Microsoft to Patch Problem Patch

slowroller writes to mention an eWeek article about a new patch to fix issues raised in their most recent release. From the article: "The company's plan is to target the rerelease only to Windows users who are affected. In a blog entry, Toulouse said the company's patch deployment technologies will have "detection logic" built into them to only offer the revised update to customers who don't have MS06-015 or are having the problem. The glitches, which Microsoft claims affect only a tiny fraction of the 120 million installations of the patch, stem from a new binary called VERCLSID.EXE that validates shell extensions before they are instantiated by the Windows Shell or Windows Explorer. On systems running Hewlett-Packard's Share-to-Web software, Sunbelt's Kerio Personal Firewall and some NVIDIA Drivers, users complained that the new binary stopped responding."

Comments

yay!

[bensafrickingenius]

Recursive patching at last!

Two Patch Tuesdays

[Vskye]

For some Windows users, there will be two Patch Tuesdays in April.
 
So, you can get two patchs and two tacos on the same day? Wow, now if MS can do the pizza deal, I might just install their OS! ;)

Re:Millions of different system configurations.

[MustardMan]

No - Microsoft doesn't release patches fast enough and they don't do adequate testing. They don't win on either count.

Heh - "tiny" fraction could still be "lots"

[NotQuiteReal]

Many product vendors would love to have a tiny fraction of the 120 million installations - it would be more than their entire market!

I know this is not a popular opinion here, but MSFT really does have a tough job, if you are objective about it, from an engineering point of view.

Re:Heh - "tiny" fraction could still be "lots"

[mcrbids]

I know this is not a popular opinion here, but MSFT really does have a tough job, if you are objective about it, from an engineering point of view.

Hear here!

I agree 100%!

As a software engineer of a rapidly growing company, it's amazing to me how much higher the standard of testing and accountability has to be with each major product release. Our company has been growing exponentially, at least 2x annually. Just a year or two ago, a bug meant a few phone calls, but in the last year or so, it's gotten to where a single bug (even a minor one) can easily swamp our telephones!

The first release was like, a proof of concept more than not. It wasn't even feature complete at release - we relied on an update mechanism built in at the last minute to cover for the fact that not all the features were completed!

Not many phone calls from that issue, I might add. But, in the last year or two, a single bug affecting a relatively small percentage of our users still loads us down with dozens of issues ticketed in a single morning.

Ugh!

Since our deliverable is web-based, fixing a bug is still very fast, but we're working furiously to improve quality control testing prior to release. I can only imagine what a company with the market size of Microsoft has to deal with - when the vast majority of computing resources are in your hands, the task of dealing with bugs and updates must be simply gargantuan.

How do they do it with such a shoddy codebase?

Re:Make your own decisions

[swmccracken]

How about Corporate: Microsoft provide a server program that you can install that downloads the updates and stores them locally.

Your corporate administrator then configures that server and manually approves and rejects updates to be deployed though the Automatic Update clients connected to your server. (Optionally approving a patch for deployment to only certain groups of computers, say the IT Department could be beta testers.)

It's called Windows Software Update Services, and has been out for quite some time. In other words, all you're asking for in the first half already exists. :-)

The second part you're talking about is deployment of patches that aren't released through automatic updates - and yes, I agree, they're often problematic. It sounds like you manually installed a non-security hotfix, which was then clobbered by a later security patch (and the bugfix wasn't included in the security patch).

Microsoft seem to believe that non-security bugfixes don't belong in security patches unless a lot of people are affected, but it means that for people that need those security patches and bugfixes, it becomes quite a mess trying to maintain them (and may require manual management, as you've found the hard way. :-( ) I think they're tryng to be cautious, which I can understand (although they've in theory fixed this for XPSP2 and 2K3, as those patches are supposed to include "general distribution release" and "quick fix engineering" versions, automatically installing the QFE version if there already is a QFE hotfix installed, otherwise installing the GDR version.)

A classic example of all this is that there's a registry key you can set that causes IE patches to install bugfixed versions. (I'm not kidding.)

Re:Again? What?

[Rosco P. Coltrane]

No, the patch was simply conflicting with a few pieces of software. If you aren't affected, you won't get the patched patch. The original bug was fixed with the original patch. This patch's patch simply whitelists a couple of programs known to cause issues with the patch.

man: Well, what've you got?

Waitress: Well, there's egg and bacon; egg sausage and bacon; egg and patch; egg bacon and patch; egg bacon sausage and patch; patch bacon sausage and patch; patch egg patch patch bacon and patch; patch sausage patch patch bacon patch tomato and patch;

Vikings: Patch patch patch patch...

Waitress: ...patch patch patch egg and patch; patch patch patch patch patch patch baked beans patch patch patch...

Vikings: Patch! Lovely patch! Lovely patch!

Waitress: ...or Lobster Thermidor a Crevette with a mornay sauce served in a Provencale manner with shallots and aubergines garnished with truffle pate, brandy and with a fried egg on top and patch.