Slashdot Mirror
Tuesday Was Microsoft's Last Non-Cumulative Patch (helpnetsecurity.com)
There was something unique about this week's Patch Tuesday. An anonymous Slashdot reader quotes HelpNetSecurity:
It was the last traditional Windows Patch Tuesday as Microsoft is moving to a new patching release model. In the future, patches will be bundled together and users will no longer be able to pick and choose which updates to install. Furthermore, these new 'monthly update packs' will be combined, so for instance, the November update will include all the patches from October as well.
Last month a Slashdot reader asked for suggestions on how to handle the new 'cumulative' updates -- although the most common response was "I run Linux."
Last month a Slashdot reader asked for suggestions on how to handle the new 'cumulative' updates -- although the most common response was "I run Linux."
Wait -- since it's a cumulative update, are we going to call them 'batch Tuesdays' from now on?
I think if the patches are bundled together now - you basically have to treat them as one larger patch. In other words, nothing changes except any time you find you did one and it breaks something, you roll the whole collection back until it can be rectified.
IMO, Microsoft's Windows Updates have been a huge, overly confusing mess for a long time anyway. I used to use WSUS to centrally administer them and for our small to mid-sized company, it became more trouble than it was worth. I like the advantage that you only have to download the patches once to the central WSUS server and then all the clients grab copies from there to save your Internet bandwidth. But in practice, our workforce is mobile enough that it's almost better we just let their laptops grab updates over the net from wherever they're at so they get patched more quickly.
Sifting through all of their patches and deciding when it was safe to "release" them was getting to be way more time-consuming for I.T. than it should have been. So often, you have slews of patches that wind up marked "superseded" by other patches, and there are weird dependencies too. Can't do certain patches unless you've done others first. (Why not automate all of that so any patch dependent on another one just auto-applies the required one as part of its installation?)
If you do a fresh install of Windows 7 these days? The update process is PAINFUL! You'll literally need to leave the PC downloading updates for a good 8-10 hours or more before it finally starts doing anything obvious. (It seems that it needs so many individual patches to get current, it overwhelms their updater service trying to sort through all of it and prepare to download them in the proper order?)
"You want security patches? Welp, you're gonna have to accept Telemetry too."
Which modern variant are you using that you have conflicts of this kind?
The world's burning. Moped Jesus spotted on I50. Details at 11.
>"Last month a Slashdot reader asked for suggestions on how to handle the new 'cumulative' updates -- although the most common response was "I run Linux.""
Yep, still run Linux...
I install whatever I want, whenever I want, however I want, on what I want. My machine belongs to me.
good to fix the 2-3 reboot passes to get systems up today + all of the optional stuff that does not auto install.
Also all of the hot fixes as well.
The hosts file is already circumvented by Microsoft.
If you really want to solve this then it's to force Microsoft to change every IP address they are associated with.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Will there still be zero day fixes?
As in small updates for just that one fix mid mouth? and then for full one at the end of mouth?
Can we get something like windows 10.01 10.02?
Or Windows 7 sp2 or SP1.5
Windows 8.2 or 8.1.5?
For general information, if you're installing a fresh Windows 7 now (starting from SP1, presumably) then it seems by far the fastest way to get a system reasonably well patched is to install the Convenience Rollup (KB3125574) and if necessary its prerequisite (KB3020369) from the Microsoft Update Catalog. That immediately brings you up to somewhere around April 2016 in terms of patch level, and you can download the required files quickly from the Catalog site and then install them locally using WUSA without waiting around for hours while Windows Update does whatever its current broken mess needs to do now. The most recent time I did this was just a few days ago, and after doing that it was then another couple of hours for Windows Update to find the rest and install the remaining security updates, but at least it could be done in an afternoon instead of leaving the new PC overnight and hoping it might have found something by the morning. Spybot Anti-Beacon or some similar tool can still turn off the various telemetry junk that you can't now individually because it's all bundled into the CR update.
Incidentally, for those who would prefer to keep security patching their existing Windows 7 systems but not get anything else, there are reportedly (direct from a Microsoft source) going to be monthly security-only bundles as well, but you'll have to get those from Microsoft Update Catalog manually as well, they won't be advertised or pushed out through Windows Update. So it looks like the new SOP is to turn off Windows Update entirely (as a bonus, you get back that CPU core that's been sitting at 100% running the svchost.exe process containing the Windows Update service for the last few months) and instead just go along and manually download the security bundle each month to install locally.
Of course, Microsoft Update Catalog requires Internet Explorer 6.0 or later and won't run with any of the other modern browsers, but I'll live with using IE to access it if it means I get security-patched but otherwise minimally screwed up Windows 7 machines for another 3 years.
Also, it's been confirmed that this policy will apply to all editions of Windows 7. It's not an Enterprise-only feature and doesn't require the use of WSUS etc. Let's hope they stick to their word on this one.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Which modern variant are you using that you have conflicts of this kind?
Well to be fair I did have a conflicting package in Fedora 24 (the only one I have ever had with this distribution) a few weeks ago and my options were 1) Update all other packages except the offending package. 2) Remove the offending package and reinstall at a later date. 3) Wait about two days for the issue to be fixed.
As least with Linux you have options so a two-day wait was not a big deal and also the package that I had the update issue with was one that I rarely used, but even so if I chose options "1" or "3" I could still use the full functionality of the package, it's not as if the conflicting package stopped working.
BTW. The AC comment was a troll since the did not appear to have a clue.
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
So what exactly are they going to do? Are we going to download the entirety of updates that have ever been released for Windows every month? That seems like a crazy waste of bandwidth, especially for people with slow or capped connections.
-=This sig has nothing to do with my comment. Move along now=-
Does anyone know what will happen to those of us deferring upgrades? I got weird errors and lost my HFS partition last time it happened. Do we get a separate set of updates, or will we be forced to grab the anniversary update despite the bugs?
Has anyone at the top of Microsoft figured that corporate suicide isn't an achievement they should be aiming for? They keep trying harder for it every year and eventually, with enough effort, will be proud recipients.
Having done the end user computing engineering thing for quite some time, I've had to deal with Windows Update in places as large as 40,000+ PCs. There's a conundrum in the cumulative patching model -- it's super-easy for IT, but could leave some places more vulnerable.
The problem is that the more diverse a company's IT needs are, and the more proprietary software they rely on, the less able they are to just roll out a bundle of fixes to everyone and call it a day. I think Microsoft is forgetting how much some companies are relying on desktop Windows for line of business applications...it's almost like everyone there has drunk deep of the Cloud/Surface/Phone/Tablet/Web Services kool aid, and just assumed those crappy 20 year old applications have disappeared along with desktop/laptop use cases. In their minds, the only thing they have to make sure works correctly on site is Internet Explorer/Edge and Office.
Admittedly, updates are a confusing mess of semi-circular dependencies and it is very difficult for Microsoft to test even common combinations. But, making them all cumulative means this...Assume you have 10 updates in a bundle, 6 work fine everywhere, 1 breaks 40 PCs in Department A, 1 breaks the LOB app running on all 18,000 PCs you run, 1 breaks a behavior in IE some junky internal web app running on 2,300 PCs and 1 breaks the CEO's computer. All those computers have to wait until the problem is solved to get the protection for the 6 vulnerabilities, and they will continue to be unpatched since the bundle is cumulative.
The other thing I'm not a fan of is the removal of any sort of information about what gets patched. There used to be comprehensive descriptions of what was patched, and companies who knew what they were doing could direct testing to the right application groups. That's the other thing that's going away this month. We're a big Microsoft shop so we're pretty much resigned to upgrading to Windows 10...I guess we'll see what happens. Microsoft's been trying to cremate Windows 7 ever since early this year, messing with support dates and not backporting features. We'll see if Microsoft's "update rings" strategy that they're recommending everyone migrate to is workable.
Apart from the obvious-but-snarky ("Install Linux! hoho I'm so clever!"), you can indefinitely postpone all Windows updates on all versions of Windows 10 by stopping (and disabling if you find a way) the Windows Update service.
Of course, you lose the security updates if you do that too. Whether that's massively important to you depends on how often you run executables downloaded from the Internet, and what TCP/IP services you run on your computer.
Obviously "No security updates" is a bad thing, but if Windows insists on installing an update that actually breaks your PC in some way, no security updates might be the better of two evils, especially if you don't use IE or Edge, run any externally accessible services, and don't run every executable you download from the Internet.
You are not alone. This is not normal. None of this is normal.
This is the correct answer.
pr0n - keeping monitor glass spotless since 1981.
I was going to ask if, by bunding updates together like this, is it going to make the lives of security researchers more difficult, as they can't simply diff the changed files of a particular security update? Seems I'm not the only one wondering this...
Which distro is it that you use that has these issues? I'd honestly like to know, because I've been using Linux for 10+ years and I didn't know of any prior to being alerted by your post. This is important info which you shouldn't hold back!
Il n'y a pas de Planet B.
Hi Alex,
Despite our history, I'm here to help you out. No, really. So pay close attention:
Nobody needs to do anything to make you look bad. That's a trainwreck you're obviously quite capable of having on your own.
People bait you because it's well-known that you constantly scan Slashdot and other sites looking for people saying things about you. And they do it because they know that you will without fail rise to the bait. Q.E.D.
The only way for you to "win" this is not to play, but you are evidently too dense to figure this out, so you just keep coming back for more. And more. And more...
Il n'y a pas de Planet B.
I really see no other purpose to this than bundling spyware with security-updates. Seems running Windows securely and reliably is going to get even more difficult than, for example, Linux. (Although systemd is trying to change that...)
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You are lucky. I updated my Win7 laptop a few days ago (had not found updates for a while and suddenly found them when on the net for a day). Took something like 20h to find all updates and another 10h or so to install them. Talk about fundamentally broken technology.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
No, it doesn't. Windows XP support ended in 2014, and not even security patches are provided by Microsoft any more.
https://www.microsoft.com/en-u...
Yes, you can shoehorn Windows Embedded Industry updates into XP, but that's only going to patch anything which was shared between the two. If a bug or exploit was specific to XP, it won't be patched. And there's no guarantee this trick will continue working next week, never mind a year or two from now -- Microsoft can close the loophole any time they want to.
Maybe you are not able to _recognize_ Linux? Because that is not what other people experience...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Used to be MS security patches were for security, and you could just say "sure, install them all". Now ever since they added things like their anti-piracy nag screens, telemetry, Windows 10 nag screens, Windows 10 itself, you can't just auto-install all the "security" patches anymore. You have to go through every patch, one by one, inspecting what it does, and then checking through additional comments for any non-security items that also may have been tacked onto the patch. Keeping even just one Windows PC patched is now a pain in the ass.
Yay for having to manually manage and babysit the OS.
Finally! This is the way Apple has done it forever and it is sooo much nicer from a user experience perspective. Some may whine about having to accept everything MS wants to push at them, but it's time for them to deal with it and move on. The Windows update process has been essentially broken for the past two decades (>5 hour patch installs on a freshly Windows is *not* acceptable), and it's finally getting fixed. A momentous day.
I appreciate you making more clear why people don't switch away from Microsoft Windows.
For those stuck with Windows, it is obnoxiously arrogant to now force ALL updates on a user. What if there is a specific patch I really do NOT want? What if there is a patch in that same update I need? I am screwed!
I think MS's move closer to "Big Brother" is totally uncalled-for, unethical, and a breach of trust. They need to be SEVERELY regulated; and I intend to push and lobby for the freedoms users deserve!
Dear Microsoft: Get your unwanted crap out of my machine and my life. I, and I alone reserve the right to manage my PC and anything in it. It deeply offends me that you would take it upon yourself to go forcing things on PCs as a general rule; be it patches or Windows 10 upgrades. You need to be severely disciplined.
Self-importance and self-indulgence is the root of ALL evil.