Slashdot Mirror
Microsoft 'Stealth Update' Proving Problematic
DaMan writes "According to the site WindowsSecrets, the stealth Update that Microsoft released back in August isn't quite as harmless as the company claims. The site's research has shown that when users try to do a repair to XP subsequent to the update, bad things happen. 'After using the repair option from an XP CD-ROM, Windows Update now downloads and installs the new 7.0.600.381 executable files. Some WU executables aren't registered with the operating system, preventing Windows Update from working as intended. This, in turn, prevents Microsoft's 80 latest patches from installing -- even if the patches successfully downloaded to the PC.' ZDNet's Hardware 2.0 has independently confirmed that this update adversely affects repaired XP installations: 'This issue highlights why it is vitally important that Microsoft doesn't release undocumented updates on the sly. Even the best tested update can have unpleasant side-effects, but if patches are documented properly and released in such a way that users (especially IT professionals) know they exist, it offers a necessary starting point for troubleshooting.'"
Duh. Undocumented updates cause problems. In related news, failure to check for a buffer overflow causes software bugs.
My blog
Why not just let everyone patch their systems, and shut off the "non genuine" check or whatever is blocking this? Why wouldn't you want people to patch the systems? Doesn't an unpatched and infected system equate more directly to lost revenue than a "non-genuine" flagged system?
stuff |
"I will gladly patch you Tuesday for something I broke today."
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
I guess their focus & therefore resources will switch more and more to Vista, so this kind of thing will probably happen with increasing frequency.
This is the reason I support and use Linux. It started as a hobby, something to do with old equipment. But, now it's because of disclosure. I know what is being installed, and can choose when to update, what to update, and, If I've the time and inclination, I can take the update apart, see what it's doing, and even modify part of it.
Microsoft doesn't allow me this, and continues to fail to predict the negative consequences resulting from these choices. Apple at least gives me the option of installing an update, even though they have a bad record on the full disclosure thing too.
A positive attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.
Wasn't it for windows update to "work properly" that those patches were released? Way to go MS, foot in mouth, lather, rinse, repeat...
A dozen system files have been updated as part of this undocumented stealth update... and yet not a single antivirus software reported this. Why?
How do these antivirus programs know for sure that these updates were 'harmless' and 'normal behaviour'.
In light of this revelation, I think corporates must now take action against these antivirus firms for not preventing this breach. Let's see what Microsoft has to say to this 'harmless' update that allows users to 'know and be informed of further updates'. A Media Defender style expose' of internal communications on this issue would be very interesting indeed.
If you keep throwing chairs, one day you'll break windows....
I'm not sure what the answer is, but someone has got to work out better technology for designing and updating operating systems. For thirty years now, we've had operating systems that only work as perfect integrated wholes, and operations called "installation" and "uninstallation" and "updates" and "patches" which are basically ad-hoc processes for which the operating system offers relatively little support.
Everything depends on everything else. After a few years of updates and software installation, whether on Windows or Mac OS X (no, I can't speak to Linux so if Linux solves all these problems I plead ignorance), almost every system is in a slightly broken state, and you just hope it isn't intolerably broken. Talk to any average mom 'n dad and they'll say "Things that used to work fine on our computer aren't working any more, I guess it's just time to buy a new computer."
Some new way of building operating systems is needed that reduces the interdependence of its components.
"How to Do Nothing," kids activities, back in print!
I ran into this a couple of weeks ago. When the attempt to use update.microsoft.com fails, the "troubleshooter" will direct you to a Knowledge Base article that advises you to do the following:
At the command prompt, type the following commands, press ENTER after each command, and then click OK every time that you receive a verification message: regsvr32 wuapi.dll
regsvr32 wuaueng1.dll
regsvr32 wuaueng.dll
regsvr32 wucltui.dll
regsvr32 wups2.dll
regsvr32 wups.dll
regsvr32 wuweb.dll
Once that is done, you'll be able to use Microsoft Update again.
Maybe they forgot to rinse.
The lather-repeat caused a buffer overflow.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
I'm actually in the process of upgrading a windows 2000 image to XP Pro (no, it can't be a clean install, it's a long and dull story), and got bit by this bug. When I searched for the error number associated with the windows update failure on technet, I did come up with technet article explaining how to register the windows update dll's to fix it (as also listed in the linked article). I just assumed it was an odd bug because of all the cruft in the windows 2000 install.
Now I find out it's because of a broken secret mandatory update to the DRM that breaks windows update altogether. Nice one Microsoft!
I had another bug after that windows update, http://support.microsoft.com/kb/883821
That took a lot longer to fix, as none of those listed fixed it. Perhaps that was also related? Lovely.
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
But earlier this year I had to allow a client's machine to use an XP service patch or be have to tell the user that the machine would be out of warranty both from the OEM and Microsoft.
The patch (SP2) froze the computer completely after an aborted install that the screen recorded as having been successfully uninstalled. It took nearly 20 hours of non-stop attempts plus two service calls to avoid having to wipe the disk -- which was not an option -- and afterwards the "Genuine Advantage" program still wants more updates.
Not surprisingly, I won't be recommending Microsoft on their next desktops. Ubuntu will be fine.
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
I thought this was because of Skype, Windows Media Player, VLC Player or Real Player. I installed new versions of all of these apps but this did not help. I struggled with this problem and found little help, even from Microsoft itself. The good thing is that Windows XP has a [neat] feature that rolls the system back to its previous configuration. This is what I used and had this problem solved.
But I then wondered whether we in the Linux world have anything comparable to the feature that helped me roll back my settings in Windows XP Professional. I haven't found one! Have I looked hard enough of am I looking in the wrong places?
Do these people realize that the ENTIRE POINT of Microsoft forcing the Windows Update patch was to make sure that future updates would trigger whatever policies the user had selected for the machine?
In other words, if Microsoft had not updated Windows Update automatically, and a user had chosen to be notified of future updates, these notifications would not work. The only way to ensure that the user's settings were properly respected was to update Windows Update.
So now this article says that the silent update wasn't harmless because Windows Update was broken after they did a restore. Do they realize that without this update, Windows Update *definitely* wouldn't work, and that the fact that this update may have a bug in it regarding restoration is completely besides the point?
Should Microsoft have made it more clear that they were doing an update? Yes. Is this update proof of Microsoft's desire to ignore user preferences and do whatever the hell they want? Obviously not.
How fucking dare anyone out there make fun of Microsoft after all it has been through?
Its stock price has stagnated. Google made Steve Ballmer mad. He threw two fucking chairs.
Ray Ozzie turned out to be a blogger, and now he's posting a bunch of comments. All you people care about is readers and making money off of them.
It's a corporation! What you don't realize is that Microsoft is making you all this money and all you do is write a bunch of crap about it.
It hasn't made a good OS in years. Its spreadsheet is called "excel" for a reason because all you people want is EXCELLENCE! EXCELLENCE! EXCELLENCE!
LEAVE IT ALONE! You are lucky it even makes products for you bastards! LEAVE MICROSOFT ALONE!
Please!
CmdrTaco talked about professionalism and said if Steve Ballmer was a professional he would've monkey danced no matter what.
Speaking of professionalism, when is it professional to publicly bash a company who is going through a hard time?
Leave Microsoft alone, please.
LEAVE MICROSOFT ALONE RIGHT NOW. I MEAN IT.
Anyone that has a problem with it you deal with me, because it is not well right now.
LEAVE IT ALONE!
The thing about this "stealth update" that riles me up is that it's indicative of the patronizing, "we know better than you" attitude that Microsoft has towards its customers. They just decided that anyone running Windows would get this update and that's that. Now, wonder of wonders, it's causing problems. Does anyone really think that they'll address this problem in a reasonable, responsible way? Or will they just release ANOTHER patch at 3:00 in the morning to fix the first one?
This unbiased moderation brought to you by the Porcine Aviation Group!
Then wouldn't it be in Microsoft's best interest to ship all installable releases with deliberately deficient code? This way they virtually guarantee that the end user will connect for an update. In a way they are already doing this with manditory activation (some features turn off if Windows is never "activated").
FTFA:
"This, in turn, prevents Microsoft's 80 latest patches from installing -- even if the patches successfully downloaded to the PC."
That the trouble I had recently! A few weeks ago, a friend asked me to clean up three of her family computers that were crawling with spyware/adware, and trojans, as well as upgrade them from WinXP Home to WinXP Pro. I got them cleaned up fine, and did the upgrade. After booting to the desktop the first time, I ran Windows Update to grab the latest patches. On all three machines, WU would install some needed components, reboot, download all outstanding patches (approximately 80+), and then fail on the install on every single update.
Windows Update would NOT run without erroring out. It took me a few hours to realize I had to manually re-register all of the components for windows update, after which I also had to delete ALL of the downloaded patches, as well as all of the $NTUninstallKBXXXXX stuff.
Then again, maybe I just did the update wrong three times in a row?
And it should be obvious to anyone who knows the company... upgrade to Vista, and you won't have to worry about repairing your XP installation anymore!
Who says this is an -unintended- side effect?
The stealth "upgrade" will make XP quite unstable. And MS will just say, XP has been end-of-lifed and Vista upgrade will fix the problems. Then Wall Street will get comfortable numbers about Vista sales. Things will continue as normal.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
What a long winded way to say the Windows update is such a horrible mess it isn't funny.
Me, I like rolled up file based updates. Download it and save it off. When the beta testers say it is OK, I apply. I have earned with over 20 OSes behind me that you patch to point in time from proven groups of patches. This idea of "auto" update is so fundamentally flawed...
Whereas documented updates are magically OK?
OK, OK, that's not really what you meant, and it's not your point
=====
If you ask me, the real problem is updates. Let's say that one update in 50 is significantly defective -- which is, IMHO, quite optimistic. Let us further guess that 50% of the defective updates introduce new unexpected problems rather than failing to (fully) fix the existing problem -- they do test these things. At least I hope they do. What is likely to get past testing is errors in areas that no one thought would be affected. Lets assume that there are 10 updates a week on average, and that the average time from first report to fix is four weeks.
If you just uncritically load updates, you'll download new grief every 10 weeks or so and take four weeks to get it fixed. that means that five times a year, you'll unwittingly install a significant new problem and that about 40% of the time you'll be living with one or more of these things.
IMO, the best strategy -- at least for larger operations -- is to evaluate each and every patch, and to load only those which seem absolutely necessary. Even that is not going to work all the time.
As for updates that you aren't asked about... A truly bad idea. Hopefully Microsoft and other operations that believe in automatic updates will learn their lesson from this relatively modest (we hope) fiasco and will never ever do THAT again. Memo to organizations that do that. If your QA -- who are overworked, underpaid, and probably need a vacation -- screws up at the wrong time and you put an important business sector offline for days or weeks, you are looking at a major league class action suit. Don't expect the shrinkwrap EULA to protect you.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
I believe the reference is to how well Windows 98 (and 98 SE) was received by Windows 95 users (98 offered lots of good fixes and new features over 95) as opposed to how poorly Windows Vista is being received by Windows XP users (since it doesn't really offer any must-have features or bug fixes).
Portable versions of Firefox, GIMP, LibreOffice, etc
You have zeroed in on the heart of this problem with laser like precision. I couldn't agree more.
If you run a business on an OS you need to know the details of upgrades. You need to test all upgrades against your production machines before applying the upgrade.
I am not talking about a home desktop, or even a corporate desktop system here. Think about computers used to control water or fuel delivery. Maybe a system that reconciles ATM transactions at a bank, or adjusts inventory databases from sales at retail locations, or the automated system that routes calls to a city's 911 emergency center.
Businesses and Governments depend on many customized pieces of software day in and day out. All software changes must be tested and shown to have no ill effects before thay are applied to enterprise production systems.
Any OS that does not allow the user to control the application of patches and updates, and instead updates systems by stealth, is not ready for the enterprise.
Think about the problems that could result if people use an OS like Windows in misssion critical applications that involve lives.
Even if lives are not involved businesses cannot tolerate amateur stunts like stealth patches from an OS vendor. They could lose billions of dollars trying to find out the cause of a problem.
This highlights how out of touch Microsoft is with the needs of enterprise level customers.