DIY Service Pack For Windows 2000/XP/2003

yeah, that's real safe by ILuvRamen · 2006-12-12 08:42 · Score: 3, Insightful

Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.

yeah, that's just so terribly safe compared to not having it...except that now there will be like a million fake isos floating around the internet saying they're the latest batch of windows updates and people who are too lazy to make the iso themselves will install the fake, spyware and trojan infested ones.

--
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'

Re:yeah, that's real safe by emor8t · 2006-12-12 08:46 · Score: 1

Well that's their problem now isn't it. You can only help the unknowledgeable learn if they are willing, otherwise, they are just stupid.

Well Einstein by El+Lobo · 2006-12-12 08:43 · Score: 2, Informative

1) Who says that you must download it from an unpatched PC?

2) The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?

3) What else will we whine about now... the versatility of Macintosh hardware?

--
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!

Re:Well Einstein by joe+155 · 2006-12-12 08:46 · Score: 3, Funny

"The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?"

I would say your second guess of 2 is closer than your first of 0... shall we split the difference and agree at 1?

--
*''I can't believe it's not a hyperlink.''
Re:Well Einstein by truthsearch · 2006-12-12 09:02 · Score: 2, Interesting

Home desktops aren't usually behind firewalls. A new PC gets connection attempts from evil scripts and viruses within seconds of plugging it into the internet. Even with a high speed connection it takes quite a long time to download and install all of the Windows updates on a new PC. So the chances of getting infected are quite high.

--
Developers: We can use your help.
Re:Well Einstein by falcon5768 · 2006-12-12 09:07 · Score: 1

even with a firewall they are. Case in point I hooked up my father in laws brand new out of the box HP to get updates. Within 3 minutes it was hit and infected before i could even get everything configured. Thankfully I had AV running on it by that time but it blew me away how fast it got infected.

--
"Slashdot, where telling the truth is overrated but lying is insightful."
Re:Well Einstein by Vellmont · 2006-12-12 09:19 · Score: 3, Insightful

Home desktops aren't usually behind firewalls.

That may have been true 10 years ago, but these days most home PCs are at least behind a NAT. Unless you've gone out of your way and configured your NAT to forward all ports to your PC (i.e. a DMZ), outside attacks will be quite useless. The only threat in this case is the user downloading a virus from email, or visiting a compromised website. If you run windows update (well, several times) before you do either of those things, there's no danger.

--
AccountKiller
Re:Well Einstein by Shakrai · 2006-12-12 09:21 · Score: 2, Informative

Home desktops aren't usually behind firewalls

Depends on your service provider. In my experiences most DSL providers use NAT routers -- even for single PC connections. Most cable providers seem to use bridges and your PC gets a globally valid address, which tends to be a problem for a Windows PC.

Then there's dialup users. But if you have to use dialup to do a complete set of Windows updates on a brand new PC it's an even money bet that you'll die from old age before they finish and in this scenario who cares about being pwned?

--
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Re:Well Einstein by Shakrai · 2006-12-12 09:24 · Score: 3, Interesting

That may have been true 10 years ago, but these days most home PCs are at least behind a NAT.

Umm, I'd have to disagree with that statement. Around here the biggest provider of internet connectivity for home users is Roadrunner. They provide you with a cable "modem" that acts as a bridge between their network and your PC. The PC gets a globally valid address.

In fact the only Roadrunner home users I know (not counting geeks/techies) that have NAT routers are those that have more then one computer. Otherwise it's right into the PC and come and get it boys cuz I'm wide open!

--
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Re:Well Einstein by Klaidas · 2006-12-12 09:26 · Score: 3, Funny

Well, the safest thing to do it to simply turn the computer off, remove the CPU, dig it in the yard and lock the rest of the computer in a safe.
Although, script kiddies might still be trying to infect it...
Re:Well Einstein by truthsearch · 2006-12-12 09:28 · Score: 1

Most home PCs are behind NATs? Personal ones? I find it impossible to imagine that most non-technical people are asking for routers/gateways when they purchase their PCs. Especially when they're only purchasing one PC and therefore don't require a NAT. Do you have any evidence?

--
Developers: We can use your help.
Re:Well Einstein by Vellmont · 2006-12-12 09:33 · Score: 1

but they're in the minority now.
They provide you with a cable "modem" that acts as a bridge between their network and your PC. The PC gets a globally valid address.

That's true, but there's a large percentage of people with more than one computer/game console/etc in their household, and roadrunner only provides one IP address unless you want to pay big money for business class service. Those people will buy a cheap NAT router at best-buy and plug it in so they can get more than one computer connected to the internet.

Also, DSL modems these days almost universally provide a NAT inside them. All this adds up to most people being behind a NAT. Obviously there's still people NOT behind a NAT, but the numbers are shrinking every day.

--
AccountKiller
Re:Well Einstein by slashbob22 · 2006-12-12 09:33 · Score: 1

would say your second guess of 2 is closer than your first of 0... shall we split the difference and agree at 1? bool hack_probability=1;

I guess there is good reason to be careful.

--
Proof by very large bribes. QED.
Re:Well Einstein by Vellmont · 2006-12-12 09:38 · Score: 1

I find it impossible to imagine that most non-technical people are asking for routers/gateways when they purchase their PCs.

Most of them don't know what the hell it is, they just want something that'll allow them to connect multiple computers on the same internet connection.

Do you have any evidence?

Just my own experience. It really doesn't take much of any technical experience to setup a NAT. Your average interface-jockey can certainly plug the thing into the cable modem, and plug his computers into the lan side.

--
AccountKiller
Re:Well Einstein by shmlco · 2006-12-12 09:40 · Score: 1

Jumping in, the Qwest DSL modem (Cisco) we received for home use was preconfigured to automatically put us on an internal NAT w/DHCP running.

So yes, evidence exists.

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Re:Well Einstein by Shakrai · 2006-12-12 09:42 · Score: 1

That's true, but there's a large percentage of people with more than one computer/game console/etc in their household, and roadrunner only provides one IP address unless you want to pay big money for business class service. Those people will buy a cheap NAT router at best-buy and plug it in so they can get more than one computer connected to the internet.

I don't disagree with you on that. I just disagree with your original statement of "most" home PCs being behind a NAT. Being the only techie at my company I've often been asked to help people with PC issues. Besides one person who had bought a combined router/ap for her laptop, I honestly can't name a single one of them that didn't just have Roadrunner plugged right into the PC.

Also, DSL modems these days almost universally provide a NAT inside them. All this adds up to most people being behind a NAT. Obviously there's still people NOT behind a NAT, but the numbers are shrinking every day.

I made that observation too. That's another reason that I steer people towards DSL over cable. Plus the fact that Verizon offers 768k service for $14.95/mo vs $34.95-$44.95 for Roadrunner. 768/128 service may not impress most people on /. but it's more then enough for Grandma to send pictures to her kids and do online banking.

In any case, you must be working with a different area or group of people then I am, because in my experience the overwhelming majority of people are not behind NAT until I put them there.

--
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Re:Well Einstein by drinkypoo · 2006-12-12 10:13 · Score: 1

The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?

I've personally seen a Windows 2000 system get railroaded because it got bad DNS from a malicious DHCP server in the real world. Visit windows update, ends up feeding you a bogus IP, redirects you to someplace that owns you.

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Re:Well Einstein by IdolizingStewie · 2006-12-12 10:50 · Score: 4, Funny

Your average interface-jockey can certainly plug the thing into the cable modem, and plug his computers into the lan side.
I want your users. I lost internet access three times last year because some dumbass down the hall plugged his router in backwards and was trying to NAT the whole damn building.
Re:Well Einstein by Vellmont · 2006-12-12 11:38 · Score: 1

I want your users. I lost internet access three times last year because some dumbass down the hall plugged his router in backwards and was trying to NAT the whole damn building.

Heh. Well I didn't say they understood what's going on at all. In their own home they can only screw up their own crap (and when it doesn't work, they plug it in the other way). In a public LAN they're dangerous as hell.

I had a similar problem a few years ago when some damn fool miss-configured his router with the same IP address as the NAT. It took me half an hour to figure out what he'd done (and confirming it via looking through ARP cache). Another time a different guy setup his router to advertise DHCP for the whole network, routing everything through his router. A third example was when a business on a totally seperate network many miles away. He had the same DSL provider as me and miss-configured his subnet mask (and I believe the DSL modem at that point was bridged). The end effect was that stuff going across his network across town wound up on my network, even though my network wasn't the destination (taking up a LOT of bandwidth). I never really did fully understand that one (though I really don't understand how DSL bridges work either).

--
AccountKiller
Re:Well Einstein by that+this+is+not+und · 2006-12-12 14:10 · Score: 1

My home network is behind TWO NAT layers. The DSL modem my ISP provided is a NAT router, but the DHCP server in it is hard-coded to only serve out one IP. The cheap-n-dirty solution was to connect a second NAT router to it as the only 'workstation' and translate everything a second time, using IT as a second DHCP server (except half my machines instead have static IPs and just use the router as a gateway statically.)
Re:Well Einstein by that+this+is+not+und · 2006-12-12 14:13 · Score: 1

You're sharing a subnet with any random fool who your landlord decides to let in the building??

And I thought it was bad allowing my wife to tumble around the 'net on her Windoze box, downloading any junk she felt like... ("ooooh, this will make starting up pogo.com games go faster....")
Re:Well Einstein by that+this+is+not+und · 2006-12-12 14:16 · Score: 1

When you power up the cpu-less motherboard, a resourceful hacker might still figure out a way to get some form of malware running on the 8042 processor that the PS/2 keyboard plugs into...
Re:Well Einstein by Aczlan · 2006-12-12 14:18 · Score: 1

he must have had a nonworking firewall or another infected computer behind the firewall.

--
"Democracy is two wolves and a lamb voting on what to have for lunch. Liberty is a well-armed lamb contesting the vote
Re:Well Einstein by Firehed · 2006-12-12 14:23 · Score: 1

Depends on your OS too. If it's a new PC, it has XP SP2 installed. Which has a firewall that's enabled by default.

I don't know if it's any good or not, but my understanding is that it should keep you covered at least until you get all your patches. Chances are that if you're confident enough with computers to have reformatted the thing for whatever reason, you have more than one in active use and thus a hardware firewall via your router.

Not to mention anyone with a wireless connection will have a wireless router. Considering that laptops are outselling desktops now, I'd say that's a fair chunk of people.

--
How are sites slashdotted when nobody reads TFAs?
Re:Well Einstein by fred133 · 2006-12-12 17:14 · Score: 1

Where have you been for the last 7 years,in an Egyptian tomb?
I don't know anyone who isn't at least behind a router of some brand.
I run a linux box in front of all windoz boxes.
Are you stoned or stupid, or you just brought your brand new PC home from beeestBuy?
I realize that the buitin firewall on a fresh install is totally worthless against the "kiddies"
but a standard install on a router give you at least 20 minutes against them.
autopatcher,though I personally haven't tried/used it sounds solid to me.
I install xp/a,sp1,then sp2 all from cd,then go for updates,yea ,its not fast,but I can pick and choose the the updates that go into the machine that I"m building.custom not product!
Remember,it's windoz,NUKE and PAVE!!!Nothing like fresh asphalt!
Re:Well Einstein by wizzahd · 2006-12-12 18:23 · Score: 1

2) The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?
I think you meant 0.002 percent. What, do you work for Verizon?
Re:Well Einstein by falcon5768 · 2006-12-12 19:35 · Score: 1

nope it was configured and running, and the only other systems behind it where 3 macs and a PS2. Simply put, by using Microsofts own software update site, it was hit with a virus. And its not unheard of, even our work firewall which doesnt let through anything remotely related to .exe, .zip or outside searches, still has managed to let through viruses disguised as things that are ok. Some can be traced to outside sources (people who have access abusing it, CDs and other media from home) but at least 1-2 times a month we get something that sneaks right through a configured firewall. Its always contained and disinfected before it does any amount of damage, but we can show through logs that it was infected from outside the network, despite it not supposed to be.

--
"Slashdot, where telling the truth is overrated but lying is insightful."
Re:Well Einstein by skinfitz · 2006-12-12 19:58 · Score: 1

Even with a high speed connection it takes quite a long time to download and install all of the Windows updates on a new PC. So the chances of getting infected are quite high.

Would that be a new PC running the current version of Windows, namely XP Service Pack 2 where the firewall is installed by default?

How is that going to get infected please?
Re:Well Einstein by foreverdisillusioned · 2006-12-12 22:56 · Score: 1

I thought the idea was somewhat far-fetched, too... that is, until I was infected by Blaster wiithin minutes of my first boot, before I had a chance to download the service packs or a firewall (my router was acting up, so I was directly plugged into the cable modem.) So yeah, it happens, and I don't think I'm the only one it's happened to, either...
Re:Well Einstein by strick1226 · 2006-12-13 04:31 · Score: 1

Although, script kiddies might still be trying to infect it...

Or crypt kiddies, perhaps...
Re:Well Einstein by RareButSeriousSideEf · 2006-12-14 14:59 · Score: 1

"2) The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?"

Last time I let an unpatched, freshly-built W2K Pro SP4 instance connect to the net sans-firewall, it was pwned and conducting outgoing portscans within 10 minutes.

The blackhats have enough strategies for surmounting firewalls that I'm not comfortable counting on one as my only prophylactic - especially on networks where I don't manage the wall myself. Seems akin to the rhythm method IMO.

I really try not to be anybody's fanboy, but after trying this Offline Update thingamabob, I'm afraid have a stomach full of Kool Aid. All hail heise Security! Join the family, meet a bunch of people who *really, really* love you, and finally attain the everlasting peace you've been seeking your whole life!

--
Pi Ran Out

Does MS offer this by MECC · 2006-12-12 08:44 · Score: 1

Does MS offer a cd with patches? Even for download (or would that violate DRM/DMCA/DigitalDarkAges laws/technologies)?

I know Apple offers their patches as download, complete with SHA1 sig.

--
"We are all geniuses when we dream"
- E.M. Cioran

Re:Does MS offer this by phantomcircuit · 2006-12-12 08:46 · Score: 2, Interesting

They used to offer a CD that they would MAIL you for free (around 2002) but stopped doing that. (no reason was given for why they stopped).
Re:Does MS offer this by El+Lobo · 2006-12-12 08:54 · Score: 1

MS goes even further. They will SEND you a CD completly without cost (excepting shipping cost) for any security fixes in any Windows system or MS product. They have been doing so since 1987 (with floppies, of course) untill today.

--
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!
Re:Does MS offer this by nine-times · 2006-12-12 09:01 · Score: 1

I can't tell... are you trying to be funny? Completely without cost (except for the costs) and better than near-instantaneous downloads, they'll probably get a CD to you within a couple months!
Re:Does MS offer this by olyar · 2006-12-12 09:03 · Score: 1

I know that you can go here and download Service Pack 2. There's lots of other individual patches that can be downloaded there as well...
From what I can tell, the value add of this site (and the autopatcher site) is that they download the patches for you all at once, and that they package some sort of script that figures out what needs to be applied.
However, according to the Terms of Use on the Microsoft site:
The Software is made available for download solely for use by end users according to the License Agreement. Any reproduction or redistribution of the Software not in accordance with the License Agreement is expressly prohibited by law, and may result in severe civil and criminal penalties. Violators will be prosecuted to the maximum extent possible.
So they may be outside the lines...

--
Custom, hands-free Linux installs. Instalinux
Re:Does MS offer this by plover · 2006-12-12 09:48 · Score: 4, Funny

This site should be "within the limits" of that TOS simply because they don't provide the software. He just provides a tool which you can use to download it from the official Microsoft site, and the TOS doesn't say anything about how you download them, just where you download them from.
Autopatcher, on the other hand, provides the actual software, which is explicitly prohibited by the TOS you mentioned. He has this hilarious line in his FAQ:
Q: Is AutoPatcher legal?
A: Yes, nwraptor once spoke to a Microsoft employee and apparently they know about us but dont care what we do! Now that's legal advice you can hang your hat on!

--
John
Re:Does MS offer this by LurkerXXX · 2006-12-12 10:06 · Score: 1

Er, they have Windows XP SP2 available. That came out well after 2002 IIRC.

I didn't look around more for other newer patches, but they might be doing that as well.
Re:Does MS offer this by SEMW · 2006-12-12 10:43 · Score: 1

I can't tell... are you trying to be funny? Completely without cost (except for the costs) and better than near-instantaneous downloads, they'll probably get a CD to you within a couple months! I know you're a troll, but I'll bite. Yes, certainly "completely without cost". That's what "free" means, you know. I also have a SP2 CD that MS shipped for free. I think the main point was to get SP2 out to those who are stuck with dial-up or -- God forbid -- not connected to the internet. As for shipping time, it arrived quicker than Ubuntu Linux (but admittedly, being a security & stability update, wasn't as fun to play around with :) ).

--
What's purple and commutes? An Abelian grape.
Re:Does MS offer this by nine-times · 2006-12-12 11:25 · Score: 1

Not exactly a troll. But sarcastic, yes. "Free" would mean completely without cost, and therefore something is not "completely without cost" if you're paying shipping/handling costs. Second, shipping CDs is fine and dandy, but in this day and age, it's not so clearly "better" than a convenient high-speed download.
Re:Does MS offer this by SEMW · 2006-12-12 12:32 · Score: 1

"Free" would mean completely without cost, and therefore something is not "completely without cost" if you're paying shipping/handling costs. I didn't pay shipping and handling costs. At the time, I didn't have a credit or debit card and thus had no means with which to pay shipping and handling costs even if I had wished to out of the goodness of my heart. I did not, in fact, pay any costs. Nor did anyone. I think they've started charging for shipping now, but they certainly didn't when they released SP2.
Second, shipping CDs is fine and dandy, but in this day and age, it's not so clearly "better" than a convenient high-speed download. Uhh... Huh? They do offer a high-speed download. They do for all their updates. They've always done so. It's called Windowsupdate. The point was that if you can't download, for whatever reason, you can order a CD as an alternative. And yes, obviously you can download updates as self-contained packages, and burn them to CD to be installed; it's called a 'network installation' (e.g. SP2 can be downloaded here). You can even 'slipstream' updates into a custom installation CD (instructions here) if you want.

--
What's purple and commutes? An Abelian grape.
Re:Does MS offer this by SuneSpeg · 2006-12-12 14:31 · Score: 2, Informative

It seems like people are totally unaware of the lovely thing from M$ called WSUS (Windows Server Update Services). Which is a local server that works as an update proxy. It saves tons of bandwidth and time!
Re:Does MS offer this by snarkth · 2006-12-12 16:42 · Score: 1

Yet they are still around...

Hey, third party distribution of microsoft patches saves microsoft bandwidth costs. Likely a significant amount. Beancounters take note...

snarkth
Re:Does MS offer this by plover · 2006-12-14 05:33 · Score: 1

Personally, I can't imagine how much bandwidth costs Microsoft. Distributing service packs, updates, hosting time servers, all that has to cost a fortune. Of course, they have a large fortune, so it's obviously worth it.
I don't really have a problem with sites like AutoPatcher, because I don't care that much about Microsoft's TOS on that page. I just thought his belief that it was all on the up-and-up was hilarious. But imagine the sh!t that would hit the fan if he distributed a virus-infected patch. Lawyers, feds, trials, it would break his piggy bank forever. At least he's not charging money for the service, he's just begging for bandwidth.
As for people who use AutoPatcher, can you "swear" that you trust him? Imagine what would happen if he deliberately wrote a password-sniffing Trojan and included it in one of the autopatch images? Microsoft may be the Evil Empire, but you know they have too much to lose by inserting identity-thieving code. This guy is small, and he could decide "hey, the Mob is offering me three million bucks to put out this zombie-creating patch, I think I'll take the money and head to the Cayman Islands!"

--
John

Corporate Windows Update by mandelbr0t · 2006-12-12 08:47 · Score: 2, Informative

This sounds like a useful script. I know people who manage Windows Updates for corporate networks, and they've mentioned these sorts of ISOs before. Effectively, it allows an admin. to read the KB articles on microsoft.com and pick-and-choose which updates to make available to the corporate network. There's a lot of updates! A backup ISO of the updates you've chosen to make available allows you to easily rebuild the update server if anything happens to it, and to build update servers for other networks based off work you've already done.

As to circumventing WGA: it's already been circumvented for XP SP2. You actually have to download and run the WGA executable to destroy a cracked XP SP2 install (Windows Update doesn't push it to you). Vista may be a different story though.

mandelbr0t

--
"Please describe the scientific nature of the 'whammy'" - Agent Scully

Re:Corporate Windows Update by node159 · 2006-12-12 10:01 · Score: 1

AutoPatcher anyone http://www.autopatcher.com/? First thing to run on any new install after the drivers are done.

Comes with all the latest 'Critical' as well as recommended patches, along with common a bunch of other wanted items (Java, TweakUi, PowerToys, Flash/Shockwave, etc) as well as a heap of tweaks out of the box!

No honestly its all sweet goodness, and will save you a lot of time and reboots.

--
GPLv2: I want my rights, I want my phone call! DRM: What use is a phone call, if you are unable to speak?
Re:Corporate Windows Update by LurkerXXX · 2006-12-12 12:36 · Score: 2, Informative

I don't know any admin who would use these for a corporate network. ISOs are typically a thing you use when you only have one or a handful of individual machines to update. WSUS makes things easy to customize for what computer receives what individual patches without messing with DIY patch ISOs. WSUS Server chaining, replicas, or offline updates allows you to copy settings to other WSUS servers without worrying about 'backup ISOs' of what you have selected. It does it all for you.
Re:Corporate Windows Update by ACMENEWSLLC · 2006-12-13 03:02 · Score: 1

>>...as to circumventing WGA: it's already been circumvented for XP SP2. You actually have to download and run the WGA executable to destroy a cracked XP SP2 install (Windows Update doesn't push it to you). Vista may be a different story though

That's a bit misleading. Automatic Updates will push WGA to you. Media Player 11 was released to customers, and it has WGA built into the patch. So if you have your computer setup to automatically download patches and apply them and you apply Media Player 11 then you have WGA now.

They did that a few weeks back.

Danger? by dedazo · 2006-12-12 08:49 · Score: 4, Insightful

Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.

A "danger" that is eliminated with a rinky $25 NAT router.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo

Re:Danger? by Captain+Splendid · 2006-12-12 09:04 · Score: 1

Thankyou. Or you could just slap a decent firewall on there from a USB key before you hook it up to the net. It's what I do when a client gets a new rig they want me to setup.

--
Linux, you magnificent bastard, I read the fucking manual!
Re:Danger? by AliasTheRoot · 2006-12-12 09:06 · Score: 2, Insightful

Or plug in the Ethernet cable after you have turned on the firewall built into XP - assuming you aren't using a SP2 install where it's enabled by default.
Re:Danger? by LodCrappo · 2006-12-12 09:07 · Score: 4, Informative

A NAT in front of your windows box does do a lot to prevent trouble while you're patching up a new install. As long as you immediately get up to date (before using the machine for anything else) then I'd think this is fine. The problem is people who rely on a NAT device for some sort of security *in place of* security patching. Many exploits work just fine through NAT if you're actually using the machine to surf the web or read email, and way too many people seem to not understand this.

--
-Lod
Re:Danger? by toadlife · 2006-12-12 14:01 · Score: 1

It's sad that it took this many posts for someone to finally post this.

Anyone who is savvy enough to download this patch thingy should (hopefully?) be savvy enough to just turn the dang firewall on before plugging in the Ethernet cable.

--
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.

autopatcher has been doing this for a while now by schnikies79 · 2006-12-12 08:49 · Score: 4, Informative

i keep a up-to-date copy for my dialup friends, which most are.

Autopatcher!

--
Gone!

Re:autopatcher has been doing this for a while now by EvilRyry · 2006-12-12 09:29 · Score: 1

I've been using autopatcher as well. I install it on my desktop with Wine, then upload it to my Samba server. I have a line in my logon.bat for the Windows machines to add Autopatcher as a weekly job, and I keep autopatcher up to date.

What does all this add up to?

Ghetto rigged WSUS for Linux servers to Windows clients.
Re:autopatcher has been doing this for a while now by F�an�ro · 2006-12-12 10:52 · Score: 2, Insightful

autopatcher is a closed source solution which requires you to trust executables from a dubious source. Even if you accept the autopatcher guys as currently trustworthy, they may still sell out or get hacked with much higher probability than microsoft.

Or just buy the firewall you should have anyway by Tim+C · 2006-12-12 08:53 · Score: 1

Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.

Or you could just buy the firewall you really should have anyway and be done with it. Seriously, I can't imagine anyone would try to argue that it's acceptable to put a server out on the net without a firewall in front of it, so why should a desktop PC be any different? That way you get to protect your unpatched Linux box too.

--
It's official. Most of you are morons.

Re:Or just buy the firewall you should have anyway by mcrbids · 2006-12-12 09:04 · Score: 4, Insightful

Perhaps the key difference is this:

I can put an unpatched RedHat Linux system on the public Internet and download patches without worrying about it. In fact, I routinely use such systems AS the router/firewall for other systems!

If you hear people around here saying things like "Windows is insecure and/or isn't really ready for the Internet", that's because it's true, or you wouldn't need that stupid $25 router in the first place!

The fact that you can't even imagine a server without a dedicated firewall in front of it speaks volumes.

--
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Re:Or just buy the firewall you should have anyway by AliasTheRoot · 2006-12-12 09:14 · Score: 1

Good luck to you and your unpatched Redhat, it doesn't have the volume of attacks a Windows box has - but don't assume it won't get rooted - it will.

It has always been good practice to have a firewall, or at least a NAT router in front of any server, be it Redhat / Windows / BSD / OSX / Solaris whatever. Thats only one piece of the puzzle of course, but a very important one.

However, for your average desktop machine there has to be a balance between security and usability, a balance that the builtin firewall, some free AV and Windows Defender pretty much meets, the current trend towards non privildeged user accounts in mainstream OS's like Vista / OSX cements that.
Re:Or just buy the firewall you should have anyway by mcrbids · 2006-12-12 09:23 · Score: 1

Good luck to you and your unpatched Redhat, it doesn't have the volume of attacks a Windows box has - but don't assume it won't get rooted - it will.

As I recall, it takes an average of about 3 months for an unpatched RedHat box to get rooted, if left up in its default config and unpatched. Can't find a link - but there was a honeypot project on this a while back. And somehow, I doubt that even at 28.8 Kbps, it would take 3 months to complete an update.

However, patch the system, and apply reasonable "best practices" - such as NOT having the password of "god" for the root account - and you should expect a clean system.

--
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Re:Or just buy the firewall you should have anyway by shmlco · 2006-12-12 09:52 · Score: 1

such as NOT having the password of "god" for the root account

Is it time for the obligatory 1-2-3-4-5 luggage joke?

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Re:Or just buy the firewall you should have anyway by pandrijeczko · 2006-12-12 10:19 · Score: 1

If you hear people around here saying things like "Windows is insecure and/or isn't really ready for the Internet", that's because it's true, or you wouldn't need that stupid $25 router in the first place!
As a Linux user myself (Gentoo), I must say that you started to sound like you knew what you were talking about - until you made the above comment...
The whole point of a "$25 router" is that it separates valid Internet IP addresses from the reserved addresses normally used on a private LAN. When you take one of those things out of the box and switch it on with it's default config, there is absolutely *NO WAY* anyone on the Internet can connect into *ANY* PC on your private LAN, whether or not those PCs run Linux or Windows. Where damage *CAN* occur is when you connect out from the private LAN to the Internet to a web or mail server and allow something in as a result. Yes, that's generally something attached to an email or script that can damage a Windows PC - but you're treading on *VERY DANGEROUS* ground if you believe that you do not need one of these boxes to protect a Linux PC.
Yep, if you're ultra-confident with Linux and know *EXACTLY* which services to leave turned off and how to securely configure the services that you leave on, then you'll probably be okay - but the first lesson anyone learns about security is that you take a *LAYERED APPROACH* to it and deploy any security measures first that are "cheap and easy" (like one of these boxes), and then harden your PCs subsequently.
Believe me, I know. Five years ago, I opened up a Linux server to the Internet (behind a NAT router) and stupidly left an FTP server running on it. Within days, someone had buffer overflowed the FTP daemon, stuck an eggdrop script on my server and had it attacking IRC users on another ISP - I only found out because my ISP kicked me off my service and wouldn't let me on again until I'd proven in pages and pages of logs that I wasn't launching those attacks.
Please don't get complacent about security - take my advice.

--
Gentoo Linux - another day, another USE flag.
Re:Or just buy the firewall you should have anyway by gad_zuki! · 2006-12-12 10:55 · Score: 1

>or you wouldn't need that stupid $25 router in the first place!

Or you know, the windows firewall that came with your xp system. Enable it. Block printer and file sharing ports on the local lan (MS default). Now download your updates.
Re:Or just buy the firewall you should have anyway by Tim+C · 2006-12-12 11:02 · Score: 1

I can put an unpatched RedHat Linux system on the public Internet and download patches without worrying about it.

Friend of mine did that until he realised that it'd been rooted a few weeks ago. Fortunately he didn't lose anything important, but it cost him an evening to work out what had happened then reformat and reinstall.

Don't assume that Linux is impervious to attack, as it most certainly isn't.

The fact that you can't even imagine a server without a dedicated firewall in front of it speaks volumes.

Yes - it says that I work at a company with a dedicated systems department who are paid (in part) not to leave things to chance. It says that I work with clients who mandate multiple firewalls on their networks, with fully separated subnets and as little as possible in the DMZ. It says that I'm willing to spend less than I spend on a night out to be that much more confident that my PC is safe from unwanted attack.

--
It's official. Most of you are morons.
Re:Or just buy the firewall you should have anyway by pandrijeczko · 2006-12-12 11:42 · Score: 1

a lot of those '$25 routers' run linux ....
Agreed - but they're running an embedded Linux meaning that they don't have much in the way of command shells, you can't drop trojan horse or bad scripts on them...

--
Gentoo Linux - another day, another USE flag.
Re:Or just buy the firewall you should have anyway by KillerBob · 2006-12-12 12:12 · Score: 1

3 months average doesn't mean that it'll definitely happen in 3 months. It could never happen, it could happen in 5 minutes. You are taking a gamble every time you go online if you aren't behind some kind of firewall.

--
If you believe everything you read, you'd better not read. - Japanese proverb
Re:Or just buy the firewall you should have anyway by dhasenan · 2006-12-12 13:10 · Score: 1

But it's reasonable to expect not to be rooted in the two or three hours it takes to get all the patches you need, if the mean time to failure is three months.
Re:Or just buy the firewall you should have anyway by KillerBob · 2006-12-12 15:42 · Score: 2, Insightful

But it's reasonable to expect not to be rooted in the two or three hours it takes to get all the patches you need, if the mean time to failure is three months.

That's up to you. But please don't take it as an offense if I say that I'd never hire you as a sysadmin.

Ask yourself this... is the 5 minutes it takes to set up basic firewalling (or even simply shutting down any daemons you're running) worth the extra time you risk if you have to reinstall the computer? Banking on averages is never a good idea, especially not when you're dealing with something mission-critical. Whatever can go wrong will go wrong, at the worst possible moment and all.

Speaking as somebody who's had computers blow up on him on many an occasion, I'd rather not take any chances I don't have to. Recovering from your own fuckups is expensive and annoying, doubly so when it's avoidable.

--
If you believe everything you read, you'd better not read. - Japanese proverb
Re:Or just buy the firewall you should have anyway by tehcyder · 2006-12-13 01:57 · Score: 1

That's up to you. But please don't take it as an offense if I say that I'd never hire you as a sysadmin.
[...] Speaking as somebody who's had computers blow up on him on many an occasion

You're a fine one to talk, at least he'll just get some viruses rather than actual physical destruction of his machine.

--
To have a right to do a thing is not at all the same as to be right in doing it

Great idea but... by rsmoody · 2006-12-12 08:54 · Score: 1

Hasn't this one already been done with AutoPatcher? I am still gonna play with this and see how it compares. AutoPatcher works fairly well, usually there are only a few items left to download after starting with a fresh install of SP2. For one, something like this that automates downloading the patches to be installed on multiple computers really helps out with the time it takes to patch a system. One download vs the 7 I will be doing here in a little bit is nice. Also along these lines is Update Accelerator for IPcop. Basically, it's a web cache for Windows Updates. You download the updates once, it stores them on the IPcop system and they are delivered from IPcop in the future, makes things take a lot less time and it's free (minus some old hardware and time).

--
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2

nLite by Nasarius · 2006-12-12 08:59 · Score: 4, Informative

I've been using nLite and RyanVM's update pack to do this for a while now. Great stuff, even works with my Dell OEM version of XP.

--
LOAD "SIG",8,1

Re:nLite by Jonah+Hex · 2006-12-12 09:26 · Score: 2, Interesting

Check out Microsoft Forum Network http://www.msfn.org/ for more do-it-yourself guides and forums dedicated to pre-building customized CDs/DVDs.

Jonah HEX

--
Horror & SciFi Erotic Nudes
Re:nlite by OAB_X · 2006-12-12 10:15 · Score: 1

Well ...... its not the same. nLite requires windows to be re-installed to do that patching (via the RyanVM patch), this is designed to be a patch utility that does not require re-installing windows.

Assuming it works of course, nLite does indeed work, this box is running via an nLite made windowz disk. (with RyanVM updates and driverpacks drivers slipstreamed)
Re:nLite by ET_Fleshy · 2006-12-12 12:46 · Score: 1

Dell OEM eh, can I interest you in an addon or two that will automatically and legally activate your version of XP for you... forever! Just a quick google search or two for some vlk keys and you're golden ;). Or... maybe you already have some, who knows? Enjoy!
Re:nLite by Nasarius · 2006-12-12 13:04 · Score: 1

For whatever reason, I've never had to activate my copy of XP from Dell, or even enter the CD key printed on the side of my PC case. It Just Works, and I don't question a good thing.

--
LOAD "SIG",8,1
Re:nLite by ET_Fleshy · 2006-12-12 13:22 · Score: 1

Are you using a restore CD or something? If you want to know why most of the OEMs don't have to activate, just meander over to the link I posted above and there is a link towards the top that will describe how it all works. Cheers!
Re:nlite by Danathar · 2006-12-12 15:37 · Score: 1

Hence my word "Almost"

Trust him? Do you know what Heise is? by Anonymous Coward · 2006-12-12 09:02 · Score: 2, Informative

Who do you refer to, exactly? Heise? Heise is not a him, it's a big (and trustworthy) publisher of computer magazines in Germany (c't and iX).

nlite by Danathar · 2006-12-12 09:03 · Score: 3, Interesting

nlite does almost the same thing and is much more flexible and easier to use

http://www.nliteos.com/

Check out RyanVM too by SteWhite · 2006-12-12 09:03 · Score: 2, Informative

For anyone interested in this sort of thing, you might also want to check out RyanVM:

http://www.ryanvm.net/msfn/

This allows you to produce updated Windows installation CDs, that actually have the service packs and post-service pack hotfixes *already integrated into the installation*. This saves the extra time normally taken to install Windows *then* go apply all the updates.

Is this the kind of stupid comment that gets... by Assmasher · 2006-12-12 09:06 · Score: 1

...a Windows zealot slagged for saying "How are you supposed know how to configure support in *nix if you can't get on the internet to do it?" Seriously...

"Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates." - Who the heck said you should connect the unpatched machine to the 'net to grab this stuff? FFS, I bet ol' Karsten would go to town of the Windows zealot for playing stupid. ;)

--
Loading...

Re:Is this the kind of stupid comment that gets... by Jerf · 2006-12-12 09:49 · Score: 1

Who the heck said you should connect the unpatched machine to the 'net to grab this stuff?
Actually, that is a good question. Who did say that?

Could it be... you?

(Clearly the point is that you use a patched machine to make the CD, then feed the CD to an unpatched machine, resulting in 0 unpatched machines on the raw internet.)

Good idea for some applications... by catdevnull · 2006-12-12 09:11 · Score: 1

This is a useful tool for my particular environment where we use RapiDeploy to re-image boxes. The image gets a little stale and we have to go through a quarantine network before our Cisco Clean Access authenticates us--we're essentially in a leper colony while we're trying to catch up on patches. It's a bit of a catch 22.

Having the patches on hand would really help when we don't have a little router on hand on field calls.

--

I might know what I'm talkin' about, but then again, this is Slashdot...

Slipstreaming by any other name by GungaDan · 2006-12-12 09:14 · Score: 1

is still just slipstreaming - you don't need any special downloaded software for this.

--
Eloi are stupid, throw morlocks at them!

Yes but... by kosmosik · 2006-12-12 09:17 · Score: 1, Informative

Yes but no Polish (or any other than few) language version is supported. So it is useless for me.

It just shows how retarded update management is in Windows. It is like 10 years behind Linux and 5 behind OSX. And Vista is no different either.

Re:Yes but... by nekokoneko · 2006-12-13 04:06 · Score: 1

So you're saying they forgot Poland?

Wish they would do this for Linux Distros by Rashkae · 2006-12-12 09:20 · Score: 1

I wish the big Linux distros would start doing this. Being unable (or unwilling) to patch a linux box without a broadband connections is one of my biggest pet peeves with the current crop of distros.

Re:Wish they would do this for Linux Distros by drinkypoo · 2006-12-12 10:19 · Score: 1

If you use synaptic (for debian and friends) it will create a download script which is just a file with a bunch of "wget url" lines in it, where url is a full URL to a .deb package.

Personally I save this file to my USB key which has a windows wget.exe on it, and name the file whatever.cmd. Then I just put the usb key in my windows machine, double-click the file, and bingo! It downloads the packages. If I save the selection file as well, then I can copy the files to the distfiles location, load the selection file, and then install precisely the packages I needed. The same script will of course work on linux or OSX with wget installed (or you could alias wget to curl, then source the script instead of running it.)

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Re:Wish they would do this for Linux Distros by Raideen · 2006-12-12 15:28 · Score: 1

I suppose that you could walk around with a copy of the files in /var/cache/apt/archives on your Debian distro. You could also keep a mirror archive if you want absolutely everything. Either way, it's basically all in once place. Also under Debian, if there are enough patches to warrant a "service pack," a release update is created. If by "big," you mean Red Hat, SuSE, Ubuntu, or other commercially supported distro, well you can do similar things with Ubuntu and there's probably already a script that does it for the RPM based distros as well. I've never carried around every Windows patch anyway. I usually keep the patches for the latest big vulerability that's being exploited by a worm at the time (which usually means that their Internet connection is getting sapped anyway) just so that I don't have to download it repeatedly.
Re:Wish they would do this for Linux Distros by petermgreen · 2006-12-12 22:54 · Score: 1

just how up to date do you feel you need to be?

debian do a "point release" every so often which includes security updates among other things and when they do so they build both new full CD/DVD images and a set of update CDs (they don't seem to yet do update DVDs but i've just suggested it ;) ).

If you really wan't the latest updates you can always take a copy of the relavent directories on security.debian.org and burn it to a CD/DVD.

--
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register

What about Microsoft? by febuiles · 2006-12-12 09:21 · Score: 3, Interesting

I wonder what Microsoft thinks about this, right now I'm downloading updates that I wouldn't be able to get since I don't use a legal version of their software.

Thank you :D

Re:What about Microsoft? by pandrijeczko · 2006-12-12 10:01 · Score: 2, Insightful

I guess they think you are a complete and total hypocrite, just like I do.
If you're not prepared to pay for their software then you shouldn't be using it, simple. And you would probably be admired more if you had the courage and strength of conviction to go spend the time learning to use an alternative OS in order to make a much clearer statement to Microsoft that you're not prepared to pay the money they ask for their products.
Any fool can download a pirated Windows CD from the Internet, it takes initiative to go learn and legally use an alternative OS.

--
Gentoo Linux - another day, another USE flag.
Re:What about Microsoft? by febuiles · 2006-12-12 16:55 · Score: 1

Pretty harsh words you've got there.

I should start by clarifying you that I've been a Linux user since 2000 according to http://counter.li.org/cgi-bin/runscript/display-pe rson.cgi?user=295182 . Maybe I should tell also tell you that I'm a supporter and programmer for some FOSS, maybe you'll even find that the software you're using has one or two lines I've written. That should qualify me as having "the initiative to go learn and legally use an alternative OS", don't you think?

Sadly enough, I live in a third world country, where deals between universities and big software companies like MS and IBM forces us to use their software. I don't feel like starting to justify myself for using pirated versions of their OS, I know it's wrong, but hey, I am not, as a student, ready to start paying 6 times my salary so these deals can go on and on, it's a dirty way to make business and I won't be part of it.

But aaanyway, who am I to judge the actions of a big American company? After all, they're Microsoft, I should be ashamed of my acts...shouldn't I?

Have a nice day.

PS1: I don't feel like a hypocrite, I see myself as a dirty pirate, with eye-patch and a parrot on the shoulder.
PS2: Neither do I look for admiration in the web, precisely on Slashdot, e-peen size doesn't matter I've heard.
Re:What about Microsoft? by pandrijeczko · 2006-12-12 20:01 · Score: 1

PS2: Neither do I look for admiration in the web, precisely on Slashdot, e-peen size doesn't matter I've heard.
But you've just contradicted yourself - you say you don't look for admiration on the web but in your initial comment you bragged about having the ability to update your illegal copy of Windows, like it is something to be proud of?
Sorry, but simply living in a Third World country does not justify piracy - it's the same the world over, if you don't like the price of something then DON'T buy it or use it, it's that simple; if lots of people do that, then MS has to listen and drop their prices.
I'm mostly a Linux user myself and even in the UK where I am, I personally do not believe MS products are worth the money based on the level of control they take of your PCs - so I just don't use the stuff, beyond what is supplied to me by my work and the single OEM copy of XP I have on one of my machines.
There is no such thing as being "forced" to use anything - very few people require the in-depth functionality of MS Office, for example, and for 90% of people, OpenOffice does more than what they need. The same is true for most other FOSS software, the real reason is that most people are just too damned lazy to have the strength of their convictions and do something about it.

--
Gentoo Linux - another day, another USE flag.
Re:What about Microsoft? by Anonymous+Cowled · 2006-12-12 21:42 · Score: 1

I wonder what Microsoft thinks about this, right now I'm downloading updates that I wouldn't be able to get since I don't use a legal version of their software.

That's plain retarded.

You are able to download security updates from windows update even with a pirated copy and always have been. Hell - you could even use the Devil's own serial key to download security updates, as long as you use automatic updates. WGA just prevents pirated copies going to Windows Update manually and downloading non-security related updates (IE7 or WMP upgrades for example).

This tool is useful for users who want to slipstream these hotfixes into their install disks. If you don't want to slipstream / don't know how - use autopatcher or a similar product. This isn't rocket science.
Re:What about Microsoft? by febuiles · 2006-12-13 03:32 · Score: 1

But you've just contradicted yourself - you say you don't look for admiration on the web but in your initial comment you bragged about having the ability to update your illegal copy of Windows, like it is something to be proud of?

I'm sorry if you misread my original comment, I was NOT trying to brag about getting free updates, I'm actually curious to see what they think about these people offering these downloads this way.

I know that living in a third world country doesn't justify piracty, nothing does, but I still do it and believe it or not, you can be forced to use MS software when you have to develop .NET applications with old IIS and MS SQL Server you don't have too many choices :D

Anyway, I don't think this is the place to discuss this.
Re:What about Microsoft? by febuiles · 2006-12-13 03:35 · Score: 1

You're had to download the genuine advantage software and do all the process for stuff like MSI updates, you _need_ an original version for this.
Re:What about Microsoft? by Anonymous+Cowled · 2006-12-13 04:02 · Score: 1

Again, I would have to disagree with you:

Download "Windows Genuine Advantage Validation Tool" and install this. If you have a pirated copy of XP, it will tell you that your serial is not valid, give you a link to a website where you can buy a legit copy and block you from accessing Windows update manually. From then on - you can set automatic updates to do whatever you want (although as you have a pirated copy - it would be worth while setting to "download, but do not install". Update will tell you when you have *security* updates available, but won't install them until you have reviewed them. It will be worth your while *NOT* installing KB905474 - the "Windows Genuine Advantage Notification Tool". This is the piece of software which reminds you - I think every hour, but I don't know, as I have a genuine copy of XP (as my secondary OS, linux is my primary) - that you do not have a valid copy of XP... but even this is very easy to bypass if you realise how it works and what it does.

Also - there are very easy ways around WPA (for gaining access to IE7 and Media Player updates).

Re:Problem with reg.exe by Jonah+Hex · 2006-12-12 09:23 · Score: 2, Insightful

So what's the point of using a reg.exe from the NT 4.0 resource kit? Rename a self extracting zip to reg.exe?

In short, don't play with strange links posted by anonymous cowards...

Jonah HEX

--
Horror & SciFi Erotic Nudes

Already been done in a better form by cHiphead · 2006-12-12 09:25 · Score: 5, Informative

Its called Autopatcher and its WAYYYY sexier. Lots of installable extras and sexy registry patches to make windows life easier.

http://www.autopatcher.com/

--

This is my sig. There are many like it, but this one is mine.

Re:Already been done in a better form by MCraigW · 2006-12-12 10:49 · Score: 4, Informative

I've been using Autopatcher for quite some time now, and I'm quite happy with it. It also has some extra utilities that it will install if you select them, and the ability to make various UI tweaks. I find it is a nice way to install everything on a new PC. I download the latest version, write it to a CD and take it to the new PC. The new PC never has to be connected to the internet to get the latest MS updates.
Re:Already been done in a better form by sbben · 2006-12-12 10:57 · Score: 2, Interesting

Same with Nlite, located here http://www.nliteos.com/nlite.html/.

I believe a vista version was release as well known as vlite. I have not used either but they look very promising, I have been meaning to try out nlite for the next time I reformat but maybe I will try one of these alternatives instead. Any one out there used them all?
Re:Already been done in a better form by NorQue · 2006-12-12 10:58 · Score: 2, Insightful

If I understood the information on the website correctly autopatcher is just a collection of the latest MS updates from a third party. With the offline update scripts from Heise you're able to create your *own* autopatcher collection from scratch. No middleman involved.
Re:Already been done in a better form by therufus · 2006-12-12 15:45 · Score: 1, Interesting

And while you're into Nlite, make sure you download the RyanVM update pack. It has all the Windows updates up to a few months ago.

After integrating RyanVM, last check there are only 6 updates to do.

Check out Ryan's files here

--
You moved your mouse. Please restart Windows for changes to take effect.
Re:Already been done in a better form by cHiphead · 2006-12-13 07:00 · Score: 1

Which just means you duplicating the effort already put forth by the Autopatcher team? I can understand from a auditable trail/security pov, but so far I have experienced no issues with their patch tool.

Cheers.

--

This is my sig. There are many like it, but this one is mine.
Re:Already been done in a better form by NorQue · 2006-12-13 07:22 · Score: 1

If you're trusting the Autopatcher people, fine. It's just that you can get the same result more secure with just a little bit more effort from that open-source heise script.
Re:Already been done in a better form by cHiphead · 2006-12-13 07:49 · Score: 1

Seriously take a look at what Autopatcher includes, its a lot more than just the integrated patches from MS. Although its nothing you couldn't take care of with a few hours of scripting on your own, Heise or not, and a Group Policy to push it to domain computers, but its very convenient for lazy..XXXX... busy folks like me. ;)

Cheers.

--

This is my sig. There are many like it, but this one is mine.

Re:WGA & Patching pirated copies by Deluge · 2006-12-12 09:39 · Score: 2, Insightful

Yes, there is. Every time MS releases an updated WGA .dll, the pirates release a cracked copy. Shows up all over the place. Download, overwite the files in WINDOWS/SYSTEM32, and presto, no more nags, and you can use Windows Update manually too.

I have a feeling it won't be quite so cut and dried with Vista though.

Torrents by shmlco · 2006-12-12 09:49 · Score: 2, Interesting

"Many exploits work just fine through NAT if you're actually using the machine to surf the web or read email, and way too many people seem to not understand this."

Or connect to a torrent server. Watch the number of attacks on your PC's FW skyrocket the instant you run BT and connect to a tracker. Lot's of hackers run torrent servers just to mine the connection information and find new, unprotected computers to attack.

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.

Stop with the "unpatched PCs are insecure" rubbish by pandrijeczko · 2006-12-12 09:52 · Score: 3, Informative

Anyone with any knowledge of security knows that if you deploy a NAT router/firewall between your unpatched PC and the Internet, whether a simple £50 box in a home environment or behind a DMZ in a corporate environment, then that PC, whether running Windows, Linux or any other OS, is pretty safe as long as you don't run any services out onto the Internet with it and don't do too much else with it. And if you run an Internet connection without one of these in place then more fool you...

On a Windows desktop PC behind a firewall, you are vulnerable to scripts and viruses that it come in from emails, documents & web pages but if you stick the PC on the network and don't use it for any of those things *until* you've put on all the updates, then nothing is going to happen to it. So let's get rid of this stupid notion that the moment you put an unpatched PC on a firewalled LAN, it's going to get swamped with viruses and rootkits - it just won't happen.

No, I'm no Microsoft fan but let's stick to facts rather than "science fiction" FUD stories...

--
Gentoo Linux - another day, another USE flag.

Does it *really* matter? by myz24 · 2006-12-12 09:53 · Score: 1

They say one of the benefits of doing this is updating older systems because of the worms spreading the internet. Does anyone who is working with a windows system and needing to install updates (and one who knows how) even directly connect any computer to the internet? In this day and age, I'd bet that nearly everyone is behind a firewall already.

Re:Trojan Horsey?! Neigh! by greg1104 · 2006-12-12 09:57 · Score: 1

In the rush to be first post, you seem to have missed that all the source code to the tools (and even gpl.txt) are included in their zip file. You need to trust AutoIt to build some of them. I see a few binaries that don't have source included, but they're generic ones like mkisofs.exe and wget.exe that could easily be replaced with trusted versions.

Danger! Danger! by madsheep · 2006-12-12 10:16 · Score: 1

Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.
Right. That's of course if you don't have of one the following:

1) 3rd party firewall on the box
2) the OS's firewall (who says you're installing without an SP?)
3) a hardware firewall
4) a home router/switch that does NAT for you (and of course a home network that's not 0wn3d)
5) IPsec policy on the box preveting connections to the ports
6) File & Print sharing + naughty services turned off.. (anyone out there??)

Yea so those are all pretty good... #6 not being full proof but definitely highly recommended regardless. These CDs might be a good [neat] idea. Then again why not just setup your own WUS box and get your patches from your local LAN while not routing out. That way you can save time, touches, and bandwidth!! wowzers.

Re:Stop with the "unpatched PCs are insecure" rubb by kosmosik · 2006-12-12 10:19 · Score: 2, Insightful

> No, I'm no Microsoft fan but let's stick to facts
> rather than "science fiction" FUD stories...

These are not SF FUD stories. There are a lot of people who:
- don't know shit about security
- don't know shit about patching
- own USB xDSL modem or connect to *untrusted* network with wifi or something similar (do you carry a $50 router with your laptop?)
- use computer to Just Work With it - as a tool - you know

And Windows is not uber-user-friendly there. In fact I think you need to be relatively skilled to set up XP so it is relatively secured. Not something your mom or dad (I assume) can do with their computers.

Recently a friend of mine reinstalled Windows (since it was wrecked to the point of no other option, at least for her) from CDs (sans SP) which came with her laptop. After 1 minute the system was infected and unusable it havent even a slight CHANCE of updating itself.

MS made some stupid decissions few years ago and now they pay the price. This is not FUD. People do not have the latest Vista and so on. Some of them use 5 year old computers since they tend to work for them.

I can surely install old version of Linux distribution or OSX and do not get infected in 10 minutes after connecting to untrusted network.

Re:Stop with the "unpatched PCs are insecure" rubb by pandrijeczko · 2006-12-12 10:36 · Score: 3, Insightful

> These are not SF FUD stories. There are a lot of people who: > - don't know shit about security > - don't know shit about patching > - own USB xDSL modem or connect to *untrusted* network with wifi or something similar (do you carry a $50 router with your laptop?) > - use computer to Just Work With it - as a tool - you know

I agree - but I've set up a number of these NAT routers recently for friends and colleagues, and apart from some simple configuration for ADSL accounts (and some wireless security if needed), these things now work pretty much out of the box. They are a whole heap of good security for little cost that are easy to setup - and protect you from about 90% of the bad things out there on the Internet the moment you switch them on.

And for your information, I carry round a Linux laptop with a fully locked down kernel firewall that I *carefully* open up as I need to if I'm on an unprotected (un-NAT-ed) Internet connection. :-)

> And Windows is not uber-user-friendly there. In fact I think you need to be relatively skilled to set up XP so it is relatively secured. Not > something your mom or dad (I assume) can do with their computers.

I agree again - which is why I recommend a NAT router to anyone I know with ADSL; and if they refuse to buy one, I refuse to offer them any help when their PC goes wrong! :-)

> MS made some stupid decissions few years ago and now they pay the price. This is not FUD. People do not have the latest Vista and so on. Some of them > use 5 year old computers since they tend to work for them.

Again, I agree. But, if anything, Windows 9x didn't have a complete enough IP stack to allow much to be run in the way of services out to the Internet - so it could be argued that unpatched and out of the box, a 9x machine is more secure than XP.

> I can surely install old version of Linux distribution or OSX and do not get infected in 10 minutes after connecting to untrusted network.

It depends on what's out there. Before I moved house last year, on my old ISP I ran an SSH (Secure Shell) server out to the Internet and my log files were filled with scripted access attempts against the server - just pounding away at my server with common account names hoping that one of them would allow entry.

Yes, a secured Linux server is always going to be more secure than a secured Windows server but please don't get complacent about it - it just takes one stupid mistake on either OS and someone will get into it.

--
Gentoo Linux - another day, another USE flag.

Re:encountered (again) another win box without NAT by pandrijeczko · 2006-12-12 10:42 · Score: 1

Today at work a customer showed me the IP the PC had gotten from the DHCP. It was public. I had to tell the person to look for the word NAT in the Router. Had to write it down for her, and tell her to call if she doesn't find it.

But if it was a public (=valid) IP address then it probably just wouldn't work, or not make a great deal of difference, depending on what the NAT routed did. If the NAT router treated it like a private IP address and put the WAN (Internet) IP in the header in it's place, then I don't see there would be any difference in functionality; if it left the public IP in place, then it just wouldn't work because a router somewhere along the way would just route it to the *real* network where that public IP actually is.

Someone correct me if I'm wrong, BTW. I'm a LAN and OS man, not a Cisco or router guru.

--
Gentoo Linux - another day, another USE flag.

Re:Stop with the "unpatched PCs are insecure" by pandrijeczko · 2006-12-12 10:46 · Score: 1

No. But have you nmap'd a Windows install lately from the Internet side of a NAT router, Hawking?

I'm afraid you'd need to have mapped those ports through to the private network on the router first before you saw anything - and in my post I did quite clearly state usage of a NAT router...

--
Gentoo Linux - another day, another USE flag.

Re:Vital... by SEMW · 2006-12-12 10:47 · Score: 1

MS sent out SP2 CDs when it came out to anyone who asked, completely free of charge. They still do it now; you just have to pay shipping. Not to mention MS have *always* offered tools to let you slipstream updates into a custom installation CD.

--
What's purple and commutes? An Abelian grape.

Installed patched OS, same as old OS by AHuxley · 2006-12-12 10:54 · Score: 1

In Capitalist West you burn cd for unsafe consumer operating system.
In Soviet Union unsafe CIA operating system burns you.

--
Domestic spying is now "Benign Information Gathering"

Re:Installed patched OS, same as old OS by PAPPP · 2006-12-12 12:07 · Score: 3, Interesting

One of the best "In Soviet..." jokes I've ever seen, for those not in the know, it refers to some US made technology, most famously pipeline control software, the soviets stole in the early 1980s which was carefully designed to pass QA tests, then go haywire. Suffice to say, the plan worked, and in fact produced the largest non-nuclear explosion seen from space when it took out a large natural gas pipeline in Siberia. A version of the story here.
Re:Installed patched OS, same as old OS by jumpfroggy · 2006-12-12 23:46 · Score: 1

Wow, that was an awesome read! It's like something out of a combination Tom Clancy + 1000 Joke book adventure, but worth the read. Sheds a little light on the zaniness that was the Cold War.

Re:Stop with the "unpatched PCs are insecure" rubb by pandrijeczko · 2006-12-12 10:58 · Score: 4, Informative

PCs behind a NAT router should be given "private" IP addresses - either fixed ones or DHCP assigned ones. These private addresses are in the ranges 10.x.x.x, 172.16.x.x to 172.31.x.x, and 192.168.x.x.

Since every directed IP packet on the Internet contains the sender and receiver IP address, any Internet router that sees a private address in either the source or destination address will drop the packet and not route it. Consequently, no-one on the Internet can get to a PC in the private address range - not only that but there are probably thousands of PCs using anyone of those private IP addresses at any moment in time.

The trick of a NAT router is that when one of your PCs connects through the router to the Internet, the NAT router substitutes the private source IP address in each packet coming from one of those PCs with the real IP address on the Internet side of the router. So when a response comes back from, say, a web server one of your PCs is accessing, the response hits the router's Internet IP and the router puts the private IP address back in to send it back to the right PC.

It is possible to forward incoming connections to the router onto a PC in the private address space but this feature has to be manually configured on the router and is turned off by default.

So, yes, you can still download a nasty email or script from a server on the Internet, even with a NAT router in place - but then you just don't use a PC for those purposes until you've fully patched them.

--
Gentoo Linux - another day, another USE flag.

Re:Stop with the "unpatched PCs are insecure" rubb by pandrijeczko · 2006-12-12 11:04 · Score: 1

I've never used that mechanism in XP so I don't know whether or not it would restrict outgoing connections also? After all, you will need to connect to a web server somewhere to download the updates...

Besides, this is about adding a good *additional* layer of security in a NAT router. Without one, your PC owns the Internet IP address meaning that it's directly exposed to the Internet - with a NAT router, the router has that IP address meaning that your PC only gets stuff that the router allows through.

--
Gentoo Linux - another day, another USE flag.

Dangerous to put an unpatched machine on the net? by NerveGas · 2006-12-12 11:11 · Score: 1

Well, it can be, but doesn't have to. Behind a decently-configured firewall, the machine can download patches without any connections from the outside getting through. YOU might ruin things by initiating connections to non-trusted sources, but that's your fault, not the OS. Of course, the security of other machines on the same network is important, but it's easy enough to maintain a seperate, firewalled network for "fresh" machines, or any sort of machine you're not sure of.

steve

--
Oh, you're not stuck, you're just unable to let go of the onion rings.

Alternate Windows Update method by fostware · 2006-12-12 11:23 · Score: 1

I prefer UpdateHF.vbs

Once you've installed Installer 3.1 and BITS2 , it downloads and installs all the updates from the Windows update site

http://www.wsus.info/forums/index.php?showtopic=68 31

--
"We know what happens to people who stay in the middle of the road. They get run over." - Aneurin Bevan

Re:encountered (again) another win box without NAT by KillerBob · 2006-12-12 11:26 · Score: 3, Informative

With *BSD, it's entirely possible to set up a low-level firewall that offers just as much protection as NAT without actually doing any address translation. It does this by monitoring the traffic at the packet-level, and can be configured to block certain ports, to ignore all unrequested traffic, or any number of QoS-type monitoring/filtering features that are a royal pain in the ass to set up on a NAT box. Really, the biggest advantage of NAT is that the DHCP allows you to have more than one computer on the network. (granted, that's a pretty big advantage).

There's even a howto on NetBSD's website that explains exactly how to go about setting such a box up.

But you're right... generally, it's easier to go with NAT in the long run.

--
If you believe everything you read, you'd better not read. - Japanese proverb

Security is about "survival of the fittest" by pandrijeczko · 2006-12-12 11:31 · Score: 3, Insightful

In response to some of the comments in this topic, a lot of the people on here need to be aware of the fact that OS security is a *process*, not a *goal*. Whether you run Windows, Linux, FreeBSD or whatever, it is very dangerous to assume that just because you have the latest updates installed alongside the latest virus checker, that you are "secure" and can just then sit back and relax.

The unfortunate fact about OS security is that it is a case of "survival of the fittest". It's pretty safe to assume that as long as there is an Internet, then there will be crackers out there trying to break into PCs that sit on the Internet. From their perspective, if they crack open a PC then they are happy and that the longer it takes them to break into a PC, the more likely they are to just give up and try another one.

Consequently, the more "walls" you put in the way of a cracker, the more the chances that you'll reach the limit of his abilities & make him give up. So security is all about doing *multiple* things against attacks - disabling well-known account names, using strong passwords, deploying software firewalls *AND* NAT routers, turning off unnecessary services, tightening the configuration of needed services to only allow certain hosts to access... these are all *ADDITIONAL* steps to just applying software updates.

Sure, a lot of these processes are tricky for new users but a lot of them are also very simple to deploy - and any of those that you do deploy put you one step ahead of the people who don't deploy them and who are, consequently, put at more risk from attack by crackers.

--
Gentoo Linux - another day, another USE flag.

Re:encountered (again) another win box without NAT by pandrijeczko · 2006-12-12 11:36 · Score: 1

I'm not a *BSD user but is this any different to what the Linux kernel does with iptables & netfilter?

I am genuinely interested because I've deployed Linux boxes (successfully) as firewalls in a few SOHO environments - but if BSD does an even better job of it then I'll definitely need to go take a look at it.

--
Gentoo Linux - another day, another USE flag.

Re:Stop with the "unpatched PCs are insecure" rubb by donatzsky · 2006-12-12 12:09 · Score: 1

While you're absolutely right that an unpatched PC should be behind a firewall/NAT, the trouble of course is that quite often this is not "possible".

Case in point: A few months ago my mother got a shiny new ADSL connection. Since it's a triple-play (net, tv and phone over ADSL) offering it comes with a ok router; nothing spectacular, but I've seen worse, and thus I thought everything was fine (not!). A week or so later her connection basically went down (you'd have to be lucky to get on-line), also IE windows began popping up (pushing some scum-ware called SystemDoctor2006) this despite the fact that she's using Firefox. Yes, she had a virus, and it had gotten in from the internet without the need for IE.
It turned out that the router was set up to put the PC in the DMZ (probably to save the ISP from support calls asking why Bit Torrent isn't working properly), thus exposing it to $Deity knows what. The morale therefore being that routers may NOT be set up properly for security thus exposing the PC even when you think it's secure.

The ISP, by the way, is Neuf (http://www.neuf.fr), so if you know someone that uses them be nice and check their router configuration.

(If it seemed a bit confused: It's 01.00 here, I'm Danish, have a slight cold, am tired and about to go to bed. YAY!)

--
VPS-like shared hosting, on under-crowded servers.

Another by Shawn+is+an+Asshole · 2006-12-12 12:24 · Score: 1

Here is another script for slipstreaming updates into an ISO:

http://smithii.com/slipstream_xpsp2

I use it for my unattended share. Works great.

--
"It ain't a war against drugs.it's a war against personal freedom" --Bill Hicks

Re:Stop with the "unpatched PCs are insecure" rubb by RobertLTux · 2006-12-12 12:26 · Score: 1

nat/firewall is like a one way mirror on the 1 side its transparent on the other side its a mirror.

If you try to shoot a target on the other side you don't know
1 who is on the other side
2 how many whos are on the other side
3 what configuration the whos are (any cops/feds/military dudes wearing what)
4 where which who is

plus if the "mirror" is any good its also tempered/Bulletproof so you would need armour peircing bullets

--
Any person using FTFY or editing my postings agrees to a US$50.00 charge

Re:Not a clever move for MS... by RobertLTux · 2006-12-12 12:34 · Score: 1

this would be about as bad as going to octoberfest getting BLASTED and then going down the autoban with the pedal to the metal and playing chicken with a semi (or an M1-A1) driving a RABBIT

--
Any person using FTFY or editing my postings agrees to a US$50.00 charge

Re:Vital... by lagfest · 2006-12-12 12:37 · Score: 1

Unfortunately, these tools aren't exactly automated.

/please tell me I'm wrong.

Re:Vital... by SEMW · 2006-12-12 13:05 · Score: 1

Well, it's not completely automated, no. It does involve typing a few commands into a command prompt (six in total); but that shouldn't really be a problem for most of the people on Slashdot. Full instructions here (it looks like quite a long page, but the bottom 2/3 is just screenshot-by-screenshot guide on how to burn a bootable CD in 3 different CD burning programs, so it's not as long as it looks).

--
What's purple and commutes? An Abelian grape.

Re:Vital... by lagfest · 2006-12-12 13:24 · Score: 1

Yeah okay, but that's for one update. There's between 2^5 and 2^6 updates out for windows xp since sp2, so that gets boring really fast.

Re:WGA & Patching pirated copies by Sneakernets · 2006-12-12 14:11 · Score: 1

I have a feeling it won't be quite so cut and dried with Vista though.

Why? Never underestimate the power of piracy. Remember how "secure" WinXP was supposed to be? in a few weeks, a WPA killer was already making the rounds? WGA killers ABOUND.
Piracy has been around forever and always will. A huge company in Redmond won't be changing that.

--
"No freeman shall ever be debarred the use of arms." -- Thomas Jefferson

Mod parent up by VGPowerlord · 2006-12-12 14:36 · Score: 1

The only special software I needed was to rip the floppy boot image from the original Windows CD so I could boot from the CD.

--
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011

Concept is great, execution is poor. ERRORs by Kazoo+the+Clown · 2006-12-12 15:18 · Score: 1

I just tried it, selected Windows 2K english, per selected platform. It instantly pops up a CMD window with a wget error:

Starting download (v. 3.02)
Copying Microsoft registry console tool...
Downloading Microsoft ifmember tool...
Can't timestamp and not clobber old files at the same time.
Usage: wget [OPTION]... [URL]...

ERROR: Download failure.

Press any key to continue . . .

Looking at the components it's not clear if there's an erroneous parameter passed to wget or something, as several things are less then obvious-- what the error means, exactly what wget command it's trying to run, etc.. No log file in sight... Not looking good...

Re:encountered (again) another win box without NAT by KillerBob · 2006-12-12 15:31 · Score: 1

BSD has the ability to firewall just like Linux with iptables/netfilter. What I'm talking about is a different ability, though. You can set it up at the hardware bridge mode, to set up an invisible firewall. One of the great features is in forcing everybody on the net to use your proxy server... you can tell it that if outbound traffic on port 80 doesn't originate from 192.168.1.5, for example, then it gets redirected to 192.168.1.5:8080. It's a great way to stealthily force your entire network to use a proxy without having to manually configure it in every computer.

I *think* that's the real reason that the system was developped. But it also makes a great way to set up firewalling: all inbound traffic on all ports can be ignored, redirected to your DMZ host, or treated however you want. It's also able to do it transparently, so you could simply drop an appropriately configured NetBSD box between your existing gateway and the world. Not a lot of point in doing it that way, though. As I said, the real advantage is in being able to quietly force traffic to go through proxies of your choice.

--
If you believe everything you read, you'd better not read. - Japanese proverb

no room for discs.... by asmjunky · 2006-12-12 16:22 · Score: 1

that's all fine and dandy, but we may have to wait for these

use your Mac to download the updates by swell · 2006-12-12 17:25 · Score: 1

Then reboot in Windows to install them.

Someday there will be threats to the Mac OS, so you can download the Mac updates from the Windows half of your Mac...

--
...omphaloskepsis often...

Re:Stop with the "unpatched PCs are insecure" rubb by Eskarel · 2006-12-12 17:26 · Score: 1

Actually I connected a freshly reinstalled XP box up to the internet(my disk is really old so it's pre SP1 and I didn't have a copy of SP2 lying around), without installing the firewall and AV software before I connected to the internet(I was tired and stupid at the time). On 8/1 ADSL my PC was pwned to the point that I couldn't download any files(including spyware scanners) that weren't corrupted before I could finish getting the windows updates. This was through a NAT router with no open ports. Without at least SP2 preinstalled NAT won't save you. A virus scanner and a reasonable software firewall plus NAT will, but not just NAT, and I'm far from ignorant about computers.

NT4 Revised Service Pack 6A by os2fan · 2006-12-12 19:42 · Score: 1

I made a service pack 7 for Windows NT some while ago, but it is still in late alpha. When this installs, it does so as "Revised service pack 6A". Still, i use one further patch file to deliver updates, like the 2k3 NTLOADER / NTDETECT.COM, sol.exe and cmd.exe from Windows 2000, and a few other "fixes".

There are, none the same, a number of useful projects to slipstream fixes etc into both OS/2 and Windows.

One might for OS/2, try UPDCD, and compare this with the various Windows versions: NLITE, HFSLIP, and USP5 for Win2k. The UPDCD, NLITE and HFSLIP projects are multi-versions, while USP5 is for 2000 only.

Windows 3.1 did not check any files, and one has always been able to update the stuff. I managed to add all of the fixes to PC-DOS 6.31, once one gets a hold of compress.exe v 1.0.

--
OS/2 - because choice is a terrible thing to waste.

Re:Problem with reg.exe by os2fan · 2006-12-12 19:54 · Score: 1

REG.EXE is supplied in the Win2k support tools (on the Win2k cd-rom), or in the base install of Windows XP and later.

The reg_x86.exe is actually a winzip file (it can be opened in any zip utility), the relevant file contains reg.exe, along with a readme file (suggesting the file goes to c:\reskitnt). I have been incliding reg.exe in the various update files etc.

--
OS/2 - because choice is a terrible thing to waste.

Re:Stop with the "unpatched PCs are insecure" rubb by evilviper · 2006-12-12 20:39 · Score: 2, Informative

Consequently, no-one on the Internet can get to a PC in the private address range - not only that but there are probably thousands of PCs using anyone of those private IP addresses at any moment in time.

People keep repeating it, but it's just not true. It is TRIVIALLY easy to send packets to private addresses behind an open NAT.

First off, the way in which packets sent to a NAT box disappear is like waving a big red flag that says "NAT". Then all it takes is a little bit of forging of header address, and a couple packets, and you can discover the exact addresses of all the machines on the private net, and send whatever you want to them.

The two ways I like to explain it (for brevity) is source routed packets, and gateways.

Sequentially ping the broadcast addresses of the private networks (like 10.255.255.255) setting a source-route of the public IP address of the NAT box. The routers between the two of you will forward the packets to the NAT box. Then, being the good little router it is, it will see the packet is supposed to go to the private network, and forward it there. The ICMP replies will be sent back to you, and you now have a list of (most of) the running systems behind the NAT. Now you can send whatever payload you want, to any one of those privately-addressed machines.

Another very simple way (which gets around blocked source-routed packets) is to get an address on the same public subnet as your target. Most providers have their public addresses grouped in a /24 subnet, or larger, which gives you at least 253 chances. That should be trivially easy to accomplish, and is left as an exercise for the reader. Once you've done that, all you have to do is set your default gateway as the NAT box's public IP, and you can just directly address all those machines by their private address, directly. No skill needed at all. The NAT box is only too happy to forward your packets, and return the replies.

Needless to say, there are many, many other ways to trick the NAT into forwarding packets to the privately addressed machines, but they are a bit too involved for a short post on /. Suffice it to say, NAT is common enough that I suspect a very large number of crackers have automatic routines to penetrate them, and your NAT isn't going to even slow them down.

For about two decades now, it has been trivially easy to setup a machine to do stateful packet filtering, which actually WILL stop penetration attempts. There's no reason NOT to do it. And for any kind of security, that's precisely what you need.

The warm fuzzy feeling you get with a NAT box, because you're ignorant of how easy they are to bypass, won't stop your computers from being turned into zombies.

--
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant

Re:autopatcher + nlite by Anonymous+Cowled · 2006-12-12 22:35 · Score: 1

Can you use autopatcher + nLite in tandem? I want to use nLite to customize my windows cd by installing all the applications I use automatically. I want to use autopatcher to apply the updates. How do I do this, what I just said?

You can, but you have to install autopatcher first (I would imagine on the build that you're going to create the "nLitened" install disk), then navigate to the program directory and manually copy the hotfixes (which are in individual folders for each hotfix...) to a suitable single directory location. It will be much easier with this script, though - as they will already be in one location.

You can also add whatever application you want to the $OEM$ folder and create a batch to run them on first boot, but you'll most likely have to remove some of the components from the original cd if you want to put a few things on there (languages and keyboard layouts are best - you'll get about 80 MB). You can of course use one of the presets, but I wouldn't recommend this. I used the "safe" preset once, added my drivers and hotfixes and it removed my IDE drivers - so even though it installed from cd, when I booted into Windows (I only have SCSI and SATA HDs), I had no CD/DVD drives!!!

Do these qualify as SP2 versions for Boot Camp? by bjb · 2006-12-13 01:52 · Score: 1

One of the things that has been putting me off from trying Boot Camp is that I have to re-purchase Windows XP to get it with SP2 on the disc (the machine I used this copy on has been decomissioned for now and I haven't built a replacement). I'm wondering if doing this would produce a disc that would work with Boot Camp or Parallels?

--
Never hit your grandmother with a shovel, for it leaves a bad impression on her mind...

XP SP3 / Vista SP1 by cafucu · 2006-12-13 08:30 · Score: 1

XP service pack 3 and Vista SP1 Beta can be downloaded here then installed offline. Remember to choose the "alternate install" ISO.

--
:%s:work:/.:g

Slashdot Mirror

DIY Service Pack For Windows 2000/XP/2003

148 of 197 comments (clear)