate users probably don't want a feature like this though, if a fix breaks the most critical business application, it's better to not apply it at all. They would be better off with an internal Windows update-server that only hosts the patches that has been OK'd by the tech department. This feature is already available as well.
Martin
Anyone remember NT4 Service Pack 6? The first one? The one that broke tcp/ip?
Pathetic Earthlings!
All Your Box Are Belong to US
In the land of the blind, the one-eyed man is king.
The following patch will do the following to your system:
Ok - Ok - I'm Bill's towel boy, spank me please and install the patch!
Hate me!
Actually that is an excellent point, as no matter how 'automagic' they want their updater to be, at some point, knowing MS, they will want to flash an updated EULA agreement across your screen so you can actually, you know, agree.
I don't think I'll agree.
Unless they do something sneaky, like 'by clicking the Start button you agree to all EULAs sent by Microsoft'... in tiny type the same colour as your desktop, of course...
If Jesus wants me it knows where to find me.
I remember at the end of the summer I used MS's little auto updater thing to install a patch that killed my network connection. MS reported a week later that it was a "minor problem", but the patch could disable networking on a "few systems". It was really fun, because had I not remembered System Restore, I would have had to wait a week or so for MS to release a fix for the patch, a double patch if you will. Can you imagine opting in when you maintain hundreds of systems, only to have your networking killed by said update?
liars & touts & shills, 0 my. & now, another terabyte or 2 of billonlyus payper liesense ?pr? ?firm? generated drivel, from robbIE's 'sponsors'. yuk. does any of this really matter, as the greed/fear based walking dead execrable huddle/hive in their bunkers? we DOWt it.
what does matter? why the planet population rescue effort of course. tell 'em robbIE.
of course that's off topic, as the hobbyists are the total opposite of the phonIE payper liesense corepirate nazis.
you gnu/software folks are to be commended. we'd be nearly doomed by now without y'all. the check's in the mail again.
meanwhile... for those yet to see the light.
don't come crying to us when there's only won channel/os left.
nothing has changed since the last phonIE ?pr? ?firm? generated 'news' brIEf. lots of good folks (on all sides) are being killed/mutilated daily. if anything the situations are continuing to deteriorate. you already know that. so whoisit that gives a fud about the latest scammage from the evile kingdumb?
the posterbouys for grand larcenIE/deception would include any & all of the walking dead who peddle phonIE stock markup payper to millions of hardworking conservative folks, & then after stealing/spending/disappearing the real dough, pretend that nothing ever happened. sound familiar robbIE? these fauxking corepirate nazi larcens, want us to pretend along with them, whilst they continue to squander yOUR "investmeNTs", on their soul DOWt craving for excess/ego gratification. yuk
no matter their ceaseless efforts to block the truth from you, the tasks (planet/population rescue) will be completed.
the lights are coming up now.
you can pretend all you want. our advise is to be as far away from the walking dead contingent as possible, when the big flash occurs. you wouldn't want to get any of that evile on you.
as to the free unlimited energy plan, as the lights come up, more&more folks will stop being misled into sucking up more&more of the infant killing barrolls of crudeness, & learn that it's more than ok to use newclear power generated by natural (hydro, solar, etc...) methods. of course more information about not wasting anything/behaving less frivolously is bound to show up, here&there.
cyphering how many babies it costs for a barroll of crudeness, we've decided to cut back, a lot, on wasteful things like giving monIE to felons, to help them destroy the planet/population.
no matter. the #1 task is planet/population rescue. the lights are coming up. we're in crisis mode. you can help.
the unlimited power (such as has never been seen before) is freely available to all, with the possible exception of the aforementioned walking dead.
consult with/trust in yOUR creator. more breathing. vote with yOUR wallet. seek others of non-aggressive intentions/behaviours. that's the spirit, moving you.
pay no heed/monIE to the greed/fear based walking dead.
each harmed innocent carries with it a bad toll. it will be repaid by you/us. the Godless felons will not be available to make reparations.
pay attention. that's definitely affordable, plus you might develop skills which could prevent you from being misled any further by phonIE ?pr? ?firm? generated misinformation.
good work so far. there's still much to be done. see you there. tell 'em robbIE.
CSO has a story claiming that patching just doesn't work as a security solution: there are too many vulnerabilities, and the patch creation and implementation process creates new vulnerabilities. For example, the article cites Microsoft's release of a nonsecurity hotfix for SQL Server -- which could reopen servers to the Slammer worm.
I was just talking about Blaster last night with one of the guys interviewed in the article. His solution is centralized patch management -- installing client software on his ten thousand boxes that checks whether a patch that he's approved for distribution has been installed yet, and either installing overnight or warning the user that the machine will be downloading, applying and rebooting soon -- save your work.
Talk about easy money! I personally would rather see my mother get automatic updates than be duped into spending this kind of money to have her computer patched (not that she would, but many mothers probably would).
Whoever did this, I wonder if they have a branch in the NYC.
Automatic Updates is a feature that Microsoft already implemented. True, they won't install for you if downloaded automatically, but that's just another feature that could be added.
There's always been the option to not use Automatic Updates. I, for one, hate that system- and connection-slugging feature even with high-end hardware on a high-speed connection. So I disabled it, and I don't download the Automatic Update updates from WindowsUpdate.
What makes you think that Microsoft won't let you choose to not use Automatic Updates? The difference may be so subtle as to simply ask upon installing Windows XP SP2 (or Longhorn, for that matter) whether or not to activate Automatic Updates. I wouldn't doubt that you'd also be able to customize it to download but not install.
It's like the old joke:
What's the difference between a light bulb and a pregnant lady?
You can unscrew a light bulb.
MS had better make very sure their functionality is more like a light bulb than a pregnant lady. :)
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
You click OK to the EULA that allows you to use Bill Gates's computer that he has so generously allows you to keep on your desk. Don't forget, it's their system, you just happen to sit in front of it. Yup yup!
You see? You see? Your stupid minds! Stupid! Stupid!
Actually, at my current environment, we all run SMS (systems management server), so nightly there is a security tool which runs which determines which patches are applicable to you but have not been run. It then "queues" them up -- sometimes several at a time -- and then installs on a pre-determined schedule.
They've also pushed this to the server room, so now patches are thrown down on the servers.
The basic philosophy behind this is that we might have a production system go down for a while, but it's better than an enterprise wide outage.
Peace out.
"This isn't a study in computer science, its a study in human behavior"
-- Some people say they can tell the time by looking at the Sun, but I have trouble seeing the numbers.
I'm not sure who these customers are that want this...but to me this amounts to saying "our customers are lazy and stupid". Maybe I'm trolling, but...the "kinds of threats" that are out there are caused by microsoft writing vulnerable code in the first place! Sure everyone has bugs, but maybe, just maybe, they'll write a buggy patch too! I don't see how anyone could even be considering this as the default. If these people want microsoft to automatically update their computer...they can turn it on right now!
I know you hear this a lot here, but people need to either
a) have a working knowledge of their computer/operating system, including how to maintain it.
b) have their computer regularly maintained by another live human being.
This isn't that hard. People have this perception of computers as the same as their television or washing machine in terms of support - don't touch it unless it's obviously unusably broken. They don't work that way, they're much closer to cars. Sure, some people don't maintain their cars either, but those people aren't in the majority.
I'm rambling at this point, but really this is a disaster waiting to happen. What, are we going to end up testing EULAS in court finally when microsoft breaks ten million computers automagically and then says "well, you clicked the agreement"? I guess that could be agreeable. Please, I know most people here know what they're doing with their computers, but this problem is not just caused by microsoft. Educate everyone you know about the needs for computer mainenence! Make them pay you, I don't care, do something. Of course, the stupid IT department here got the worm too, so maybe it's completely hopeless.
That way, people will perceive MS as a totalitarian-dictator-like software company, whose aim is to take control of your machine away from you even more than they currently do.
It's really funny how almost EVERY move MS makes back-fires on them.
Compare to the early 90s when MS couldn't do anything wrong...
I don't know the meaning of the word 'don't' - J
Sure the tech savvy users like those who frequent slashdot (and we're ignoring the rabid fascist anti-MS zealots here) will not like the idea - but the problem that Microsoft is having is that even the general public are starting to mistrust them.
A case in point is the abysmal failure of Passport. Sure it has hundreds of users, but nearly all of them were forced into getting it because they wanted a hotmail account. Very few people actually store all their personal details on there.
Until they get the trust issue sorted, people are never going knowingly let them take control.
Avantslash - View Slashdot cleanly on your mobile phone.
Doesn't Microsoft remember the .NET update fiasco they caused 2 years ago?
.NET updates to XP, 2K, etc caused Windows PCs to lose the ability to access the web, launch certain applications (including little things like Internet Explorer and Outlook Express), and even raised stability issues with certain PCs. In certain cases, the rollback feature would not resolve the issue, and the OS had to be reinstalled.
.NET update patch on new PCs - Dell, HP, Compaq, et al - all recommended that users *stay away* from the .NET updates.
Installation of the
Even the OEMs were *not* installing the
Given that even Microsoft cannot predict how their patches will behave once installed on their own OS, what are they thinking even considering updating automatically?
This is a bad idea on soooo many levels
First of all is their patches. They sure as hell aren't 100%. So one day your favorite program might work, and the next day it might not. All wihtout you doing anything. This is why businesses take a while to evaluate patches.
Secondly, what if there is an exploitable bug(and there will be at least one). Every windows machine out there might be downloading viruses instead of updates. If someone were to reverse engineer the network interface, and hack a couple DNS servers, they could have all those users downloading whatever they wanted, even illegal things, or viruses, hacks, anything.
Plus there's the privacy issues. I konw that right now windowsupdate could send MS anything anyway, but if we all expect it to update any time it wants, we have no controls at all on our system, MS could send an update to lock you out of your own system if they suspect you of something, or just for the hell of it.
While I don't expect this to actually go through, its important to be wary of just how abusive such a system could be.
P.S. I, for one, welcome our new windowsupdate.microsoft.com masters.
Wouldn't you love to hack this so that it downloads and automatically installs Debian?
:)
I would.
Chris
http://www.studentplatinum.com
Subscribe for free to my show!
OK, Considering that they do incoporate this 'necessity of the customers' into the OS, who is going to pay for all this ?
MS Patches arent a dll replacement or anything simple like that - so, one would have to account for the bandwidth costs for the *MB worth of download, and also, who will support, if like a user above pointed out that, a patch would break the OS - call MS Support ? (Wait - I need your credit card # please).
To understand the needs of another person is a difficult thing indeed.
I really hate hearing news like this. On one hand, I think it's a great idea, because there are far too many morons out there who don't know how to update and patch their OS. This would be such a help for it. Of course, I'm not sure that I want MS automagically installing software on my computer, especially if it is without my knowledge. Why don't we have an agent program like the antivirus updates, that when the computer starts, it looks out on the net for updates, then informs the user of the updates, the size, and what they do. Then the user has the control to download them or not, but at least the updates will be right in their face. Either that or don't allow them on the net to spread virii. Of course, maybe we should block all MS OS users from the net. Looks like I need to install Linux...
Don't buy WoW Gold! Make it yourself!
If Dell, HP, IBM, for Vendor X sells a PC to a customer, and Automatic Update causes that PC to no longer boot or work properly, that customer is going to back to where they bought the PC. Who is expected to pay the support? The vendor? Microsoft? The customer? My guess it'll be the customer one way or the other.
What if the machine is in a small or home-office business handling some critical task and the Automatic Update causes a failure or some data to be lost? Will M$ be liable and pay damages? Doubtful.
If the patch requires a reboot, will it also automatically reboot the machine?
I can see so many ways this is going to cause all kinds of problems.
My guess is that the "Home" version of the OS will have automatic update turned on by default, and probably difficult to turn off since M$ users don't know how to do anything for themselves, therefore if they try to turn this off they must really be trying to turn it on so they'll leave it on. (Hmm, that sounds kind of like turning off DCOM but it still being active).
The "Pro" of "Office" or "Server" or whatever they call the more expensive version used by IT departments will probably have this turned off so automatic update doesn't take out people's networks. Especially people big enough to be more than just a minor irritant.
Can you image a Fortune 100 company having 1/3 or 1/2 of it's systems down and its IT department totally consumed and in knots trying to fix a problem that looks like a virus. First just a couple of systems would have problems, but as their clocks hit a certain time and the Auto Update goes out and installs the new code, more and more systems fail.
And then there are the systems that report they have the update installed, but really they don't for whatever reason. Following NTBugTraq on this last virus has been more interesting than for past viruses. Several systems had DCOM turned off, all the tools said it was off, but the systems were still vulnerable. Other systems reported the patch was installed, but they were still vulnerable.
This auto update sounds like such a can of worms. M$ may just be giving more people the push they need to check out alternatives. Here's hoping.
. 62,400 repetitions make one truth -- Brave New World, Aldous Huxley
... as the 'Automatic Updates' control in Windows 2000 SP3 and beyond. It is enabled by default in SP3/SP4, and will place an icon in your taskbar when new updates are available. It won't download them until you ask it to do so.
You can set it completely off, or set it to automagically download and install updates.
What came before the Big Bang? Hum, it must have outside of time...
From the article:
"The company is 'looking very seriously' at requiring future versions of Windows to accept automatic software fixes unless the user specifically refuses to receive them..."
So yes you can "at least press Ok first." Although I'm sure CmdrTaco has nothing to worry about, since he doesn't run Windows any more, which I suppose is why he didn't read the article.
Personally, I think that this would probably be a responsible move on their part (and Bruce Schneier apparently agrees with me). I especially like the fact that they're going to start shipping Windows with the firewall enabled. As far as I'm concerned, no one should be worried as long as you can disable automatic updates and disable the firewall (though I think they should make it slightly non-obvious how to do so, so that the people this is intended to benefit won't turn it off). After all, you don't leave Windows exactly as it comes off the CD, do you? Hopefully, you'll also be able to create corporate install CDs with these features disabled if need be.
There are only two things that concern me:
1. Broken patches: What if, as has happened in the past, an update breaks the auto-update mechanism? Then they'll be pretty well stuffed. I'm not sure what to say about that other than "don't do that."
2. Dial-up users: As the article mentions, SP1a is big. Really big. I mean, you might think that the OpenOffice download is big, but that's just peanuts compared to...right. However, that was a combination of many small patches, and just like many other things in life, if people had updated incrementally as they should have, they wouldn't have a need for a giant update. Hopefully, MS will be able to keep the patch size down, and we can watch 2003 to see if they can keep the frequency down as well.
(Yes, I now have to care about Microsoft products again, which is annoying, but I might as well make the best of it).
WMBC freeform/independent online radio.
It would be great if they shipped XP with this option already enabled, as opposed to the "download, but then ask to install" like it does now. Everyone I run into NEVER installs anything that way, because they're "too busy" and just want all the little dialog boxes to go away as fast as possible.
And never mind the Win98 folks, who actually get the update notifier screen, but then have to go to click "take me to the page" and push a few buttons there, because people were "scared" that microsoft was STEALING ALL YOUR PERSONAL INFO OMFG. Everyone just clicks the "remind me later" and never gets a patch installed that way.
Slashdot, I present you the reverse-psychology troll!
Do you troll for people who play the devil's advocate, or think they have a non-conformist point of view or what? I'm really confused.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Hm, software that would slow your internet connection way down and patch Windows without the user's knowledge. Sounds like the RPC DCOM Cleanup Worm.
Adidas To Bring Back Sneakernet
Tell ya what Microsoft, you can patch my machine automatically as long as I get to sue you the first time an automagic update foos my bar. Yeah, tough call huh?
You may not know this, but there are a lot of people who don't jump on the latest service packs not because they lazy, but because they are scared.
You don't really own your computer, Microsoft does. They can do whatever they want whenever they want. Isn't that right class? Now repeat after me...
Having recently obtained an XP computer, I can assert that everytime one boots up the system (which is to say, with quite some regularity ;-), Microsoft already offers a persistent pop-up bubble prompting users to register for automatic updates. I think it is safe to say that the "average user" would certainly sign up just to be rid of the damn thing.
It seems to me that in todays world it is impossible to run any form of Windows without some form of Antivirus protection. So when is Microsoft going to buy Symantec and integrate Norton Anti-virus into Windows? Oh wait, that would be an anti-trust violation. On the other hand they were allowed to integrate a TCP stack into windows which put 3rd parties out of business.
-- Thou hast strayed far from the path of the Avatar.
I thought the Automatic Updating Service in XP Pro already did this. It has the options to download and install, download and let you decide, just tell you there is a patch or of course you can disable it totally... I fail to see how this "new" idea is any different. I thought the XP auto update was set to download and inform by default so perhaps they're just switching the default setting.
Just have a look for yourself. Control Panel > System > Automatic Updates
IMHO this is a dangerous thing to do, as once the virii-writers get hook of how the auto-update feature works it will become a big vulnerability.
Check for downloaded MP3s (from a database of known MD5s)
MD5 can't distinguish an infringing copy of a work from a a copy authorized by Title 17, U.S. Code, section 107 or 1008, provided they are from identical digital phonorecords using identical encoder settings. Only something that makes discs different, such as audio watermarking, can do this, but this is incompatible with current Compact Disc mass production techniques.
Check for P2P programs -- disable them
And watch as people b**** that Windows SMB File Sharing and BitTorrent (both P2P programs with a history of actual non-infringing use) don't work anymore.
Check for competitors' products (DRDOS, Java, Mozilla, OpenOffice, etc) -- disable them and alert user that their software was incompatable with the latest service pack.
In other words, "DOS ain't done till Lotus won't run"? Microsoft may be in for more than an antitrust slap on the wrist this time.
Will I retire or break 10K?
Maybe Micorsoft should write their own worms, to update their own bugs!
instead, why not "look seriously" into building an OS that doesn't need a weekly patch?
!(^((ri)|(mp))aa$)
Parent post mentions OS X
MODERATORS!!!!
HURRY, mod this up +1 interesting
Theres a line in the crontab that runs apt-get update; apt-get upgrade every 10 days in the latest version of debian.
The focus of the article is that Microsoft is ignoring people who cry "privacy" and opt for updates by default with a choice to disable or screen because they cannot allow Slammer worms to thrive when patches have been out for months.
::makes a raspberry::
Also, they are going to ship with firewalls enabled. People who want to run servers will have to learn to open ports.
Microsoft is adopting a secure-by-default stance, even if it inconviences some users or ruffles a few feathers.
The fact that Debian can do these things has nothing to do with it. I take it you are very proud of Debian, but maybe you should have posted about how Debian doesn't offer to run updates by defaults but gives you the option to do so if you like.
Oh, and MacOSX and RedHat takes the same attitude (up2date utility sits in corner, turns red if there's an update you should apply, MacOS has a similar tool).
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Oh sure, fix the problem by implementing something to allow remote code execution without alerting the user. Anyone want to bet how long before someone finds an exploit?
I am the Barber of Seville.
it seems MS is runnning down another long dark hallway. why not just spend more time coding software that doesn't allow privilage elevation? imagine if ford came out to your house and put brand new firestones on because the tread shredded on the last pair. bill pull you head out of your ass and FIX the PROBLEM. Send your staff back to school at University of Leeds to learn how to write secure code.
Let's assume for a moment that everyone's fine with Microsoft deciding you need to patch your system. Your home machine downloads the patch and installs it and your machine reboots - you're patched.
Those of us that work as sysadmins/netadmins/DBAs at various companies know that when Microsoft puts a patch out on Windows Update, it's not necessarily tested out to completion. That's part of why patches take so long to proliferate - dependable administrators test them in-house, instead of depending on MS's testers. Let's face it...if Microsofts Quality Assurance team were so sharp (or listened to - it can't ALL be their fault), many of the after-the-fact patches wouldn't be necessary.
Is Microsoft going to take responsibility for auto-installed patches that a) don't work b) make situations worse? Or are they going to take the stance of "The user could've refused our auto-install, but they didn't - they knew the risks."
We all know how hard it can be to opt-out of spam - how difficult will Microsoft make it to opt-out of auto-installed patches...and for those of us that can't/don't, how sure are we that it won't make things worse?
Actually, it's quite good. You'll note that it's emulating only the X11 libraries, really even only the X11 server itself. The slowdown of having X apps pass through that layer also occurs on Linux, *BSD, or any other OS. KDE and GNOME may be open standards, but they're not as nice-looking as Aqua, and the WindowServer that runs Apple's windowing system, is, AFAIK, part of Darwin, and thus open.
Darwin is not a kernel, Mach is the kernel. You'll note that it's the same micro-kernel that GNU Hurd uses, and if Hurd isn't Unix, what is (nowadays)? Darwin may be based on FreeBSD, but the kernel is Mach, which isn't. Also, you seem to be overlooking that most Linux programs are compiled for Intel processors, not PowerPCs. Thus, they wouldn't run anyways. However, most do compile with little or no modification. Netinfo is never used directly. Requests are handeled by lookupd, which uses Netinfo, but searches flat files (/etc/passwd, /etc/hosts, etc.) first. Netinfo also allows networks that share common printers, hosts, network configuration, users, mounts, etc. to be constructed easily. Unlike the registry, Netinfo is documented, and has manipulation utilities, for both the command line and the GUI. And, it's never gotten fscked up (for me.) Mac hardware may be expensive, but- it's better. Even the Linux people who use Linux on Macs agree it's faster, better, etc. on a Mac. Macs are more durable, featureful, more standard, and "just work" more and don't work less.
Okay, find music for that cheap on Linux (while still supporting the artisit. It's hard. The music industries wouldn't stand for a service without DRM, and you'll note Apple is pretty darn nice. Unlimited CD burns (but no more that 10 for the same playlist), 3 computers, unlimited iPods. Plus, AACs are MPEG-4, which is darn good quality, and darn small file size. I would never use Windoze, and always like Linux. But for me, Mac OS X is a great UNIX, and is all I need it to be.
It would seem youhaven't taken a close enough look at Mac OS X.
Moderators: Mod me down troll all you want, but mod the parent down troll as well.I have several people who use a web based service from my company that runs on Windows 2000 Server. I check for patches daily and install them as soon as I do a full backup (in case it shits out the whole system).
My users kept calling saying "You have that Blaster Worm on your system because every time I try to connect my computer dies!". So I explain to them my systems have been patched for that exploit for over a month and I have run all the proper testing software to verify. I then ask if they have AntiVirus software installed and their reply is "I don't know.". Lol, I don't know, so it must me my server! I immediately tell them to invest in a copy of Norton Antivirus and Norton Firewall.
Ah, the world of windows.
The funny thing is if these same people were running linux they would be logged in as root and still execute whatever script someone sent them. I'm not too sure Linux would be any more secure than Windows because in windows you can also run as just a User. However, when doing that a significant number of poorly designed programs will not work.
You have it wrong, Bozo. All the money from the sale of Iraqi oil goes to Iraq. Nobody is raping them; that was what Saddam and his bunch were doing. If you don't know the facts, keep your mouth shut.
ahem, I think you left a few off...
- Check for Yahoo, AOL, IRC, etc. clients, as well as Jabber and Trillian, disable and cancel the user accounts, and re-enable with the new MSN client. Update registry so that system will no longer boot if MSN is tampered with.
- Check for the presence of Opera, Mozilla, other browsers, disable and delete them, then modify the registry so that their installers will no longer work, then reinstall Internet Explorer with fully idiotic preferences set as defaults, and provide support for a whole new set of web "standards" that only Microsoft will ever use.
- Filter through user's bookmarks and delete any bookmarks that match any of the following criteria: a) bookmark points to competitor's web site, b) bookmark points to web site that sell competitors products, c) bookmark points to site that mentions any competing product, or d) bookmark points to site that employs or otherwise associates with one or more individuals who currently, or have in the past, made use of or considered using a competing product.
- Remove all versions of email clients other Outlook. If user does not have Outlook or any other Office products currently installed, go ahead and continue removing other email clients, but after that's finished force the user to purchase a copy of Outlook because it's the only "safe" email client for Windows
- Check to see if user has updated their system prefs to show file extensions in the Explorer windows. If so, set it to false so that file extensions are no longer shown because that's really more "secure"
Did I get them all?
What's likely to happen? Microsoft will screw up a few times, to great embarrasment, then they will by economic necessity learn how to make reliable patches. After all, their only alternative is the greater embarrasment of rampant worms and viruses. The rest of the industry (including free software) will see that it is possible, and be pressured to do the same. It may be rocky for a while, but the end result is that millions of naive users will have reasonably secury systems. This is a huge improvement over today.
The evaluation of an action as 'practical' . . . depends on what it is that one wishes to practice.
A new worm is sweeping across the Net today. The worm, dubbed JudusUpdate.MSFT, apparently exploits yet another hole in Microsoft's enterprise class security, only this one has a twist, infected machines are instructed to auto-update from a trojan server. Once infected, computers that are able become "evil-update" servers themselves. Microsoft is not commenting at this point.
Becaues every single hotfix I've EVER applied required a reboot.
.DLL's .exe's .com's .txt's .jif's
What happened to them going from 50 situations that required a reboot to 6? (opening for a +5:funny below)
Of course, those 6 reboot situations are:
1. updating
2. updating
3. updating
4. updating
5. updating
6. updating printer settings.
"Draco dormiens nunquam titillandus."
This is going to sound like a troll and so it should...
Just come off the phone to helpdesk; I have an email attachment that should be reported. They tell me "as the PIF file has made it through the firewall there shouldn't be any problems with it". Oooooookay phone monkey, log the call and go back to trying to sort the printing problem I gave you yesterday.
Seriously, these phone monkeys stay in the job 12 months. It is no more than a stepping stone for them. They know little to nothing about the normal power-user stuff. They are fresh from college looking for the money their careers advisor told them about 3 years ago.
"Cycle the power"
"The server is corrupted"
"I've logged your call"
"Are you sure the network cable is plugged in?"
"We have informed our network enterprise discovery analyst support migration team"
As a corporate user the helpdesk would be the last point of call. Anyone can log calls and even then it can be done wrong.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
Ok MS, that will work.
At least until someone finds out that the update system itself is broken and uses it to directly install stuff into your computer.
Oh wait... they've been on secure programming for some time now... ain't gonna happen.
Yes, the typical home user could use some help. Help them by setting up the existing security features correctly by default. This would take care of the majority of the problems.
Mention Debian's ability to do a apt-get/cron setup for security patches in a Microsoft article is instant free karma, regardless if it's even on topic. You risk lower karma by pointing out the true nature of the article. Slashbots with mod points are truly a sad sight to behold.
Some people just can't see shades of gray...
Yes, Saddam and his cronies were raping the Iraqis. No, the money from the sale of Iraqi oil doesn't go directly to Iraq -- it goes towards the "rebuilding" of Iraq, which means it is used to pay the companies like Haliburton who are doing the actual rebuilding. Some of the benefits (rebuilt infrastructure) will benefit Iraqis. Some of the workers will be subcontracted local Iraqi workers as well. Whoah -- not so clear now, is it?
billy gates why do you make this possible ? Stop making money and fix your software!!
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
The major problem with software distrobutions such as windows is that the entire OS thrives on the 'one click' philosophy. One-click update, one-click install, and one click virus infection. People are so used to windows giving them one click 'Ok' windows that they end up clicking Ok and worrying later. 90% of regular office users end up clicking okay to almost anything and installing spyware, viruses, etc.
Windows needs to 'brand' the update procedure; make it so obvious and un-repeatable by other apps, so that users are not duped.
Reason, free market capitalism, and individualism
XP has a firewall built in, why not just enable that to start?
Most people never do more than surfing and word processing, these people would be helped by enabling the firewall to start. Seems it would be accepted easier by the IT community at large and give XP a minimum of security right from the start. I also think that windows update *Notification* should be enabled as well so that people can never say that they were not warned.
This worked fine for me, as on my machine (the one I run Windows on for the wife in Grad School) I have it download automatically but ask before installing, whereas on my parent's computer I have it do it all automatically.
So is there something wrong with the *process*? Are they just advocating to have this Auto Updater installed by default, but still ask you the questions the first time through? If so, I see no problem and think it's a great idea. It'd be just like "up2date" or RedCarpet.
http://www.xp-antispy.org/
Is the juice worth the sqeeze?
Shades of AOL!!!!
Basil
Apple's OS X has a nice approach to this; it runs at a specified time that you decide, looks for updates, asks you to pick which you want to install, then installs and prompts for restarts if needed.
As it runs twice a day automatically, every couple of weeks I just see a indicator in my Dock and I can then load the patch, new foo etc while continuing other work. The restart I just put off until I'm done with my current task.
Better than asking me to do something via email, more comfortable than my computer being remotely controller.
I didn't bother to patch my office machine against MSBLASTER, and why should I?
I've been stripped of most of the permissions to admin my own machine because the internal IT support has been centralized. That means a few people service the rest of us in a way that generally has the good of the company in mind.
That said, if they take away my permission to do it, and they get caught with their pants down, why do they expect us all to run software locally on our own machines to fix the latest problem X? It's because oboviously these people do not have enough resouces support a network of our size.
If it wasn't the veil of "computers" clouding the issue, I bet someone upstairs would have corrected the logic of, "If they can't do their own job, we can get the whole company to waste a bit of time to help them out."
Certain systems require certain amounts of support, but this is not an OS issue. It's just more pronounced in systems that require more man hours to keep on the bleeding edge of security.
Comment removed based on user account deletion
If users were given the option to send in a proof of purchase or just reference their activiation codes they could receive, free of charge, a CD with all necessary updates and patches from MS for their OS?
Yeah - this would be expensive, but besides the fact that MS can obviously afford to do this don't you think that it would motivate MS management to take a more aggressive stance on security vulnerabilities in general?
As it stands today if a (home) user has to do a system restore (from the computer manufacturer CDs) or wipes and reloads thier OS for one reason or another, they will risk getting a virus just trying to connect to microsoft update to download the large number of updates available since they purchased their system/OS.
As a side note, what about all the folks that buy PCs that are already in the sales channel that aren't protected from the Blaster worm?? Take it home, hook up to internet, boom...virus. (speaking specifically about the many folks who don't know what a router or firewall is)
There has to be a better solution to all this.
Is the juice worth the sqeeze?
If this is supposed to cure MS Windows of blaster and it's friends, it's sort of a dead end. As part of the worm payload, a hacker would just subvert the windowsupdate IP resolving; an entry in HOSTS would do just fine. Or patching the windows update software itself so it connects to a site of the hackers choosing.
Does everything include nothing?
Frankly, I think its about time that MS started at least trying to secure their products. I mean, we've had the ability to secure them for some time...but it wasn't enabled by default. The built-in firewall? Disabled by default. All those assorted patches and updates? Up to the user to actually go out and install them.
I would be thrilled to see a default install of Windows become more secure...it would make my life a lot easier. Just so long as they allow the option to disable things (like the personal firewall) if you choose to.
yrs,
Ephemeriis
"Work is the curse of the drinking classes." -Oscar Wilde
Used to crash if you pressed the "windows" key, losing all your work. As a result, artists would rip the windows key out of the new-fangled keyboards.
At the end of the article, there was some talk about enabling a firewall by default. No doubt, many users will not even know they have a firewall and certainly will not know how to disable it. I have had some negative experiences with users who don't know how to disable their own firewalls. Most notably the LAN party with in which I could not get rtsp working on all the computers because the MS users did not even know where their firewalls were! This also interfered greatly with the gameplay. Having a firewall engaged by default will interfere with file transfers on a home network using windows, especially those that are already walled in with ISP routers and no "home IT department".
10 Bits= $.25
100 Bits= $.50
110 Bits= $.75
1000 Bits= 1 byte
It seems to me that Microsoft creates environments where terrorism can thrive. Does this qualify as aiding terrorists?
Microsoft wants to leave themselves an open channel into your computer to update windows. I wonder how long it will be before someone exploits it with a virus.
Isn't what Debian and other "automatic" distros do? Sure, you can decide what to install and what to uninstall, but how many people really do what installer is doing? Sure, Microsoft stuff is closed, and Debian/Gentoo/etc stuff is open, at least for now.
What I am trying to tell is: lots of you trust in Debian developers, you trust they give you good set of applications with good configuration. You don't trust Microsoft. But what about "standard users"? They trust Microsoft just like you trust Debian. What's the difference for them?
PS. yes, I am Slackware/LFS user
I don't think it's a horrible idea to make automatic silent updates the default. After cleaning up some of my relatives' machines after the Blaster worm, I set them all to automatic updates. Yes, there is a chance that an update might break something, but this chance is far less than the chance of another exploit or worm trashing the system.
They just don't understand it at all and as the person who gets called when there is a problem, I'll take any proactive measures that I can to make sure things continue running smoothly.
And what happens when someone hacks into Microsoft's update servers and releases a patch that recursively writes over every byte of the hard drive to the tune of a 1980's video game MIDI file?
Is Microsoft going to be liable for the loss of all your documents, and time to recreate your system?
Software vendors (ahem, Microsoft) can't continue monopolizing themselves without offering more accountability.
(har har.)
--- Jason Olshefsky
Karma: Poser (mostly affected by adding this line long after everyone else did)
The journo possibly took him out to lunch, and he was commenting on the idea of being taken out to lunch ...
We hear lots of folks in the government and elsewhere clamoring for push-down patch solutions like this for the allegedly clueless home user.
But where are the legal protections against nefarious activities taking place during the push-down?
I would patch my home Windows box IF there was a legal mandate that MS could not lawfully change my EULA when doing so, and IF there was a legal mandate that MS could not push spyware or other changes to the OS down the pipeline and could lawfully push the patch and ONLY the patch down the pipe.
And, oh yeah, I forgot, I don't use Windows anymore because it doesn't work as well as Linux. So fix that OS first, and dem patches, and then maybe you'll see me back as a customer.
While I am in complete agreement that I don't want MS screwing around with _my_ windows boxes, I'm not sure I agree with the premise that people need to "have a working knowledge of their computer/operating system" or have their computer regularly maintained by someone else.
:)) and the box is easy to use. This is what MS should be striving for, and the automagic updates seems to me to be a way to accomplish this.
It seems to me that the ideal for the naive home user would be to have Windows be as effortless as a gaming console. Yes, I know that hardware variety makes this difficult, but imagine if the only problems you are likely to have are hardware failures (linux, anyone?
And they wonder why people have problems!
IMHO, the best option would be to have it enabled by default on machines, with the option of disabling it for power users.
This means that the computer illiterate of this world will be automatically protected (some people I know have never heard of windows update before, let alone visited it).
For people who actually have some knowledge of what they are doing, well, they can just turn it off and complete upgrades in the normal manner...everybody wins.
I am NaN
Definitely. But taking this a step further, we have auto insurance, some forms of which are required in order to be legally allowed to drive. I wonder if we'll start seeing something like virus insurance, to pay for damages caused by security exploits.
People would want it, and it would be an encouragement to take short security courses -- you know, a few hours per day for a few days, going over how to install updates, common sense when downloading things, etc. -- because it would reduce their insurance premium. (Similar to how taking a driver's ed course can reduce a student's car-insurance payments.) And this would cause greater public pressure on Microsoft and other software vendors to make their software more secure, again because people would want to lower their insurance costs. No legal force would be needed; the market would offer all the incentives.
It could work...
Most EULAs state that the software vendor isn't accountable for lost data or functionality.
Imagine, MS might DOS themselves to death with this automatic update feature.
In fact I want MS to quietly run every aspect of my life unasked. I want multimegabyte SPs unasked. I want new and improved packaging and several dozen applet upgrades unasked. Especially the ones that break something else. I want updates to wipe out competing applications unasked. I want application changes on the fly so that file formats suddently become incompatible. I want their updates to clash with themselves. And mostly I want to pay for it.
the problem.
I don't think people are reluctant about the idea.
"Oh, you want to patch my box automagically? Right
on." That's a great idea. I think the reason
people are hesitant is because Micros~1 makes you
click on that EULA which basically gives them
access to any and all information they want to.
The other side of it is, "Well don't click the EULA
dummy." Well then one (not I) can't use Micros~1
Windows! And even if you don't have a problem
with that, recall that Micros~1 patches are
known to really screw up machines sometimes.
What a dilemna no?
Instead of taking the blame for writing yet another security hole (not even a novel one at that), they're pushing it off on the customers who are behind on patches. Yes, people should apply patches for these, but maybe they could be a bit more careful in writing the OS and apps in the first place. The blame here is on MS and the virus/worm writers, not on the customers who are having both inflicted on them.
Yes, no OS is perfect. But, their attitude here seems to be "you deserve to get hit if you didn't apply the patch-of-the week".
News flash: Win2k SP2+ and WinXP *already have* the code needed to run updates automagically. We use it here and it works quite well. A couple of Registry tweaks is all they need to turn it on.
HOWEVER we also run MS' Software Update Service, which lets us set up a local mirror of the Windows Update patch kits and decide which ones we'll allow the managed stations to fetch. We can test patches first and block any that seem troublesome. I wouldn't turn on automatic patch installation without this review.
Having said all this, I don't think that push-patching will be accepted by those home users who are aware of it. Having a PC that belongs to the company managed by people you could actually go yell at is a lot different from having your *personal property* adjusted without your consent by some faceless company a thousand miles away. The effort being spent on this scheme should be redirected toward teaching some of their coders basic sanitation (like, if you don't allocate net buffers from the stack, you won't facilitate any embarrassing stack-smashing exploits, duuh).
I can hear it now, a phone call from my Windows/56k modem afflicted parents, "Why's it all so slow?".
To which the only real reply is "Because Bill knows best Mum. Because Bill knows best". Add to this the fact that they crank up their computer on a six-monthly basis, and would probably stop altogether if each time they did, it rebooted the PC. Not that much different from MSBlast, really.
ooooooh! What does this button do? - DeeDee, Dexters Lab.
So Microsoft, "No, you may not administer my systems!"
--
Luck is just skill you didn't know you had.
I'm sure these customers didn't know they had a problem with their PCs. That was the first fact that caused the worm to be a problem. The fact that the computers weren't patched was secondary. Instead of pushing the patches, why not be more aggressive about notifying customers, and giving us better tools to patch and scan? Asking millions of users to pull updates ALL THE TIME, or turn on an automatic pull where there are only 3 configuration options is a real lack of choice. There are lots of things in between that can be tried. If I were a home XP user, and I saw a notification, "Message from Microsoft Security: Due to a problem recently found in WinXP, You are at high risk of being hit with an intrusive virus or worm. Here is a web site with details. Here is a 1-800 number with details. To correct the problem now, press Ok." Supposing MS did give home users this easy to use scan, notify, patch utility, the only reason they would not use it is if the EULA were too scary. This is easy to fix. Put a big splash screen with "Absolutely no Information is gathered and Sent to Microsoft. To see how this tool works, click here. Microsoft will never change this policy without your consent. (Like we did with WindowsUpdate)" We shouldn't have to wait long to see an analysis of Blaster, but I am going to guess that the majority of infection vectors came from business or academic Win2000 installations. WinXP systems crashed so much, they weren't efficiently spreading the worm. So corporate tools to fill this middle ground need to be improved. The hard to learn and use tools like IIS lockdown, hfncheck, etc need to be seriously overhauled. At work, I would love to have a non-web-based WindowsUpdate SCANNER, and a separate PATCHER. They'd be easy to use with a GUI, but also have command line options so they could be used in scripts. (SUS isn't what I'm talking about, because it is browser based, and the process is still a pull. The only way you can push an important update is to go to each server, or set the servers auto-pull frequency really high) I also wonder if MS is afraid that making system maintenance too easy might cut in to their SMS server sales?
have a Windows machine at home, but I only use it occasionally (check for an important e-mail, check e-bay late at night, etc.).
The problem is that my home machine is a dial-up and every time I turn it on, Microsoft expects me to patch my system. If I installed every microsoft patch, it would take me longer to download and install the system updates than to
do what I wanted to do.
How many other people have machines that most of the system resources are used to patch the operating system???
I owned that PC all the way out of the store. I owned it all the way home and out of the box. I plugged it all up, hit the power button, then the "transfer of ownership" started. Once the initial non-linux OS started to boot (or install for my "put together box"), my ownership went away. My PC told me it had to get some files. It reached out across the open internet and started doing things on it's own. Then a popup message appeared on the screen. "Your machine has been caught downloading Intellectual Property of !! Your harddrive is being wiped!!"
So the cycle of ownership goes.....
simply do an add deny tcp and add deny udp in ipfw on ms's address on your gateway and you don't have to worry about it.
Red Hat is for people who hate Windows, FreeBSD is for people who love Unix.
www.putertech.net
No, the fix for SP2 largely involves telling ZoneAlarm (free) not to give the system process SVCHOST.EXE access to the internet. ZA is a 4M download.
will it automaticly rewrite/upgrade the eula as needed?
ms media player 9 style eula
short version: i own your box
Windows NT service pack 6
[RANT]
Remember this gem? All the people that installed it had inoperable machines. It was so bad that it was recalled *6* hours after being posted. Then a week later came SP6a. I definitely do *NOT* want them pushing crap to my machines. I have no problem getting my own updates. Set up auto-update by default, but let those of us that know what we're doing be able to turn it off. I'm all for (l)users getting crap in general (not necessarily viruses/virii). Maybe that will get them off computers and leave them to the experts.
How come everyone and their brother is allowed to operate a computer at will, but I need a license to fish?
[/RANT]
-Ab
Nothing fails quite like prayer.
Well, turns out that 3dsmax is only made for rc3 or earlier of Windows 2000. If you upgrade to rc4, it actually fucks with the .max format! Any MAX 3d files I make in a machine running Win2k RC4 will end up crashing the OS of a machine using RC3 or earlier. Let me tell you, this was endlessly frustrating for a video game development team. We had to roll back all of our computers to RC3, and then load all the MAX files into XP, save them in there, re-load them on an RC3 machine, and save them again.
Bullshit. All because for some reason, upgrading (patching) to RC4 basically CHANGED THE FORMAT OF 3DSMAX files. Bullshit.
{
}
else
*/
Ed Wedig
Graphic design services
docbrown.net
yes, i am a leftwing whiner
Realizing that you have a problem is the first step on the road to recovery.
That's a joke, son. ;-)
DFL
Never send a human to do a machine's job.
Oh, yes! Great example. Last time I got a recall notice, an armed representative from Ford showed up and commandeered my vehicle. Can someone tell me where people get these ideas?
I'd sure hate for the automatic update to interrupt my game playing by rebooting my machine!
In other words: they've deleted your Linux root partition ;-)
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"This is a terrible idea. My brother is a sys admin and 9 times out of 10 the microsoft update patch breaks some or all of the 3rd party software installed like Backup Exec, anti virus.... you know... the minor things ;-)
Have a Happy.
If you look, the original SP6 for NT cannot be found. What is out now is "SP6A". SP6 had the unfortunate side effect of disabling Lotus Notes. It managed to break SMTP for Notes, and only Notes - Exchange was unaffected. Our IT group decided to wait before installing SP6, but our corporate offices were not so smart - they took themselves off email for 2 days or so. So yes, Microsoft patches do break things.
"Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
The obvious answer would be, by signing the updates and verifying them on the recipient machine via public keys. Now, given this particular company's outstanding track record of handling security issues, how can anyone actually mandate this (and not be employed at MS)?
Other question that might arise: As a home user, who doesn't make constant backups of the whole system, how can I verify that one particular patch doesn't corrupt my whole system (as has happened before)? If it would be really automatic, how can I make sure that the same patch that hosed my system won't be installed right after I rebooted from backups? Wouldn't this be a Microsoft denial-of-service attack?
One would now argue, that it is possible to switch the automatic update off, but then what would this be useful for? After the first malfunctioning automatic patch many users will switch this feature off to prevent from further incidents. And we would be back to square one.
Now, what's the point in all this?
I feel so sig.
I think forced immunization of vulnerable open machines on the network is a good idea, under the right conditions.
After public notification of the nature of the vulnerability.
After a patch has been made available and notices posted, sent out.
After a user or sysadmin keeps their machine unpatched and exposed.
After a second warning has been posted, sent that forced patching will occur.
Then, and only then, a worm-delivered patch should be administered.
But it should not be administered by MS, though they were responsible for the vulnerability.
MS is a profit oriented business, whose goals include many actions directed towards increasing their own profit in the long and short term, as well as fixing software that users have bought from them.
No. It should be role of people responsible for network health, because that is the public good that is impacted. As a public, non-profit entity, they would be free of conflict of interest, financial considerations. If MS were to administer remote administration in this way, they would be opening themselves up to conflicts of interest, particularly because of the monopoly market position they hold.
"Provided by the management for your protection."
of the Department Of Homeland Security after 9-11?
I could just see the next M$ exploit... automatic virus downloads. No longer do you have to download a virus yourself, its automatic.
I'l definitely be blocking that port on my win box.
You can contrast that with the performance I got out of a $10/month dial up service and free software. I fowarded it to a local net via ipchains and my wife and I were able to use it at the same time. She slowed it up more than I did because she refused to use any of Mozilla's pop-up or image blockers. By loading browser tabs with interesting stuff while reading other interesting stuff, I hardly noticed the difference. Of course mail worked just fine. The only difficulty I had was missing inbound phone calls and software updates.
The software update problem would not bother me as much today. I built a debian mirror using a script from debian.math.lsu.edu, rsync and debmirror. It's very efficient and the interactive nature of the script would keep it from being hung up on by my ISP, if for some reason it took that long to get everything in US stable i386. All my local machines use it for updates already to spare everyone bandwith.
What a contrast! I did not even mention the trust aspect of software updates and how Microsoft update break stuff while free software does not. Ah the Windoze concophony, the product is much greater than the sum of it's parts.
Friends don't help friends install M$ junk.
I myself use RH9 on the laptop, and Slack-current on the desktop. However, the family computer back home is still chugging away on a well patched win2k. Im the only "tech" person in my family; I find my family demonstrates very well the vast difference in the world of computer users; on one hand you have the joe-average-user who can turn the computer on, surf the net, write papers and check their emails. These people generally use some flavour of winbloze on an x86. They care not and generally know not, or are too scared to apply patches, lest it breaks and swallows all their data.
On the other hand you have the geeks, the haX0rs, the more knowledgeable users, who may use winbloze for games etc, and generally use Linux. These are the people who are intimately aware of how their system works; they are comfortable at a bash prompt; they know about the latest vulnerabilities; they know how to close ports, hell they know what a port *is*.
I spent 20 minutes just explaining what a port is to my Dad, and why it had to be closed.
People use windows, because like it or not, windows brought computers to the masses.
In short, Windows brought computers to your Mom, your Dad, your grandparents. People who otherwise would never have touched a computer.
Problem is, Microsoft has to live up to its responsibilities, it brought computing to Joe Public; it cannot expect Joe Public to know about or understand patches.
You're a piggy.
::shimmies and shakes::
Wooooooooooooo!
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
*working on important stuff you have to finish that day*
Alert Alert! Windows has detected that a new update is available from windowsupdate.microsoft.com (yeah the other site was disabled
Do you want to apply the update? Ok - Cancel; *CLICK*OK*
Are you sure? *Yes*
Downloading, please wait... (poor 56k owners)
Installing, please wait...
Windows has now to reboot your computer, please wait
*Nooooo* My word document!
Cruel world, isn't it?
You know, this is ridiculous. If you don't want to spend hours downloading the patch (justifiably) then simply order the cdrom for $9.d s/ser vicepacks/sp4/ordercd.asp
http://www.microsoft.com/windows2000/downloa
All the rest after the service packs are patches; *most* aren't that large to begin with (other than DirectX 9 and Windows DRM -up-your-nose Player).
I can't understand why people bitch about this constantly. It might be $20 per year for the twice-yearly service packs they release.
People don't want automatic updates because you never know what you're getting. It might not have received good QC and it will break a working system, it might contain malicious features (because the entity who makes it has interests that are ultimately in conflict with their users' interest), or it might offer a path for third parties (e.g. script kiddies, spies, etc) into your system.
That sounds bad, but that's the situation you already have, even before you factor automatic updates into it. Without updates, you also don't know that a working system will still work tomorrow, you don't know that it doesn't contain any malicious features, and you don't know if it contains a means for third parties to make your computer their bitch.
Keeping your machines secure requires that you take responsibility for your computer and don't make assumptions about what somebody else did. You audit, inspect, and must understand how things work. But a Windows user doesn't really have the means to do that because they don't have access to the source. While they are ultimate responsible for their computer, their last decision and act on the matter was to trust in Microsoft and then: "whatever's going to happen, is going to happen." It's not really a reponsible way to act, but it's a decision that has been made by millions of people and it's the reality of our world. It is impossible to run Windows without "I trust Microsoft" being the premise that your business, your homework, or your enjoyable video game relies upon.
If that's scary, well, yeah, it should be scary. It's more than scary, it's stupid because Microsoft has already tipped their hand and publicly revealed that they are untrustworthy and that their products are intentionally designed to serve more than one master (i.e. Palladium. Even before that, we all inferred that Microsoft products weren't written entirely for the interests of the users, but Palladium has made that explicit). But that's just how things are. And if you're going to trust Microsoft to have power over you, and you're already resigned to being at their mercy, then you might as well go all the way and give them maximum power to do whatever it is that they're going to do. Half measures suck.
When people complain about the security concerns inherent in automatic Windows updates, I'm reminded of a dream Lisa had on The Simpsons. Milhouse/Moses asks Skinner/pharoah to let his people go. The pharoah's reply: "I've never heard such insolence! You call yourselves slaves?!"
Since so many of windows' updates require reboots, would they "automatically" reboot the machine when they finish installing the update? If so, how is their automatic update any different in effect on end users than the blaster worm, which rebooted machines?
Frankly, I'd get pissed off to find my machine rebooting during the middle of some important work/long computation.
...afterall, isn't Microsoft running some of their servers on BSD? Oh wait, that was Hotmail...
"Right now, somewhere in this world, Scott Baio is plowing a woman he doesn't love," - Peter Griffin, *Family Guy*
During the peak of the blaster virus I firerd up IE (which of course was still set to the default homwpage) in order to go the MS update site. Well MSN which loaded into the browser as far as I could tell said nothing on the homepage on the blaster worm. You'd think that since this was a worm directed at MS itself that at a minimum there'd be a banner ad warning people to upgrade and if they were serious a forced push of the update to my machine as soon as I visited any MS controlled website (except maybe MSNBC or ESPN.com).
Instead of just pushing the upgrade on the people that visit their sites, they want to start by pushing to every user on the Net? Give it a go at MSN and Microsoft.com first and see what reaction you get before you make it mandatory - oh and another idea - make patches that don't require reboots.
Work for Change & GET PAID!
I thought this service was already available from another shady vendor.
I guess it is time to embrace, extend, and extinguish another competing solution.
All data is speech. All speech is Free.
Being a mac-savy person I don't have a long-time experience with Windows but I do work with it on a day-to-day basis at work. Recently I went to a friend's house to help her install a new computer she got and while running Windows Update I got that "NT/Authority System" shutdown dealy. After bouncing back and forth between symantec and microsoft I had managed to install like 2 different patches and run some application. I also found myself in regedit at one point.
Anyway, the point is, if the current system is confusing for someone who works with PCs as a techie for 8hrs a day 5 days a week, how confusing could it be for someone who only uses their computer for email and the internet?
SP 6 broke Lotus Notes servers thus 6a came out.
Even worse, SP 2 installed over a network failed. Failed badly. It did something horrible to the ntfs.sys file IIRC. This meant that the box would blue screen on boot and be irrecoverable if you had an NTFS partition.
--- I wish I could hear the soundtrack to my life. That way I'd know when to duck.
Someday, you too will embrace Penguin Love(tm) and shun the evil SoAp. The mighty will fall and a new 60's era will begin!
so you're happy to give your address to ms? good for you pal...
and if it does, I'll just sniff the traffic, find out what port it's going out on, and just block that on my home LAN. Easy-peasy, japanesy....
Spread the RC luvin'
say you have a farm of servers. If microsoft forces updates to all systems, it could potentially break the servers, since it's happened in the past. On a typical home users system it's fine, but corporate server should not get automatic updates. The system administrators and developers should go through regression testing on select boxes before a complex wide patch is applied.
If I have to reboot my servers every time a major bug hits (3 times/year) for 5 minutes, that's bad enough. (99.9971% availability) If I have to reboot the servers every week, now we're down to 99.95% uptime.
This, of course, doesn't count downtime or technical support issues caused by workstations missing their server connections, or the patches that didn't happen in time, or any of the various other factors that help kill capitalism, and endanger our National Security.
--Mike--
You mean SP4?
The truth doesn't care what I think.
I like the car metaphor for computers...I think it is common knowledge that the oil needs to be changed +/- 3000 miles.
Is the idea of regular computer maintenance only for the tech-savvy? Perhaps not. Changing the perceptions of new/novice computer users can change - whether this is from the friend that builds you a PC to the salesperson at the store.
Perhaps vendors need to distribute a "Maintenance Checklist". There are certain things that one must do to their computer on a semi-regular basis. Whether it be cleaning the pet hair from fan intakes or applying virus defs and patches.
I really believe in personal accountability. If you purchase a car, you're responsible for the oil, tires etc....a computer is not the same as a toaster. It's a complex piece of equipment. It needs to be treated as such.
My $0.02
-carolyn
You will be assimilated. Resistance is futile!
The record continues to speak for itself. Free software runs without being rooted, Microsoft continues to be an impossible mess. I have full confidence that the diversity, the ease of updating and sound security models of free software will continue and the situation will remain unchanged. That leaves little to moan about.
I don't know why I feed trolls like you. There's just something about a stupid lie that makes me cry out.
Friends don't help friends install M$ junk.
I'm getting bounce messages with attached .pif viruses coming in at an alarming rate. They are all hitting me because the original sender forged my address as the reply to, and then various mail daemons are bouncing them back at me.
New, or normal internet shit that just hasn't happened to me yet ?
They are bouncing to a freeshell.org account, by the way, and I have noticed that pop.freeshell.org is occasionally unresponsive this morning.
Agreed. The cry seems to be, "Patch our machines quickly, but not too quickly." We can talk on and on about Microsoft writing unstable software and make some pretty good arguments. However, the real problem is that it's a complex system that's designed to look easy. It only stands to reason that a complex system will have more vulnerabilities. (Again, in no way trying to defend Microsoft.)
So, we cry when Microsoft "allows" machines to not get patched. But can I really yell at my mom about this? She & Dad were under the impression this was easy! So now they need to learn a bunch of stuff about the technology--bzz, wrong answer.
Then we can cry when Microsoft makes the scary proposition of auto-updating machines. The fact is, these are tough choices to make, and none of the possibilities are without problems.
I think the auto-update with an opt-out is the best way to go. MS, for all its faults, I think has a decent track record on patches. I've never had an issue, nor known anyone who's had a patch break their machine.
I don't have a problem with an integrated update, as long as it alerts me, instead of downloading updates straightaway. Getting a message like "There's an update availabe, which fixes important security flaws" would definitely get my attention and get me to check for that update.
2) People whine that users are too lazy/stupid to install the patches
3) People whine about automatic patch installation
Well geez people, it looks like you're going to have to quit whining about at least one of these three things, because they aren't all compatible. If we admit that users are too ignorant/lazy/stupid to install patches, then we have no right to complain about MS wanting to automatically update things, because everyone is complaining that their security is terrible. It isn't fair to put people into an impossible situation like that, then blame them for it.
Like my ex-NASA boss likes to say: "Faster, better, cheaper. You can pick two."
The article pretty clearly states that the idea is that the updates will be downloaded and installed automatically, UNLESS THE USER SPECIFICALY REFUSES TO ACCEPT THEM.
So, in typpical Slashdot form, the headline makes it sound much more ominous than it likely will be.
They will simply turn on by default the downloading and installing of patches, WHICH CAN BE DONE ON TODAY'S WINDOWS SYSTEMS. They are just changing the default setting, and I think most of us would say this is a good idea, given all the security problems we see day in and day out that result almost entirely because people don't patch their systems, home users and admins alike!
As long as you can disable the feature, there is no real privacy concern here. Yes, it should be stated clearly what is going on and that you can choose to disable it, but even if it's not, it's not that big a deal.
If they DON'T do this, then they get killed for having a flawed OS. And my grandmother shouldn't have to know about patching her system, right? But if they do this, then they are big brother trying to take over the world.
Show me the position they can take that is good for them AND us. And don't trot out the "they should just build better software" argument. Yes, they should. Now please rejoin the regularly scheduled program called REALITY, because it's not going to happen.
Back to semi-lucidity...
Now, if I *CAN'T* turn this proposed feature off, I'll jump to Linux full-time faster than anyone, believe me. But I don't think this will be the case at all, and the article states that I am right, so let's not overblow this, at least until we KNOW it's a problem.
If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
how long until someone writes some worm that will pose as an automatic update and everyone using this method of updating gets infected that way? at some point you just stop supporting the stupid and the ignorant.
Everybody denies I am a genius--but nobody ever called me one!
They will use the 'terrorist' umbrella to do what they want.
Next its 'automatic scanning' and 'automatic deletion', to protect us..
Hey, its working for everyone else on the planet. You can almost get away with murder if its under the guise of ' homeland security'...
---- Booth was a patriot ----
Well, source is a lot smaller than binaries. Huh? Oh. ;)
-Looking for a job as a materials chemist or multivariat
Anybody else nervous about this because of all the problems they have had with MS updates? We have had clients whose machines had the OS totally borked after an update was applied. We wont apply any MS patch or service pack until it has been tested really thoroughly first.
Granted it can create problems like the Slammer worm getting loose, BUT we didnt have a single instance of that happening, due to stringent antivirus rules.
Just my two cents worth.
Now that the (UK keyboard) shift keys are eaten away by a backslash and a euro, and the space bar has two ctrls, three windows keys and two alt keys alongside it, how long before it ends up being the size of the zx spectrums space key?
Of course if Microsoft opens it's own backdoor to the everyone's system then eventually someone will write a virus that spoofs itself as a Microsoft Update and tries to 'help out' everyone.
Beginner mode: take care of everything for me. I just want my e-mail and yahoo.com. Things like 'hide protected OS files' are enabled.
Normal mode: current state of OSs. Some automation, and some of those stupid 'protections' that we all immediately disable would not be put in place to start with.
Expert mode: no automation of anything. Think of this as slackware style windows. You have to configure a bunch of really technical details by hand, but since you know what you are doing you can take advantage of this and configure the system exactly the way you want.
Due to the above, I'd pass on auto update, but I also run windows update regularly, I'm sure many users do not.
Where do you want to be, What are you doing to get there.
So, how long will it be before the method by which Microsoft intends to push these patches on the unsuspecting masses gets reverse engineered? Then, Mr. Hacker just writes MS Blaster 2.0, and sends it out as if it was a patch.
- "That's just the kind of fuzzy-headed liberal thinking that leads to being eaten."
Even if the automation was forced, the problem is that the majority of internet users still use dial-up. They are at a lower risk for infection, but they are still at risk (trust me, my father-in-law got hit by it). The problem with dial-up users is that they don't want to spend literally hours downloading patches, so they don't patch their system.
What would be nice is if Microsoft provided a CD subscription for their patches for cheap.
This sig has been temporarily disconnected or is no longer in service
Well, considering the quality of your post, I'm not sure many people will rush to try out your head-ass removal services. However, you are completely wrong about Linux. The first time my grandmother says, "I tried to install this piece of software, and it says I don't have privledges", and I reply with, "Just type Su and enter the root password"...she's going to think, "Why don't I just run as root all the time?" Problem solved, and Linux is once again shown to be as secure as any other OS. Forget removing the network cable, you wanna secure your system? Remove the user.
This may or may not be evil on it's own, but why use the same model for everything. Can Microsoft not figure out how to package their junk? Let 'em sell a version that is mandatory update, with teh licence to go along with it. For the tech-savy or "ownership" type of person, sell a version that you buy and maintain yourself.
When it comes to cars, we can rent, buy, lease, etc. Why not the OS of our computer?
Actually, I know the answer: Microsoft is not intersted in fitting into the customer's needs. They have the goal of controlling the OS from the get go, they are just trying to push how fast they get there. Any other goal is kinda left behind...
Q818043 - Caused many computers to lose their internet connection.
Q811493 - Caused severe slow down on many computers.
I don't think I'd patches that completely screw up my system automatically installed.
The problems you had deleting Outlook Express are no doubt caused by Windows File Protection. In order to beat it, simply delete the copies of the files you wish to delete from the directory C:\Windows\System32\dllcache (or similar, depending on where you installed Windows).
Once the relevant files (such as msimn.exe) are not present in dllcache, you can delete the versions of them in the main program directory. Windows will, at this point, moan that it failed to restore the files and ask for the CD to restore them, but you have the opportunity to decline, and Windows will never bother you about those files again.
I don't advise that you delete the entire contents of dllcache, though, no matter how elite you think you are. Windows File Protection is good for protecting against apps which overwrite the installed libraries in the Windows directory which can render your Windows 2000 installation unbootable in some cases.
For instance, a couple years ago, on two different computers, I had installed a few Windows updates, and my F6 hotkey to highlight the location bar in Explorer stopped working. Now, some of you might not care about this, but I *hate* using the mouse unless I really need to, and I try to live my life on computers with hotkeys whenever possible. When one stops working following a regularly scheduled update, I get pissed. (In other news, I'd like help with that if anyone knows how to cure it!)
Err... I meant to say that an option is fine, but don't ram it down my throat. I like to be aware of updates as they occur, and I like to be the one that gives the final approval of any software that is installed/updated onto my system.
If you skip setting up standard users (which most grandmas would do) you can ONLY log in as root. Same goes for every distro I've used (Slackware, Debian, Redhat, Suse, etc...)
;)
It's not an attack on linux it's a fact of who is using the system and who is setting it up? IF it's the same person they are significantly more likely to use ROOT. This is the reason Linux has almost zero likelihood of being successful on the Desktop, it requires conceptual understanding of security and the how and why you should(n't) run as root. Grandma doesn't care.
Plus, most users of computers learnt the Windows-Way. All Admin, All the time.
If we could just get rid of the hackers there would be no security issues. BURN THEM AT THE STAKE!!! lol, j/k
Part of the problem is that they want to sell a big fat Win2k3 server to everyone so they can "maintenance" their PCs [nevermind just fixing the problems]. They need to put all their patches in the same place/structure for all the products. Then create a tool runable by any windows box That can act like a mini-update for the PCs on your network. The patch lists should be pushed to the ISPs and users so that everyone can be aware of them...not stashed on some obscure part of the site. Also, the update notification should be in generic email, useable by anyone [not just windows PCs] i.e. my ISP running BSD should be able to mirror the patches.
The net result would be that ISPs with "first contact" to the network could then firewall you off until you patch the approved updates. It's a bit harsh, but would be greatly effective. Also, ISP bandwidth would be saved by mirroring the patches "off the internet" rather than all that traffic going thru to MS...[they wouldn't have to meter for it]
Of course this will never happen in such a neat and clean manor because MS wants control..and if you won't give it up they want you to suffer the concequences. It's not about stuff just working...or this would have been done a long time ago!
Last week, I get a call that her computer had been infected by the virus. I removed it, set up XP's firewall feature, and all that, but one interesting thing I saw is that the logs showed that no new patches had downloaded in a couple months.
I went to Windows Update to get the patches manually, and see that something has gone awry and things are broken. You can pick your patches, agree to the EULA, start the download, but then the download abruptly cuts off and patches are all flagged as "failed". No, the computer isn't out of disk space or anything... I actually couldn't figure out what was wrong. If anyone has any ideas please post a reply.
But, back to my main point. When you apply patches manually, you can immediately see that for this particular PC, something in the update process is broken, but leaving things to automatic update, the only cue is that it's been a couple months since the "new updates are ready to install" dialog popped up.
For an even more automated update system to be at all a good thing, it would definitely have to be not only nice and easy when things go right (which Windows Update is) but able to handle it when a PC is at all screwy... as another example, I had temporarily bumped the PC's clock back a year to keep the virus dormant while getting rid of it, and noticed that if your PC's clock is off by more than 100 days, Windows Update breaks and displays cryptic hexadecimal errors. Not even a message remotely useful for identifying the problem.
In short, I think with something that can mysteriously stop working as easily as Windows Update, removing human verification from the loop is just asking for trouble.
was still disable how could you download the new patch to fix the issue? Many home users ran into this Catch-22 of needing a network interface to get the patch but couldn't because the previous one broke the interface. You remembered System Restore. You were lucky.
What happens when this kind of problem occurs auto-magically installing a patch without notification to the user?
Now I get it! Microsoft has been intentionally leaving all these vulnterabilities so people get frustrated to the point where we ("we" the public) WANT them to have complete control of what's on our computer.
no comment
1. Microsoft releases a patch a month before a virus hits.
2. People do not install the patch.
3. The virus hits affecting thousands of machines.
4. Microsoft comes under heavy criticism.
5. Seeing that a lot of people won't install patches manually, they look into automatic updates so that they can avoid wide-spread virus infections in the future.
Seems like MS is in a catch 22. People will criticize them for having manual patches available or for automatic updates. It seems like they would have to create the world's first flawless OS for everyone to be happy.
All OS's require security patches at some time or another. It just so happens that Windows has such a large customer base that their viri have a wide-spread effect while viri for another OS might not be as major. So I ask, what can MS do realistically to announce and distribute security patches?
"Oh dear, she's stuck in an infinite loop and he's an idiot" -Prof. Farnsworth (Futurama)
and everything seems to be
Two wrongs may not make a right, but three
i wonder what else would happen with the "automatic update"...
**AA ?
iF yOu WAnT to C YOUr iP agaIn gAThEr tWO MilLIon dOLLArS IN Non - cONsEcuTivE TweNtY's AnD AWaiT FuRThER iNstrUctIoN
A few days ago I was very confused, a guy came in to our internet cafe, downloaded the blaster patch, and saved it on a floppy. I asked him about it, and he told me he had a laptop, and a 9,600GSM connection. 1 kilobyte per second, its great! He tried downloading the patch a couple of times, but it took way too long.
He'd have to be online 24/7 if he was forced to download every update, and he still wouldnt have the bandwidth!
I don't think that the fact that some people who have passed the driver's test can't really drive is an invalidation of the concept of testing. I just think we need a more thorough test.
:), and take the test further: out on the road. Go through twisty backwoods roads. Merge onto a major highway, change a few lanes. Go through one of those freakish 5-way intersections with one direction of one road split by concrete medians into 3 segments, two of which turn left (in different ways) and one of which goes on only to be further split by highway entrances on both sides of the road, right after the traffic light.
My father (who repaired county police vehicles at the time, and repairs state vehicles now) set up traffic cones and made me weave through them. I had to practice skidding on an empty, icy parking lot (and braking from 60mph on a non-icy lot) to see what would happen and prepare myself. I learned in a 1971 Plymouth Valiant with a 3-speed manual transmission and no power brakes.
After passing the current driving test, you are allowed to drive on the road. So take them through the above additions (maybe not the Valiant
WMBC freeform/independent online radio.
Im confused, I was under the impression windows always had auto updating, just no one ever used it??? Eh its a great thing anyway, I use it all the time in OS X, its nice cause you still have to select the software (if its not a system dependant thing like iMovie) and type in your password to allow it to install. It will download it without the password, but in order to install it you must put the admin password in.
"Slashdot, where telling the truth is overrated but lying is insightful."
What stops a coder from writing Virii that just goes into the Autoupdate? then everyone will be infected?
SimonTek
Uhm... last i checked, there's an option to do that already. I think it defaults to download automatically and then an icon in the taskbar lets you know they're ready to install and with 3 clicks you're installing them and getting ready to reboot 3 times. Maybe they're talking about making it default or forfced... maybe i should RTFA...
DONT PANIC
I don't think I should be forced into high-speed access just so I can update my Windows partition periodically.
I'm all for it. I think the Department of Homeland Security should realize what a risk having all these unpatched Windows computers is and urge Congress to pass a Rural Broadband Act, like they passed the Rural Electrification Act in the 30's.
Then I might actually be able to get a DSL line, which I can't now even though I'm a mile from a FOX (Verizon doesn't want to spend money to put a DSLAM in my FOX, IIRC).
Hey, Tom Ridge: we won't be safe from the terrorists until I can get something better than 26.4k at my house.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Sounds like the way the Foundationers were hidden in the Foundation series at one point. They made a religion out of it, and controlled all the advanced technology that way.
Pretty cool.
I like it. Let's start a religion! It'll be tax deductible too! Cha-ching!
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.
You mean in the same manner that someone could have written a worm to take advantage of the RPC vulnerability and install ANYTHING on millions of computers?
They could call it Blaster, and get all sorts of media attention!
wow... scary...
(for the pedants out there, yes, Blaster only seems to have hit a few hundred thousand machines. Blame the worm authors for not being good enough coders)
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Just a note. Apple's X11 server on MacOS X is not an emulator at all. It is a window sever application, just like the ones you would have on Linux, Windows, BSD, or whatever. It is still in beta (not alpha as an earlier poster tries to say) but it works pretty much perfectly and is just as quick as other X11 window servers out there. Apple plans on releasing the completed version with MacOS X 10.3, Panther, and it will be a free download.
Take a look at Apple's X11 site for more information.
Sapere aude!
it goes something like this:
..., the more ... systems will slip through your fingers..." -- Princess Leia
"...The more you tighten your grip,
i see a day coming when the gate-ster bill will not only bend over to pick up a thousand dollar bill; he'll be very, very grateful. mu-hu-hu-hu-ha-ha-ha-ha-ha-ha.
I guess the next time a recall is issued for my car, they'll just come and tow it away to be fixed regardless of where I am or what I'm doing..
Maybe the cops will pull me over and force me to take my car in to be fixed right there on the spot...
Maybe the government will start forcing me to do things "for my own good" because they know what's good for me better than I do...
Where the fsck does this look like we're going?
The first time M$ tries to connect to my computer, I'm going to consider it CyberTerrorism(TM) and press charges...
If the software update is a new version of Windows Messenger or iTunes, users should be able to say no. But what if the update prevents your computer from attacking other machines? Maybe your right to ignore software updates ends when your PC attacks my network!
At some point, we're going to have to make security updates mandatory. They would be downloaded and installed automatically, whether the user wants them or not.
The user might be able to say, "Not right now," but should not be permitted to reject security updates altogether. After a reasonable period of time, the system could be programmed to prevent all network access except to get the security update.
I'm not entirely comfortable with this idea, but I suspect that's where we're headed. I have no doubt that Microsoft will introduce something like this in the next XP service pack (or sooner).
Here's what's needed to make such a system succeed:
- Version 3.0 Quality
- No Tricks!
- Updates For All
- CD Distribution
I don't have much confidence in Microsoft's ability or desire to make a system that works this way, but I think that's what is needed.Most users and sysadmins have been burned at least once by beta-quality patches that do more harm than good. Every "Security Update" should be thoroughly tested before it's released. If a crisis makes a quick-and-dirty security fix necessary, a high quality fix should follow ASAP.
Any mandatory update system will fail if the updates are perceived to be unnecessary, unreliable or self-serving for the OS vendor.
In the past, Microsoft has used the Windows Update system to force unwanted Microsoft software on users. (If I remember correctly, IE6 was released as a "Critical Update" to IE5.) No more.
Also, system updates must be kept separate from application updates. (i.e. Disabled versions of Messenger should not mysteriously reappear after a system update.)
If one machine is insecure, we're all insecure. If Microsoft adds a security update system to Windows XP (or introduces this as a feature in "Longhorn"), a compatible system must be made available for older systems, including (at least) Windows 2000, Win98 and WinMe.
Although software downloads are relatively cheap and convenient for the OS vendor and for high-speed Internet users, dial-up users should be able to get the latest software updates on CD promptly, for a nominal fee.
Maybe there's a viable alternative to mandatory security updates, but I don't see one. Clearly, the current system doesn't work, and it's costing us all time and money.
As it works now when you click OK to install the update you agree to a new EULA. If they change the update to work automatically without the OK button would you still be agreeing to the new EULA? I don't think they could do that without asking you, because if they could do that they would be doing it now.
I work for a post production company, recently was in the final week of a 3month long project; A full 30sec CG commercial for Clorox. So it's the final days before deadline and I'm working 100+ hr week, the worm is about to hit and I download the latest security patches, all is well...or so I thought. In my half-awake, overworked not quite alert fashion, I agreed to let windows update do its thing, a decision I now regret. It installs the latest patches including the one for RPC, and I continue with my work. I work through the weekend in "3d Studio Max" made by "Discreet" Saving my work diligently as I go. On Monday the other folks in the office come in and alert me to a minor problem that every time they try to click on one of my .max files in explorer, explorer.exe crashes. Just hovering over the damn thing causes a crash ( explorer in detail view, without the web features on) I checked the files myself and they all seem to work fine, but nobody else can open or render them. I check google, I check Discreet's support forums...nothing. Then I remember that I windows update ran over the weekend and 2 patches were installed, the DirectX patch and the RPC patch. Because 3dsmax utilizes directx or opengl for viewport rendering, I started there. Interestingly, there is no easy way to remove that patch, there is no listing for it in add/remove, I found an entry for it in the registry and called MS security dept to help me remove it, they had no fuckin clue. I tried my best and all my .max scene files were still coming up corrupt. So then I switched gears and tried removing MS03-026. BINGO. This little shit had caused every .max scene file I created over the weekend to be totally corrupt. I lost about 36hrs of work at a time where I couldn't spare a minute. Thanks Microsoft and Discreet!
I posted my story to the discreet support site, a couple days later discreet posted an official response, confirming what i had posted. Some customers were notified via email, many were not. A lot of people got screwed like I did with this bizarre conflict.
I learned my lesson, don't click on Windows system dialog boxes when you are half asleep and unable to make sound decisions.
Most cars have a security cap or door (opened from inside the car) on their gas tank. Now say, the security cap/door had an issue wherein it was liable to pop off/open, or if it was very simple to pop (5-year-old-with-a-paperclip easy) that would be the defect.
I think that one of the scariest things is not the lack of security, but the lack of security obfuscated behind a wall of ignorance which mistakenly indicates safetly.
In the beginning there was the Word. And the Word was a near pointer...and God said Let there be Light! And a light was instantiated...
Who volunteers to write the book of SCO? *ducks*
I think this is a tough issue because while I don't like MS at all, I do want computing in general to be secure. Now the problem I have is that nasty ole MS likes to slip in additions to their EULA. They know most users don't read it and basically are being unethical IMO. So what happens now when an update is applied without ANY user intervention or knowledge with a new EULA? Will MS say that by not stopping the update or optting out you are agreeing to the new terms? Soon MS will have every MS windows user agreeing to allow them to scan for programs and remove any program that MS wants. Wait.. I think that already happend. I guess the next step will be to have every user "agree" without knowing to allow DRM to be put in their PC's. That would sure make user adoption very easy. I think the ONLY sensible solution is to not have RPC on by default. To not have SMB on by default unless a user chooses to share a folder. They should NOT have users belong to the administrator group by default. That is just brain dead IMO. They should do what Red Hat is doing. If a task requires root (admin) credentials, then prompt for the root(admin) password. Or you can just do what I have done and use Linux exclusivly and enjoy a much more "out of the box" secure computing experience.
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
I've found that most patches, as they apply to functions/etc used by higher-level apps, tend to break those same apps. MySQL server fragged after being patch, and require a patch-fixing-patch, and I've heard the same for other server-type apps. Drivers can also be an issue, as a driver that misinstalls can fubar a machine nicely so that it requires a full reinstall of the OS.
...that some black project group within Microsoft isn't releasing exploits that would force people to consider, welcome, and approve a service that provides automatic updates and fixes to be applied to all computers?
...far more than current methods of virus transmission. What happens if a bug slips through testing which, say, messes with the TCP/IP stack? Then you have practically every home computer in the world unable to access the Net to get the fix. Or even worse, it could just muck up some kernel function, then the computer would be completely unusable. It will happen sooner or later.
Another thing: IANANG (network guru) but what would be the effect on, international Internet links if, say, every single computer in Europe tries to fetch a 20 MB file at the same time? At least the way things are now the load is distributed!
Yes, of course, you can press OK first, if you want. There's no "Cancel" button on this dialog, mind you.
I don't have much to add.
This is exactly what I was going to say, except that I was going to have to alter the analogy slightly since my car is so old that I forgot about locking gas caps. Older versions of operating system that made it onto the Internet were not designed for security, and originally cars (and doors) didn't have locks, etc. But it's irresponsible to fail to address discovered security problems in new releases.
Note to crazy people: I am not suggesting that Linux is perfect, nor any existing operating system. OpenBSD comes closest today (in terms of "general purpose" operating systems).
WMBC freeform/independent online radio.
Still, even though XP has bugs..people are stillr etarded. for the average user who is above the MAC and too complicated for linux, windows isnt going anywhere.
DirectX 9 totally wasted my install - BSOD on boot. Couldn't even boot in safe mode. I reinstalled and it worked the second time, for some reason.
Somewhere in there replies is a message indicating you can remove outlook from the DLL cache. Another trick to nuking "vampire" apps is to remove the container folder, then make a file in the parent having the same name as the indicated folder. It won't be able to create a folder as long as a file by the same name exists...
Another really large pain is apps that come bundles. Some of the Norton stuff is like this - I have one package that had a bunch of Utils and then the antivirus. I only wanted the AV, but the utils kept coming back from the dead when I deleted them from the registry etc. Best way to solve that was to start in "safe mode" and rename the folder so that it can't find the files - then nuke registry entries.
so patch the laptops right away, I doubt those are production machines.
This P.I.G. will walk on the water, This P.I.G. will walk on the sea, This P.I.G. will walk whereever he wants.
Harris Miller, president of the Information Technology Association of America, applauded Microsoft for considering the move. "People are going to have to accept mandatory updates as part of the warranty process, and that's exactly what Microsoft should be doing," Miller said. "You can't just send out a recall notice and hope that people come into the shop and do their maintenance."
Great Harris,
#1 anyone with a last name as a first is suspect to begin with,
#2"...You can't just send out recall notices..." WHY NOT it works for companies that ACTUALLY have to accept responsibility for their products, like FORD and GM, if those companies who have liability can do it how come M$ can't ??
#3Sure I'll accept auto-updates as part of the product warranty, as soon as the M$ accepts financial responsibility for any downtime,damages or the cost of fixing programs that no longer work following an update, like corporate customers are the only ones with that problem.
errr....umm...*whooosh* *whoosh* Is this thing on ?
And as my father, a mechanic, will tell you, most people do not check the oil, coolant, power steering fluid, tire pressure, etc. The more careful ones bring in the car if it makes a funny noise long enough. Many people only think about the car when it won't run anymore. Putting gas in the car is pretty much the only thing "end-users" do reliably, and even that doesn't happen often enough sometimes (did you know that it's better for your car to not allow it to get below 1/4 tank, because then junk on the bottom of the fuel tank gets sucked into the engine?)
The frightening bit is that my mom, a Physician's Assistant, will tell you the same thing about people and their bodies. She gets in all sorts of cases where people have had horrible things wrong with them and haven't bothered to come in for a week, or the guy who drank 3 40-oz. beers a night, and his main concern was wondering why he had to wake up to go to the bathroom so often.
(as for dishwashers, most of them require you to at least scrape your plate before you put it in, and my father, having cleared out a dishwasher that pretended you didn't have to do that, will tell you that they ALL require this.)
WMBC freeform/independent online radio.
> Yikes! Can I at least press 'Ok' first
:-)
Yes of course. You will be presented with a typical MS dialog saying:
---
Do you wish to continue?
OK
---
The facility to push updates to end users should be included in Windows. It would have to be used carefully though -- not every patch needs to be pushed -- only critical updates or patches for bugs currently being exploited.
End users are obviously too stupid to keep their systems patched.. something like this has to happen.
Windowsupdate is a god send for people with broadband but MS are going to be required to send CDs in the mail if they want to keep dial-up users up to speed.
Windows Update has an Automatic Updates feature that downloads updates in the background. It uses a service called Background Intelligent Transfer Service (BITS) to check for updates and download using idle bandwidth. While you are typing Slashdot comments, the connection is idle, and BITS can use this idle time to download updates. It can download part of it, and restart when you reconnect. So, unless your ISP charges you by the bit, you wouldn't notice it. Sure, it will take a while to get the update (weeks?), but you'll eventually get it.
Dial-up users aren't the weak link in the chain anyway - broadband users with insecure computers are, and are the reason these worms spread to rapidly.
There is an API for BITS if you are interested in making a self-updating application for Windows:
All of the efforts Micro$loth has made to patch, update, and secure their software is akin to the adage, "You can't polish a turd."
That's what they have put out, and added layer upon layer to their bloated, pretentious OS and stagnant application suite.
Back in the day Windoze 3.1 seemed revolutionary. As did the quantum leap to Windoze 95. But past that end users started to see the instability, insecurity, and faults in their product.
Since then they have put on different window dressing on the same tired products. A future upgrade to Office 2003? Why, since most of the basic necessary business suite of features have been the present in the same form since Office 95? What is so new and must-have that some moron is going to shell out hundreds of dollars?
Bill Gates has never been a technical guru or industry visionary IMO. He just took other people's ideas, reinvented them as warmed over versions, and marketed them more effectively than predecessors.
MS-DOS versus PC-DOS. Windoze OS versus the Mac OS and UNIX X Windows. Excel versus VisiCalc and Lotus 123. Word versus WordPerfect. The list goes on and on.
After all of this crap now they want to drill into people's PC's? Yeah right. I'm about ready to take my XBox and set it on fire.
If someone comes along and pours sugar into your gas tank your car won't keep running right. Is that a recallable defect?
Yes. MY car has a locked gas tank. If its lock was so ineffective that anyone could put anything they damn well pleased in it, it would be a defect.
If someone sends a particularly malformed request to a process on your machine it won't run right. Is that a recallable defect?
I'd say no in both cases.
I guess the equivalent of a lock here would be some way for the machine to not run broken code...er...
You can't take the sky from me...
I've seen a ton of news articles on the "Anti-Blaster" worm. Virtually all of them quote users to the effect of "It's easier to let my computer be infected by the Anti-Blaster worm and let it deal with the patch then it is to figure out how to patch it myself."
Most people out there want to treat the computer like an appliance. It just works, they don't have to do anything to it. While I'd like to see less buggy code in the first place, I think an auto-update function is just fine for the vast majority of people. People don't complain (too much) when their DirectTV or Tivo auto updates it's software...for those who want the computer to be an appliance this is the same thing.
Um, excuse me, but since when is the Windows Registry not documented? Have you ever actually opened the Win32 SDK? There's more and better documentation for the Registry than there are for most UNIX apps.
RTFM before you flame it.
Our one and only windows box (XP) was set up for auto updates, and one morning when we got in to work it just sat there with a blue screen hinting at some sort of problem with the graphics driver. We were able to revive the box after some effort, but had to get a vendor driver, since the one XP updated itself with killed the box... Thats just completely unacceptable if you'd ever want to consider using windows boxes for any kind of server software you're shipping, since its a QA nightmare (what does the customer know, except that the server you supplied him with is now broken).
How long before a virus is made which will mod the HOSTS file to redirect windowsupdate.com to a pr0n site or whatever ...
---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
He didn't update the driver. He applied patches. How are you going to use "Roll Back Driver" to undo Windows Updates? I'd like to know that one.
Now who's the dumbass?
C Pungent
If Microsoft is going to force me to use it, it needs to work better. I use it on my XP workstation at work since its behind a firewall and reasonably secure (nobody here has a laptop they bring in from outside). Yesterday I get to work and it tells me theres a "new" update. Its the DCOM fix (not that it tells you what it is anymore, but I can recognize the issue number now) a month late so I tell it to install. Today I get into work and it tells me theres a "new" update. Guess what it fixes? The same issue. Who wants to bet it will tell me to install the dcom patch again tomorrow?
This kind of service from an automatic system is inexcusable. If Microsoft can't figure out how to publish updates and "push" them out in a consistent and timely way, then they need better coders before they start requiring us to use this service.
If I have been able to see further than others, it is because I bought a pair of binoculars.
So, let's see. You installed an unnamed critical update for Windows 2000. Then the next day, there were more that showed up. Clearly, they depended on that first update (kind of like when you install IE6, and suddenly the service pack for it shows up).
Then, you go to Windows Update for Windows XP--an entirely different Windows product--and there is a different amount of updates (after you claim there were none, which was probably just because you didn't let it update the Windows Update control when it asks you...the latest is V4).
In other words, all your little "problems" are perfectly explained away.
As far as GNU's hack incident, it's an "insider" now? Looks like historical revisionism to me. It gets me how Slashbots throw out small comments like that and start myths in an attempt to throw off criticism.
"Sufferin' succotash."
It pops up an entire balloon that won't go away until you click it.
"Sufferin' succotash."
Maybe I'm naive, but won't this just create another hole that can be exploited? If the bad guys figure out how to spoof Microsoft's AutoUpdate server, they can push evil code out to everyone and know that the code will be run automatically without any intervention needed by the user.
This will also require a known port to always be open on every single system that is set up to allow these updates. What a perfect setup for those who pride themselves in finding flaws in Miscrosoft products. Exploit the hole and gain access to almost any computer.
On the other hand, how will Microsoft get past all those DSL firewall appliances that are becoming so prevalent?
The only reason I don't install the updates on time is because I usually have 10 or 15 applications open at work and don't want to spend the time to close them all, install, reboot and reopen them (My computer dies when the hard drive is being used and takes > 5 minutes to reboot because of all the fun conflicts).
Anyway, I want to know if windows will auto-reboot during these installations. Last time I did windows update I had to reboot three times.
I'm hoping that it will just magically restart your computer while you are working. Then everyone can say "OMG my computer just restarted and I didn't do anything! I must have a virus."
And we can all say "Oh no, that's a Microsoft feature. It randomly reboots your computer at inopportune times so you don't get that virus that randomly reboots your computer at inopportune times."
The quote is:
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.
It actually makes a difference.
It showed up as a critical update for me as well. I started laughing... I take it it's a WHQL version and they're so far behind on those that I probably wouldn't consider using it. Worse yet, there's no bloody information that I could see describing anything about versioning or why they consider the driver update "critical". Take it or leave it.
Anybody install it? WTF is up with it? Something in a newer Nvidia driver break DX 9.0b? Sheesh...
How reliable is a non-standard download protocol? Maybe it's described in the paper, and if I can't download the paper about BITS, I'm skeptical about using BITS to download hotfixes :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Do you mean that if you're not comptuer savvy you'll get Official Automatic Updates from Microsoft, or do you mean that you'll get Unofficial Automatic Updates from Mafiaboy, Staecheldraht, MSBlaster, Slammer, IISvermin, and SpammerRelay?
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
When you install Windows XP, auto-update is enabled by default. You do get a little message notifying you of this, but it's enabled until you turn it off manually. In addition, the recently-released Windows 2000 Service Pack 4 enables auto-update without even informing you, even if you had manually disabled it prior to installing the service pack. Microsoft is already doing what this article seems to imply they're only considering doing. Where's the news here?
Isn't there ALREADY a client that does this?
I'm damn sure that all the PCs at my school automatically check Windows Update and download the updates. They ask us if we want to install, but that can be disabled.
I used to get high on life, but I developed a tolerance. Now I need something stronger.
First, I oppose MS pushing down these updates. The last thing I want is my computer doing something I don't want it to do. It does that enough, with BSOD, and some other lock ups.
Heck, if the OS isn't compatible with half the hardware out there already, how are they going to garunatee pushing patches down won't hurt more?
Comparing using a computer to driving a car is not equal comparisions. Driving a car has lots of responsibilities and accountabilities. There is an impact to society on a whole. Using a computer in your home, is just you and whatever you want to do. And don't anybody start comparing the Internet as a Superhighway mumbo jumbo.
Start taking away rights of the people, and you're playing with fire. The last thing I want to do is join the NCA, National Computer Association, to protect our rights to bare computers.... err... wait a second...
Anywho, but what bothers me most is that WE are debating the wrong issue. MS has cleverly shifted the burden of responsibility to the users. If MS had designed the OS a little more secure in the first place, we wouldn't be in this pickle.
Ok, so back to curing symptoms and not the actual problem. How do you force users to do their updates? Like Norton where you get a regular reminder? Isn't that Critical Updates.
Users need a tool to educate why the updates are necessary. Why do I need to download this 19MB file and how the heck am I going to do that over a 56k modem. They do not need to read a 6000 line. If the patches are 19MB, shouldn't MS be sending out the patches on cd? If you register your software, you can get the patches on cd. Maybe then MS will understand making buggy software.
Stupid users want it in clear and concise English / Spanish / Japanese / Australian / Martian, whatever. Why the heck don't they make a friggin multimedia tutorial??? Oh right, cause its not a Mac.
If the users choose to not to install patches that have been out for x number of months, then bullox for them, don't whine about MS. But a patch is out one month, and MS expects the whole world to be patched??? Get real.
They're just making PR statements to shift our conscious thinking. They're shifting the focus of the main problem by pointing out another problem. Taking the car analogy. Its like saying that the Exploder rollsover cause the driver goes to fast, and not that the vehicle has design flaws.
Anywho, I could be wrong, but that's just my opinion.
After the embarassment of last week's blaster worm, Microsoft is weighing the possibility of automatic update.
You've got to be kidding. So now instead of a worm relying on making incoming connections to an open port on a computer not behind a firewall we're going to make outgoing connections and just trust that no one managed to steal Microsoft's private key which will surely be available to hundreds of employees?
Yeah, that sounds like a solution.
I speak as someone who, in spite of running an totally up to date Norton Antivirus, Norton Personal Firewall, AND a hardware Firewall, got infected. And, the infection occured while I was manually running Windows Update to bring my Windows 2000 system totally up to date with the latest patches.
The most remarkable aspect of the infection was that Microsoft called me to try to help me recover and clean my system. When I asked how, with all of these protective measures, I got infected, I was amazed by their explanation. They explained that the files on their server(s) are fine, but that the payload was infected IN TRANSIT while I ran Windows Update.
I am stunned that someone would be able to infect something such that the windows update traffic could be intercepted and replaced by an infected version of the payload, all without affecting the performance of the network transfer as viewed by me the user.
I am doubly stunned that Windows Update would not protect against modification of the payload in-transit, particularly since it appears to sidestep both Firewalls and Antivirus protections. In its current state, it would seem Windows Update is a wonderful backdoor just waiting to be exploited.
Now there's something I want running without my knowledge...!
Why doesn't M$ concentrate on the Trustworthy Computing Initiative they announced in the beginning of 2002. No matter what technology they implement and burdens they put on their users, they will never fix the problem if they don't fix the problem.
Those people can buy WebTV. Hardware differences aren't the only issue here, software differences are. If microsofts automagic patch only kills computers running a few specific software programs, the whole default automagic updates is flawed. These boxes you talk about would have to have standard hardware and standard software, and I can't think of many people who would want that as their system.
You forgot detecting any Linux or other OS partitions and reformatting them to NTFS.
This is a great point. People don't want security. They don't care about viruses (unless their connection slows). They don't care what they install. Lastly, as long as their "e-mail machine" isn't "broken" they don't give a rat's ass about anything that comes from their "`puter". I think that the only thing that will solve this is a strict regiment of euthanasia and eugenics!
At the moment you can't fully switch off automatic updates on WinXP. I disabled the setting and even shutdown the service, but still IE automatically navigates to the windows update page, even though that's not my home page.
its all those reboots, having to reboot to install a patch only ot find a patch that was waiting for the other patch to install and both needing a reboot (thank god that most come with a "do it later" option)... how are you suppose to work in all this? oh and some finer control on things would be nice, like being able to shut down the general listening on stuff like the now RPC service. maybe give an ability to finetune the allowed ip ranges that you can get traffic from (who needs to share windows shares onto the internet?)... oh and maybe have most features turned of as standard, the last time i installed mandrake linux it first wonderd if i knew what i was doing when i selcted some server and then asked if i wanted to have them start at boot (it was off as standard)...
comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
Microsoft's new feature Automatic Update, which downloads and installs software onto a computer running Windows XP^2 has been hacked. It appears there is a security flaw that has been exposed by a virus writer know as Zero Cool. The new virus dubbed haha.gates.sucks.w32 installs a trojan cloaked as an update to the Windows system software. The trojan displays a message saying "Ha Ha, Bill Gates You SUCK! Why on earth did you put this feature into your already shitty software?" and then proceeds to clear random bits on your harddrive.
In other news, Linux is closing in on World domination.
All your boxen belong to us
Later,
Phil
There are a good number of windows updates that are already unnecessary for my personal needs, OR that are more hinderance than help!
The power of Christ compiles you.
A Random Blog
Actually if you go to the windowsupdate you can "customize" the page and exclude any updates you want from the list of available ones. If you've already installed it, then it won't show up.
DoD will never let something like that fly in any of its facilities. Microsoft will have to provide a way to disable that service.
I'm sure if MS does go that route then there will be a lengthy section in the Windows STIGs to destroy it.
"People don't like installing patches? Well them, we'll force them to install them."
.sig
Sheesh - how about examining why people don't do updates and then doing something about that?
Most people I know don't like the updates because MS makes a lot of changes besides just the "critical" security flaw.
Every change is a potential bug, and MS's history on that front is abysmal.
If the patches really were patches instead of replacements, far more people would install them.
It wouldn't hurt if there was an "unpatch" too, and if patches weren't dependant on each other.
-- this is not a
but to me this amounts to saying "our customers are lazy and stupid".
Hello? This is news to you? Wake up, dude, people _are_ lazy and stupid.
I can't get windows update to install fixes on my machine either. However, as long as it's downloading things correctly, you can still install things manually from the download location (a hidden folder which is, AFAIK, c:\WUTEMP by default). If it's not downloading them correctly, check out Daisy, which basically just parses lists of updates available, determines which ones you don't have installed, and wget's the installers directly.
Anyone using XP should remember the Windows Media Player 9 update. You know the one I'm talking about -- the one that downloads and installs itself, THEN tells you that it is also updating copy protection schemes for Windows XP.
I have a legal copy of XP and yes, it continued working properly. But with WindowsUpdate, I sure as hell don't trust Microsoft to install what they say they are installing. What's going to be next... updates from the government to intercept my email?
At least if I don't use automatic updates, I get a chance to see what professional auditors are saying on security mailing lists before I install the patch.
If you think I'm paranoid you obviously haven't been reading enough articles about Ashcroft lately...
from Wired News "I've been getting these pop-ups on my new computer's screen saying there was a patch that was downloaded and did I want to install it now," said Kathy Greeves, a schoolteacher. "I thought it could be an attempt to hack my computer, or give it a virus, so I always click 'no.' I thought I was being smart."
I bet this same woman thinks nothing of downloading spyware ridden crap because it's cute or makes piracy idiot-proof. Maybe if Microsoft had a purple gorilla sing the updates, people would take notice.
I learned my lesson, don't click on Windows system dialog boxes when you are half asleep and unable to make sound decisions.
Sounds like you hosed your work, not MS03-026. You know MS had a link available from their homepage for like a few weeks now - you know the one thats in RED. If you click on it, it'll take you to a webpage that has links to every OS thats affected - from there you can download the individual patch. I know its alot to expect, but yes, the same thing that people whine about not being able to disable (Windows Update) is NOT required for updating patches! Amazing, isn't it?!!?
I wrote a post a little ago saying that Microsoft was going to use the excuse of virus and their inability to write secure software as an excuse to grant them power over all computers they have the OS on.
In short, what they are saying is because we cant write secure software, we want total control of the software so that no one can use it in anyway that is not approved by us.
Therefore now when I dont want to use Windows or even a patch windows, my computer is considered "untrustworthy" and maybe my ISP will block it.
I think we have to be very very very cafeful in where this war on terrorism, war on computer viruses, war on everying is going ot go.
I can see someone in power tell linux to do *this*, install that or we want let you on the internet. I am surprised at how very little freedom is left on the internet and we all need to watch carefully and pipe up with the time comes.
Sorry for the rabble rosuing rant but I had too much coffe
Sigs are dangerous coy things
First of all, I have to say that I come from germany and it is hard for me to write all these crap in english. I hope, you'll understand what I try tell you.
Why do a million-dollar-weight company like Microsoft need such ways to make their software secure. Sure, it is hard to make a software like windows absolutely secure, but should it be possible for hackers and scripters to create such a virus like BLASTER???? I often tried to configure the Windows XP Firewall, but does it make sense to configure a firewall which is not able to close some holes in Windows which HAVE to stay wide open??? Firewall active or not, some ports are still not closed by it. That should be changed. To make my system secure I must have the ability to shut all these holes.
In my opinion that is the only way to make a system secure. eMail-Attachments are not the only way to get those viruses. I allready said it.....remember BLASTER. That was only the first time, we heard of a kind of virus like that, I think! Look forward to the future, and make those ways unpossible instead of installing patches or stuff like that. When millions of users try to download those patches, the update-server will also crash,....so is that really the way of help we need???
If they're going to do this, why not implement it using a distributed-computing model and releive bandwidth on their own servers? They could use some of the techniques of MSBlaster to do it. It would work something like this: The patch gets installed on the first computer. That computer then looks for other computers on the network, ftps the patch over to them, and forces them to install it. Then they go and find other computers to patch... Sound familliar?
Clearly the technology's simplicity is oversold. "Anyone can use it!"
I agree with this statement (not sure I understand what you're getting at with the rest of your post, though). Microsoft has been marketing computing as something for the everyman. Yet, their patching process is not understandable by most. They need to fix this.
The average person is not going to understand the messages that Windows Update gives. And they certainly will get lost with the descriptions at MS's Knowledge Base. What I'd really love to see is Microsoft use some of their mega-bucks to outsource the Windows Update service. Microsoft would still be responsible for creating the patches, of course, since they've got a closed-source OS. But it would be up to a third party to write the message that gets sent to the user. Something the average person can understand complete with a fair and unbiased description of the pros and cons of installing the patch. Clearly Microsfot does not have the interest in creating understandable messages because they sure as hell have the resources to implement this now. Right now the home user is confronted with a cryptic message about a new patch that they don't understand. "Well, since I don't understand what this patch does and my computer is working fine now," they reason, "why should I take a chance installing this new thing? Especially because I've been bitten by bad patches in the past!"
Gates loves to believe that his wealth is because of his great genius. But the fact of the matter is that he lucked out and entered a field that was ripe for explosion. Gates owes a huge, huge, huge debt to Tim Berners-Lee, the creator of the WWW. Remember, Gates thought the public's interest in the internet was going to be a fad. So he's an accidental success in my book. Now that the everyman is at Microsoft's mercy due to their monopolistic practices, it's really up to Microsoft to start making computer security accessable to those persons. If they don't start going that, then perhaps it's time to start thinking about government regulation (you can hear the collective groan of all the conservatives out there).
GMD
watch this
What a *retarded* idea. Windows XP has automatic updates turned on by default, so there isnt much difference.
;)
Ok, I can see the logic in making Windows Update fully transparent (and for the majority of users, this would be a good idea).
Regardless, for users like me running on a 56k connection, downloading a couple of meg worth of useless patches, this is *not* an option. My firewall is a better preventative measure than patches upon patches, so i'd rather not bother.
And if the "functionality" is put in anyway? Well, there will be cracks - hey, my firewall will probably block it anyways
Of course, its all the more reason to convert to linux.
i think there is a good thing to all this. people write these viruses for a reason, to show to the public that thier pretty little OS is really buggy and has massive holes in it. i dont blame it on the user, i blame it on the people who write the OS. they should be responsible for all these matters!!! i say, give em' hell...
A morning without coffee is like something without something else.
Im convinced that ever Windows installation should have something like a lamps filament. Then, after some time of use, one morning the user should receive the message: "Your Windows filament had just burnt out. Please change your OS." When this occurs, the user would now that probably his system has a lot of deprecated DLLs and other stuff like that and that he needs to reinstall the Windows from zero.
Installed from Windows update or direct link from the web, results would be the same, bizzare software conflict that silently corrupted all my 3d scenes.
.max scene files are corrupt"
Now think about this one AC, what type of computer user is going to actively seek out the latest patches via MS website and install them, probably a more technically skilled user.
The novice or clueless user who has Microsoft change their computer completely behind the scenes without any notice or intervention could run into problems. Should those patches corrupt their system or conflict with software, is that novice going to be able clean up the mess? Not likely. But they may have a chance, if they were presented with a box saying "Hey Im going to install the following updates that address these issues, do you agree to install these?" Then the newbie user would at least have a small clue as to what the hell is going on with their computer.
I think tis best to alert the novice users, educate them on whats going on, not give them some false sense of security. "Oh my computer is fine, I dont need to be aware of viruses and exploits, because my computer is doing it all for me automatically, and gosh darnit, I trust those geniuses up in redmond to do whats best for me"
If you were a tech support guy and got a phone call "Hey all my
tech: "Has anything changed on your computer recently"
"I have no idea"
Wouldnt you rather get
"Well recently I was alerted to a critical update by Microsoft, it was a patch called Ms03-026 or something and it was for some RPC vulnerability, whatever that is!"
Which call would you rather get?
I would rather speak to the user who has a slight clue as to what the hell is happening. Amazing, isn't it ?
Getting back to the article, I dont think its a good idea to make windows updates automatic and mandatory. I think they should have several more levels of notification and warning. Are you ready to surrender full control of your machine to Microsoft or any other third party? Im guessing not many people here are.
...you just have to turn it on.
clifgriffin > blog
You know if MS would have just taken from the *NIX community and put a simple firewall in their desktop OS's this thing wouldn't have happened.
There is no way I would allow them to automatically update "MY" computer without having knowledge of it. But hey maybe that is because I am a geek.
There are flaws in every OS, we all know that but with all the R & D money MS has, you can't tell me they couldn't port something like ipfilter or ipfwd.
I know this wouldn't solve viruses, but the average user should know better to click on an E-Mail from someone they don't know.
I'm William Wallace!!!!
Whoops, I accidently blocked http://v4.windowsupdate.microsoft.com at my firewall. Oh well...
This message brought to you by Jack Schitt's Previously Shat Shit
Nah, it's more like Gene Wolfe's "Long Sun" series, in which the everyday people actually perform rites to their virtual caretakers/overlords in order to receive fucntional rewards. It'd be like, if you consistently didn't bring at least a small bird to be sacrificed to the god Fanningus, he wouldn't keep your home network protect you from RIAA lawsuits, but if you bought a lamb for the priest of Billicose, your home-built DoomIII network would function smoothly and without lag.
By the way, Foundation's oft-cited status as "greatest SF series" is undeserved, in my opinion. It's somehow too... I dunno... deterministic. I suppose that's connotative code for "white, male, western, forty years dead", although I quite naturally wish to avoid the overtones of political correctness.
__
Hollywood, Television, has become the dream machine. We need to take that back; each of us is a Dream Machine
The bottom line being that OS Security is in the same arms race as Network Security and Digital Rights Management: for every update to every system, someone's going to try to find a way around it. There likely isn't a good way to make an operating system (ANY operating system) completely secure, without lobotomizing it. Just like you're never going to make your car completely secure from thieves unless you make it unusable, and even then "completely" probably goes a bit far.
So who do we hold responsible? Surely the perpitrators of said attacks, just like we hold thieves liable. But thieves are sometimes quite hard to catch and hackers seem to be even more difficult. If we continue this comparason, the next logical step is Insurance. Maybe State Farm or Allstate should start offering PC Security insurance wherein, for a small monthly fee (or large, in the case of corporations), you can be compensated for damage done to your system or the time it takes you to restore your system post attack, as long as you can establish that you took the necessary steps to protect your system, which means, in part, applying patches in a timely manner.
And maybe, instead of overlooking cluelessness, it really could be punished. If someone's car gets stolen but they left the doors open and the keys in it, while we don't excuse them completely, we usually do say "well, wise up.. that'll teach you." But in the case of a worm, your unpatched system can go on to do damage to other systems, in which case you are (partially) responsible for the propagation of a damaging and costly problem. So you have to take responsibility for the damage you caused, just like I have to take responsibility for the damage I do with my car, even if that's as a direct result of a vandal, say.. cutting my brake line. It's still my fault. That's why I have insurance. Is there anyone from an insurance company reading? Do you see a money maker here??
This is definitely not a one-for-one comparason and I personally feel the computer security situation is far more complex than the car security bit. And just like car makers issue recalls and face liability issues for glaring oversights in manufacturing, I certainly think OS makers should face the same thing. But you're crazy if you think Microsoft makes unsecure software on purpose. Should they do more testing? Aboslutely, but how many applications really get tested as extensively as they should? But, people point out security problems, and sometimes, MS decides to fix them. Hey great. Then it's up to the user to apply the patch. This system is at least workable, so long as they don't put people in jail for discussing security holes. And while I'm ranting, if we're gonna do that, shouldn't we start putting the Consumer Reports people in jail for doing and releasing testing that leads to the indentification of a defect resulting in a recall? I mean really! Lets have some equality!
Alright, I'm done. Really.
Buy the President
Recent versions of Lindows no longer run everything as root.
Why should ANYONE be forced to update? It's ok to ask (hey, blaster's out - should we install this security fix? etc.)
However, I have re-installed Windows 2000 on my machine several times. I can tell you that every time I install the patches, it runs NOTICEABLY SLOWER. So I don't install the fixes but I do license firewall and virus software - and to date have had no viruses or trojans!!
Let's stop with the "we must" crap and get back to reality. Choice. It makes the world go around.
AC
What about the legality of the issue? Is it legal for microsoft to dictate what and when to install on an end user system? Surely this breaches users privacy rights.
But for now. .
Man. Going back to Win98 has relieved SOOO much stress! (Which, honestly, I believe is one of the core reasons that computers exist; to cause society-wide stress and anxiety; but then I believe the cities are primarily just big negative energy batteries for the evil aliens to feed on. But then people also call me weird.)
Win98 does everything I need, and while it does not necessarily do so flawlessly, it does so reliably because at this point, I know that OS backwards and forwards. Whatever problems crop up I can fix in a few minutes because I've spent the last six years or so messing with that system. --Win2K had lots of bells and whistles, but it confused me with all of the new quirks and bits of bullshit which also came along with it.
Plus it was several major steps forward toward the whole massive information control society we all fear. (Well, those of us with brains.) Like this latest horseshit with auto-updates. Makes me wonder if Bill Gates isn't taking a page out of Bush's diary; invent a threat in order to advance your own agenda.)
But anyway. .
--I don't mind email attachment trojans. Like safe sex, those dangers are a choice. But shit! That last virus was able to get into Win2000 if you were simply connected to the web! I mean, what the hell? And there were other strange problems cropping up which I didn't understand, and since all the latest viruses are focused on the platform du jour, going back a step is a virtual gurantee of safe computing! --I bet the guys who still run the old C64's never have to worry about such nonsense; they're off the grid!
The problem which downed the computer industry is the very thing which is going to make my life easier from now on; there are no more killer apps on the horizon. Once computers reached the point where all tasks could be done without hair-pulling delays, or with quality drops in the digital versus analogue contest, there was suddenly no longer any reason to keep up with the Joneses.
--Thank goodness I've grown past the point where I give two beans about the latest game advancements!
Yep. Off the grid, where the air is clear!
-FL
However it is looked at above we then must ask what is acceptable "problem fixing" behavior and methodology. Should I just walk in the customer's homes and fix it myself or should I at least schedule a time when convenient. What happens if my "fix" causes other problems or just incompatabilities and lost bread? For that matter, what about all that bread lost from my inept development?
What if some customers have bothered to pay attention to my lack of commitment to quality in both the initial development and in fixes and as such do not trust me to fix their systems until they hear from all their neighbors what they have experienced as a result of the fix? They may have real concerns that my toaster fix will not work and cause other problems and more lost bread. They may have even had relatives or friends be electrocuted.
What about other appliances? Perhaps in the past I have noticed that other components plugged into the electrical grid of the house fail to operate after earlier toaster patches. Maybe my refridgerator stops working and my Microwave's light and half of its controls go out. Who pays for those repairs?
I can tell you with certainty that if this was indeed about toasters (or TV's, Washers, or Microwaves) that there would not be any toaster makers in business still that produced such crap as Microsoft does. I think MS has done some great things but it is often hard to see the roses when all your vision is blurred by blood from the thorns.
I say 'nay' (or maybe 'Ni!') to another attempt by Citizen Gates to take more control over the end user's life. For users that are on a dial-up ISP, an 11 or 14 MB update will slow their system speed to a crawl and generate lots of hate calls to the service providers. Plus as a corporate IT manager I've enough work made for me and my staff having to shut down or securing all of the unnecessary crap that MS loads into the OS. For example: Outlook Express (and the icons that go with it) (and who's idea was it to make OE mandatory?) Messenger Service, Alerter, etc. Remote Access Etc. I could go on but you see my point.
Only the dead have seen the end of War. - Plato
You can turn it off. Relax. Fucking zealots.
Just write a law limiting what they can inflict on you when they 'update', do your best to make it easy to proven failure to comply, write huge penalties for non-compliance, and still watch MS completely abuse automatic update... Hmmm...
Look at the vulnerable Version of windows. It is every one of the NT > 4.0 family.
The exploit was coded into every thing even after it was found. This bug has been around since 1993.
What SP6 actually did (IIRC) was not to disable SMTP for Notes specifically, but to bind port 1352 to another process, which is THE main port that Notes/Domino uses to communicate (as important as port 80 is to a web server).
The conspiracy theorists suggested that M$ did it on purpose, this was at a time when the TCO wars were at a peak between Lotus/IBM and M$.
"Stop throwing the Constitution in my face, it's just a goddamned piece of paper!" - George W. Bush Nov. 2005
Read NTBugTraq. You'll find the "horror stories" your dismissing.
If your network didn't get affected - good for you. If you didn't have any applications stop working due to automatic updates or manually installed patches, even better. More than likely your not doing anything very advanced on your network making admin a lot easier.
But oh yes, you posted as an AC, so your probably just full of hot air and a troll.
. 62,400 repetitions make one truth -- Brave New World, Aldous Huxley
I know how you feel. I get crap all the time from people saying "Switch to Linux." "Linux works better." "Blah, blah, blah Linux..." I'm sure Linux works fine, but until the huge variety of applications become available like all the stuff they have for Windows, I'm sticking with it, despite an occasional headache. Like you, I also have a job to do and don't have the time or money to learn start using a whole new operation.
Now the only way Auto Update can work and work safely is if central servers are split and made mult target. It would take a virus writer a bit more time to work out a DOS attack on all to shut the network down. Number 2 users have to be able to redirect there auto update to a non server ie a Mag CD from a cover book in the worst case that something gets spreeding that is defeating the antivirus camp completely. Ie a virus that is watching the antivirus updates for its self and it changing to go under the radar. Note no virus writer has been good enought to write one like this yet but it may come. The antivirus jaming viruses are pretty dam effective.
Now this is MS bigest problem not have deals with Computer mags to have there update always on the cd. But instead wanting users to log into MS server so they can detect pirates. Basicly if MS fixs all the bugs they will have no way to track computer pirates. So I don't see defects going away any time soon.
I thought what he meant by:
> Think about it, if you don't know enough about something to know how to turn it on or off, do you really think you should be able to choose if it's on or off?
was that since the majority of Windows "home users" arguably barely know enough about PCs to know how to turn them on or off, then maybe they shouldn't be able to choose if their PC is on or off, ergo, they shouldn't be allowed to use them.
I found it rather funny. In addition, "secure-as-default" is a commonsense idea that anyone should support.
So there I was, presenting my proposal to the board when Microsoft Automatic Update kicked in. Id didn't so much as pop up a bubble-box notice. The interractive graphics ground to a halt and then the computer rebooted three times.
There was nothing I could do, and I couldn't explain it away because it was all happening in the background. They thought my general design was bad.
Fortunately it happened exactly the same way to the next three presenters, so I didn't lose my job.
Unfortunately the last guy got the bid, he'd still been working on his presentation via 802.11z in the back of the hall, so he was all patched up before it was his turn.
So what if it was only half-visualized demo-ware. His "worked" and mine "didn't"...
===
Don't think it will happen? Think I am just paranoid?
Think again.
"What can we do to your time-critical work-flow today?" -- New Microsoft marketing slogan.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
Come on people, time for something very much resembling Whack-a-Rat.
Building a better backup.
Zettabyte Storage
could it be because these recent worms have been attacking THEM?
"...Bush's diary; invent a threat in order to advance your own agenda."
If you haven't noticed yet that "invented threat (terrorism)" just blew up the UN compound in Bagdad. The US tried to provide security for them but "they didn't want it." Seeing as the UN was on record as against the US action against Iraq and theses "invented" terrorists it makes no sense unless they really are terrorists and were in Iraq. What do you know bathists and islamic terrorists do act in concert and want to kill everone. What ever aganda Bush might have he sure as fuck isn't wrong about these people.
An auto-update patch could first be sent out to, say, 100 volunteer test machines. If problems arise the first two days, go back and fix. Next, send it to 1,000 test machines and see what happens for a couple days. Then 10,000, etc. Gradually sweep out to the milliions of real machines in diverse scenarios as reliability is proven.
You and everybody like you reinforcing their support for Bush.
Because you're right. There IS no rational reason for the Iraqis to blow up a UN compound. Neither tactical nor diplomatic. It's incredibly stupid. --The UN, the one world body which might have the ability to lean on the US and make things better for Iraq, and the Iraqis attack it. Hmmm.
Same thing happens all the time with the Palestinians. --Just when things are looking good for them; talks about land being returned, or the Jewish military pulling back in its supremacist policies, a 'Palestinian' suicide bomber will take out another busload of civilians. --I mean, EXACTLY when things are looking up. You can pretty much predict the day of an attack based on how good things are looking in the 'Roadmap to Peace' or whatever horseshit the media is shoveling on any given month.
It's the same old pattern, and it's happened, literally, countless times. Just when things are looking as though Peace might break out, the party with the most to gain shoots itself in the foot, thereby 'justifying' the aggressive force of the massively superior power of the Jews, or in this case, the US.
In warzones, it is very, very easy to get away with operations of this sort. You don't even need to Greenbaum, (Look that up!) a victim. You just need a charismatic CIA asset operating behind the enemy lines, (like Bin Laden for instance; that guy was created by the CIA a decade and a half ago. Any half-assed Googling will tell you that.), and get the guy to start distributing horseshit to his followers. The young men are cut off enough from world awareness so they don't really know what's going on, and they're angry enough at the violations played upon them and their land and their loved ones; that's a lot of bottled up rage and misery. It'd be very, very easy to whip them up into blowing up pretty much any target you convince them is 'Bad'. Hell, we've seen that very scenario played out in reverse; Americans seeing their 'Homeland' being hurt getting whipped up into a big enough frenzy to also blow up ridiculous targets which had nothing to do with the original injustice. Targets such as Afghanistan and Iraq, for instance. And who gains in the end?
Somebody is getting rich as hell, and it's not you or me! -Haliburton, Dyncorp, Carlyle Group and fucking Worldcom of all companies; they're the ones profiting! Oh, and a Jewish telco got another of the billion dollar reconstruction deals. --Companies which are either responsible for losing BILLIONS of dollars due to the recent economy-destroying frauds in 2001, (for which the perpetrators are STILL not being penalized thanks to friends in high places), or in which Bush and his cronies are actually direct shareholders!
So, I'm sorry. I just don't buy it. It makes zero sense for Iraq to bomb a UN holding, and (as you demonstrate), such ploys are simply far too effective a propaganda policy for them not to be regarded with a high level of suspicion. There's just too much money at stake, and the people in direct line to collect that cash have demonstrated time and again that they have no internal moral compases whatsoever. When I see 2+2, I can only say, "4".
-FL
Users want realiable OS
Two Wrongs Don't Make A Right-- But They Make Me Feel A Whole Lot Better
I have provided some PC support professionally and as a "hobby" (friends, colleagues) in, let me count, 15 countries in four continents (perhaps even your corner of the US) and I can confidently say that only weirdos (like /.ers ) have their computer on at all times.
Most people realize the critter is using that thing some parts of the US lacked sorely this last weekend, electricity, and most people are sure as hell that that is not free since they are reminded of the fact periodically by the electricity bill.
IANAL but write like a drunk one.
Every single computer that is on unnecessarily causes environmental damage, most goverments, individuals and organizations in general agree that such damage should be restricted in as much as possible without interfering with productive activities.
A computer doing nothing in a household for 22 hours wasting power is not only foolish (no matter how much you pay for your electricity) but wasteful.
A computer used in a lab for the best part of 12 or 14 hours is a completely different beast since society is getting a direct benefit and thus the environmental damage at least have a direct justification.
And in spite of all that, your friends are weirdos and in a minority. Most people have the common sense to turn off their computers when they stop using them.
IANAL but write like a drunk one.
Because to do the right thing conflicts with their interests, their way to work and their perceived bottom line.
-They should respect the privacy of their users.
-They should not force feed EULAs with patches.
-They should take enough time to test patches, ensuring they don't brake things.
MS has willingly ignored the first two issues above, there are many examples of that.
As for the last one, they are completely lost: they are trying to integrate so many things in the OS (in their anticompetitive zeal to try to push out of the market every single company that produces any useful piece of software) that they are creating an unmaintainable pile of software kludge.
With the pressures to cut costs and to put patches out in service quickly there is a fundamental contradiction between effective software testing and complexity of a software kludge that includes everything and the kitchen sink.
They are becoming a victim of developping according to marketing strategy and not to sound software engineering principles. If they are in a catch 22 it is one of their own making.
IANAL but write like a drunk one.
There is only one entity that can force people to do something in a cumpolsory manner, yes ladies and gentlemen, your often depised goverment.
If a given goverment mandates software upgrades in the benefit of the common good then I will gladly agree. Of course this invasion of privacy to prop-up a private service means that the service provider becomes heavily regulated.
If mandatory pacthes woud mean that MS would be forced to produce quality software or it would be fined for endagering the public, I am all for it.
If mandatory patches means a company I don't trust will put whatever they see fit in the computers of my friends and relatives (not mine mind you, I don't have to worry about MS ever touching my hard disk) I will be a vocal opossition to such stupid, ludicrous idea.
Since when did MS became tha arbiter and regulator of how people use computers? That some people seem to believe they have that "right" shows in how horrible bad shape the IT industry is.
IANAL but write like a drunk one.
What happens when MS puts out something that has bugs? It's not so bad if it's not a big bug, but that's not a given.
A couple years back, I was running Windows Update on a box at work and it installed a video driver (Intel, I think) which BSODd my box. I couldn't even rescue it and had to reload it. I knew other people who had the same problem with that update. A day or so later, MS yanked that update.
Now that was my fault. I had a back room of identical boxes on shelves that I could have tested the patch on first. But what about Mom and Pop? When their box BSODs, it'll cost them $100 to put it back working, and they may lose some pix of the grandkids. Who's going to pay for that? MS? Not bloody likely.
over whose dead body will you say that? i mean, if windows was really easy to use, users would be able to figure out what their systems needed to STAY easy to use. lets take just one issue; ports. how many of them are there in a WINXP system anyway? how many users could even tell you that with a hint of accuracy? the list goes on... the trend has been for MicroSoft to push more complex products into the pipeline on the consuming public who is untrained to handle (in my view be even be aware of) the complexity of the systems they have to be responsible to manange. when was the last time you saw a complete manual ship with a WINXP box? or, when was the last time you saw a step by step here are the _insert how many zillion___ (qty) things you the user 'must' do when you get your computer setup and power it on the first time? Message to the captain; your customers need better PC roadmaps Bill Gates!!!!!!
"The UN, the one world body which might have the ability to lean on the US and make things better for Iraq"
The US completely ignored the UN and everybody else in the international community before the war and will continue to do so, so long as it remains the only bully in the playground. There is currently no other world power to keep Bush in check and his administration is determined to take over the world, at almost any cost.
I get more an more concerned every day when I hear those chilling phrases such as "the American Century" and "Homeland Security" and "Patriot Act". It's getting like the McCarthy era with the "reds under the beds" - genuine, peaceful Americans are becoming more afraid to speak out in case they're labelled as unpatriotic or supportive of terrorists - is that freedom?
The only phrase I'm still waiting to hear Bush come out with is "the final solution", then I know we're all going straight to hell.
Go permanent? In your dreams and my worst nightmares.