Slashdot Mirror
Microsoft 'Stealth Update' Proving Problematic
DaMan writes "According to the site WindowsSecrets, the stealth Update that Microsoft released back in August isn't quite as harmless as the company claims. The site's research has shown that when users try to do a repair to XP subsequent to the update, bad things happen. 'After using the repair option from an XP CD-ROM, Windows Update now downloads and installs the new 7.0.600.381 executable files. Some WU executables aren't registered with the operating system, preventing Windows Update from working as intended. This, in turn, prevents Microsoft's 80 latest patches from installing -- even if the patches successfully downloaded to the PC.' ZDNet's Hardware 2.0 has independently confirmed that this update adversely affects repaired XP installations: 'This issue highlights why it is vitally important that Microsoft doesn't release undocumented updates on the sly. Even the best tested update can have unpleasant side-effects, but if patches are documented properly and released in such a way that users (especially IT professionals) know they exist, it offers a necessary starting point for troubleshooting.'"
Duh. Undocumented updates cause problems. In related news, failure to check for a buffer overflow causes software bugs.
My blog
"I will gladly patch you Tuesday for something I broke today."
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
"Nice PC you have here. Shame if something were to happen to it..."
Slashdot Burying Stories About Slashdot Media Owned
This is the reason I support and use Linux. It started as a hobby, something to do with old equipment. But, now it's because of disclosure. I know what is being installed, and can choose when to update, what to update, and, If I've the time and inclination, I can take the update apart, see what it's doing, and even modify part of it.
Microsoft doesn't allow me this, and continues to fail to predict the negative consequences resulting from these choices. Apple at least gives me the option of installing an update, even though they have a bad record on the full disclosure thing too.
A positive attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.
Wasn't it for windows update to "work properly" that those patches were released? Way to go MS, foot in mouth, lather, rinse, repeat...
A dozen system files have been updated as part of this undocumented stealth update... and yet not a single antivirus software reported this. Why?
How do these antivirus programs know for sure that these updates were 'harmless' and 'normal behaviour'.
In light of this revelation, I think corporates must now take action against these antivirus firms for not preventing this breach. Let's see what Microsoft has to say to this 'harmless' update that allows users to 'know and be informed of further updates'. A Media Defender style expose' of internal communications on this issue would be very interesting indeed.
If you keep throwing chairs, one day you'll break windows....
Maybe they forgot to rinse.
The lather-repeat caused a buffer overflow.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
"But at least Windows doesn't require you to go to the terminal and type cryptic and scary commands just to fix little problems..."
- oft-heard criticism of Linux
How fucking dare anyone out there make fun of Microsoft after all it has been through?
Its stock price has stagnated. Google made Steve Ballmer mad. He threw two fucking chairs.
Ray Ozzie turned out to be a blogger, and now he's posting a bunch of comments. All you people care about is readers and making money off of them.
It's a corporation! What you don't realize is that Microsoft is making you all this money and all you do is write a bunch of crap about it.
It hasn't made a good OS in years. Its spreadsheet is called "excel" for a reason because all you people want is EXCELLENCE! EXCELLENCE! EXCELLENCE!
LEAVE IT ALONE! You are lucky it even makes products for you bastards! LEAVE MICROSOFT ALONE!
Please!
CmdrTaco talked about professionalism and said if Steve Ballmer was a professional he would've monkey danced no matter what.
Speaking of professionalism, when is it professional to publicly bash a company who is going through a hard time?
Leave Microsoft alone, please.
LEAVE MICROSOFT ALONE RIGHT NOW. I MEAN IT.
Anyone that has a problem with it you deal with me, because it is not well right now.
LEAVE IT ALONE!
from here: http://bash.org/?464385
Whereas documented updates are magically OK?
OK, OK, that's not really what you meant, and it's not your point
=====
If you ask me, the real problem is updates. Let's say that one update in 50 is significantly defective -- which is, IMHO, quite optimistic. Let us further guess that 50% of the defective updates introduce new unexpected problems rather than failing to (fully) fix the existing problem -- they do test these things. At least I hope they do. What is likely to get past testing is errors in areas that no one thought would be affected. Lets assume that there are 10 updates a week on average, and that the average time from first report to fix is four weeks.
If you just uncritically load updates, you'll download new grief every 10 weeks or so and take four weeks to get it fixed. that means that five times a year, you'll unwittingly install a significant new problem and that about 40% of the time you'll be living with one or more of these things.
IMO, the best strategy -- at least for larger operations -- is to evaluate each and every patch, and to load only those which seem absolutely necessary. Even that is not going to work all the time.
As for updates that you aren't asked about... A truly bad idea. Hopefully Microsoft and other operations that believe in automatic updates will learn their lesson from this relatively modest (we hope) fiasco and will never ever do THAT again. Memo to organizations that do that. If your QA -- who are overworked, underpaid, and probably need a vacation -- screws up at the wrong time and you put an important business sector offline for days or weeks, you are looking at a major league class action suit. Don't expect the shrinkwrap EULA to protect you.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
You have zeroed in on the heart of this problem with laser like precision. I couldn't agree more.
If you run a business on an OS you need to know the details of upgrades. You need to test all upgrades against your production machines before applying the upgrade.
I am not talking about a home desktop, or even a corporate desktop system here. Think about computers used to control water or fuel delivery. Maybe a system that reconciles ATM transactions at a bank, or adjusts inventory databases from sales at retail locations, or the automated system that routes calls to a city's 911 emergency center.
Businesses and Governments depend on many customized pieces of software day in and day out. All software changes must be tested and shown to have no ill effects before thay are applied to enterprise production systems.
Any OS that does not allow the user to control the application of patches and updates, and instead updates systems by stealth, is not ready for the enterprise.
Think about the problems that could result if people use an OS like Windows in misssion critical applications that involve lives.
Even if lives are not involved businesses cannot tolerate amateur stunts like stealth patches from an OS vendor. They could lose billions of dollars trying to find out the cause of a problem.
This highlights how out of touch Microsoft is with the needs of enterprise level customers.