Slashdot Mirror
'Don't Tell People To Turn Off Windows Update, Just Don't' (troyhunt.com)
Security researchers Troy Hunt, writing on his blog: Often, the updates these products deliver patch some pretty nasty security flaws. If you had any version of Windows since Vista running the default Windows Update, you would have had the critical Microsoft Security Bulletin known as "MS17-010" pushed down to your PC and automatically installed. Without doing a thing, when WannaCry came along almost 2 months later, the machine was protected because the exploit it targeted had already been patched. It's because of this essential protection provided by automatic updates that those advocating for disabling the process are being labelled the IT equivalents of anti-vaxxers and whilst I don't fully agree with real world analogies like this, you can certainly see where they're coming from. As with vaccinations, patches protect the host from nasty things that the vast majority of people simply don't understand. This is how consumer software these days should be: self-updating with zero input required from the user. As soon as they're required to do something, it'll be neglected which is why Windows Update is so critical.
Unless you have a production environment with a software product that breaks with Windows update turned on. In which case you have to take additional security and maintenance measures and have a team that is tasked with (and funded properly) to do testing and updates on a regular basis.
This is generally sound advice, although some IT shops prefer to manage the process to ensure that either (a) a particular update doesn't break some proprietary code, or (b) because of regulatory reasons particular machines may not be permitted to have the software changed without some sort of documentation being generated.
If they hadn't done shit such as the forced Win10 update, or forced GWA, or done a lot of other crap that broke peoples systems (in the name of marketing), then maybe people wouldn't have said, "Turn it off".
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
The telemetry spying though,,,
Windows Update also wanted to install telemetry on my Windows 7 system until I removed the patch. Then for 12 months Windows Update wanted to 'upgrade' me to Windows 10, the software employed all sorts of tricks to make me say yes and in the end I just disabled updates as it was less hassle.
My Windows 7 system was not affected by the events over the weekend as all it does is run some test equipment. It still has Windows Update disabled and it's going to stay that way.
The reason folks turn off Windows Update is that it behaves kind of like malware itself! I'm technologically savvy enough to set my registry and so on to disable the awful "Get Windows Ten" updates, but when so many users got shafted by Windows "self-updating with zero input required from the user" to a completely new operating system (a new operating system that actively thwarts end-user control over updates!), is it any wonder that so many of them switched it off?
The comparison to anti-vaxxers is interesting, and apt in more ways than Troy may have known. Much like Microsoft hijacked their Windows Update program to push Windows 10, the CIA used a Pakistani polio vaccination campaign to gather intelligence about Osama bin Laden (see here: https://en.wikipedia.org/wiki/...). This has resulted in the killing of other relief workers and general suspicion of medical aid programs in that region, and so polio persists.
It is pretty common to see people recommend setting it to only do the critical updates, so with somebody that doesn't understand what they're doing, playing a little telephone and purple monkey dishwasher disable all security features in Windows.
Enjoy the Windows 10 telemetry yet?
I mean, I use Windows 10 too but only as the OS required to run games. As far as Microsoft knows, all I use is Battle.net, Steam and GoG.
#DeleteFacebook
The problem is that around 30% of MS Updates actually hurt the user, either by introducing "features" that (like Apple) inadvertently or deliberately adding things that are of no benefit to anyone but MS and in many case hurt he users. Windows 10 Basically is capable of hijiacking itself (as per it's design) so it's hard to know what is good and what is not especially MS gives VERY vague descriptions of it's updates as per the new windows 10+ policy to tell users, it's our update, just take it (up the rear end). The sooner we start admiting that we don't in fact NEED MS Windows at this point, the better. Linux anyone?
"Imagination is more important than knowledge" - Einstein
Vaccines worked in a society that had trust and a belief in a brighter future. Our society is no longer trustworthy. The wolves are running the hen house. Anti-vaxxers are a natural consequence of the loss of societal trust. I am not an anti-vaxxer, but, as a conspiracy theorist, I understand how anti-vaxxers came to be. We, as a people, no longer trust our government, pretty much at all. Any trust is blind trust placed at our political parties and idols. We are blind fools to give that trust at all, but it is just about the only thing left keeping this obviously corrupt system running.
And, guess what. We're seeing the same fucking thing from Microsoft. We can't trust them. The problem with the author (and as a security engineer by trade, everyone makes this mistake all the time) is that he does not understand the threat he's protecting against. People who advocate for disabling automatic updates have assessed the software vendor to be the bigger threat than hackers. They're not wrong, and the author has completely misunderstood the owner's threat model.
Problem solved, permanently.
When all you have is a hammer, every problem starts to look like a thumb.
But don't be a retard. Keep reading this site and others. I manually installed MS17-010 a month ago even though Windows Update has been off for years. People get what they deserve. You need to actively pursue your own security, not ignore it or worse, pretend that Microsoft is going to do it for you. Windows Update is more trouble than it's worth. Especially since Windows 10.
Seven puppies were harmed during the making of this post.
get a Mac. Now I am one of those annoying people who say switch to Linux.
I am in favour of auto-updating Windows, don't get me wrong; however, it could be catastrophic if anyone ever manages to figure out a way to spread a virus via the auto update.
I'm not sure the technical route someone would have to take to do this; If, perhaps someone could somehow infect a DNS server to treat an infected server as a Microsoft update server.
"That's the way to do it" - Punch
If you use pirated software, you get what you paid for.
Those fuckers at MSFT ruined security updates by force-feeding the user spyware, or even forcing an "upgrade" to Windows 10.
Now nobody trusts Microsoft, and would rather take their chances without the "essential updates".
the continual additions of resource-heavy snooping spyware and telemetry services for in-app advertising delivery hammer many institutions that would otherwise happily install security patches, if they were JUST security patches.
But many of the Important patches we have recieved from MSFT are just that. Ads, telemetry to try to sell us stuff that blows out the bandwidth in mission critical software and pops up things that get in the way of doing actual work.
There's your problem. That and the "patching" of things in a way that breaks apps that believe the public documentation instead of the actual way MSFT codes and tests its apps.
-- Tigger warning: This post may contain tiggers! --
As a side note, the delay to release PDB symbols on MS's symbol server after a Patch Tuesday has been at least days and sometimes more than a week for the last two months (at least for the Win10 symbols I tried). I use them a lot with WinDbg.
Because of getwin10
nobody cares what you do on your PC
Then why did they implement telemetry in Windows?
There is, it's the "critical updates only" checkbox.
The problem isn't the lack of said checkbox, it's the fact that Microsoft doesn't respect that checkbox and considers all sorts of marketing fluff and malware to be "critical"
If Microsoft would just go back to the days when security patches were done separately from other sorts of updates, that would be a huge help. I know a lot of people who disable updates to avoid feature changes, but would accept automatic security updates.
Microsoft's position of not making a distinction between the two is a large disincentive to allowing automatic updates for a lot of people.
It's more accurate to tailor the message about automatic updates to the audience.
For computer savvy people that are likely to read the message about available updates and install them, than turning off automatic installation is appropriate, because many of us can't afford to have long running processes or tasks dumped from memory with a reboot.
For your average user or nontechnical person, absolutely, advise them to leave it at defaults (and to save often).
at troyhunt.com
Hi, I'm Troy Hunt, I write this blog, create courses for Pluralsight and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals
It's obviously in his interest to make everyone Microsoft's puppets.
Anons need not reply. Questions end with a question mark.
Microsoft only have themselves to blame for people disabling Windows Updates because they made it untrustworthy:
If you buy Microsoft software, you get what you paid for.
I haven't that problem since Windows XP. Then again, I'm not running on minimum spec hardware.
Except if vaccines failed as much as a Microsoft patch did there would be no doctors... because people would be shooting them in the street.
Yeah, yeah... I can already hear the autistic fast typing from some keyboard warrior looking to 'correct' me on this one. But sorry... Microsoft no longer has any credibility to tell people what to do with their machines. The entire roll out of Windows 10 has been nothing but train wreck after train wreck. And you know what? Even if we get the occasional virus it's still better than having to deal with the rest of the continuing train wreck that is Microsoft. People are just going to have go back to the old day when people had to actually learn how to protect themselves. Instead of waiting on the industry to sell you a next generation of device that 'might' be eventually patched.
The number of problems caused by installing Windows updates for our IT department: THOUSANDS
The number of problems caused by holes left in the Windows OS that an update or patch supposedly has fixed: 20
Easy decision.
I don't think I've ever worked at a company that had "automatic updates" turned on. The reason being, company ecosystems tend to be predominantly all the same hardware, same Windows version and same patch level, and a bug in an update that affects that particular collection of hardware and software can take an astounding number of seats offline. (In much the same way a biological virus can take out an entire species if they're not sufficiently genetically diverse.) So yeah, no. Companies that want to stay in business don't do that. Of course, they *do* have a team that tests updates in a lab and sends out validated updates to the rest of the company, often a subset of what Microsoft spews out.
I do something similar at home. We have three Winders boxes, and none of them have auto update turned on. Every week or so, I look at what updates are available, and apply at minimum the security updates to the least used of those three boxes. If it survives a reboot and some reasonable amount of smoke testing, I install on the game machine, and if that works out ok, after a day or two I'll install it on my own workstation. I have to take care because my machine is (a) my only conduit to my "day job", and (b) my main workstation for my side-business. I can't afford to be down because Microsoft botched a patch any more than any large company can.
So yeah, security updates are important. Vital, even. But that doesn't mean you just install every update the moment it becomes available. An important part of "security" is "availability". And that's just as important as "confidentiality" and "integrity".
Another contributor had it right -- there should be a way to auto install security updates only. So if Microsoft botched a driver update and it renders unbootable a certain brand of PC running a certain brand of video card, it's less likely to take large numbers of users offline.
I know there are essential and optional updates (or whatever words they use) but most updates are considered by Microsoft to be essential.
And this doesn't even address compatibility of updates with installed applications. You know, the software you use to actually do work.
All that said, it does seem like Microsoft is doing a better job vetting their patches before release than they did the earlier part of this century. But being burned a few times breeds caution.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Making a blanket statement like this is not really valid. I think for the average consumer desktop that searches the web, maybe plays some games and does some basic office stuff it is probably a good idea not to turn off updates. Telling a corporation that they absolutely need to update every time Microsoft releases something is probably a bad idea. The better advice would be for companies would be to educate themselves, hire people that know what they are doing, or hire outside contractors that are reputable and educated to handle their security. Simply saying "Update Windows" does not define a good security policy.
Sent from my TARDIS
If you're managing hundreds or thousands of systems, you've always got a few with failed Windows updates. It's a never ending battle. It's nigh impossible to stay 100% up to date. THAT is Microsofts fault.
No way! I will NOT allow windows to just install updates into my production environment... Yes, I know it is a risk to leave systems unpatched, but given the frequency of Microsoft breaking my systems with their patches, the risk of downtime from a security flaw is usually LESS than the risk of having some exploit that causes down time.
However.... This doesn't mean I don't pay attention to the released updates. Oh no, we have a test system where we DO let them load as soon as they are released and a functionality and performance test that we run as soon as we can. We update only after successfully passing the test suit (and fixing any issues we found), which sometimes can take more than a week. I choose when the updates go out, not Microsoft.
So, for mission critical applications and systems, I recommend you NOT enable updates.... But I also recommend that you have resources available to test the updates and try to stay reasonably current with Microsoft's patches....
But, that's business.... At home? I generally don't turn on updates either... But I'm aware of what's coming out, so I generally know when the really important stuff gets released so I will update accordingly... Of course, I'm in charge of the In-Laws computer maintenance needs and they live in another state. For them, I have automatic updates turned on, at least until things get hosed and I have to make a multi-state trip to get them going again.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
... and tell them to stop using the security update distribution channel to trick me into doing an unwanted operating system update. Recently, Windows Update has looked a lot like malware in the way it operated to trick customers into upgrading to Windows 10.
Don't use the channel for security updates to force advertising on your customers, just don't.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
There is, it's the "critical updates only" checkbox.
The problem isn't the lack of said checkbox, it's the fact that Microsoft doesn't respect that checkbox and considers all sorts of marketing fluff and malware to be "critical"
But they are critical updates from Microsoft's point of view: critical to marketing.
also, doctors don't break into your house in the middle of the night to give you a vaccine (and snoop around your house while they're there).
Support Right To Repair Legislation.
Option A) Turn automatic updates ON and risk Microsoft making your machine unusable due to a faulty update
Option B) Turn automatic updates OFF and risk Microsoft making your machine unusable due to the absence of a security update
When I go to update it just spins for hours and when it finally does update my tablets keyboard no longer works.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
If an MS Update actually updated just the software you have (taking into account anything you've disabled or removed) - then this feature would be useful. As-is, it seems to Upgrade, Re-enable, Reset the OS to a state that is disruptive. This is not what such a feature should be doing. We've seen this before when updates required clicking (no scripting mode) and when updates required accepting EULA's that didn't allow a "No" - you were left with the half-way install. Each time, MS had to learn that their platform would be far more secure if they kept it simple. When they fail doing this well, the feature is disabled. The platform silently becomes a haven for compromised equipment - and a continued poor reputation for service. Has nobody written down the requirements for this type of tool over there? Or more clearly: The requirements should include what NOT to do as well as what is required. I'm very surprised, given that MS wants to be the go-to OS for corporate use. Every OS has flaws and attacks, but making patches into sales gimmicks is what pushes people away.
Because Windows Update reboots your computer without your permission or control over the process. We're essentially back to Windows 95 in terms of operating system stability because Microsoft cannot figure out how to update an operating system without resetting the computer in the process.
If Windows 10 (1) avoided reboots unless absolutely 100% necessary, and (2) prompted you to reboot (perhaps nagging you until you do) rather than running a timer you often don't even see before it expires do it, then, well, people would be a little happier about the tool.
Updating is good. Microsoft's implementation is shit. If you want people to install security updates, don't do implement it in a way that's indistinguishable from a kernel level bug that crashes your computer every few days.
You are not alone. This is not normal. None of this is normal.
It goes further than that. Plenty of times my XP laptop would hang after an update, or the networking was disabled. The latter was great since it stopped you downloading the update that fixed the other update unless you had another machine.
Still, it made me learn about restore points.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Yah blame the user for the virus exploits and not the vendor that created the software with huge holes and the vendor who is blocking updates when running new gen CPU's on older OS versions just to try and push people to W10.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
The last time I left updates enabled, update started updating my machine and demanded a reboot in the middle of a major corporate presentation in front of a large audience. This is UNACCEPTABLE behavior!
Windows Updates (1) Constantly reset browser preferences, (2) Frequently break hardware drivers, and (3) Often interfere with critical, urgent work tasks. Don't tell me not to turn them off! Don't tell me not to tell others to turn them off! NOT GONNA HAPPEN!!!
Windows Updates should be TURNED OFF, during all business / production usage. Then updates should be enabled/installed manually during weekends, vacations or other non-critical times. I DECIDE when my machine can be down for maintenance. Not Microsoft. The Updates STAY OFF, until I purposely enable them when I am willing to allow time for reboots, and have the time to restore my machine to proper configuration and operation afterward.
I tell people to turn off the automatic downloading and installing of updates all the time. Instead of having updates shoved down their throats i TEACH people how to look up the updates that microsoft is putting out and how to decide whether or not those are updates that they need. I also teach people how to conduct regular backups in case they do miss something.
Because blindly accepting anything from anyone is a bad idea. period. full stop! It encourages ignorance and helplessness, teaching people how to use these tools we call computers is the only way to stop shit like this and in the cast that something does happen a full and proper backup is only a wipe and reinstall away.
also how are the words of a microsoft employee "news for nerds" we already have enough shills that post int he comments.
Tell Microsoft to stop pushing patches which install Windows 10 without my agreeing upon it, and I'll let Windows update run. No, I suppose Microsoft stopped with the whole Windows 10 thing a few months back, but there's now a trust issue I personally have to get past. The fact of the matter is, I don't trust Microsoft anymore.
- Mark.
WU is ransomware. It's just a different kind of ransom.
WannaCry: "send us $300 in BTC or we'll kill your data if you don't have backups".
WU: "Send us personal data via telemetry, take un upgrade you don't want, let us chew your CPU and interfere with your games. If you don't, we'll force you to do a lot of busy work to separate the security wheat from the marketing chaff, and if you don't do it right you'll be vulnerable to things like WannaCry".
MS bears a lot of blame until they stop holding the familiar Windows experience hostage, and return it to us without forcing us to pay a ransom.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
We personally have TWO laptops that got repeatedly broken by non-disableable driver updates (already told Windows to never update drivers, hid the offending update, etc) and it still managed to get through, multiple times, and do the blue-screen tango repeatedly until I gave up trying to fix, it went into safe mode and disabled the Windows Update service. I had to keep it that way for a couple months until I was able to load a "newer" driver from the video chip manufacturer that fixed it and/or MS stopped pushing the broken one. Then I was able to turn updates back on again.
All was fine, I THOUGHT, until several months later when the Anniversary updated got pushed to these systems. I bugged both my laptop manufacturer and Microsoft, repeatedly. Microsoft swore up and down that it would "only try to load the update once" and then stop trying if it failed. They also said the Anniversry update wasn't "certified" for this laptop model so I should just not install it, which would be fine except that _they forecully push it out, including to this laptop mode_! When I told them it had already attempted to update, failed and hung, at least twice they said it tries twice and then won't try again. Still incorrect. I tried basically everything including downloading the update to a USB and installing it manually, updating the drivers, downgrading the drivers, removing what I think was the suspect driver causing the hang during the update install, hiding the update with show/hide update tool, etc. Hiding disabled it for a while, but the dang thing is relentless, after a while it still comes back. The only 100% reliable way to make sure it will never try again, and hang the system (usually leaving it in a hung state with the fan blaring and screen showing 32% or something, all night long) is to completely disable the Windows Update service, or buy a new computer, or downgrade to an earlier version of Windows, or say to hell with and load Linux. The latter isn't an option because the laptops are used by family members who require Windows for specific applications.
...are being labelled the IT equivalents of anti-vaxxers...
So, people who have done their research, and have decided that the cost/benefit ratio is too low. Sounds about right.
If you value security, don't run the mission-critical parts of your infrastructure on a general purpose operating system like Windows, but rather run it on a minimalist, locked-down OS that has _only_ the facilities needed to do its job. The update carousel is a nightmare. If you want to ensure your Windows box doesn't sporadically reboot during a long unattended operation in order to update, what do you do? If you want to lock Windows down so it can only do the job to hand, and nothing else, you're screwed. If you run mission-critical stuff on a full-featured general purpose OS (and the same can be said for off-the-shelf Linux distros like Ubuntu and Fedora), you are kinda asking for it.
That this idea is older than me, but is ignored, is laughable.
John_Chalisque
Basically, you have the choice between being taken down by one of their fucked up updates or by the malware.
Pick your poison. No, survival is not a choice. Unless you dump that shit.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I turn off Windows update on the boxes that I still have. I recommend everyone I know disable Windows update on all boxes that they have.
If you leave Windows update on, and just take the security updates by default, you will get owned by Microsoft. Constant telemetry will stream from your box.
I also recommend people look up how to stop this on Windows 7 and 8, where it is possible to stop it. It is not possible in 10, though some people have had some success at limiting it.
The article's advice is horseshit. WU should be disabled for personal computers if privacy is any manner of concern. Microsoft has revectored their security update mechanism to: try to upgrade you to Windows 10. Install sleeper services that only months after installation began transmitting telemetry. Remove useful names from KBs to prevent successful system administration. Transmit information about what programs you use, when you use them, how often you use them. Transmit information regarding crashes. Broadly expose envelope information about your non-Microsoft related activities to Microsoft and anyone they choose to share that information with.
Disable WU on 7 and 8. Tear out the bad patches. Only EVER manually apply patches that you actually require for security and functioinality.
Comparing being a sensible system administrator who doesn't want to transfer control over their personal activities to Microsoft to antivaxxers is disgusting. Anyone making this comparison is irresponsible.
https://superuser.com/question...
The list of KBs that you must manually remove (and prevent reinstallation of) to keep Windows without telemetry is provided on that su post. The list is:
KB3065988 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: July 2015 more info .NET Framework 1.1 when you upgrade Windows 8.1 or Windows 7 more info
KB3083325 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: September 2015 more info
KB3083324 Windows Update Client for Windows 7 and Windows Server 2008 R2: September 2015 more info
KB2976978 Compatibility update for Windows 8.1 and Windows 8 more info
KB3075853 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: August 2015 more info
KB3065987 Windows Update Client for Windows 7 and Windows Server 2008 R2: July 2015 more info
KB3050265 Windows Update Client for Windows 7: June 2015 more info
KB3050267 Windows Update Client for Windows 8.1: June 2015 more info
KB3075851 Windows Update Client for Windows 7 and Windows Server 2008 R2: August 2015 more info
KB2902907 MS Security Essentials/Windows Defender related update [no description/information available]
KB3068708 Update for customer experience and diagnostic telemetry more info
KB3022345 Update for customer experience and diagnostic telemetry more info
KB2952664 Compatibility update for upgrading Windows 7 more info
KB2990214 Update that enables you to upgrade from Windows 7 to a later version of Windows more info
KB3035583 Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1 more info
KB971033 Description of the update for Windows Activation Technologies more info
KB3021917 Update to Windows 7 SP1 for performance improvements more info
KB3044374 Update that enables you to upgrade from Windows 8.1 to a later version of Windows more info
KB3046480 Update helps to determine whether to migrate the
KB3075249 Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7 more info
KB3080149 Update for customer experience and diagnostic telemetry more info
KB3083324 Windows Update Client for Windows 7 and Windows Server 2008 R2: September 2015 more info
KB3083325 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: September 2015 more info
KB3083710 Windows Update Client for Windows 7 and Windows Server 2008 R2: Octobe
One of the more common things that causes problems with the updates is if the clock on your computer isn't correctly set, and that includes timezone and daylight saving.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
... rather than running a timer you often don't even see before it expires do it...
HAH! That's exactly how I wound up running Windows 10. Left my Windows 7 machine running over the weekend and came back to Windows 10. Fuck!
Because getting some kind of virus is a hypothetical, while seeing several people's presentations ruined, my own work stopped for half an hour on three occasions, bad drivers installed multiple times, all those are tangible experiences.
The problems here with people turning off Windows Updates can be laid right at the feet of Microsoft.
Sneaking in "Urgent" patchs that introduce unwanted functionality, start spying on the end user, etc?
Not to mention the older issues with newer patches breaking production software.
And the oldest issue of all, Windows updates breaking (and bricking) systems to the point of needing a complete reload.
If those jackasses up in Redmond would pay attention, and hire people to ride herd on all the Indian and Chinese programmers they're paying pennies a day for, they'd know this by now.
But nope! Gotta shovel this shit out as fast as humanly possible. QA is for pussies! Isn't that what our paying user base is paying for?
This situation has been going on for decades now. And it's only getting worse...
Chas - The one, the only.
THANK GOD!!!
P.S.: I agree on the Windows Updates that delivery telemetry (above). I've removed all that junk, and my systems run smoother...and faster...without clogging up my system with "data for M$" and without using my Internet connection for something that appears to offer me absolute NO perceived benefit.
If M$ has competent quality control practices, this "telemetry" would have no value. I suspect much of it is used to justify their own internal practices ("See how many people never use XYZ feature? Let's not waste time patching that PoS.")
I disabled automatic updates on my Windows 7 machines when MS started to offer only cumulative updates for Windows 7 through the updater that combine security updates with non security updates. Before that I installed security updates automatically. But with rollup updates, this is something of the past. I don't want them to install whatever crapware they want on my machine. For that reason I already avoid Windows 10 whenever I can.
So I prefer to download security updates manually from http://www.catalog.update.micr... (yes, you can do it without using IE) and pay something like ~$30 a year for a proper proprietary anti-virus than putting up with Microsoft's shit. Hey, I'd even be willing to pay that money to MS every year if they offered a better service and didn't try to screw me over every chance they get.
There are MANY companies that want EXACTLY this data. The marketing/analytics business is pretty huge.
So have you stopped beating your wife yet?
The controversy over whether to run Windows update or not misses the larger point. If you choose to buy a car with a deplorable safety record, despite its expense, then sure, by all means follow the recall notices and bring the car to the dealer every week to get the latest problem fixed. But suggesting Windows update is the "smart" move is like suggesting the same car owners are brilliant for wearing their seatbelt while driving their risk laden vehicles. The smart thing is just don't use a product with an horrendous security record.
Why would anyone *disable* automatic updates on Windows?
To avoid all the nastiness that comes with Windows updates, perhaps?
And how would that stop the rebooting?
nt
It used to be that you had the option to only install security patches, but with Win10, not anymore. MS routinely breaks things by adding functionality now. The push UI changes some people do not want and that can also break things.
If anybody needs to change something here, it is Microsoft. First, they should stop writing really bad software. And second, they should stop forcing people to accept functionality-changes bundled with security patches.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
There are 7 billion people in the world, do you really think the right answer is for all of them to read /. and "hacker news" every day?
Do you think bridge designers sit around saying "you shouldn't be allowed to drive across my bridge unless you understand how retention walls work"?
Use an OS from a company that doesn't hate you and you won't have to disable auto-update.
People get WannaCry by clicking on the wrong email not by SMB exploits. I get that repurposed NSA exploit angle makes for interesting and irresistible news stories but substantively it's way overhyped and using it to support blanket assertions is a nonstarter in my view.
There is compelling quantifiable evidence to support the position vaccines help more than they hurt. The case for updates is closer to the question of whether throwing billions into the intelligence industrial complex makes real people quantifiably safer from being terrorized given opportunity cost of not investing these funds to address significantly more statistically substantial problems such as pulling down US murder rate.
What we know for sure is social engineering accounts for 90% of general p0wnage worldwide. Even if all unintentional software bugs were patched with 100% coverage overnight absolutely nothing would change.
In 2017 given Microsoft's proven track record of both incompetence and sleaze when it comes to updates it's an open question as far as I'm concerned whether updates are still worth applying at all. Majority of end users are behind stealth mode firewalls and the only whackable thing they have sticking out is a web browser. If you keep firefox or chromium or whatever up to date and lock down some associated configuration are you really appreciably safer vs probability of computer failing to boot or introduction of some new Microsoft "telemetry" malware or Microsoft false choice prompt dismissal scam? I honestly don't know the answer. I do know it very much depends on context not only in terms of the users needs and environment but the value judgments of the end user.
If Microsoft would stop constantly peddling malware, firing QA staff, fix updates to not use insane amounts of resources while taking forever and requiring a reboot to sneeze... If only updates were properly labeled and people trusted Microsoft not to screw with them... my guess less will find value in disabling updates.
I personally believe coordinated automated updates of billions of systems globally in a matter of days is an extraordinarily perilous activity in and of itself no matter how careful you are. Sooner or later this is bound to end in a major disaster. While updates do fix problems quicker they also significantly lower the cost and tolerance for releasing defective software. It sends a signal to the market releasing defective software is a cost free activity.
Windows Update needs a few changes to be trusted:
1) An option that only installs critical security updates and not features
2) Needs to stop rebooting your machine when it is busy doing something. This includes intrusive nags that interrupt what you're doing
3) They need to stop breaking things like they did with third party boot loaders a year or so ago
You are right, of course, but you fail to understand the mentality that exists within Microsoft.
Windows 7 is by far still the most popular version. Microsoft could have left it alone and just made security and performance improvements "under the hood". But Microsoft suffers from "New Coke Syndrome", i.e., making pointless, needless changes that are driven by marketing, not by technical necessity.
Playing devil's advocate, here...
By disabling automatic updates in earlier versions, before Microsoft played these games, the end users put themselves in a position of trust, in control of the security, stability, and performance of not only their own computers, but every computer connected to the internet, regardless of OS or version. Those same users also put themselves in a position of trust regarding the perception of the security of Microsoft's OS.
Those users failed miserably to live up to the position they chose for themselves.
As a result, Microsoft have, and perhaps rightly so, removed the option that previously allowed those users to put themselves in that position.
It does have the side effect of screwing those of us who both disabled automatic updates and manually installed updates within a reasonable timeframe (or took sufficient security measures to mitigate the risk of not having installed updates). Now, we no longer have that choice and yes, that does suck.
It sucks a bit less, though, when you take a moment to realize that, over time, the mess that is older versions of Windows with Windows Update disabled and manual updates literally never applied will clean itself up as those systems naturally remove themselves from the environment, either through obsolescence or hardware failure. They'll be replaced with new systems on which the user can't disable updates irresponsibly (that is, turn it off and "forget" to ever manually install updates that are actually important) and we'll all be better off for it.
Yes, even those of us who are suffering with forced updates now.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Windows system restore and windows installer basically implement a horrible copy on write file system on top of ntfs. Windows installer does enormous amount of time upfront calculating how to rollback back the install if it is fails. Run into problems and windows update gets in endless loops , spending most of the time re-calculating how to do a failed install again. Microsoft bite the bullet and fix ReFS to have proper CoW filesystem with snapshots and shocker the ability to boot from a ReFS volume.
I *have* to disable the update service on my laptop. Win 10 insists on installing newer Intel graphics drivers, except they don't work with the Optimus setup on my laptop. With the newer Intel drivers, any 3D game I start crashes when it tries to use the Nvidia card. So I have to let Windows 10 update my laptop, disable the update service, then reinstall the Intel GPU drivers provided by my laptop vendor (and also the Nvidia drivers if Windows 10 has auto-updated those).
When Win 10 first came out, it gave you the option to disable updates to a specific device driver. But for some inexplicable reason, Microsoft removed this option in the Oct 2016 update. Because of Microsoft's brain-dead update policies, I literally cannot use my gaming laptop to play games if I have Windows Update enabled.
Translation: "I've never had a problem myself, so other people claiming to have problems are clearly either being hyperbolic or lying."
some are just control freaks and don't want anything done without their say
Your use of the disparaging term "control freaks" betrays your disdain for people who actually dare to think that their computer belongs to them and want to treat it as if it were.
My computer should never do anything that I didn't approve of or ask it to do. If it does, then I call that "malfunctioning".
The so called "security experts" are preaching about the immense dangers of disabling automatic updates. Never mind the time consumed involuntarily by consumers having to patch their systems every second week. Never mind the unsaved files, permanently lost, due to automatic reboots in the middle of the night. Never mind the havoc wrecked on production and development environments running multiple virtual machines. It's time the security people stepped down from their high horses and realized that automatic updates should never be enforced -- only strongly recommended. Developers and power users don't want to live in the Microsoft nanny state of supervised reboots -- not even if you're able to schedule them.
Because they do care about what crashes on your computer and why, so they can fix those issues. That's more to do with what other people (software developers) do on your computer than what you do on it.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Companies like Microsoft have to be responsible to their customers and not push updates that violate their sovereign right to control their own bought-and-paid-for hardware, not install unwanted 'features' like things that shove ads in your face, not brick people's computers, and otherwise not subvert and annex peoples' bought-and-paid-for hardware into their surveillance network. Companies like Microsoft seem to think that THEY own people's computers, not the PEOPLE WHO PAID FOR THEM, and that is FLAT OUT WRONG, AND FURTHERMORE POSITIVELY OFFENSIVE. If companies like Microsoft had a respectful attitude and respectful business practices THEN PEOPLE WOULDN'T BE TURNING OFF AUTOMATIC UPDATES IN THE FIRST PLACE!
Because getting some kind of virus is a hypothetical
Until it happens to you or you see it happen to someone else. According to you, seeing it happen is enough; after all, you did say
seeing several people's presentations ruined [...] are tangible experiences.
All of the "ruined presentations" I've seen have been reported in the news media. The very same news media who reports on these viruses people are getting, mind you.
And yes, I've had updates interrupt my work before. Twice, on two different systems. I treat those incidents as bluescreens and, well, even with those, Windows 10 is still more stable and reliable than any previous version.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Don't push unwanted updates down people's throat. Don't make updates so annoying that you have to reboot your computer so often. People shouldn't be forced to stop everything they are doing to reboot their computer so often. If you want everyone to do them, these updates should be seamless.
If MS really wants to make people do updates promptly, they need to get their heads back out of their asses. In the late WinXP and into the early Win7 era, there was a strong push for security and the updates were usually both relevant and easy to install.
Fast forward to now, and half the updates you get are MS pushing their latest piece of crapware (*coughskypecough*) that you don't want, and like 90% of them require a full computer reboot -- which they'll happily do with our without your input and hope to hell you saved your work that day.
If MS wants people to install critical updates then:
a) Stop calling every fucking sales pitch "critical," and
b) Go back to putting in the effort to avoid reboots. I know its easier to just reset and not worry about internal version conflicts and whatnot, but its a serious detriment to anyone who doesn't normally shut off their computer in the first place (and those people are the ones who least need to be force into an unwanted reboot!)
Unfortunately MS has decided to do the exact opposite of that and compensate by giving you no choice -- enjoy losing your work.. what're you gonna do about it? Switch to Mac? Oh you are? Well fuck.
Automatic updates are great and all, until the update becomes a problem in itself, breaking something.
Microsoft really should have two update paths: CRITICAL (and take it seriously, no more stupid updates labeled as CRITICAL)
And: Non-CRITICAL (everything else goes here, especially driver updates!!!!)
Make one optional, make one mandatory. Problem solved, assuming M$ can adhere to a fairly strict no-nonsense policy to what gets flagged critical.
How about: Whether or not you have automatic updates enabled, don't ever put a windows box on a public-facing IP, unless it's super-dooper-hardened/firewalled and has a 24/7 NOC staff to monitor it.
The ruined presentations are ones that I've actually attended and had to sit through Windows suddenly deciding to reboot and the presenter not knowing what to do, and the attendees having to sit through the installation process.
Or ones that I watched live streamed.
I do digital painting from live model, after a few times of having Windows install an update for 40 minutes or botching a driver update that took me a similar amount of time to figure out how to fix, that's the limited time I have with the model, and the money paid wasted, I'm not enabling updates on this device again.
Now on my main desktop I still have Windows 7 so I'm less apprehensive and do update manually every couple of months.
In Server 2016 you have two options: allow the server a full 8 hour window to reboot itself when updates need to be applied, or disable the whole thing via group policy. Nothing in between.
I've been hit by this numerous times. HyperV server running a bunch of VDIs? FUCK IT, I'm Windows Update, I get to take the whole fucking thing down! Exchange for an international corporation that relies on 24/7 email? SCREW YOU, I'm Windows Update, reboot that bitch!
Guess how many people have no choice but to disable them because they don't want their servers randomly rebooting?
We had THREE Production servers that got Windows updates (Windows 2012 R2) and suddenly wouldn't boot! Our Windows admin spent the whole day on the phone with Microsoft and we had to rebuild ALL THREE servers!. Backups you say - yeah they wouldn't boot either. You see the servers didn't get rebooted until 5 days AFTER the updates got applied. So the backups were no good either. This latest Ransomware is just another death kneel for Windows now our IT executive management are looking at how soon we can start migrating anything we can to Linux servers even out Enterprise Architect is highly recommending it.
... one could implore the software vendors to make the update process less arduous, cumbersome, error prone, and OBNOXIOUS AS ALL HOLY HELL.
As someone who has, on multiple occasions/systems, got frustrated enough with Windows Update to disable the service (hint: that's the ONLY way to prevent it from randomly rebooting your system when you are trying to use it, whether you like it or not), I can say with some certainty that I would have no issue with leaving updates enabled, if the process wasn't so GODDAMN TERRIBLE. Suggestion to vendors and prognosticators: the vendors are as much, if not more, to blame as the users who respond to the INFURIATING behavior of their devices. Instead of blaming the users, I'd suggest perhaps it might be more productive to blame the vendors for the poor quality software which drives the users to disable it.
Playing devil's advocate, here... By disabling automatic updates in earlier versions, before Microsoft played these games,
I believe they started playing those games with the second or third update. I can't tell you exactly which update it was, but it was way way early in the game and they fubarred lots of systems. Something about an internal MS driver updating and overriding third party drivers IIRC. They also have always pushed new features in "updates".
The cesspool just got a check and balance.
How in fuck do I safely update a Windows install, without risking telemetry and all of the shove-Win10-down-my-throat bullshit? Nobody has a fucking answer to this. I need to update my installs, ASAP - but I'm holding off because I don't know how to avoid all of the fucking MS-produced malware... Someone give me a fucking answer...don't link me to offline installers, that just install all of the problematic updates as well...
Second or third update to...???
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I don't think that's the complete explanation. If that's all it was, then we'd have the ability to turn the telemetry off.
That telemetry is mandatory tells me that Microsoft has much more nefarious reasons afoot. Probably centered around monetization.
"Automatic" updates are routinely disabled. Most updates from Microsoft are crap. The updates take lots of wasted time (seriously, I've applied a service pack in the past that installed faster than some of these new Windows updates). Not every update is for security, even Microsoft still manages to make a distinction So you can be routinely applying security updates (manually or automatically) while still disabling other updates and remain secure.
And precisely because Windows is known for being insecure means you should never trust it for security. Many of it's holes came about from updates either to it or to its applications. The fact that Microsoft shoved out a marketing feature as a security update should say very clearly to never trust them. ALWAYS review each and every update manually to see if it's safe. Pro users are allowed to delay updates for some months, even security updates can be delayed, and Enterprise users can put off updates indefinitely. Only the Home users (known internally in Microsoft as "suckers) are forced to take updates immediately.
Crash reporting is literally the only telemetry you can't turn off...
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
No, end users made this mess and are hoping to blame Microsoft.
No, Microsoft made this mess and you are blaming end users. If security updates were implemented and deployed with care, and if Microsoft behaved in a trustworthy way, then very few people would object to their being automatically installed.
Few sane individuals would turn off security updates at the critical security level concerning defects offering networked remote execution with escalation.
These little reason for this relatively small group of patches to disrupt normal operations, if Microsoft were to take a conservative stance.
But somehow Microsoft manages to bundle in weird instability bycatch, and you're either left with your pants down, or your pants on fire. For which the only viable solution is an OS-upgrade cycle with a new-and-improved EULA, which somehow never fails to be ever more Orwellian.
Pants or privacy. Choose one.
Nice business model, should your customers willingly board the train.
There are a lot of ways to protect your hardware, yes a bare system on the internet directly is vulnerable to a lot of exploits but IT professionals have been protecting these systems for decades from things before microsoft releases a patch and protects them.
Windows 10 single handedly caused far more problems and cost for users of production software that any viruses for one company I worked for.
We were flooded with calls from users who were FORCED into windows 10 and now ALL THEIR SHIT DON'T WORK.
Trusting microsoft completely is bullshit, review the updates, decide if they're relevant. We can't trust these companies to blindly accept all their software "updates", a lot of them these days aren't even things that affect you, but they want their software to gather more data or other garbage.
What you have is the opinion of a person having limited knowledged ... You only looked at one single threat and decided what you asked is good for everyone. Obviously you haven't done any risk assessment.
In environments where hundreds/thousands of comptuers run to put together a massive operation, we don't do "automatic" updates... which gives MS the decision of when and what. Instead we evaluate the credibility of the patches even if it comes from its authentic provide MS. Why? Because unlike the patch that you mentioned, there were other patches that crashed thousands of servers worldwide... or upgraded the OS from Windows server 2003/2008 to Windows10 and render all of its applications useless because those apps are not compatible with Windows 10.
Even if a patch is credible and verified... we run it through test, then QA, then Staging, then Production in that order. So you see... just because MS provides a patch, doesn't mean you have to install it. MS is not the only provider here. There are other providers that issued patches which consequentially created disasters and we were left with fixing their problems.
For personal use computers, yeah sure it would be OK to have an abrupt patch that causes problems or do an upgrade without consent. For some that's still unacceptable since they rely on their machines to make a living.
'nough said... what you said is wrong. Let the experienced speak and you'll learn from them.
I'm guessing as a security researcher, he's never had any real world experience.
Allowing a software vendor to automatically apply updates and patches might sound like a good idea "in theory" but it requires a level of trust--something which Microsoft has never achieved in my organization over the past 17 years.
As others stated, the *only* way for a business to manage updates properly requires building a test environment and funding knowledgeable staff to test updates against their system and software configurations. Turning on Windows Update without any oversight almost guarantees you eventually having a Really Bad Day at the office when you come in and MS has decided to update something having to do with the login authentication and none of your users can log in.
Fast forward to Windows 10 and you have the "installing, failing, rolling back, rebooting" cycle and if you think calling Microsoft is going to get you a 5-minute fix, you're probably going to find yourself needing a new job.
Most malware doesn't cause the kinds of damage that Windows does.
I would rather restore my mother PC from a backup than have to deal with Win10 on her machine. They turned it off for now, but it takes one under-perform quarter for them to get back at it.
"Security update KB12345: This update changes the color of the mouse cursor. Be aware that this update is required for all future updates to Windows 7 and 8.1. For a list of incognito non-security changes, please visit ."
But I'm not enabling automatic updates in any environment I manage.
Too many times have I been alerted of a new security issue by a client, though I was already aware, and was asked to install the patches that correct the issue. The environment's already designed to prevent many of these issues (ACLs, competent firewall rules) and I'm not worried, but want to qualm their fears with something real, like Microsoft patches. ...
So it's 3AM and I'm rebooting and I receive a real blue screen of death (i.e. 'we can't boot to shit, you want to recover?'), I scramble around and restore the last backup. The client isn't pleased, neither am I, and we forget about the ordeal because it's already solved.
What I'm saying is just like many others. I don't need your patches, they usually fuck things up, but some people do. So, it's a deal. Microsoft can deal with a swathe of angry customers who fail to boot or reboot loop to oblivion and I'll keep my mouth shut (other than blaming Troy Hunt, maybe).
Due to bad patches and forced reboots on some machines where losing time in working hours was a serious problem you just had to turn off updates. The sensible thing after that is disk imaging then manually applying the updates (and waiting through whatever patch rollbacks are needed) every few weeks.
The extent of the current problem is partly due to windows updates being very poorly managed and used as a vector for a new product that is in some ways inferior to the one it replaces. Some people did the necessary for them step of stopping automatic updates and then never took the time consuming steps of doing the manual updates.
Microsoft behaved badly and lost trust, leaving malware to exploit other areas where MS has behaved badly with bandaid fixes later.
Blaming the users doesn't get anyone anywhere. They had their reasons. They may not be entirely good reasons but MS should be working on regaining their trust instead of blaming them.
For people on low capped 30 - 60gig cellular and satellite connection, Windows updates are often simply unworkable.
You can't demand I use a day's worth of internet activity to install a updates. Sorry does not work that way. If M$ won't make individual updates available so people on the meter can pick just the critical, that affect them, people will continue to disable updates.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Because they do care about what crashes on your computer and why, so they can fix those issues.
If Microsoft wants telemetry data to resolve issues with system crashes, they can earn it. Start by actually reading through the forum posts with thousands of people reporting the same issue, and work to address that issue, rather than having an offshored 'support rep' copy/paste a 'solution', mark the issue as solved, never following up on the thread, and then waiting until page 807 for some enterprising individual to figure out the registry hack + permissions change + third party utility that *actually* solves the problem. This is the norm in the Microsoft support forums. Microsoft cannot simultaneously argue that they need telemetry in order to address crashes, performance issues, and system instabilities, while also ignoring the green pastures of such information volunteered to them that goes unaddressed and unresolved unless another end user provides a workaround.
That's more to do with what other people (software developers) do on your computer than what you do on it.
So then why don't they provide an opt-out if I would prefer to deal with the crashes personally and not get their help? Why don't they provide the raw data that gets sent back? You are defending Microsoft taking data that my computer has generated and not showing it to me while appearing to be perplexed as to why "*.microsoft.com DENY ANY ANY" is becoming a progressively more common firewall rule. They want information about how well my computer runs, they can ask for it, and I will be more than happy to give it to them (fairly commonly in the forums, see point #1). MS wants to take it, not show it to me, write a EULA indicating that they can do whatever they want with that data, and expect me to trust them to do the right thing on my behalf? Sorry, no.
>>'Don't Tell People To Turn Off Windows Update, Just Don't'
Yep. Better tell people to use Linux.
aaaaaaa
>> Our Windows admin spent the whole day on the phone with Microsoft and we had to rebuild ALL THREE server
That'S normal when administrating MS machines
aaaaaaa
Second or third update served through WU. That was a long time ago, so I could be off by a couple of updates as I don't keep records of the number of times MS screwed me anymore.
The cesspool just got a check and balance.
If Microsoft wants telemetry data to resolve issues with system crashes, they can earn it. Start by actually reading through the forum posts with thousands of people reporting the same issue, and work to address that issue
How many of those thousands of people do you think can actually accurately describe the actual problem they're facing, let along provide the technical details that come from crash telemetry? It's honestly like Ford asking someone who was involved in a car accident due to a bug in their car's anti-lock braking system to help them fix it, rather than asking the car itself what went wrong; cars store post-crash and post-fault telemetry for a reason, and Windows does for the very same reason. Only the system knows why the system failed.
This is the norm in the Microsoft support forums. Microsoft cannot simultaneously argue that they need telemetry in order to address crashes, performance issues, and system instabilities, while also ignoring the green pastures of such information volunteered to them that goes unaddressed and unresolved unless another end user provides a workaround.
A feature or function not behaving as expected and a program crash are two different things. One (the program crash) will provide telemetry and the other will not. Microsoft does not need telemetry to learn that sometimes the Start menu does not open when you click it; and telemetry will not tell them that, either. Those types of issues do belong in forums, as they're not crashes but, rather, UI and UX bugs that telemetry can't possibly nail down; they're not failures of the system, they're failures of the design of the system.
A program crash, on the other hand, is much easier to track down and fix when you have the actual system that experienced it provide details about it that the end user who was sitting at that system can't possibly even be aware of. Sure, you can have a thousand people report the crash, each giving a slightly different account of the issue, and you can assume that all of those similar-sounding crashes follow the same root cause, spend countless hours attempting to reproduce an intermittent problem, finally get it to happen once so you can now confirm that a problem does exist, then spend countless more hours trying to reproduce it again and again with every proposed fix because, well, it's an intermittent problem, it doesn't happen every time you do the thing that triggers it...
Or, you can have the failing system tell you how and why it failed, immediately know what needs to be fixed and how to verify that it ha been fixed, and possibly learn that there are a handful of "whys" for a given "how". That's something a thousand forum posts can't give you.
Imagine a thousand people posting about Word crashing when they open files saved by a certain older version of Word. You read all thousand reports, they all say Word 2016 sometimes crashes when opening files saved by Word 2003. Do you know, from a thousand descriptions of the crash scenario, what caused those crashes? Do you know that there was just one cause? Might there be multiple causes? I mean, come on, we're talking about Microsoft, right? Even you should agree that a single issue in their software is likely to have multiple causes.
So, what, they see the forum posts, reproduce the issue on their end--they found a working test case, they're not gonna keep looking for more of them--and fix the issue they reproduced. Well... They fix one cause of that issue. Then they report back that it has been fixed.
And it has, for about 10% of the people who reported it.
Telemetry lets them see the actual problem, and not just the result of the problem, so they can fix it right the first time.
You can't honestly be sitting there with a straight face, comparing pre-XP Windows to post-XP Windows, and telling me it doesn't work. Every version of Windows released since XP has been more stab
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I don't think having tons of vulnerable machines out there is good, even from a justice or karma perspective.
Unlike IoT gadgets, which are exclusively bought by people with far too much money in their pockets, a regular computer is a necessity in the modern world, and not having one closes the door on many good careers.
Now consider that some people are very poor and uneducated. The machine might have already cost them a year's salary, and a license would've been another year's. They probably don't have know anyone who knows Linux. They might not know what an OS is, or even what pirating is. And many of the cheaper computers are simply sold with a pirated version.
Besides, the attacker could've just as easily made them a part of a botnet rather than asking for ransom.
This is almost, but not quite, true.
If we accept that Microsoft is being forthright and truthful about this, then the telemetry you can't turn off includes "basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information."
This is quite a bit more than only crash reports. Also, crash reports are not exactly innocuous. They can contain very sensitive information themselves.
It's honestly like Ford asking someone who was involved in a car accident due to a bug in their car's anti-lock braking system to help them fix it, rather than asking the car itself what went wrong; cars store post-crash and post-fault telemetry for a reason, and Windows does for the very same reason.
Except that, with the exception of more modern cars (which are just as unacceptable as Microsoft's mandatory telemetry), your car is not constantly phoning home with that telemetry. Someone has to physically retrieve it, which involves your active consent.
If, in the event of a crash, Windows asked if it could send the crash report to Microsoft (like it used to!), there'd be no issue.
Telemetry lets them see the actual problem, and not just the result of the problem, so they can fix it right the first time.
You're arguing in favor of telemetry, but I don't see anyone arguing against it. What people are arguing against is that it is mandatory.
Update to what? Not from where. Windows XP? Because that's what I was talking about... you know, when I said "disabling automatic updates in earlier versions" and "before Microsoft played these games".
If people hadn't done that, then not held up their responsibility (to the rest of the users, not to themselves or Microsoft) to install security patches to ensure their machines didn't become shit-spewing bot nests, perhaps Microsoft wouldn't have taken away the ability.
You seem to only be able to mentally go as far back as the release of Windows 10, but we're discussing things that happened long, long before then, which lead to many of Microsoft's (admittedly ill-thought) decisions regarding Windows 10. Logical fallacy: attributing decisions made prior to an event to occurrences which followed. Correct that, then we'll talk.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
If we accept that Microsoft is being forthright and truthful about this, then the telemetry you can't turn off includes "basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information."
Basic device information (such as CPU type, RAM and storage sizes and utilization, and what hardware and drivers are installed) would seem to be somewhat required as part of a crash report. In fact, quality-related information would seem to be more user-friendly name for "why did it crash", coupled with "app compatibility" as a way of saying "what crashed". It really seems as though they've broken "crash report" into its component elements; likely in an attempt to be somewhat more transparent about what's in them. Looks like that backfired.
Also, I would certainly hope Microsoft, and not some other party, is getting information about how I use the Microsoft Store. How do you suspect the Windows Store works? Do you think every Windows install comes with a full copy of everything that has ever resided in, or will ever reside in, the Windows store (including the app I am currently writing), and just calculates the current state of the store based on the current date and time? Or do you think, more reasonably, that the current state of the store resides on Microsoft's servers and you have to send data back to those servers so they know what to serve you?
I don't think Microsoft has devised a way to see into the future and determine every single piece of software that will even be submitted to the Microsoft Store, nor have they invented a compression algorithm efficient enough to fit all of that onto a single DVD, so I'm leaning toward the server solution.
This is quite a bit more than only crash reports. Also, crash reports are not exactly innocuous. They can contain very sensitive information themselves.
There is actually a setting (set to disallow by default) to allow or disallow automatic sending of potentially sensitive contents (e.g. contents of RAM or files) along with crash reports. I don't recall where I saw it, but I do know it's there and defaults to asking the user prior to sending such data.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Someone has to physically retrieve it, which involves your active consent.
You gave that consent to Microsoft by installing a non-Enterprise version of Windows 10 and accepting the license agreement, or by installing an Enterprise version of Windows 10 and not disabling automatic error reporting.
If, in the event of a crash, Windows asked if it could send the crash report to Microsoft (like it used to!), there'd be no issue.
If Microsoft wasn't, then, forced to deal with idiots who insist they fix their crashing programs, yet refuse to provide crash reports when asked, there'd be no issue.
You're arguing in favor of telemetry, but I don't see anyone arguing against it. What people are arguing against is that it is mandatory.
Except that it's not. Either you work in an industry where Windows is mandatory, in which case you can afford the 5-license minimum for Enterprise and disable the telemetry, or you don't and you can use something else.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Well, one good reason is that most IT departments in the world can't afford to have exactly the same hardware on every production platform. It would be nice, and we'd like to have an exact duplicate of every hardware configuration / software configuration, but we just don't have unlimited cash to do that. So no matter how we test on the most prevalent hardware configuration, you can still get bitten by a particular hardware anomaly on a particular box. It's easy to blame the IT guys, but everybody has a budget they have to deal with and arguing for hardware to just test on is rarely going to be on higher management radar until there is a huge downtime that is public facing.
That's another reason that running Microsoft Windows only virtually on Linux is nice. You can have better control of the hardware it sees. But there are some PHBs out there that want it running on the bare metal for whatever good reasons, so you can never be completely free of the similar hardware issues.
Also, it is very rare for IT to use software in all the same ways that the actual end users do. It can appear to work fine, but fail when some engineer does "their" thing with the software that perhaps no other engineer does. Again, it's easy to blame the IT guys.
Sorry Troy Hunt... Out here in the real world, Windows Update bricks PCs without notice. Most of my clients are in business and rely on their PCs & Servers to work day in and out reliably, yet when Windows Update pushes something out that brings that client to the paper & pencil age, that is not exactly a way to inspire confidence. And removing descriptions of just what a patch does, we should not have to play Russian Roulette.
The Windows 10 upgrade was yet another example of a company not knowing when "No means No" and deserved to be blocked.
So instead of blaming organizations for not patching, why isn't anyone telling Microsoft that we have had enough of their hole-filled software and to fix it or get your wallet out.
Agrisea Tsunami - Epyc Servers... https://agrisea.net/products
Perhaps they should... What they're doing now seems to be working just as well, if not better, given that Win 10 is more stable than previous versions; but I imagine it would be even more so if they still had a QA team.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
You say it was reading and writing your hard drive, but you don't at any point mention network activity. Considering that the only way, out of the box, to monitor disk access is Task Manager and you specifically mention that this was the first 5 minutes, that's what you must have been using. Did you see network activity in that time? And which process are you referring to as "diagtrack"? If you have a process that's actually called "diagtrack", that's not Windows and you should contact your OEM about it.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Microsoft is the cause why a lot of end users disable updates. There is/was a setting to only install security patches and not install the rest. Microsoft then made telemetry and Windows10 appear as security patches so they would get installed. The users disabled automatic updates and started installing security patches manually (those users who bothered to do it, anyway). After that, Microsoft stopped providing patches individually, so that if you wanted to install a security patch, you had to install telemetry and GWX as well. So the users stopped installing updates completely.
If Microsoft made it possible to only install security patches (and chose which ones, I may not need a patch that protects my computer from a local user) and preferable made it so that not every patch required a reboot, I think more people would update their OS. Of course, now that Microsoft has lost the trust of its users, it may be extremely difficult to earn in back.
I chose to uninstall the protocol from my Windows 10 computer (Microsoft published workaround) instead of installing the patch because I do not trust the patch to not re-enable telemetry on my PC.
I'm talking XP for this one. I thought that was obvious, as that's where WU on the client started? WU always had the ability to do exactly what MS has completed with Win10, so disabling it way back then was the intelligent move for systems admins that needed to keep things running and avoid fire drills. Had MS followed a sensible update process with mandatory critical patches that only fixed holes and with proper warning if it would fubar an API which, admittedly, can happen, then people would have trusted them. As it was, MS acted like they knew better what should run on your computer and treated the updates as en blanc permission to reconfigure whatever they deemed appropriate. So admins started disabling this WU process, word got out, and many others saw their problems go away when they disabled it, so it spread. If disabling WU hadn't fixed something, then people would have stopped disabling WU.... So who do you blame?
In truth, MS systems can be semi-secure at least from the bot-net spewing bits if MS had a sensible configuration and firewall in place on their OS. Ideally you'd have a separate firewall between you and the internet, but not having one on system caused massive issues. (I'm sure you recall the study that dropping a new XP system without an external firewall on the internet to update it via WU would infect it before it could even start downloading?) Also running all processes at System was another problem, directly with XP and still an issue with W10, although it's a touch more difficult to execute an overflow as System. (This is the root of most if not all of MS's exploit issues with their apps)
The cesspool just got a check and balance.
Microsoft is the cause why a lot of end users disable updates. There is/was a setting to only install security patches and not install the rest. Microsoft then made telemetry and Windows10 appear as security patches so they would get installed.
So you're saying that end users began disabling updates on Windows XP in 2001 because of something Microsoft did with Windows 10 in 2015?
Nah. Don't think so.
Before Windows 10 was released, end users spent 14 years making it clear they can not be trusted to keep their systems up to date with patches for critical vulnerabilities, so we've now all lost the ability to decide for ourselves. Even in the face of the option to only install critical (security) updates, people entirely disabled them, then never went back and manually applied patches which truly were critical, consistently enough over the course of a decade and a half that the end result was a mass of shit-spewing bot nests (which then formed shit-spewing botnets) and the general idea that Windows was inherently insecure, when the reality is that a patched Windows system is no more or less secure than any other fully patched system and, with those security patches regularly installed, the shit-spewing botnet problem would largely not exist.
We've been dealing with that particular problem for as long as we have precisely because users chose not to install updates, and have made that choice for far longer than Windows 10 had been out.
If Microsoft made it possible to only install security patches
I like where this is going; we might see eye-to-eye on this after all...
(and chose which ones,
Oh, so close. The problem, here, is that when you can choose which updates to install, you can choose to install no updates, which is what people have been doing since 2001 when they were first given the option, which is why we can no longer make that choice.
I may not need a patch that protects my computer from a local user)
Right, because nobody every breaks into buildings and messes with (or steals) computers. You may be the only intended user of a system, but that doesn't stop someone else from gaining access. There is also the possibility of a trusted software vendor getting hacked and their application ending up with some code that exploits that "local user" vulnerability you didn't patch. You use that software regularly, you install the bad update, you run the application... you are the local user and now you've been exploited. Guess you needed that patch, after all.
and preferable made it so that not every patch required a reboot,
So many patches don't, actually. It just seems like they all do because there's usually (but not always) one that does in every update set.
I think more people would update their OS.
History has shown us otherwise.
I chose to uninstall the protocol from my Windows 10 computer (Microsoft published workaround) instead of installing the patch because I do not trust the patch to not re-enable telemetry on my PC.
Link, please? Actually, nevermind, I'm calling bullshit either way. You don't trust Microsoft's patch to do the job, but you trust their manual procedures? And you trust that no part of the system will act to protect the services you've removed? You do realize that Windows has had system file protection (and automatic repair and restoration of said files) since Windows 7, right?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
You gave that consent to Microsoft by installing a non-Enterprise version of Windows 10 and accepting the license agreement, or by installing an Enterprise version of Windows 10 and not disabling automatic error reporting.
Legally, yes. In the real world, though, no. Consent through EULAs cannot be considered "active consent" by any reasonable definition.
If Microsoft wasn't, then, forced to deal with idiots who insist they fix their crashing programs, yet refuse to provide crash reports when asked, there'd be no issue.
Fine. If Microsoft doesn't want to deal with people who think that clicking the "send crash report" button means that Microsoft will fix the crash, then do it in the background -- but let people disable the automatic reporting if they wish.
Except that it's not. Either you work in an industry where Windows is mandatory, in which case you can afford the 5-license minimum for Enterprise and disable the telemetry, or you don't and you can use something else.
Well, yes, in the big picture, nothing about Windows is mandatory. Even using a computer at all is optional. But that argument is a bit disingenuous. I was talking about telemetry being mandatory if you're using consumer level Windows.
I'm talking XP for this one.
I don't recall early issues with WU, actually. I do recall being surprised that such a new system seemed to work quite well out of the box.
I thought that was obvious, as that's where WU on the client started?
One would think, but you seemed to be fixed on more recent events so I wanted to be sure.
WU always had the ability to do exactly what MS has completed with Win10, so disabling it way back then was the intelligent move for systems admins that needed to keep things running and avoid fire drills.
We actually agree on this point. Where it falls apart is that, while sysadmins would go back and eventually install updates after testing them, end users were disabling the updates, then not installing them later.
WSUS or no WSUS, sysadmins can still disable automatic updates on Win 10 Enterprise, so nothing changes for a company that has at least 5 computers and buys the right version of Windows (which is no more expensive, mind you; it gets cheaper in a volume license). The same actually applies to someone with a single computer, if they're willing to pay the 5 license minimum.
I've always been one to disable updates, myself. I've also always been one to manually install them. That is not the problem! The problem is when people do the first step, but not the second!
Again, we're not talking about sysadmins, here. We're talking about end users who really have no business managing their own updates.
In truth, MS systems can be semi-secure at least from the bot-net spewing bits if MS had a sensible configuration and firewall in place on their OS. Ideally you'd have a separate firewall between you and the internet, but not having one on system caused massive issues.
Well, then, I guess it's a good thing one has been included since XP SP2. Mind you, it didn't really get good until Vista, but it was there. It's really a non-issue wince Vista, though, as one has been included, with a "deny by default" configuration, since Vista.
Ideally you'd have a separate firewall between you and the internet, but not having one on system caused massive issues.
Well, yeah, the same can be said of any OS, though, if no firewall is enabled. In fact, hardware firewalls should really be the norm (even cheap routers include basic firewall functions now), especially in the face of Intel's AMT exploits, which are OS-agnostic; even the best software firewall won't stop that from being exploited as the ME grabs the packets and the OS never even sees them.
I'm sure you recall the study that dropping a new XP system without an external firewall on the internet to update it via WU would infect it before it could even start downloading?
Actually, no, I didn't know any study was necessary. Blaster was so bad a friend of mine ended up having to reinstall 4 times to get the patch before infection occurred. I was there, watching and laughing the whole time.
Also running all processes at System was another problem, directly with XP and still an issue with W10, although it's a touch more difficult to execute an overflow as System.
Was, was, was, was, was. All I hear from you is a stream of "was". Really, only system services run as System anymore; it's something they started fixing with Vista and it's taken some time to get all the software vendors on board with running their applications as the user, but we're finally there. If it's still an issue on your Win 10 system, talk to the app vendor who hasn't been keeping up; Microsoft made it a pain in the ass to keep following the old and insecure model and that's really all they can do without everyone bitching about how they broke that one mission critical application.
Yes, the problem dates
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Legally, yes. In the real world, though, no. Consent through EULAs cannot be considered "active consent" by any reasonable definition.
You actively clicked the "Agree" button. If you didn't actively read what you were agreeing to, that's your own fault. Perhaps, if people actively refused to agree to shit that was onerously long and difficult to read, that shit would be made a lot shorter and in plain English. Companies care about market share and they won't change as long as we keep giving it to them. Take responsibility, say "NO!" to things you don't agree to, rather than lying and saying "I AGREE!", then trying to make it someone else's fault when the thing you claimed to agree to happens to you and you don't like it.
Fine. If Microsoft doesn't want to deal with people who think that clicking the "send crash report" button means that Microsoft will fix the crash, then do it in the background -- but let people disable the automatic reporting if they wish.
You misunderstand. These aren't people who think clicking the button means MS will fix the crashes, these are people who REFUSE TO CLICK THE BUTTON and bitch that MS never fixes the crashes. Go back and read what I wrote again, because you clearly missed something.
Well, yes, in the big picture, nothing about Windows is mandatory. Even using a computer at all is optional. But that argument is a bit disingenuous. I was talking about telemetry being mandatory if you're using consumer level Windows.
And what we have here is an informed market. We all know telemetry is there. Don't like it? Don't use it. You really do have a choice.
Just don't believe that Apple collects any less telemetry, or that you can disable all of it. They don't and you can't. You might know this if you ever read that EULA we were just talking about.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Right, because nobody every breaks into buildings and messes with (or steals) computers.
If somebody broke into my home and stole my computer, I would be more unhappy because they stole my computer and not because now they can hack it (they can just pull the HDD out and connect it to another PC or boot my PC from a live CD if they want to access the data).
There is also the possibility of a trusted software vendor getting hacked and their application ending up with some code that exploits that "local user" vulnerability you didn't patch. You use that software regularly, you install the bad update, you run the application... you are the local user and now you've been exploited. Guess you needed that patch, after all.
And in Windows XP days my user was the admin - there was no need to exploit privilege escalation bug if the program was bad. Now my user is still the admin, but UAC sometimes pops up asking for my approval.
OTOH, if I opened a wrong email attachment, it could encrypt my data even if running as limited user (me) on a fully patched system (or Linux). So, on a single user computer it is kinda pointless ("The malware encrypted all my data, but at least the system files are unaffected, yay!").
History has shown us otherwise.
So, with today's forced updates, everybody updates more often? Even Windows 7 or 8? I used to update my Windows 7 PCs (not very often, but I did), until GWX and telemetry showed up. And now I cannot even pick and choose to not install telemetry, so Windows Update got disabled. Though I will install the specific patch on my Windows 7 and Windows XP laptops as those may be exposed to the internet without a router.
I would say that when telemetry and GWX came out, more people disabled updates if they wanted to avoid installing Windows 10.
Link, please?
https://technet.microsoft.com/...
You don't trust Microsoft's patch to do the job, but you trust their manual procedures? And you trust that no part of the system will act to protect the services you've removed? You do realize that Windows has had system file protection (and automatic repair and restoration of said files) since Windows 7, right?
Microsoft's patch means running their (new) code on my computer. It may just do what is promised, but it may also flip some registry or group policy setting that disables telemetry (enterprise edition). I do not know either way, so I would be back to sniffing packets on my router looking for any communication between that PC and Microsoft.
On the other hand, I expect the manual workaround to work as promised, because I really doubt that Microsoft had the foresight to make uninstalling SMBv1 support also mess up the other settings.
We actually agree on this point. Where it falls apart is that, while sysadmins would go back and eventually install updates after testing them, end users were disabling the updates, then not installing them later.
And my point is that the same forces driving sys admins to disable it drove regular users to disable it. I do agree with your conclusion about them not following through afterwards, however the fault remains with MS in the first place, for forcing more than necessary down users throats. By way of comparison, Apple AFAIK has only used the mandatory push once. In over 5 years.
WSUS or no WSUS, sysadmins can still disable automatic updates on Win 10 Enterprise, so nothing changes for a company that has at least 5 computers and buys the right version of Windows
And with Win10, Enterprise or not, you will be forced to accept all updates within a 9-12 month window. I'm too lazy to look it up again for precision. It is no longer your choice. You will upgrade, soon or sooner.
Well, then, I guess it's a good thing one has been included since XP SP2. Mind you, it didn't really get good until Vista, but it was there. It's really a non-issue wince Vista, though, as one has been included, with a "deny by default" configuration, since Vista.
I recall some vague thing around SP2+ that while things were better, it was still best to not connect directly without a router + firewall in place. You are correct that once Vista came out, that concern seemed to diminish significantly.
especially in the face of Intel's AMT exploits, which are OS-agnostic; even the best software firewall won't stop that from being exploited as the ME grabs the packets and the OS never even sees them.
Well, if you have hardware with AMT in it. :)
Also running all processes at System was another problem, directly with XP and still an issue with W10, although it's a touch more difficult to execute an overflow as System.
Was, was, was, was, was. All I hear from you is a stream of "was". Really, only system services run as System anymore; it's something they started fixing with Vista and it's taken some time to get all the software vendors on board with running their applications as the user, but we're finally there. If it's still an issue on your Win 10 system, talk to the app vendor who hasn't been keeping up; Microsoft made it a pain in the ass to keep following the old and insecure model and that's really all they can do without everyone bitching about how they broke that one mission critical application.
I can honestly tell you it's still a problem with Server 2012. It has little to do with the fact that the app process has a lower than system token. If any DLL used by the app, or, honestly, if the app can load a DLL, you can execute any arbitrary code with System privs. Like I mentioned, it used to be simple, it's harder now, but by no means impossible. The problem I'm highlighting is the core issue with Windows itself - it's insecure by design. That design has not changed since 2012 or, in fact, since NT4, in any meaningful way. Bandaids are starting to lean.
Yes, the problem dates back to early versions of Windows, but the problem persists due to recent versions of applications.
As mentioned above - it has little to do with the apps. It's actually an inherent "feature" if you will of the OS.
Microsoft could fix it in the next release, but all of those applications that rely on it (still, even though they should not) would break and users would blame Microsoft, rather than the application vendors. Like you're doing right now.
Hopefully I've laid clear why the blame is appropriately laid at MS's feet.
The cesspool just got a check and balance.
If somebody broke into my home and stole my computer, I would be more unhappy because they stole my computer and not because now they can hack it (they can just pull the HDD out and connect it to another PC or boot my PC from a live CD if they want to access the data).
Why, when full disk encryption is so easy?
And in Windows XP days my user was the admin - there was no need to exploit privilege escalation bug if the program was bad. Now my user is still the admin, but UAC sometimes pops up asking for my approval.
Ok, so you don't care about security.
OTOH, if I opened a wrong email attachment, it could encrypt my data even if running as limited user (me) on a fully patched system (or Linux). So, on a single user computer it is kinda pointless ("The malware encrypted all my data, but at least the system files are unaffected, yay!").
Unless you run backups as an admin user; then, at least, it couldn't encrypt your backups without privilege escalation.
I would say that when telemetry and GWX came out, more people disabled updates if they wanted to avoid installing Windows 10.
Why do all of you idiots act like telemetry is something that's brand new? Not being able to turn it off is brand new, but it's nothing new at all and most of you have probably had it enabled this whole damn time. The best part? Many of you probably still have it enabled! Hell, most of you probably wanted it enabled and are just now starting to even care because you're losing the ability to turn it off any everyone is talking about it.
Microsoft's patch means running their (new) code on my computer. It may just do what is promised, but it may also flip some registry or group policy setting that disables telemetry (enterprise edition). I do not know either way, so I would be back to sniffing packets on my router looking for any communication between that PC and Microsoft. On the other hand, I expect the manual workaround to work as promised, because I really doubt that Microsoft had the foresight to make uninstalling SMBv1 support also mess up the other settings.
Oh, you were talking about disabling SMB; you mentioned telemetry, so that's what I thought you were talking about. I was confused, as I was not aware that Microsoft ever released an official method (manual or via patch) to remove telemetry from Windows 10. Hell, it's still not clear until you read the last sentence of that paragraph, as you still talk about disabling telemetry.
You may be all over the place but, well hey, you're keeping the price of my Reynolds stock high. That is, unless you buy generic tinfoil.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
And with Win10, Enterprise or not, you will be forced to accept all updates within a 9-12 month window. I'm too lazy to look it up again for precision. It is no longer your choice. You will upgrade, soon or sooner.
I can't find anything pointing to that so, really, if you could be so kind as to look it up and provide a link, that'd be great. Otherwise, well, I'm having a really hard time trusting your "facts" when I can't verify them; I have sources for what I say, and I provide them when I make my more unbelievable claims, but I see none from you. Without some indication that your "facts" are anything more than conjecture, there's not a whole lot of point continuing this conversation.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Sure, this has some discussion of when Business/Enterprise customers can expect to see updates, but doesn't relate the "forced" aspect. Note that there is no statement that they can be avoided. There's wishy-washy wording in there. This, while older, has the verbiage I remember being finalized last year. Another story implying there's no stopping the upgrades, but, like you, I cannot find the original smoking gun that made me walk away from Win10 as a viable OS. That was over 2 years ago, and digging through thousands of google stories on "forced enterprise windows 10 upgrades" isn't what I am doing today.
The cesspool just got a check and balance.