Slashdot Mirror
Microsoft wants Automatic Update for Windows
Edward Dao writes "After the embarassment of last week's blaster worm, Microsoft is weighing the possibility of automatic update. Microsoft not only wants to upload the latest patch on to users' computer but also installing it for them." This will work out really well for everyone I'm sure. Yikes! Can I at least press 'Ok' first?
Wouldn't this clasify as a worm too? I don't want anything installed on my system without my permission too.
Nice to see that M$ is in the worm buiesness too.
If you RTFA you'd find that Microsoft is only "looking very seriously" at this idea,
that it would not apply to business users of XP (since they want careful control
of the patching of their machines), and that it would be possible to opt-out from
the automatic updates.
So if you are a business user you don't get automatic updates, if you are a home
user of XP that is technically savvy you can turn it off, and if you are a home
user who is not computer savvy then you are going to get automatic updates. This
latter group seems like the ideal set of people to get automatic protection.
John.
if someone breaks into MS WindowsUpdate servers, he could install ANYTHING on millions of computers!
wow... scary...
So what is it that you really want?
Manual updates? "LOLOLOL! M$ users are so stooopid that they can't do even that!".
Automatic updates? "LOLOLOLOLOL!!! You would let Microsoft to update your systems?! You fool! Why don't you download a Gentoo instead?!"
Systems that are secure and usable out-of-box? No such thing.
BOO! TERRO
1) WindowsUpdate needs to become MicrosoftUpdate. This would scan and offer patches for all MS software (OS, Exchange, SQL, IIS, Office, Visual Studio, ....). Also extend SUS to do the same.
...
2) Critical Update notification should be done the way OSX does it (with a little configging) -- instead of a tiny little innocuos icon in the system tray, put an obnoxious pop-up in the middle of the screen, with a big "Go Ahead and Install" button, with lots of skull & cross-bone icons.
3) Create patches using their own packaging structure: MSI. This allows for much simpler deployment and management, via Active Directory. No need to pay for SMS simply for patch deployment.
4) Supply MUCH MORE documentation to end users, discussing the importance of keeping one's machine patched.
5) Stop producing such buggy software! =}8v)
Just my $0.02
10b||~10b -- aah, what a question!
The main problem is people not knowing, or not caring about patching or updating the problems. This isn't something that's directly managable by MS. With an OS so widely used, how can updates be ensured to be installed on everyone's machine to stop spreading of viruses and exploits?
Some will say the user should have the choice... ok, so half the people who couldn't care less will still allow the spreading of the problems...
Some will say automatic background updating is the only solution... ok, so the majority of people still using low speed connections will bog down their systems, let alone major networks suddenly pulling huge bandwidth when every machine receives the command to update simultaneously...
And some still complain that even if the update is pushed and you need to say yes or no, it's still infringing on your privacy your own system...
Is there any way to implement a global, trustworthy, reliable patch service that is accepted by everyone? If not, there's no way to stop the virus spreading, work generating underground from having hay-days at the world's expense...
And this goes for any OS, not just Windows...
Anyone remember NT4 Service Pack 6? The first one? The one that broke tcp/ip?
Tell ya what Microsoft, you can patch my machine automatically as long as I get to sue you the first time an automagic update foos my bar. Yeah, tough call huh?
You may not know this, but there are a lot of people who don't jump on the latest service packs not because they lazy, but because they are scared.
I thought the Automatic Updating Service in XP Pro already did this. It has the options to download and install, download and let you decide, just tell you there is a patch or of course you can disable it totally... I fail to see how this "new" idea is any different. I thought the XP auto update was set to download and inform by default so perhaps they're just switching the default setting.
Just have a look for yourself. Control Panel > System > Automatic Updates
Good point. Surely this would blow off any EULA type update licenses. How can you agree to an automatic update you didn't even know about?
Forget thrust, drag, lift and weight. Airplanes fly because of money.
Let's assume for a moment that everyone's fine with Microsoft deciding you need to patch your system. Your home machine downloads the patch and installs it and your machine reboots - you're patched.
Those of us that work as sysadmins/netadmins/DBAs at various companies know that when Microsoft puts a patch out on Windows Update, it's not necessarily tested out to completion. That's part of why patches take so long to proliferate - dependable administrators test them in-house, instead of depending on MS's testers. Let's face it...if Microsofts Quality Assurance team were so sharp (or listened to - it can't ALL be their fault), many of the after-the-fact patches wouldn't be necessary.
Is Microsoft going to take responsibility for auto-installed patches that a) don't work b) make situations worse? Or are they going to take the stance of "The user could've refused our auto-install, but they didn't - they knew the risks."
We all know how hard it can be to opt-out of spam - how difficult will Microsoft make it to opt-out of auto-installed patches...and for those of us that can't/don't, how sure are we that it won't make things worse?
I have several people who use a web based service from my company that runs on Windows 2000 Server. I check for patches daily and install them as soon as I do a full backup (in case it shits out the whole system).
My users kept calling saying "You have that Blaster Worm on your system because every time I try to connect my computer dies!". So I explain to them my systems have been patched for that exploit for over a month and I have run all the proper testing software to verify. I then ask if they have AntiVirus software installed and their reply is "I don't know.". Lol, I don't know, so it must me my server! I immediately tell them to invest in a copy of Norton Antivirus and Norton Firewall.
Ah, the world of windows.
The funny thing is if these same people were running linux they would be logged in as root and still execute whatever script someone sent them. I'm not too sure Linux would be any more secure than Windows because in windows you can also run as just a User. However, when doing that a significant number of poorly designed programs will not work.
ahem, I think you left a few off...
- Check for Yahoo, AOL, IRC, etc. clients, as well as Jabber and Trillian, disable and cancel the user accounts, and re-enable with the new MSN client. Update registry so that system will no longer boot if MSN is tampered with.
- Check for the presence of Opera, Mozilla, other browsers, disable and delete them, then modify the registry so that their installers will no longer work, then reinstall Internet Explorer with fully idiotic preferences set as defaults, and provide support for a whole new set of web "standards" that only Microsoft will ever use.
- Filter through user's bookmarks and delete any bookmarks that match any of the following criteria: a) bookmark points to competitor's web site, b) bookmark points to web site that sell competitors products, c) bookmark points to site that mentions any competing product, or d) bookmark points to site that employs or otherwise associates with one or more individuals who currently, or have in the past, made use of or considered using a competing product.
- Remove all versions of email clients other Outlook. If user does not have Outlook or any other Office products currently installed, go ahead and continue removing other email clients, but after that's finished force the user to purchase a copy of Outlook because it's the only "safe" email client for Windows
- Check to see if user has updated their system prefs to show file extensions in the Explorer windows. If so, set it to false so that file extensions are no longer shown because that's really more "secure"
Did I get them all?
The major problem with software distrobutions such as windows is that the entire OS thrives on the 'one click' philosophy. One-click update, one-click install, and one click virus infection. People are so used to windows giving them one click 'Ok' windows that they end up clicking Ok and worrying later. 90% of regular office users end up clicking okay to almost anything and installing spyware, viruses, etc.
Windows needs to 'brand' the update procedure; make it so obvious and un-repeatable by other apps, so that users are not duped.
Reason, free market capitalism, and individualism
I didn't bother to patch my office machine against MSBLASTER, and why should I?
I've been stripped of most of the permissions to admin my own machine because the internal IT support has been centralized. That means a few people service the rest of us in a way that generally has the good of the company in mind.
That said, if they take away my permission to do it, and they get caught with their pants down, why do they expect us all to run software locally on our own machines to fix the latest problem X? It's because oboviously these people do not have enough resouces support a network of our size.
If it wasn't the veil of "computers" clouding the issue, I bet someone upstairs would have corrected the logic of, "If they can't do their own job, we can get the whole company to waste a bit of time to help them out."
Certain systems require certain amounts of support, but this is not an OS issue. It's just more pronounced in systems that require more man hours to keep on the bleeding edge of security.
I don't think it's a horrible idea to make automatic silent updates the default. After cleaning up some of my relatives' machines after the Blaster worm, I set them all to automatic updates. Yes, there is a chance that an update might break something, but this chance is far less than the chance of another exploit or worm trashing the system.
They just don't understand it at all and as the person who gets called when there is a problem, I'll take any proactive measures that I can to make sure things continue running smoothly.
I'm sure these customers didn't know they had a problem with their PCs. That was the first fact that caused the worm to be a problem. The fact that the computers weren't patched was secondary. Instead of pushing the patches, why not be more aggressive about notifying customers, and giving us better tools to patch and scan? Asking millions of users to pull updates ALL THE TIME, or turn on an automatic pull where there are only 3 configuration options is a real lack of choice. There are lots of things in between that can be tried. If I were a home XP user, and I saw a notification, "Message from Microsoft Security: Due to a problem recently found in WinXP, You are at high risk of being hit with an intrusive virus or worm. Here is a web site with details. Here is a 1-800 number with details. To correct the problem now, press Ok." Supposing MS did give home users this easy to use scan, notify, patch utility, the only reason they would not use it is if the EULA were too scary. This is easy to fix. Put a big splash screen with "Absolutely no Information is gathered and Sent to Microsoft. To see how this tool works, click here. Microsoft will never change this policy without your consent. (Like we did with WindowsUpdate)" We shouldn't have to wait long to see an analysis of Blaster, but I am going to guess that the majority of infection vectors came from business or academic Win2000 installations. WinXP systems crashed so much, they weren't efficiently spreading the worm. So corporate tools to fill this middle ground need to be improved. The hard to learn and use tools like IIS lockdown, hfncheck, etc need to be seriously overhauled. At work, I would love to have a non-web-based WindowsUpdate SCANNER, and a separate PATCHER. They'd be easy to use with a GUI, but also have command line options so they could be used in scripts. (SUS isn't what I'm talking about, because it is browser based, and the process is still a pull. The only way you can push an important update is to go to each server, or set the servers auto-pull frequency really high) I also wonder if MS is afraid that making system maintenance too easy might cut in to their SMS server sales?
simply do an add deny tcp and add deny udp in ipfw on ms's address on your gateway and you don't have to worry about it.
Red Hat is for people who hate Windows, FreeBSD is for people who love Unix.
www.putertech.net
Valid points... but we're talking lesser of two evils here. I would much rather see a single user of a computer have problems (due to firewall, updates) than their unpatched machine causing problems for more than one user.
We can't have it both ways... right now windows is set for ease of use over security... and having auto-updates and a firewall will move them towards the security side of things and away from ease of use... but isn't that what we've been bitching about for years?
I think forced immunization of vulnerable open machines on the network is a good idea, under the right conditions.
After public notification of the nature of the vulnerability.
After a patch has been made available and notices posted, sent out.
After a user or sysadmin keeps their machine unpatched and exposed.
After a second warning has been posted, sent that forced patching will occur.
Then, and only then, a worm-delivered patch should be administered.
But it should not be administered by MS, though they were responsible for the vulnerability.
MS is a profit oriented business, whose goals include many actions directed towards increasing their own profit in the long and short term, as well as fixing software that users have bought from them.
No. It should be role of people responsible for network health, because that is the public good that is impacted. As a public, non-profit entity, they would be free of conflict of interest, financial considerations. If MS were to administer remote administration in this way, they would be opening themselves up to conflicts of interest, particularly because of the monopoly market position they hold.
"Provided by the management for your protection."
SP 6 broke Lotus Notes servers thus 6a came out.
Even worse, SP 2 installed over a network failed. Failed badly. It did something horrible to the ntfs.sys file IIRC. This meant that the box would blue screen on boot and be irrecoverable if you had an NTFS partition.
--- I wish I could hear the soundtrack to my life. That way I'd know when to duck.
If I have to reboot my servers every time a major bug hits (3 times/year) for 5 minutes, that's bad enough. (99.9971% availability) If I have to reboot the servers every week, now we're down to 99.95% uptime.
This, of course, doesn't count downtime or technical support issues caused by workstations missing their server connections, or the patches that didn't happen in time, or any of the various other factors that help kill capitalism, and endanger our National Security.
--Mike--
This is a prime example of blind hatred.
For years slashdotters have been spouting how Microsoft defaults were wrong. How in Linux you have full control but it defaults to a safe mode. Now Microsoft wants to do the same thing and everyone gets all FUD'ed about it.
Credibility is important, RTFA, think, then post.
Perhaps a better solution would be for any "home" version to have an automatic updater that pops up a big red warning box into the middle of the screen telling users they need to patch and a little sliding theremometer scale to show the severity of the patch.
the above is my personal opinion and does not necessarily reflect that of the little voices in my head
1. Microsoft releases a patch a month before a virus hits.
2. People do not install the patch.
3. The virus hits affecting thousands of machines.
4. Microsoft comes under heavy criticism.
5. Seeing that a lot of people won't install patches manually, they look into automatic updates so that they can avoid wide-spread virus infections in the future.
Seems like MS is in a catch 22. People will criticize them for having manual patches available or for automatic updates. It seems like they would have to create the world's first flawless OS for everyone to be happy.
All OS's require security patches at some time or another. It just so happens that Windows has such a large customer base that their viri have a wide-spread effect while viri for another OS might not be as major. So I ask, what can MS do realistically to announce and distribute security patches?
"Oh dear, she's stuck in an infinite loop and he's an idiot" -Prof. Farnsworth (Futurama)
If the software update is a new version of Windows Messenger or iTunes, users should be able to say no. But what if the update prevents your computer from attacking other machines? Maybe your right to ignore software updates ends when your PC attacks my network!
At some point, we're going to have to make security updates mandatory. They would be downloaded and installed automatically, whether the user wants them or not.
The user might be able to say, "Not right now," but should not be permitted to reject security updates altogether. After a reasonable period of time, the system could be programmed to prevent all network access except to get the security update.
I'm not entirely comfortable with this idea, but I suspect that's where we're headed. I have no doubt that Microsoft will introduce something like this in the next XP service pack (or sooner).
Here's what's needed to make such a system succeed:
- Version 3.0 Quality
- No Tricks!
- Updates For All
- CD Distribution
I don't have much confidence in Microsoft's ability or desire to make a system that works this way, but I think that's what is needed.Most users and sysadmins have been burned at least once by beta-quality patches that do more harm than good. Every "Security Update" should be thoroughly tested before it's released. If a crisis makes a quick-and-dirty security fix necessary, a high quality fix should follow ASAP.
Any mandatory update system will fail if the updates are perceived to be unnecessary, unreliable or self-serving for the OS vendor.
In the past, Microsoft has used the Windows Update system to force unwanted Microsoft software on users. (If I remember correctly, IE6 was released as a "Critical Update" to IE5.) No more.
Also, system updates must be kept separate from application updates. (i.e. Disabled versions of Messenger should not mysteriously reappear after a system update.)
If one machine is insecure, we're all insecure. If Microsoft adds a security update system to Windows XP (or introduces this as a feature in "Longhorn"), a compatible system must be made available for older systems, including (at least) Windows 2000, Win98 and WinMe.
Although software downloads are relatively cheap and convenient for the OS vendor and for high-speed Internet users, dial-up users should be able to get the latest software updates on CD promptly, for a nominal fee.
Maybe there's a viable alternative to mandatory security updates, but I don't see one. Clearly, the current system doesn't work, and it's costing us all time and money.
Why should ANYONE be forced to update? It's ok to ask (hey, blaster's out - should we install this security fix? etc.)
However, I have re-installed Windows 2000 on my machine several times. I can tell you that every time I install the patches, it runs NOTICEABLY SLOWER. So I don't install the fixes but I do license firewall and virus software - and to date have had no viruses or trojans!!
Let's stop with the "we must" crap and get back to reality. Choice. It makes the world go around.
AC