More Than Half of PC Applications Installed Worldwide Are Out-of-Date (helpnetsecurity.com)

Because upgrades are often crap by AmiMoJo · 2019-01-23 02:06 · Score: 5, Informative

Half the time the upgrade doesn't add any value for the user, so why upgrade? VLC is a great example, it pretty much just works and the updates only add support for very obscure stuff that most users don't care about.

The real problem is that security fixes are not well communicated, and that sometimes abused as a way to get users to take user-hostile changes.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC

Re:Because upgrades are often crap by Opportunist · 2019-01-23 02:15 · Score: 2

Umm... VLC isn't exactly the best example of what you shouldn't update due to feature bloat. Quite a few of the updates VLC gets plug security holes. Video formats are public knowledge and quite hard to implement securely, twice so if that wasn't exactly the key demand when developing the formats, and the programs using them.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Because upgrades are often crap by AmiMoJo · 2019-01-23 02:22 · Score: 2

It would help if updating was easier. I keep meaning to try Chocolatey or another package manager to make the process easier. The effort of downloading and installing/extracting VLC every time they release an update is too great for me to bother.
If it was just VLC I might, but most apps are as bad. Particularly annoying is when you have non-default install options that the update resets every time.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Because upgrades are often crap by Ol+Olsoc · 2019-01-23 02:38 · Score: 2

It would help if updating was easier. I keep meaning to try Chocolatey or another package manager to make the process easier. The effort of downloading and installing/extracting VLC every time they release an update is too great for me to bother.
As well, many updates don't work as well as what they replace.

--
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Re:Because upgrades are often crap by oogoliegoogolie · 2019-01-23 03:37 · Score: 5, Insightful

The real problem is that security fixes are not well communicated, and that sometimes abused as a way to get users to take user-hostile changes.
Exactly! Most updates have replaced detailed release notes with ambiguous comments as such.
"Fixed various bugs"
"Fixes some other minor issues"
"Other improvements and bug fixes"
"Major improvements under the hood"
"Improved security measures"
"Improved wifi setup"
Words like "improved, improvement,various, some" are ambiguous and/or subjective. Was a feature removed or added? Was functionality changed? When companies say improved, does that mean improved for me or for the company? Every bug-tracking software lets you create a list of the fixed bugs-export it, review it, edit it, then publish it! Usually when companies aren't explaining something it makes me wonder what are they hiding.
WTF is with all this rapid-release crap? So many products have too many releases now. Don't push an update out just for typos other minor UI designs. Return to semi-annual major updates for everything except for critical security patches and major functionality issues.
Re:Because upgrades are often crap by Solandri · 2019-01-23 03:53 · Score: 3, Insightful

The real problem is that security fixes are not well communicated, and that sometimes abused as a way to get users to take user-hostile changes.
Yeah, for open source software the security fixes are usually only available via updating the software. It's like car manufacturers requiring you to get the newest model car (for free in the case of open source) instead of issuing recalls to fix problems.

Pay software usually issues security updates for older versions for a while, without requiring you update to a new version (that you have to pay for). But they seem to be trying to kill that model off, replacing it with a subscription model which forces everyone onto the same version.

It would be less of a problem if you could customize software and its installations. Often you only want a limited feature set (e.g. only Word and Excel) but the software insists on installing everything. That's the problem I've had with antivirus software. They all now include all sorts of web monitoring and active file inspection (tries to scan in real-time every file your computer tries to open) which just intolerably slows down the computer or browser. I have to shut those features off, but would rather not install them in the first place. Or things like the infamous ribbon interface in Office. I bet tens if not hundreds of millions of users would've killed for an option to disable it and go back to the previous interface. Instead, your only option is to continue using outdated software.
Re:Because upgrades are often crap by Anonymous Coward · 2019-01-23 04:11 · Score: 1

ACD Canvas is a classic example of the push to subscription mode. Back around 2015 they moved from regular version numbering to annual version numbering ... but the annual updates had gradually fewer useful changes and there have not been bug or security updates for years. Maybe the lack of security/bug fixes means there aren't any - highly unlikely in any software no matter how long it's been out (Canvas has been out using its current architecture since before 2010). Then, in the last year or so, they've made it clear that future updates must be obtained through an annual subscription that's about the same price a full purchase used to be. Given the continuing lack of significant improvements (the last one was a move to 64 bits about 2 years ago, which didn't really improve things much because it's still single-threaded in significant ways. So I've chosen to stop updating. I'm not a business that can write off an annual update at the price of a new copy or negotiate some wholesale deal. Still use it; it's a very nice illustration+GIS package. But future updates will depend on whether there's a clear bug to fix (that should be free regardless!) or the underlying architecture becomes more multi-core friendly (some operations need that to speed up).
Re: Because upgrades are often crap by edris90 · 2019-01-23 05:14 · Score: 1

How many time how many times I've had to scour the net for the old version of something because the new version intentionally broke something intrinsic, or remove a reliable user-controlled function and replace it with restricted dumbed-down crap, so they can sell you what you already had on a new product, instead of Simply maintaining what already worked. When you do a job right no one ever has to do it again. When you solve a problem it eliminates the need to deal with that problem ever again. but since we live in a country of pussies that depend on money for psychological security, there is no incentive for people to finish the job. Every incentive for them to stop short of solving the problem in order to sell more products
Re:Because upgrades are often crap by solios · 2019-01-23 05:43 · Score: 1

Go back to telling me EXACTLY what you're changing on my system when I install your update and I'll go back to installing them.
Re:Because upgrades are often crap by Darinbob · 2019-01-23 07:03 · Score: 2

I don't upgrade itunes often, because every time I do they radically change the user interface. I only use it to sync podcasts, never to buy music, and it only runs when I ask it to.
Upgrading rarely does anything useful. Yes, if there's a security hole then upgrading is good. But applications insist on upgrading when there is not need and even when the upgraded version becomes less useful or introduces dubious features. The concept that a new version is automatically more secure is naive.
Re:Because upgrades are often crap by Darinbob · 2019-01-23 07:09 · Score: 2

Probably the whole continuous integration and dev-ops crap. Developers are being conditioned/trained to rapidly release changes, and use the customer as the tester, rather than stick to a reliable and predictable release schedule. It should be the job of the rest of the company to push back and insist on a reliable release schedule. This lets the company predict and communicate to customers what upcoming features will be, engage and figure out what customers want, and so forth. Letting developers run the show on a sprint schedule is failing.
Re:Because upgrades are often crap by Darinbob · 2019-01-23 07:15 · Score: 1

That may be for PC software, but in many areas of software it isn't true. Ie, embedded medical devices - you sell the expensive device, plus some amount of maintenance that gives up updated software, and every release gives you a detailed list of what changed. Since some customes may be optionally paying for the update, it is good business to list what the new features are and why they are worth paying for.
Right now with one product I worked on there was a bump in a version number just to keep it matched with the version for a related component. But it's causing me headaches because a partner is demanding to know what changed so that they can test it, and the product manager is exacerbating this by failing to understand that nothing changed. The point being that many customers are paying attention to releases.
Re:Because upgrades are often crap by R.Mo_Robert · 2019-01-23 08:43 · Score: 1

The real problem is that security fixes are not well communicated...
Exactly! Most updates have replaced detailed release notes with ambiguous comments as such.
"Fixed various bugs"
"Fixes some other minor issues" [...]
Even worse, so many apps now (on mobile devices especially) have dumbed their release notes down to something that isn't even release notes. You 've seen them--things like: "We're making things better in every release. Make sure you have automatic updates turned on!" without even the slightest hint of something resembling the summary of a changelog (which, at least, "fixed various bugs" might be).

--
R.Mo
Re:Because upgrades are often crap by scdeimos · 2019-01-23 09:43 · Score: 1

^ This.
Another common trend nowdays is to take previously free features and move them a login-required paywall, especially on mobile devices but often on desktops as well.
Re:Because upgrades are often crap by Ol+Olsoc · 2019-01-23 10:10 · Score: 1

^ This.
Another common trend nowdays is to take previously free features and move them a login-required paywall, especially on mobile devices but often on desktops as well.
There is a Bell Curve to many softwares. The early versions show promise, then they hit a peak of quality after a couple revisions. Then they get bloated.
I have an SDR program I use that is pretty nice. Many other users keep asking for this or that new feature - often for some arcane things only they use. I've been pleading the devs not to implement them - which of course pisses off the demander. But I'll probably lose, as one person gets their special feature, and the rest of us will have to jump through the hoops of a diminshed product.

--
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Re:Because upgrades are often crap by Luckyo · 2019-01-23 11:00 · Score: 1

There's also the fact that most security fixes for software like VLC are utterly pointless unless you're using some obscure internet facing features that actually have meaningful holes in them.
Most people I know use media players to play files they trust already on their machine. Meaning it is not a security threat even if it's ten years old.
Re:Because upgrades are often crap by Zehsi · 2019-01-23 12:14 · Score: 1

wrong OS
Re:Because upgrades are often crap by Mr_Silver · 2019-01-23 21:34 · Score: 1

The real problem is that security fixes are not well communicated, and that sometimes abused as a way to get users to take user-hostile changes.
I'd also argue that if Microsoft had taken steps to allow third parties (including independent developers, not just large software houses) the ability to have their applications registered on and then automatically updated through Windows Update then we probably wouldn't have had quite the situation without outdated software as we do now.
I know UWP changes things a bit but, even now, if you're not using that then every single application needs to roll their own update mechanism creating a tonne of unnecessary duplication that could have been handled by Windows Update.

--
Avantslash - View Slashdot cleanly on your mobile phone.
Re:Because upgrades are often crap by AmiMoJo · 2019-01-23 21:39 · Score: 1

I was really hoping that Chocolatey would make updates much easier. The only real issue I've seen so far is that it's support for portable apps is very poor. I generally prefer not to install if possible, many apps run just fine from an extracted archive. Even the ones that claim to need installing.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Because upgrades are often crap by strikethree · 2019-01-24 12:25 · Score: 1

WTF is with all this rapid-release crap?
Gotta get the product out this quarter or the company will fold. Quality Assurance takes time, we don't have time. Quality Assurance takes money.... whoah whoah whoah there cowboy. QA costs money?! Fuck that shit. Release it now. We will fix any bugs later if they impact adoption of the device/thing/product.
Are you really curious or ...

--
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen

So? by Drethon · 2019-01-23 02:08 · Score: 1

As far as I know (feel free to correct my ignorance) Adobe Shockwave is for online games which I don't bother with, I only use VLC for DVDs since Windows refuses a proper media player and I don't use Skype. If these programs are running in a vulnerable manner (excluding VLC, which is not set to auto run), seems like Windows is more responsible since I never asked for them to run...

Re:So? by Opportunist · 2019-01-23 02:17 · Score: 1

In this case I'd highly recommend removing Shockwave from the system altogether (and flush Flash while you're at it, too). I would still keep VLC updated just in case, unless you deliberately decided to associate video files with Media Player (and I honestly couldn't think of any good reason why anyone would want that if they have VLC), there is a nonzero chance that at some point in time it might open a video file.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:So? by Drethon · 2019-01-23 02:33 · Score: 1

I pretty much don't view videos except DVD or streaming, so media player is associated with all the videos I don't watch... Removing Shockwave is probably a good idea, I've never really given the program much thought, assuming it is installed.
Re:So? by Opportunist · 2019-01-23 03:21 · Score: 1

Are you sure? I wouldn't put it beyond some shady site to abuse a loophole in HTML5 to open a video, whether you like it or not.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:So? by Drethon · 2019-01-23 03:50 · Score: 1

Are you sure? I wouldn't put it beyond some shady site to abuse a loophole in HTML5 to open a video, whether you like it or not.
As long as it is a video run by the default player, it will be media player as I never set VLC as default anything, I just manually open DVDs. I'm not big on auto run anyway, I usually plug in a device or insert a disk, then go do something else for a while and then come back later and use it. I hate windows popping up on me when I'm busy with something else.

No kidding by The+Grim+Reefer · 2019-01-23 02:12 · Score: 5, Insightful

Avast's PC Trends Report 2019 found [PDF] that users are making themselves vulnerable by not implementing security patches and keeping outdated versions of popular applications on their PCs. From a news report:

The applications where updates are most frequently neglected include Adobe Shockwave (96%), VLC Media Player (94%) and Skype (94%).

There are a lot of applications that the newer versions are considerably worse. It's funny that they mention Skype. It worked much better and was more intuitive 10 years ago in comparison to what is currently available.

I'm surprised that Shockwave is on the list. I didn't know that it was still in use.

Re:No kidding by Austerity+Empowers · 2019-01-23 02:39 · Score: 3, Insightful

This is the best reason why users don't upgrade. The upgrade is trash or breaks something of value. People are going to pick features > security every time.
Re:No kidding by jellomizer · 2019-01-23 02:48 · Score: 1

Not that they are worse. But updating software just brings in features that you don't use and could get in the way for your usage.
It would be a nightmare for even a large software company like Microsoft and Apple. To apply Security Updates, Bug Fixes, and performance improvements, for more then 3 major versions. of a product. A small company it is taking too many resources to fix their current version, where they want to put their resources in making the next version.
For the most part we will need to expect updates will give us new features that we don't want or need, and this is where we will also get the Security Fixes.
This is part of the reason why Cloud is so popular, it forces the upgrade, because the vendor upgrades everyone, and takes the customer out of the picture. Yep they get the crap they don't want, but their system is always up to date.
Now if we collectively are tired of the cloud and feature bloat. We really should start to work on better source control systems, that handles branching and merging much better and easier, as well as a fast and easy way to deploy fixes, or quickly recall such fixes if there is a bigger problem.
My 22+ Years experience on what is now called "Full Stack" Development. Deployment and applying fixes safely has always been the biggest hurtle, which is often more difficult to deal with then the actual program.

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Re: No kidding by Darinbob · 2019-01-23 07:16 · Score: 1

So trying to avoid malware is being selfish?
Re:No kidding by Darinbob · 2019-01-23 07:20 · Score: 1

Not true. Upgrades and security should be separate things. If there is a security fix then the upgrade notes must mention this. Upgrading by itself does not increase security. If the company can't take the time to accurately communicate what is in an upgrade then the consumer rightfully should refuse the upgrades, or uninstall the product. If the company insists on automatic upgrades then that is a problem in itself. Rapid release cycles do not promote security and can actually worsen security because of the lack of adequate testing that a break-neck release schedule discourages.

Way too many by DarkRookie2 · 2019-01-23 02:14 · Score: 5, Interesting

Software now adays seems to want to update every 6 hours.
This is not surprising and prolly the reason for stuff like this.
People should make stuff that doesn't require that many updates.

--
http://progressquest.com/spoltog.php?name=Son+Of+Son+Of+DarkRookie

Re:Way too many by Anonymous Coward · 2019-01-23 02:24 · Score: 1

You can thank "Agile" for that. Which is just another spin on the old "change request" of waterfall except that clients are told it is better. Not saying that waterfall is any mind you.
Re:Way too many by Malc · 2019-01-23 02:42 · Score: 3, Interesting

Updates this frequently seems to be an excuse for poorer quality software. Every update fixes problems with the last version and introduces a ton of new issues. The overall average quality of the software stays poor and doesn't incrementally improve. I think I preferred the old way of working where updates were just fixes, and once in a while I got an upgrade that actually felt worthwhile because the impact of all the new features normally out weighed any new issues introduced.
If I've got something I'm happy with then I can wait; I don't need something new every 30s (or even every two weeks)
Re:Way too many by jellomizer · 2019-01-23 02:50 · Score: 1

Well it is based on how much software you want to update. A highly maintained app may get an update once a week. but if you have 28 of these apps, it will seem like every 6 hours there is a new update.

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Re:Way too many by drinkypoo · 2019-01-23 03:42 · Score: 1

People certainly tried a lot harder before internet updates, when most customers wouldn't apply updates at all. To my mind games have actually been hit hardest. The patches often add up to be bigger than the game...

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Re:Way too many by AmiMoJo · 2019-01-23 05:18 · Score: 1

Users are partly to blame for this. They think that an app that hasn't been updated for 3 years is dead and abandoned, when in fact it's just stable.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Way too many by DarkRookie2 · 2019-01-23 05:22 · Score: 1

I think most user wouldn't notice or care.

--
http://progressquest.com/spoltog.php?name=Son+Of+Son+Of+DarkRookie
Re:Way too many by AmiMoJo · 2019-01-23 05:33 · Score: 1

App stores and search engines do it too. They favour new apps and recently updated web pages.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Way too many by Falos · 2019-01-23 05:56 · Score: 1

Heard somewhere they will outright unlist something from the two major stores (ios/playstore) if it hasn't updated in X timeunits.
Re:Way too many by RedK · 2019-01-23 07:06 · Score: 1

After waiting for more than a decade for Enlightenment 17 while stuck on an aging Enlightenment DR16, yes, it felt like Rasterman had abandonned it while hyping up and over-promising a bunch of features. Features that most people were hungry for.
You guys generalize quite a bit. Slow release cycles are not inherently better or provide more stability than faster cycles. Sometimes slow release cycles are just that : overly slow because stuff isn't getting done.
Another good example : Duke Nukem Forever, delayed endlessly because George Broussard got a World of Warcraft addiction.

--
"Not to mention all the idiots who use words like boxen."
Anonymous Coward on Monday August 04, @06:49PM
Re:Way too many by Darinbob · 2019-01-23 07:24 · Score: 2

Customer push 1 fixes a bug. Two weeks later customer push 2 fixes the security hole in the earlier push, while also adding a new UI widget. Two weeks later the security patch is tweaked because it wasn't working, and at the same time there is a patch to have tighter integration with the monetization store. Two weeks later a patch is out to fix actually encrypt the monetizing transaction, along with a new dark UI theme. Two weeks later the software now pops up a notification to remind users to not turn off automatic updates.
Re: Way too many by Darinbob · 2019-01-23 07:25 · Score: 1

Agile comes from bottom up. The developers push for Agile while not caring at all about the fiducial reports.
Re: Way too many by ayesnymous · 2019-01-23 16:31 · Score: 1

As a developer, why would I want to spend more time in meetings, have more deadlines, and less time to finish my work?
Re: Way too many by Darinbob · 2019-01-23 17:00 · Score: 1

Where did I suggest this? Agile actually adds MORE meetings if you count the daily scrums, the long planning sessions every two weeks, and of course the fallout because no one ever does Agile perfectly and the scrums end up lasting too long. It seems if anyone criticizes even the smallest aspect of Agile that they get accused of being a Waterfall heretic.
Developers should be developing. They should not be the business drivers, they should not tell operations how to run the company. You can have a sane and predictable release schedule while still using Agile. It falls apart when the entire company decides that they want to be Agile, and have continuous delivery and think that thay can push out a new update every month when the testing cycle is longer than that.
Re: Way too many by ayesnymous · 2019-01-24 05:29 · Score: 1

Yes I meant Agile adds more meetings, sorry if I wasn't clear.
Re:Way too many by strikethree · 2019-01-24 12:27 · Score: 1

Future Linux User in 2020
Almost 2020 now bud. Need any advice on getting started? ;)

--
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
Re:Way too many by DarkRookie2 · 2019-01-25 03:14 · Score: 1

Nah, but thanks.
Was waiting on Steam to allow things that weren't Steam games to run on Proton.
That has happened and WINE is now version 4.0
Going to Kubuntu sometime this weekend.

--
http://progressquest.com/spoltog.php?name=Son+Of+Son+Of+DarkRookie

'Old'. 'Spring 2017'. Hmm.... by mccalli · 2019-01-23 02:16 · Score: 1

That's way too recent to be unsupported.

Re:'Old'. 'Spring 2017'. Hmm.... by jellomizer · 2019-01-23 02:53 · Score: 1

Depends on the App.
Internet facings apps, that allow the user to point to wherever. Such as web browsers, email clients, or even that Facebook app, which will link to an outside site within the App. Will need constant security updates and fixes. Spring 2017 for your web browser is like crossing a tightrope. However if it is an internal app. Say how Excel use to be before it went to the cloud. Then 2017 isn't that big of a deal, especially if you have macros disabled.

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.

Update Available by stealth_finger · 2019-01-23 02:16 · Score: 1

-enabled more ads

--
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u

This is not a problem to most users, it's an perk by cloud.pt · 2019-01-23 02:17 · Score: 4, Insightful

There was a time stable software was a standard, not a luxury. Now, the definition of stable is whatever the software maker decides at that point in time. This doesn't make sense. The user is the one with his requirements in mind. That's what makes people buy some piece of software and expect a life-long license. That's also why cloud apps are cheaper and have a time-frame. The real problem comes when the two worlds mix: you buy a piece of software that is offline only but is a time bomb, with expiring license and basically stopping because the local clock got past a point or the remote clock from the authentication server did. Or the opposite, when you purchase an Office 365 cloud license but have access to a download of the offline suite which will only work for as long as your remote account hasn't expired.

In my experience, the biggest offenders: by Opportunist · 2019-01-23 02:20 · Score: 2

Compression tools.

I'm not kidding here. Most of the things listed in the report usually come with auto-update features that you have to deliberately disable or cancel. Compression tools like WinRar or 7zip get installed once and never get touched again. Ever. Unfortunately, due to the nature of what they do, they can very easily be exploited to run arbitrary malware code if the decompression algorithm is poorly implemented.

Keep your compression tools updated!

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.

Re:In my experience, the biggest offenders: by 110010001000 · 2019-01-23 02:32 · Score: 1

What hacker is targeting WinRar and 7zip exploits? Hackers have much bigger things to exploit. There are a lot of CVE's filed but you would have to open a trojan file to get exploited.
Re:In my experience, the biggest offenders: by Opportunist · 2019-01-23 03:25 · Score: 2

You don't download compressed files from the internet? No mods for your favorite game, no file someone sends you on whatsapp? While I'd guess that you probably don't work in HR where opening compressed files is pretty much par for the course every time you're hiring and someone sends you their CV, you don't exchange files with anyone? Where you always, really always, check whether the from-header is actually from your mail partner?
But you're right, these are usually things that the average Joe Hacker doesn't do. This is something done for more interesting targets that are a bit more security conscious...

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:In my experience, the biggest offenders: by Opportunist · 2019-01-23 05:16 · Score: 1

Only the local user account... yes. That means all your documents, all your pictures, your browser history along with the passwords stored in your browser, your password file if you choose to have one because you don't trust your browser to store it securely, your emails, your ...
But your drivers are safe. I give you that.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:In my experience, the biggest offenders: by cloud.pt · 2019-01-23 06:54 · Score: 1

what if I only want this compression tool for decompressing my own files? Do I have to pay another commercial WinRar license just because the owner wants to sell me, what to my use case effectively is, some snake-oil?
It's a nice tip you got there, but companies want to make money, continuously, no matter your rights. That purpose of theirs will never align of our intention of buying stuff that we really own.
Re:In my experience, the biggest offenders: by Opportunist · 2019-01-23 22:23 · Score: 1

Then I guess switching to 7zip which is free and can read RAR files is an option.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:In my experience, the biggest offenders: by cloud.pt · 2019-01-24 00:01 · Score: 1

Yes, 7zip is great. But you started using an unzip tool for the sake of the argument, and I kept it going. It would apply to anything else, such as MS Word documents.
Re:In my experience, the biggest offenders: by Opportunist · 2019-01-24 01:58 · Score: 1

With the difference that MS Office (as well as Adobe Acrobat) comes with an auto-update function that you have to deliberately disable (or at the very least not enable).
Compression tools don't offer the option to check for updates altogether. In other words, updating them is easily overlooked by the average user.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.

Because older versions support Windows XP by xack · 2019-01-23 02:21 · Score: 2

Like it not, XP is not going away soon. It is too useful for many purposes and still has over 10% market share in China. If software arbitrarily drops support for XP then older versions will stay in use. There is still significant amount of users on Chrome 49 and Firefox 52 since they support XP. Just because Microsoft dosen't support it dosen't have to mean that open source software needs to. XP forever!

Absolutely! by rickb928 · 2019-01-23 02:21 · Score: 2

I run Office 2003 on all my home machines, first because it's good enough. And because I have a valid multi user license. And because Microsoft somehow gave it compatibility updates. And, lastly, because LibreOffice would be my replacement.

Flash and Shockwave I avoid, so those usually are disabled or uninstalled. Problems solved.

And my Surface Pro 3 is in the Windows Insider Program, so I get a lot of updates, back up my data obsessively, and have updates scheduled. So far so good.

Truly, word processing hasn't advanced much since Word 6.0 and Quark, unless you hang on features like formatting preview and dynamic content, and since paper is out of favor, these now make sense. In the day of printing, there were a lot of features not useful to production environments.

But hey,. I missed Minesweeper so much I went and found it.

--
deleting the extra space after periods so i can stay relevant, yeah.

Yeah by ArchieBunker · 2019-01-23 02:27 · Score: 4, Insightful

Because coders can't stop coding. Quit adding shit for the sake of adding it. You're done, stop, move on to another project. At some point your project has evolved to a pinnacle and anything you do from there on detracts from it.

--
Only the State obtains its revenue by coercion. - Murray Rothbard

Re:Yeah by Darinbob · 2019-01-23 07:31 · Score: 1

Yes, but such coding should be planned out in advance. Coders should not be coding without a direction from management. That means they should have a release schedule, a list of features going into the release, a list of bugs that need fixing, and ultimately a set of detailed release notes. That's where you get stability. And you can do his sort of development while also using Agile! Agile does not preclude long term planning.

Skype by MobaHup · 2019-01-23 02:27 · Score: 2

Purposefully using an older 7.40 version of Skype while I can, because the newest version is a bloated, buggy piece of crap.

Re:Skype by Obfiscator · 2019-01-24 21:32 · Score: 1

I gave up on Skype a while ago and moved to Jitsi. Accessible through the web, free, open source. Don't even need an account to start a call.
Makes me wonder how they stay afloat. I hope they are not recording my calls!

--
"Nothing shocks me. I'm a scientist." -Indiana Jones

Package management to the rescue by Boern1138 · 2019-01-23 02:30 · Score: 2

That's one of the reasons I prefer Linux. Most major distributions have some kind of package manager that takes the burden of checking every application for updates from me. Just one command/click and every program is updated to the latest version. It can't get much easier than that. And if you are lazy and don't care you can let your distro even do the updates silently in the background.

Re:Package management to the rescue by fbobraga · 2019-01-23 02:47 · Score: 1

It's why popular linux distros are so superior to windoze: very good package management, automatic updates to all software used (unique exception here is http://atom.io/ that I manually update)
Re:Package management to the rescue by Anonymous Coward · 2019-01-23 03:05 · Score: 1

Depends, I've had far worse luck dealing with package managers on desktop focused distros then I've had on any version of Windows. Last problem I had was on Mint 18.3 when some genius pushed an Xorg update and then forgot that libGLX also needs to be updated as well, causing X to abort with an ABI version mismatch. Ubuntu I gave up on constantly fighting with out of date repos that 9 times out of 10 it's faster and easier just to reinstall then to fight with apt.
Debian and RHEL/CENTOS are better in that regard but then you're fighting with older packages while applications like Skype and the like are demanding updated libraries. Snap containers have alleviated it somewhat but it's still annoying.
Re:Package management to the rescue by Shikaku · 2019-01-23 07:25 · Score: 1

Arch Linux or many of its derivatives. Everything stays updated, you can choose to not install Systemd (look here https://artixlinux.org/ for instructions or installation media) and everything updates pretty quickly, even in AUR. A rolling release distribution is the keyword here, there's a few more like Gentoo, with Debian or Ubuntu they release by cycles of specific time intervals, which would work fine for a server but not particularly well for a desktop if you need faster package updates.

Makes sense by HalAtWork · 2019-01-23 02:36 · Score: 4, Insightful

As others have mentioned a lot of newer versions of apps remove features or rearrange the UI just to seem fresh but that's annoying to the user.

Besides that, on Windows a lot of apps seem to install a companion app just to check for updates, a lot of the time this gets disabled because it adds clutter to the taskbar and adds to startup time, not to mention triggering annoying popups if it can't reach the internet or if they need you to agree to new terms.

During Windows installers people see a checkbox for that and disable it automatically because they're usually trying to shoehorn some adware or promotional app, or take over file associations or sign you up for something you don't want. So people just disable these.

I moved away from Windows because of these hassles and now I have a central updating service for everything on my system. I understand Windows Store can do this, but not all apps are on the Windows Store because of certain restrictions and other criteria that leaves out the app you may want, or because the third party has their own storefront service/launcher they want you to use, and some people want to avoid it altogether because of the experience.

It seems like a hassle to deal with all of this when you just want to accomplish things in a straightforward way, especially if you are an end user who gets anxious when they are presented with a dialog box with options like many non-techies who will just see that and immediately call the local nerd.

--
Twinstiq, game news

This is why. by Anonymous Coward · 2019-01-23 02:40 · Score: 1

"Man I love this app. The way it handles and does everything I want. The way everything hangs together in a logical..."

"WTF? Why did they completely change the UI?"

Re:This is why. by Farmer+Tim · 2019-01-23 04:34 · Score: 2

"WTF? Why did they completely change the UI?"
The Useless Interface works exactly as intended.

--
Blank until /. makes another boneheaded UI decision.

I like Chrome's approach by ddtmm · 2019-01-23 02:44 · Score: 2

If it was just 1 or 2 programs that need regular updating, for whatever reason, people would be more inclined to do them. The problem is that there are so many programs that need regular updating, people just can't be bothered.

If more programs allowed you to enable automatic updating in the background like the way Chrome does (that is, seamlessly in the background) I think more people would enable that method. I know I would. And if you don't like it, just don't enable it. There are a lot pf apps I'd be fine with background auto-update.

Re:Out of date? by Sarten-X · 2019-01-23 02:50 · Score: 1

Yes.

It's typically "use before a security vulnerability is identified and exploited by malware".

--
You do not have a moral or legal right to do absolutely anything you want.

If you like that feature you can keep it by DarkOx · 2019-01-23 02:53 · Score: 4, Insightful

"If you like your feature you can keep it"

I think in the consumer software space there is very real conflict between security updates and functional requirements.

Uses chose software because it did something they wanted to do. The home computer is not purely entertainment for a lot people. Many of them actually do care that they can create the weekly mailer, exchange very documents with people in their only hobby group - which could range from pictures to CAD drawings and 3d printing instructions.

The trouble is these days installing that update could do any number of things. Maybe a feature you used is out right dropped or is only available in the paid "pro" version now; requires an active internet connection when it did not before etc etc. Maybe is just works and looks different and learning some new work flow or rebuilding all your scripts and macros just isn't something you want to do this month. If the changes don't work for you to bad; no security fixes then. Also if you only have one system and don't know other people doing exactly what you are doing often its a mystery as to what version next will bring. Again if its a process that is critical to you, can your risk updating?

At least before critical system components like Windows itself could be pretty well depended on not push major user visible changes or changes likely to break other applications and API functions in updates. Increasingly this too is changing and its no surprise people respond by not updating.

What does MS do in response make it more and more difficult to turn off auto updates; yes I suppose it keeps people on the update train a little longer but it does nothing to build confidence. Increasingly it drives the to other platforms which they will then not install updates on with our without justification.

--
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html

Re:This is not a problem to most users, it's an pe by Malc · 2019-01-23 02:53 · Score: 1

Adobe don't seem to understand this. I've been using Lightroom 6 for 3.5 years, and now they've broken one of it's key modules (Adobe apologist blame one of their vendors). I took a look at the latest Lightroom Class CC (v8.1) and I really can't see the benefit: native support for HEIC (I'd already worked around that), a dehaze filter that doesn't seem to do anything I couldn't do with contrast and clarity, autosettings that cause more work because they over compress contrast and pump the colour saturation making photos look like over processed iPhone HDR photos, and all the issues that annoyed me with LR6 still annoy me in the latest version. And the cost... 3.5 years of LR Classic CC is 7x the price of LR6, and increasing, and if you don't want to pay, you lose all editing functionality. What a con.

BTW, you mentioned Office 365. I'm still using Office 2011 on my Mac at home, and I really can't see any benefits over it in the Office 365 at work. Microsoft managed to break moving messages between folders before Christmas for my work G-Suite account. Forced me to switch to Mail.app. Support couldn't offer any rollback options to something that worked for me. I did try to switch to IMAP, but this took four days to download my mail and 3x the SSD space. The latest update this month seems to find Outlook stuck on high CPU, and kernel_task and Window Server getting stuck on high CPU. Useless.

I'd update more if... by QuietLagoon · 2019-01-23 03:03 · Score: 3, Interesting

... the updates did not add data collection. One application I am using requires me to install google analytics when I upgrade the application. So I stopped upgrading it. Then there is Windows 10, if I upgrade to Windows 10, I turn my PC into a Microsoft data collection machine. If you want to know a reason why some do not upgrade, ask the software providers who put egregious data collection into their upgrades.

Re:aint broke dont fix it by jellomizer · 2019-01-23 03:06 · Score: 1

Don't do maintenance until it is broken too?
If you have a security hole in your app, and you don't update it, you are spinning roulette wheel to see if you get hacked or not.

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.

Re:Out of date? by Anonymous Coward · 2019-01-23 03:10 · Score: 1

Increasingly, it's "use before the vendor switches to a subscription model to wring every last dollar out of its customers."

relevance by argStyopa · 2019-01-23 03:10 · Score: 1

There's a HUGE difference between "needs update" and "needs MEANINGFUL update".

I don't know of a metric that would measure that, unless perhaps you measured the size of the update vs installed size of the program?

I know this wouldn't be perfect, but I'd guess in general critical updates would be more sizable than trivial "this button doesn't look right when clicked" updates.

--
-Styopa

Re:What a hassle! by Sarten-X · 2019-01-23 03:14 · Score: 1

Oh yes... I'd like to see something similar to Ubuntu's PPA system implemented by Microsoft.

Within Windows, maintain a list of software and URLs (and perhaps licensing identifiers). When a program is installing, it can ask to enable automatic updates, and if approved, it can add a URL to the list. Those URLs would point to an XML file (or JSON, or whatever) describing available versions, along with how to run the installer (preferably in a silent update mode). Windows itself can then periodically search for updates, alert the user with a consistent UI, and update as requested.

I'm assuming the Windows Store was built to do much of that, but having the walled garden approach limits its appeal.

--
You do not have a moral or legal right to do absolutely anything you want.

Re:Two-way firewall. by Immerman · 2019-01-23 03:15 · Score: 1

>Turn off Windows data collection which is meant to have been a opt in.
I think you meant either "should have been", or "was originally claimed to be" - if it was meant to be, it would have been fixed in one of the last half-dozen major updates.

Also, turning it off only eliminates some of the information it sends back, and updates turn it back on regularly. I would be interested to know if a software firewall would even stop it, or if Windows treats it as privileged communication that can only be stopped by an external firewall.

--
--- Most topics have many sides worth arguing, allow me to take one opposite you.

yeah .. simple if you think about it by mordred99 · 2019-01-23 03:23 · Score: 1

I am in IT Security and I know the risks. I also view all CVE released daily. I know what I am doing. But there is only so much time in the day to manage your own software. If you had a company managing all things installed on your desktops (or laptops) and took away the rights of users to install their own software, then hell yeah I blame them when they have the tools to manage it. But for my home machines? I know Putty, VLC, and libreoffice are out of date. Those are the only three applications I have installed on my laptop outside of the OS and Firefox. Why? I use them infrequently and I don't spend the time to check them every time I login to the machine. I just want it to work.

The final thing actually is windows 10 has made it worse for me. I used to keep my machines running 24x7. Now due to how the updates are deployed, and being unable to kill the reboots, etc. I shut them off so they don't reboot on me at random times. I never know when an update is coming (yes I know about patch Tuesday, but MS releases so many damn out of cycle patches, it is not the only time you get patches). So my machines are not running, thus no software to worry about, limiting risk.

Finally - there is no single update mechanism like many Linux distros. Each one has some crappy software, always running and taking resources, just to update. Why does an update daemon (process) take 56Mb of memory? I used to run an entire OS and its app on that much memory. That is now the updater process for java which always runs? Have a dozen of those crappy things running and your machine crawls.

Bloated "security" patches... by Anonymous Coward · 2019-01-23 03:30 · Score: 1

Not long ago, Steam made me update Civilization V. Not to make it better, not to fix security holes, but to force a new bloated interface so the makers of the Civilization series could show me ads for some Civ 6 DLC. That's all. Fallout 4 still gets updates that are mostly worthless ways of new monetization angles rather than actually improving the game.

Thats just two examples of why I would have never updated that software if it had not been forced on me. I'll update more software when it's proven that patching security holes is more important than bloaty worthless patches.

Re:aint broke dont fix it by clovis · 2019-01-23 03:52 · Score: 1

whatever it is, it's broke in some way

Time to upgrade all my apps by OrangeTide · 2019-01-23 03:55 · Score: 1

I can't wait to see what new ads they will blast me with and what plug-ins they will automatically install.

--
“Common sense is not so common.” — Voltaire

Re: Time to upgrade all my apps by bn-7bc · 2019-01-23 16:47 · Score: 1

Hmm imust be lucky then non of the games i play regyraly, nor Vs 2017 communery or Davinci resolve 15 is blasring me whith ads, tru Resolve has gone tru several ui changes tha last few years but evrytime it has gitten better imho and we have gotten more features, ( fairlight and fusuion are the onse that stand out most) in both cases no ads that I have spotted (in resolves case I use the free (non studio version so, some effects and transitions are dissabld as is the fusion camera tracher and dnr. Iâ(TM)m just saying this to illustrate that not all software is a constant barrage of ads as for tekemetry, i know resolve does not d it, as (atleast the studio version) can be run on combuters without an active internet connection

Summary of reasons WHY no updating by UnknownSoldier · 2019-01-23 03:57 · Score: 4, Insightful

Here is a (partial) list of why people don't upgrade:

- Don't fix what isn't broken. The old version is KNOWN to work, the new one is a GAMBLE. /s Because Microsoft has such a good track of updates not breaking -- oh wait, they don't!
- Hate having to schedule time for updates
- Telemetry bullshit
- New version is not compatible with old version files
- New UI is crap
- Useful features removed
- Cost of new version is prohibitive
- New version holds you hostage -- if you don't pay the rental tax it stops working
- Can't run the old version along side the new version to test what changed
- No ability to "downgrade" to the previous version if you run into issues with the new version
- Installer fucks up
- New installer has malware and/or ads or hijacks the browser.
- No solution for upgrade issues
- No perceived value with a patch that only has security fixes. "They don't effect me."
- Distrust of a patch that was "only" supposed to address security issues -- yet breaks functionality.
- Updates dont respect MY time for when is a good time to update
- New version doesn't work on your older OS -- such as Microsoft's bullshit of not releasing DX12 for Windows 7,
- Forced updates which means downtime.
- Auto updates are broken
- Patch notes don't list WHAT has changed. MS has a shitty habit of this.

When I installed Gimp 2.8 it blew away my working 2.6 versions on OSX. I then had to track down why Export wasn't working AT ALL. Turns out it was a problem with one of the python scripts IIRC. There is no way in hell a normal user would have been able to track down what the cause was.

I also ran into this recently when I upgraded to the latest Inkscape 0.9x.

I did an upgrade but all the menu icons were missing. Had to uninstall and reinstall to fix.

Once I got the new version working I noticed the default units got changed from 90px/inch to 96px/inch. Now whenever I open old files I have to manually verify they didn't get fucked up.

Upgrades aren't cheap -- both from a Time and Money factor.

The old version may have a fixed cost; the new version may nickel and dime you -- worse it holds you hostage. If you stop paying the monthly rental tax it stops working.

Users have learnt to distrust upgrades. They almost never work out-of-the-box. This means wasting even MORE time.

There are only 2 main reasons to update:

- New features
- Security fixes

When the risk:reward ratio is analyzed it isn't always cut and dry.

Is it any wonder people don't trust new versions?

*only* "more than half"? by cascadingstylesheet · 2019-01-23 04:19 · Score: 1

I'm surprised it isn't higher.

Re:aint broke dont fix it by Killall+-9+Bash · 2019-01-23 05:03 · Score: 1

That's all fine and dandy until KB4480970 made our fileserver (and printer scan mappings) shit the bed 2 days ago. Best part of that update was I know for a fact I had updates disabled ON EVERY PC IN OUR SMALL COMPANY. Found unsolicited SMB fucking update installed, and windows update settings locked into "some settings managed by your administrator" bullshit I can't change/disable. Fuck microsoft, fuck their forced upgrades to computers with updates disabled, and fuck any dumbshit IT "pro" who thinks auto-updates are a good idea.

--
"Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016

Pretty soon by AndyKron · 2019-01-23 05:29 · Score: 1

It almost makes better sense not to use computers these days.

Lack of yum/apt style management by Junta · 2019-01-23 06:12 · Score: 1

A lot of this is because in Windows, every vendor pretty much had to build-their-own auto-updater, if at all.

If a software installs an auto-update agent that runs as a matter of course, they are assholes because they are running when they shouldn't be and many auto-updaters add up.

If a software checks auto-update on startup, it's annoying and disruptive because you are trying to use this app, not get nagged about updating. Additionally this means software is neglected when not run and frequently an update is 'do it later' because you are trying to use the app and don't want to wait/risk.

It's a shame MS never delivered an extensible auto-update framework that applications could register their update sources. MS store is the closest thing, but a good facility would not require Microsoft servers to be involved.

Some have raised the valid point that software changes crap and has inflicted update fatigue on people and that is an issue, but I wager most of the time it's because the 'system update' doesn't have a path for applications to naturally get updated at the same time.

--
XML is like violence. If it doesn't solve the problem, use more.

Re:This is not a problem to most users, it's an pe by Wrath0fb0b · 2019-01-23 06:29 · Score: 1

There was a time stable software was a standard, not a luxury.

Those were also the days of comically bad security vulnerabilities and insanely long times to delivering critical security fixes.

These days, Project Zero gives you a 90 day disclosure window. Stable or not, you are highly incentivized to patch it before it's publicly disclosed.

Re:aint broke dont fix it by cloud.pt · 2019-01-23 06:50 · Score: 1

Maintenance and security should also be user choice. Not giving that choice isn't much different than what Apple, Ferrari, hell, even John Deere are trying to do. They want monopoly on maintenance because of what they say is "brand appeal" but we all know is flat out profit from stupid margins.

I didn't need a security patch on my good ol' Photoshop (insert any other relevant offline app or even OS). What the hell can go wrong if I'm not using it online or already taking measures myself to prevent problems? Why do I have to be financially bound to these companies' decisions if I already paid for right of ownership, even if just the executable form.

This is a far cry from all these companies to keep being relevant selling you services after their initial goal of selling you products. It's the best marketing ever - it's marketing you don't need, because it is enforced on you.

Re:Who Controls The Computer? by UnknownSoldier · 2019-01-23 07:03 · Score: 1

Agreed that Notepad++ and FileZilla are great examples! Ironically just upgraded both them this month from ancient versions and had zero problems. I do this about once a year and don't have any qualms because they have earned my respect.

Microsoft is completely clueless in respecting the user's time and space.

I can understand MS's position -- old software has bugs. I get that and that old versions are security vulnerabilities when people don't want to update. However, Forced Updates are NOT the correct way to handle this when the NEW software has a different set of bugs, or worse, breaks. That's literally a FU to users.

I 100% agree with you: The buyer should always be in control. Anything else sends the message: "We don't trust you." Uh, why would I, as an user, trust you, the provider, then when you don't trust me!?

Re:This is not a problem to most users, it's an pe by packrat0x · 2019-01-23 10:39 · Score: 1

Forced me to switch to Mail.app. Support couldn't offer any rollback options to something that worked for me. I did try to switch to IMAP, but this took four days to download my mail and 3x the SSD space.

The trick to IMAP is to have a separate server, then connect to it remotely. This works best on a LAN, but still works as long as you have an internet connection back to your server. My server allows users to read mail with Outlook, Seamonkey, Mutt, etc.

--
227-3517

Re:Two-way firewall. by Luckyo · 2019-01-23 11:06 · Score: 1

When win10 came out, there was a forum for external firewall software that maintained a blocklist for win10 telemetry. I added it manually to my software firewall and it did in fact work.

Until one day, MS updated win10 to the point where it would literally refuse to access the internet with any software until I removed relevant telemetry blocks on the firewall. Literally all internet facing software just stopped having access to the internet until I allowed telemetry through, at which point, it all magically started working again.

So I can vouch for the fact that properly configured software firewall does appear to block win10 telemetry, but MS has some rather nasty tricks if you do it.

Creeptastic by WaffleMonster · 2019-01-23 12:33 · Score: 1

Oh look another sleazy company rummaging through millions of computers and collecting shit on all of the software everyone has installed when they don't have to then publically bragging about their exploits after the fact.

Re:This is not a problem to most users, it's an pe by strikethree · 2019-01-24 12:28 · Score: 1

The real problem comes when the two worlds mix: you buy a piece of software that is offline only but is a time bomb, with expiring license and basically stopping because the local clock got past a point or the remote clock from the authentication server did.

ROFLMAO. This is what recently took down a major drug lord. It is absolutely hilarious.

--
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen

Slashdot Mirror

More Than Half of PC Applications Installed Worldwide Are Out-of-Date (helpnetsecurity.com)

99 of 151 comments (clear)