Don't tell people to turn off Windows Update
troyhunt.com
troyhunt.com
Microsoft shares part of the blame here for pushing features that the user clearly doesn't want through updates (especially to the major OS version). Look at the recent ads in Windows file explorer for one example. A lot of the advice to turn Windows Update off is a misguided response to Microsoft's own bone-headed moves in recent years to install bullshit that the user doesn't want.
I still sort of regret installing Windows 10 to this day because of the obnoxious Cortana bar it foisted upon my start menu that I can't get rid of. And yet not installing Windows 10 would've left me less secure with an OS hitting EOL for security updates much sooner.
Microsoft definitely shares some of the blame for this precisely because they have automatically "opted in" their users to stuff they don't want during past updates. Stop the bullshit, Microsoft.
Vaccinations are awesome, but Microsoft's heavy-handed bundling is similar to how the CIA was using vaccinations as cover to collect DNA[1] samples in Pakistan. This inadvertently led to a distrust of vaccinations[2] which harmed the efforts to eradicate Polio (or biological WCry, if you will).
Additionally, Microsoft abused the update system to download an entire, multi-GB OS (Windows 10) on systems running on Windows 8, "just in case they will want to upgrade". This was very expensive for people on metered bandwidth. Microsoft should separate critical updates from the less critical ones and give users the ability to opt-in for critical updates only.
1. https://www.theguardian.com/world/2011/jul/11/cia-fake-vacci...
2. http://www.nytimes.com/2012/07/10/health/cia-vaccine-ruse-in...
Most people don't know/care about Windows Update pushing features.
However most people DO care when their computers spontaneously reboot themselves with no warning (sometimes even in the middle of "active hours"!) which is what msft has set by default (and indeed has/had no UI to modify in some versions of Win10)
By contrast, every single Windows Update that I deal with (a) requires a restart for seemingly no reason, (b) slows down the shutdown process immensely, and then (c) goes through sometimes multiple long installation processes, during which I cannot use my machine.
Of course, as a casual user, I would find Windows Update annoying enough to want to disable it. More so when my computer decides to restart of its own accord, sometimes right in the middle of me actively using it.
(Obviously, I am security conscious enough that I don't really disable Automatic Updates on my Windows boxes, and instead just remember to reboot my machine once in a while so it goes through them on my schedule.)
Could switching the Windows Update UI to a scheduled weekly reboot + updates (call it "Maintenance" or something) be useful? Would fewer people see the need to try to disable the updates if they could control exactly when they would happen, consistently?
In its infinite wisdom Windows won't let me set "7am-11pm" as active hours - it caps it at either 10 or 12 hours. So no matter what I set it to, Windows 10 updates will inconvenience me more than just about any other OS in the house.
But inversely, i'm annoyed that this "upgrade phenomena" seems squarely targeted at Microsoft when people who run Linux or OSX upgrade the second new shiny comes out. I'm not ranting here other than expressing a curiosity of culture that leads to cultural problems lingering much longer than they should.
Windows 10 is awesome.. the experiment with "ads" sucks but its all tweakable.. just jump to Rs2 and provide feedback if there is something you do/don't like. MS listens.
If we want people to regain trust in auto-update there need to be something that prevent abuse. If that is regulations, liability laws, or just industry practice will be up to the future to decide. Until then a person will have to rational decide on auto-update as past people did with the uncertainty of not know what is snake oil and what is real.
You are far too confident in current medical practice.
People avoid doing firmware updates on various devices for the same reason, as there is no indication what will change or go missing (never mind that it likely will reset the device, and thus require a full reconfigure before being useful again).
The basic problem of our world is that it is ruled by 20-sometings that loath working on "old" tech. The epitome of this is the FOSS world that goes through a wrenching rewrite churn every 5 years or so as new heads take over "old" projects.
For all their antics, one reason MS is still top dog is that they support APIs and ABIs first introduced with Windows 95 (or even older, if you manage to do a 32-bit install).
Never mind that MS did offer XP updates, for a price. One reason the NHS got hit hard was that some penny pinching bureaucrat decided they could not afford to pay said price.
Disagree thoroughly. The reason why people push shit through the security-updates channel is because of money and structural pressure from management to ensure adoption of the company's new $THING.
disagree completely, it's not the 20-somethings that come to you and say "the budget we have is limited, and we have to prioritize, feature X might get us more exposure, so work on that and it doesn't matter if it breaks backwards compatibility, users will adapt"
If upper mgmt goes after "oh shiny" there's not you can do at the individual contributor level, and if you know you are in a "oh shiny" management situation there is also no incentive whatsoever in spending time making sure you think about the future when developing, since you're going to have to throw everything away anyways in a few months or a year at the most.
It's all about "being nimble" and "velocity" and "being innovative", where all of them are more or less shorthands for "churn things quickly until something sticks". Stable, reliable, dependable software is unsexy, if the company you work for is large enough you might be able to find a team that works along those lines and be happy, otherwise it's fighting fires all the time.
I also far too often see this logicaL fallacy being used. I was recently railing against MS and someone said, "well I'm more worried about facebook, what about them?" Your comments about OSX and Chrome have almost nothing to do with the the current discussion topic which is MS updates systems. I wish people would stop doing this equivicating, it's tiring and logically fallacious.
A person can call out any company they want for anything they want on the merits of their argument without it having to turn into a major company comparison.
All that said... gnu+linux actually allows the user control, and things like this can be stopped.
Bottom line is this, either the user controls the program, or the program controls the user. Google, Apple, and MS have all shown they are more concerned with controlling the user than giving them freedom. GNU+linux or really just GNU, is the future of freedom, and until people start understanding how inherently political software is, and stop basing their software choices purely on pragmatics (but mah lozedoze gaming!), these types of problems will continue to happen and have things written about them, but the solution is already here.
Stop using closed source proprietary systems.
We run Windows 10 and the lastest Windows server on all our machines and don't have problems because we have good, in-house, local IT people and also good security on the edge routers.
Why should they do this? And why should they care at all about people on metered bandwidth? What are Microsoft users going to do if they don't like getting a huge bill for downloading Win10 unexpectedly? Stop using MS? Not likely.
When are people going to wake up and realize that Microsoft has absolutely zero incentive to worry about keeping their customers happy?
I set up a PC for him with a legal, licensed copy of Windows 10, and he promptly reset it using a pirate/cracked version of LTSB because he didn't want the "Windows 8 stuff" and he didn't want "Microsoft spying on him"
Within 2 days it was full of viruses and malware. I don't let him plug his computer in to our office network, and I don't let him near any of our office computers.
Here's a better analogy: suppose you were pushed to get a vaccination, but the vaccine company secretly added a virus to the vaccine which alters your DNA so that your hands turn into claws and you grow antlers, because they thought this would be a great idea somehow. Then after word gets out about this, they say anyone who doesn't get this vaccine is an "anti-vaxxer" and "ignorant". That's basically what Microsoft did.
(reference for the body modifications: http://dilbert.com/strip/2004-04-18)
The anti-vaxxer movement makes no sense outside the backfire effect, in almost all cases it has little to no basis or justifications. On the other hand there is a long history of very valid reasons of distrusting windows update and disabling it.
Using windows update to force people into windows 10 is only one of the most recent examples that windows update is by Microsoft and for the interest of Microsoft not the user. This is totally different from the system update you have with apt and Debian.
Autism is the product of having a differently wired brain than a non-autist does. It's something you're born with, not something you can get later.
Certain medications used by pregnant women can result in children being autistic, but I seriously doubt that this extends to any vaccines as well. Perhaps some really exotic ones maybe, but common vaccination definitely not.
Source: I am autistic, read up on it to be able to better deal with it and am dealing with it on a daily basis.
And truth be told, I don't know if I'd be better or worse off without it. It doesn't make my life unlivable and I guess the understanding of autism of most people is too much based on rumor-mongering and hearsay, than any actual facts.
I disabled it a long time ago and haven't looked back. Get back to me when MS starts remembering their customers are human beings again.
> Get back to me when MS starts remembering their customers are human beings again.
Oh, they know. Their whole abusive process is build around milking that fact for all it is worth.
MS has MILLIONS of people yammering for features and they go to great lengths to shorten the release cycle for getting new features to developers and customers.
I find this as a positive thing and this concept of MS as "the enemy" is absurd..
You're essentially writing off 10s of millions of happy customers participating in a growing and flourishing community without any regard..
Empathy.. its a good thing.. even if your personal choice is that of something else.
Then spend an afternoon going through each option, setting enabled/disabled for everything you don't want or don't recognize.
You can easily disable entire subsystems like Cortana, tips, telemetry, camera, biometrics, error reporting, games, Homegroup, Defender, Windows Store, and a whole bunch of other garbage.
When 7 goes end-of-life, I'll be 100% Linux.
So, this should work - but only in the pro Version.
But then i get myself thinking of Gnome, and how i have seen similar tools sprout for tweaking it in recent years...
But yeah I get a notif when the update is available and I install it whenever possible.
Regarding unwanted features, have you tried Classic Shell / Classic Start Menu? Literally first thing I install on a new Windows installation.
At that point, Windows 10 became a liability, and that laptop still doesn't have automatic updates turned on anymore. (It still gets routine manual updates, but it's definitely not ideal.)
This is a good analogy, but does it work in different circumstances? (Apologies for the derail)
Over on Android, the apps have got so big (and the storage was until recently so small) that automatic updates _cannot_ be installed - the new apps are too big, the phone is full. What do we do then?
Moving all my photos and ebook .pdfs off did alleviate the burden somewhat, but hasn't completely solved it.
My current workaround for very large apps is to uninstall, redownload, install. Apparently, holding both the update and the installed app uses much more space than doing a fresh install.
Or just leave them all on the internal system, until a system utility wakes up to the fact that there is not enough space, and suggest moving apps to the sdcard. After few rounds of updates, rinse and repeat.
Then apply that to a local copy of the previous APK.
If that goes well, it attempts to install the new APK alongside the old install.
And if that works out, the user data is switched over and the old install and APK removed.
So at certain points during the install you need to have enough space for two full installs of the app, and the APKs they came in.
Microsoft needs to deliver updates in tiers in order to regain trust. Simply dividing it up into mandatory security updates, optional bug fixes, and optional feature upgrades would go a long way to addressing that even if the default is for all three tiers.
Except that there were demonstrated cases of MS inserting the "brainwashing drugs" on the updates. Many people had legitimate copies of Win XP bricked by XPA, MS alti-malware broke install a couple of times in Win7 (and off-line machines were bricked by DRM more than once), and, finally with Win10 we've officially got the spyware and adware coming through updates like people were long expecting.
What to do? Upgrade the hardware. It's not supported anyway. Modern Android devices which have updates published do not have this problem anymore.
Apps take up 6.32 GB of storage on my phone. The remaining space is taken up by the app cache. This isn't useless information like you'd expect, but it turns out it is data that is vital to the operation of my apps. I clear it fairly often, but it fills right back up again within a day.
Luckily I have an SD card slot, so I have space on my phone, but Google does not like expandable storage. Probably because they are a cloud organization or something.
I personally like to stay on a fairly new phone, but I think it is stupid that your phone can become obsolete within a few years. If the radios are still compatible with the cell towers, manufacturers should be obligated to support them. If you can't support your phones, don't churn out so many crappy phones.
I know times are different, but I used a Motorola Razr V3 from 2004 to 2011. It worked just fine for the entire time. Obviously internet sucked, but I was going to school in a place where the internet barely worked anyways.
If you just want a phone for texting, calling, and maybe as a GPS here and there, there is no good reason to buy a new phone other than planned obsolescence.
A Moto G 2015 has only 8GB storage.
Even mid-range devices sold today only come with 8GB storage, of which 6GB are used by the OS.
No, it isn't. Anti-vaxxers think that vaccines are harmful (or useless). Most users think security updates are important, they just don't want to be interrupted.
Vaccines are harmful; it's just that the positive effects vastly shadow the negative effects in the general case.
No, unfortunately not - it spread using SMB internally on LANs, but travelled internet-to-LAN by "regular" phishing. It downloads its payload off the internet, but most good firewall would allow that (was the WannaCry payload detectable by virus scanners at the time of the infection? A "good" firewall might be one expected to intercept and scan all downloads).
> A legitimate reason like "this Windows runs on a medical/factory/etc. device that CANNOT go offline to install updates willy-nilly".
"Cannot go offline" implies that it's operationally critical. If you operate such devices, it is an absolute imperative that you have a procedure for taking them offline regularly for updates (not "willy-nilly" and anyone using that word about running a two-year out of date OS on a critical device is objectively not qualified to run them - and anyone buying such a device that can't be upgraded isn't qualified to buy them (and anyone making such a device...)).
In some contexts that simply isn't a viable strategy. As an extreme example, consider something like an implanted medical device that needs to run 24/7 for the rest of a person's life, which can only be replaced via surgery under hospital conditions, and for which any failure is already a life-threatening event. Of course that kind of device probably isn't going to be running an OS like Windows, but it makes the point. In fact, the USSS has reportedly had the standard wireless update facility disabled in such devices for prominent public figures who might be at risk of being attacked that way.
Some equipment used in hospitals or to run other essential infrastructure might be within the realms of running a "normal" OS like Windows but still be in a position where any time out of service is extremely expensive in one way or another, so routinely disrupting operation to apply updates still isn't acceptable. There are also contexts where the device is regulated and making any change at all requires re-approval -- a legitimate and serious conflict when faced with this kind of security risk if the situation when a regulated device goes out of spec can also be serious.
You need different security strategies for this kind of environment, which rely more on external controls. You can't just say everything must be able to come out of service at frequent intervals for security updates, and you can't just handwash the problem away by calling people who understand the issues "unqualified". It's a far more complicated problem than that, and often there are no completely satisfactory arrangements.
The folks at hospitals are not going to fight with such an expensive machine, not even for updates - if something goes wrong, they would be to blame, they can live without that.
The attack could come from the internal network (it spreads first via email). Also, don't forget the upnp shenanigans
Ms is trying to turn Cortana into the Google play services of Windows So they can consensually(forcefully) collect data from every windows device.
I never use the "Windows Search" anymore, i hate it. It's slow and useless. I always disable the service. Then again, searching with standard windows search is probably my biggest annoyance on Windows
IIRC there were other tools: regain, lookeen, ...
[1]: https://www.mythicsoft.com/agentransack [2]: http://www.voidtools.com/
I see apparently there are workarounds to get Cortana in all regions but most people aren't going to bother. If we're getting degraded local search because of where we live that seems pretty dumb.
Microsoft lost every single ounce of credibility with the way they force-loaded Windows 10. Turning off Windows Update isn't enough anymore. The only solution is to dump Windows. Install Linux, or buy Apple hardware. It's unfortunate, but Microsoft will never recoup the trust it lost with the push of Windows 10. Microsoft cannot be trusted.
Running an MS OS has been a one-way ticket to owned for roughly 18 years now.[1]
You are fragile to these things because you choose to be - not because this is a necessary condition of participating on computer networks.
This ransomware attack was based on an SMB vuln. One of the stuxnet vectors was an autorun vuln.[2] Would you wake the fuck up and see that it is 2017 and you're getting owned by SMB and autorun vulns ?
[1] Melissa virus was 1999, BO2k was 2000.
[2] Has any single file caused more mayhem in the world than autorun.inf ? The net negative effect of autorun.inf on the world must be in the tens of billions of dollars by now.
This is why the anti-vaxxer analogy is foolish and frankly rather offensive. Managing updates is about risk, and the risk from Microsoft screwing up your entire system with updates was demonstrably very high before. For example, anyone who was using the default settings to trust Microsoft's suggested updates got changed automatically to an entirely new OS not so long ago -- a new OS, incidentally, which has also had compatibility problems with various hardware, which also has significant privacy concerns particularly in places like doctors' surgeries or other environments managing sensitive information, and which is also infamous for disrupting normal day-to-day work by changing things and/or rebooting at undesired times.
I know plenty of smart, well-informed people who work in IT and made an active decision to reduce or disable updates on some of their Windows systems for these kinds of reasons. Whether they would have advised home users with no technical knowledge to turn updates off completely is a different question, but it's not an entirely unreasonable policy given Microsoft's recent track record of abusing automatic update processes.
Of course, I've also had SMBv1 disabled for many years (there's no reason to retain support for it unless you need to support WinXP machines, in which case you have my condolences), the desktop sits on an isolated subnet with a very restrictive router and firewall in front of it and all telemetry, Cortana and other malware has been eviscerated via group policy and other settings, along with router-level blocking of telemetry and update servers.
I fully understand that my case is atypical and the average user isn't going to follow comparable precautions, so I don't actively recommend my approach to anyone else, but it works great for me. Apart from wasting about a day per year on maintenance, I'm as happy with the OS itself as I've ever been with any Windows version, and it fulfills my Windows development and occasional gaming needs just fine. Obviously, I'm much less happy with Microsoft as a company for forcing me to go through such lengths to make their OS into something I'm comfortable using.
We avoid taking a big amount of medication that would fix some problem just because it's harmful (and even medication that is less worse than the disease).
And not restoring jack shit. I wouldn't mind Windows Update so much if it could competently restart my applications and restore my Explorer windows, but the only thing it does every fucking time is make the taskbar icons disappear until I force-restart the Explorer process.
Though I would still mind it a lot for the insanely slow and unhelpful update process at shutdown, every update requires half an hour of shutdown as the machine does who the fuck knows what with an unhelpful throbber telling you it's at 30% of some arbitrary process you've no idea about and which looks exactly as if the entire thing had crashed.
Nothing is better than running a simulation for twenty hours and waking up to a nice blank desktop. /s
"Do you want to upgrade to Windows 10? Press the hidden button to cancel, otherwise upgrade commences." This is how malware works.... But published and pushed by MS's own channels. And his jab at people who say that turning off WU is similar to anti-vaxxers is completely inane and false - we know the damage Microsoft has done to user's computers.
In reality, I'd rather they upgrade to Linux. Those machines wouldn't get bit by this, unless you run the executable with WINE. But I blame MS for being spammy and spyware-y and malware-y, which encouraged users to turn off harassing and onerous updates.
But really, it's getting worse. I remember seeing a bunch of articles last month about how to preemptively defend against the "creator's update" because it came bundled with a bunch of software people didn't want. They use windows update as a trojan horse to install new applications, that sets a very bad precedent.
I've even stopped urging my friends and colleagues to enable auto-updates because I'm worried that they'll end up having windows auto-update to a new version and break something and then I'll have to help them through it. I just can't be bothered anymore.
That should be unacceptable and I don't know why it's not.
I have updates set to download but not install automatically and I periodically manually install them. Microsoft's active-hours thing is BS too as it must be less than 12 hours. I honestly don't care as much if my machine reboots between 1:00am and 7:00am but apparently that's not enough time.
How long does it take to install updates anyway? Why can't I just set my inactive period to 4-6am?
I also have more than a few stories of people hiring me precisely due to a hijacked OS install of Win10, accompanied by slower machine and worse usability. It only takes a few of those and a whole social circle will warn about it (because of the time and harassment).
In fact, I remember this getting so bad, that local news media was talking about how to stop having your machine hacked by MS with a forced Win10 install. In all honesty, if this were you or I, we'd be facing CFAA charges for this shit.
If I have a desktop pc and I shutdown, I don't mind an update. but if it's a stealth download of windows 10 pro when I have home, then NO.
if people never shutdown, then yes maybe force a reboot for critical updates. but windows needs to figure that out.
if I shutdown a laptop because i'm running out of battery, then updating windows for 30 minutes is not a good idea.
and sometimes you'll get 30 updates in one go when I've shutdown the PC every day and it should have installed a few in that timeframe.
Bingo. For a while, Microsoft was really good about not requiring restarts to install updates. I haven't had a restart-free update since I installed Win10.
When you have a small SSD it sucks.
I ended up having to delay my working day by about 45 minutes while Windows decided to do a mandatory update without any granularity of choice on when is convenient for me. That's what is frustrating. I ended up being unproductive for a whole hour because Windows forced an update on me.
Windows definitely have to make it better as Troy suggests. The frequency is also costly.
There is.
ChromeOS updates the system once every 6 weeks and still has a far more secure system.
Is it not still like that? MacOS seems worse to me, since restarting when an update exists isn't sufficient: you have to remember to go back to the update and click 'update & restart'...
Linux handles this best though, by a long shot.
Their current solution is scheduling updates to periods when the computer is not in use. I think recently they added an option for you to define a set of hours where updates take place.
But the problem with this is that people don't treat Windows PCs like always-on devices like they treat mobile phones and tablets. So in those night hours the computer is off forcing daytime updates.
In fact, if you can't afford the restart even when you schedule it, there's ksplice and a variety of similar solutions that can switch to a new kernel without a restart.
I did have firefox behave weirdly once after an upgrade until I restarted it, around v15 or so -- but I believe even that is no longer an issue; at the very least, I haven't had any issue with upgrading firefox while using it, and restarting it a week later.
Well, how do Linux and other unices do that?
If you never restart a Linux desktop (or at least log out), you will be running outdated libraries, even if you run updates in the background.
(The best solution would be what Android does, where every program is supposed to know how to checkpoint itself, and they are forcefully restarted on a upgrade, transparently to the user. But even there, updates to system libraries still require a full reboot.)
services: they are specifically designed to be updated and restarted
Oftentimes it looks suspiciously as if the (rightful) need for security and quick responses is used as an excuse for "OS-as-a-service" shift that mostly benefits the vendors.
What happened to the old practice of clearly distinguishing between "security" and "feature" updates? What happened to actually educating the users?
"Fuck you, I want some sweet data and money" is what happened.
I take that as a proof that the whole discussion is more about pushing Windows-as-a-service than about actually caring for security.
[1] https://news.ycombinator.com/item?id=14340449
[2] https://docs.microsoft.com/en-us/windows/deployment/update/w... "Long Term Servicing Branch"
* Don't reboot it without my consent
* Don't install/run advertising without my consent
* Don't install/run spyware without my consent
* Don't keep interrupting my work to nag me for my consent
The tasks I want to accomplish using my PC are more important to me than the tasks you want to accomplish using my PC. If the latter get in the way of the former, I will take whatever steps are necessary to prevent this from happening.
One might reasonably claim that allowing Windows Update free reign prevents malicious software installing itself on my PC and introducing undesirable behaviour.
However, if the introduction of undesirable behaviour by malicious software is a risk, but the introduction of undesirable behaviour by Microsoft a certainty, the incentives do not favour enabling automatic updates.
The best solution, of course, is to switch to a stable Linux distro.
Of course it is not as bad as on OSX, where if you install any Google product, like Drive or Chrome, it will nag you to authenticate it, by misleading you with messages like "We need you to authenticate so that our software can run properly" (It will run fine without you authorizing it). Google will then install the deceptively named "Keystone Agent", which runs as root, and monitors your filesystem for Google software, and will silently delete and replace it with the latest versions. Often, these newer versions remove existing functionality, such as the ability to disable DRM in Chrome [1].
The reason for this pattern for updates, is because users might not agree to this if they were given a choice.
Wrong: you are implicitly agreeing to the above 4 behaviors if you willingly use a Microsoft OS. Any time you select a vendor, you implicitly agree to their business practices and the way their product/service works. For MS, that means you consent to it rebooting whenever it wants, advertising to you, spying on you, and interrupting your work to nag you for consent. If you don't agree with these things, then you need to find another vendor.
>The best solution, of course, is to switch to a stable Linux distro.
Exactly!
Without those, you aren't much of an owner of anything.
Author here blames people that took prudent actions to preserve their autonomy, while MS was holding them hostage by bundling security updates with unwanted monitoring. Many of them switched to Linux/BSD and are using Windows minimally as a consequence.
Win10 is a shame.
They could have at least separated security updates from random crap updates. A button would be nice as well.
If anyone knows how to disable updates on non-professional win10, please let me know.
edit: I do know about security and the importance of updates. You few downvoting me can go shove it up your arse. It's crap behavior from win10, period.
Start --> 'services.msc' --> find "Windows Updates" service --> right-click --> properties --> switch it to Disabled and reboot.
Turn it on once a month or whenever YOU want to update. Done.
Thx.
Time to msconfig this laptop to "usable" state.
edit:
Parent comment flagged ? Are we on "Anti-hacker Non-news" ?
Anyway; Start-> type "services" (or "msiconfig" for more options, basically the same as winXP) and you can turn off "windows Update" there. Don't forget to turn it on every once in a while, especially if you use public networks.
update: There's also a thing called "Background Intelligent Something", that is the thing doing the actual downloads. Seems it continued downloading even without the update service running. Said service looks mildly important, but still it had to die.
In the atmospheric/climatology lab there are a number of computers running very specific versions of Windows (down to specific patches) tailored to really obscure science research software packages, some industry standard, most custom-rolled and tailored to that project. Which means they're very fragile and need to be left alone.
Of course Microsoft blasts Win10 installer files down our very expensive, very slow satellite link, and proceeds to force Win7/8 systems to Win10 which broke a few multi-million dollar experiments in a place that takes MONTHS to get to in the winter. So effectively killed the research.
And yeah, you can argue "well you should've disabled Windows updates etc etc" but in REALITY, not perfect-theory world, you should be able to trust your OS manufacturer not to force-install a major OS revision without your consent. And in the old days of Microsoft, you could. Now they just say "f--- you, we're installing it regardless what you want."
That company can die in a fire for all I care.
The lesson there is that you should always quarantine computers that need to be pinned on very specific versions of an OS, especially in such a precarious setting! Those computers should not have been able to communicate over the internet at all, except for those cases where communication is part of their purpose (e.g., monitoring the experiments), and that should happen via a dedicated VPN allowing only the traffic necessary.
I'm surprised this isn't the standard operating procedure for this kind of case.
I have some doubts about this story... The forced Windows 10 update was only sent to non-enterprise versions of Windows. I highly doubt any of these experiments were running the home editions of Windows due to the lack of control. Also, I am pretty sure that running home versions of Windows in contexts like this is against the Windows TOS.
I once had to turn off updates on all laptops in my workplace so we could use the internet. (They thought the network was under a virus attack)
Yeah yeah you can turn of Windows updates or whatever, but you shouldn't have to do that just to force Microsoft to respect your wishes to update when you want to. And no, I'm not talking about some stupid restricted 8-hour window with no other option outside completely shutting down the service. TBH I'm still surprised they haven't tried to block users from doing that too at this point.
In such a situation you can dramatically reduce the bandwidth required by setting up an update server. There's no need for every laptop to download the same patch from the internet, download the patch once and everyone gets it.
(I appreciate that doesn't help the situation where you don't have enough data for one machine)
Totally overlooked the suspicious timeline of Microsoft releasing patched for vulnerabilities that were exploited for a long time by the NSA right after it was made apparent those had been stolen and were about to be released in the wild. No question asked about NSA having known and exploited those vulnerabilities for a while, no question about Microsoft possibly willingly playing along or being legally forced to do so.
No mention that disabling Microsoft update trend is a logical answer to Microsoft using the system to silently installing spying software, breaking the system altogether, disabling pirated versions among others.
No mention that the solution to things like the wannycry outbreak is not turning on windows update but less windows and more other OS and backups. With a sane backup policy ransomware is merely a joke.
No, it isn't. Disabling update isn't a logical answer to _anything_ except "what's the best way to get malware". If you don't want Microsoft's "spyware" don't install their OS. There is no coherent logic to simultaneously not trusting Microsoft, and running their code - any version of it.
Of course there is. Many of us found Windows 7 to be a useful OS and trusted Microsoft of that era to produce it. That doesn't necessarily mean we trust Microsoft of this era or more recent Microsoft products to be something we want to use. There is no logical incompatibility here. They've simply changed their strategy to one some of us don't like, after we bought some of their earlier products and before the support lifetime of those products ran out.
I disabled Win10 updates over 1.5 years ago with zero issue. Security people love to claim the sky is falling, but it's all about risk/reward. Risk of issue due to actual exploit is pretty low for most people, so even though the potential IMPACT is very high, because the probability is so low compared to the constant irritation of Microsoft arbitrarily forcing whatever they want down your throat once a month, they just deal with it and shut off updates.
edit: downvote if you want, I'm not wrong.
So it's a trade-off: Security threats or antifeatures.
Get some error code, search for it, find 1001 sites that offer you to tell exactly what is wrong, for a price.
1) Windows update installed just security updates instead of potentially disruptive crap "features". The epitome of that, is of course forced update to Windows 10. Ads in Explorer is a close second. This would reduce the frequency of updates significantly as well, which would also help.
2) Windows update would use a sane default of not rebooting you while you are in the middle of something.
There's a setting that you can do where windows installs update in the background, with no user intervention, but IFF it doesn't require a reboot, and asks otherwise. But this setting requires Group Policy (or being part of a domain), so it's not available to non-Pro Windows customers (and it's a very esoteric option users won't know about anyway).
You can also reduce the frequency of updates with "install updates for windows only", but you can't really restrict yourself to only security updates (unless you run Windows 10 Enterprise LTSB edition, which you don't).
Actually the best thing for Windows, both usability and security wise would be to make Windows 10 Enterprise LTSB edition the version of Windows people use.
As I said, it is totally feasible because Microsoft is already doing it with LTSB.
But in reality they are spreading dangerous misinformed information.
Windows's auto updates though can be annoying, ensures that the average computer is up to date. Like in the example of this article:
"If you had any version of Windows since Vista running the default Windows Update, you would have had the critical Microsoft Security Bulletin known as "MS17-010" pushed down to your PC and automatically installed. Without doing a thing, when WannaCry came along almost 2 months later"
The average user cares that their holiday photos, documents or credentials don't get stolen or ransomed.
> The average user cares that their holiday photos, documents or credentials don't get stolen or ransomed.
Are both true. However, windows updates also occasionally cause restarts in the least opportune moments (e.g. when you have unsaved work and left for the day), or make a restart take 40 minutes when you need your computer right now (in the middle of an important phone call). Both of these have happened to virtually every Windows user I know, prompting some of them to disable Windows Updates.
Other issues with windows updates are bandwidth abuse (getting Win10 downloaded automatically on metered mobile connection), breaking some software/drivers/configuration, or installing unwelcome telemetry spyware. Each of these only happened to one or two persons I know.
The average user now keeps all their holiday photos on their mobile phone / cloud, but they do care about documents and credentials.
You are not wrong, but the way Microsoft Update behaves, you have to choose the lesser of evils (potentially get ransomwared, vs potentially avoid things listed above). It is not patently clear that Windows Update is universally the better option.
And it wouldn't be a choice between evils in the first place, if microsoft didn't try to advance their agenda by stopping the practice of "security updates" vs "other updates". Microsoft deserves all of the blame for the disdain to Windows Update, and therefore a big chunk of the sorry state of its users.
On the other hand, this is how I started programming when I was 15 :D
But well, I didn't write it in my resume till I finished my CS degree.
I've never had such intrusive updates on Mac or Android.
Perhaps Microsoft needs to figure out how to make updates much more seamless. You shouldn't need a 2-hour reboot in the middle of editing a word file just to protect against malware.
Oh, and if Microsoft actually had a QA department to make sure they don't brick machines.
https://www.sysnative.com/forums/windows-update/22645-win10v...
Tracking it down required using sysutils' procmon.exe to log about 4GB of event data and correlating it with the CBS.log. It was a broken embedded unicode string registry value with a byte swap from x36 to xFE.
My point -- there are a LOT of posts out there with people with broken windows 10 updates, and I think Microsoft could better address this.
Windows only updates when you're doing something because you're putting everyone else at risk by not running the damn things in and you've had plenty of notice.
Or you wake up, get dressed for an important meeting, unlock your door, and suddenly realize you're going to be late because your car decided this was the best time to finish refueling in spite of your instructions to refuel at another time of day.
Mine is that this has never happened to me since I switched to different OSs than Microsoft's, circa windows XP.
Our software and engineering staff are no longer confidently able to perform long-running operations overnight or across weekends. Simulations, and data-capture runs in particular are now routinely being done during normal business hours since users cannot trust that their OS won't kill everything for an update midway.
Among my tasks for this coming week is working up plan to isolate key workstations, and estimating the required budget to provide the affected users with secondary PCs for routine tasks which require internet connectivity.
So, you're admitting in public that your organization is using the consumer editions of Windows for business use instead of the enterprise edition, which allows administrators to control updates and reboots? Sounds more like your IT department basically doesn't know what it's doing; the additional cost of the enterprise edition is negligible compared to the cost of your engineering software and other tools.
Using an appropriate analogy to make something clearer works better than shoehorning something to push your view.
I plug my laptop to charge the battery when convenient and operate in a geographical area where power shortages are still an exception so I have no fuel issue in my computer usage whether I use automatic system update or not.
Actually I do not use automatic system update, if there is such a thing for this OS, it is discouraged as updates can sometimes break the system if applied blindly.
How exactly can someone not applying updates when windows asks for it put everyone else at risk ? What risk do I face from this from behind my BSD firewall on an Arch linux powered computer ?
Then again my experience of windows computers since windows update was introduced is not in line with what you describe here, getting even worse in recent times with updates applying themselves with little to no warning, sometimes running several times in a row: logs you out of your computer, applies updates for 10-45 minutes, reboots, applies updates for 15-60 minutes, logs you in, crawls your computer down by downloading more updates, logs you out of your computer, applies update for 10-45 minutes, etc...
I've witnessed this happens 3 times in a single week, the owner of the computer was pissed, I'm paid by the hour and happily browsed the web on my linux laptop while the client pestered against his computer, microsoft, technology, corporations, politicians allowing this to happen and so on.
You are better than 99% of users which is what this issue is about. You are a power user capable of looking after a machine. The problem the people who aren't.
Assuming that things work the same elsewhere as they do around you is akin to self-deception.
I'm probably leaning towards the power user category of computer users nowadays, but I wasn't born that way I learned it the hard way by having to deal with Microsoft's crap for years. Now it has become a habit too.
In your case it should be possible to have a windows "branch" with just critical vulnerabilities patched with binary diffs or something rather than 680-odd Mb patch sets.
I like this analogy! A car that runs out of fuel when its manufacturer tells it to!
> Windows only updates when you're doing something because you're putting everyone else at risk
Are you sure it's me putting people at risk, and not Microsoft?
The global scale of it shows how the end user is less trustworthy than the vendor.
> putting everyone else at risk
What hyperbole. And what a bizarre thing to socially shame people over. This is like using 9/11 to emotionally argue for behavior changes, a week after 9/11.
That's a terrible analogy. I have been shaming people for bad security practices and self-righteous ignorance for many years (even before 9/11 ironically!).
I've seen too many people have been wrong and had a bad outcome including complete data loss and in one case livelihood being shot entirely. This isn't a random assertion from thin air. You can't trust people to look after their computers.
As implemented, Windows 10 feels like a system to deploy code and update computers that happens to run user software.
It's obnoxious. Many people I know have solved the problem by moving to Apple.
My Linux install never urges me to update. Updates come out many times a day, and I can ignore them entirely for as long as I want. My Windows install continually urges me to update. It makes them increasingly hard to ignore, to make sure I install them. The idea behind this is not bad: many people would postpone updates indefinitely without understanding the consequences. Browsers these days install updates without even asking the user, and complaints about that are rare.
The problem is that updating Windows is a terrible experience. It wants to install updates when I shut down, which on a laptop is often the moment I'm leaving, when I'm ready to put it into my bag and go home. This is a terrible time to install updates. It's even worse because the time the updates take is incredibly unpredictable. Sometimes they're done in a minute, but I've also had a single small update take 45 minutes. I ended up putting the laptop into the bag while it was running the update. When I arrived home it was very close to overheating, had burnt through much of the battery capacity (the battery in that thing isn't very good), and it wasn't done yet.
Then I figured the solution would be to avoid updates at shutdown, always executing them manually when I was going to keep using it for a while. This is how I handle updates on Linux, and it works perfectly. So I tried that a few times, and the experience was terrible. It would always require a reboot immediately after, while I was working. This is a terrible time to reboot.
Meanwhile, every time I update my Linux installations, it's painless. I just run the update command, it tells me exactly what it's going to update, I accept, and I can leave it running in the background. The longest one of those updates ever took was 10-15 minutes, on a machine that hadn't been on for 6 months. Hundreds of packages updated in minutes, without disrupting the work I was doing. An hour or so later I shut it down and from the next boot on I was running the newest kernel.
What Microsoft needs to do is to make updates painless. It needs to be clear what is being updated and how long it is going to take. It needs to stop requiring reboots all the time, and when that is achieved it needs to stop updating on shutdown.
Also important: It needs to stop requring multiple reboots for one update round. Windows, for me, is not the OS that boots by default. Every time it restarts I need to explicitly tell my computer that "yes, unfortunately there are still reasons to keep using this."
Until the browser decide to break something you used (see firefox and alsa support on linux, or firefox and australis, or firefox the upcoming drop of non web extension extensions, ...). Automatic update should be limited to critical security and not significantly alter or break user experience.
> Meanwhile, every time I update my Linux installations, it's painless.
You're lucky you did not have to deal with upgrading ubuntu, or linux mint update packs, or used a distro like sidux, or have been hit by a systemd bug preventing the system from booting making evident that systemd also broke the emergency shell used to fix things. Updating a linux system is usually less painful than a windows one, but it is not as flawless as your experience paints it. With the advent of systemd it is now more windows like requiring reboot and tightly coupled versions.
I jumped on that train when they moved to GTK3, but said train seems to be running out of track.
As of late, Mozilla have done a whole lot to alienate long time _nix users in their attempt at catching Chrome's tail.
And you bring up a good point about tightly coupled versions.
_nix was in part adopted because things were loosely coupled. But in the pursuit of attention the DEs and various other big projects have steadily pushed for more tight coupling so that they can deliver a certain "commercial" UX.
1. For home users, turn on auto updates. Yes, MS's policies for updates suck, but the alternative is probably getting infected by something worse. For professional use, IT is probably going to turn it off, but then it is their responsibility to make sure critical updates get installed.
2. MS's policies suck, so everyone should disable auto updates. Then, make sure the machines have critical updates installed manually.
Unfortunately, history has clearly demonstrated that the second step of #2 doesn't happen. Heck, the NHS probably has a dedicated IT staff and that particular update hadn't bubbled to the top yet. That produces option 3:
3. Turn off updates to be moar bettar, then be surprised when the machine starts acting funny.
Once you update, Windows 10 is gonna reboot sooner or later. You can schedule it, but there's nothing you can do to stop it. It's unavoidable. It doesn't care if you're running a long compile, or uploading a large file. If you aren't sitting in front of the computer, it's gonna reboot, period.
I find this to be unacceptable.
The previous behavior, where it essentially nagged you mercilessly until you acquiesced, was far superior. I didn't go out of my way to find a 3rd party program to disable that nag-- I found it useful, to remind me I had to reboot at some point, when I found it convenient to do so.
The NSA should be focused on protecting US interests by helping these things get patched ASAP, not sitting on a treasure trove of 0-days and then they get leaked and everyone has them whilst chaos ensues.
Microsoft should be focusing on providing less controversial updates, clearly categorizing essential security updates apart from new, often controversial features. What a mess Windows 10 roll out was.
They have billions of dollars and can throw legions of software engineers at this problem fairly easily with their resources, this isn't some minor company that can't handle this issue.
But it does not work that way and wishful thinking and shoulds have no impact.
Telling people they're powerless and that they shouldn't bother is a great way of making them powerless.
Blaming the users is nice and easy, but Microsoft definitely deserves half of the blame (if not more).
Snaps were designed from the beginning to push automatic updates, even of non-security updates: https://www.youtube.com/watch?v=DLxqdf89hRo
Few people really mind updates. What Microsoft really needs to do is minimize the number of forced restarts required, like Linux which only really needs a reboot if you update the kernel itself (and even then, there are ways around that).
It's mind boggling how much bad software is available for Windows. Microsoft is doing a rather impressive job maintaining backward compatibility and yet some vendors manage to lock their software to specific version or even "patch-level". How do that even happen? Actually I know how that happens, developers that don't give a shit about the platform they're developing for.
https://www.reddit.com/r/technology/comments/4mcdon/i_live_i...
I'm going all the way back to Windows 7 here.
The only machines that are terrible to use are those I use at work because they are laden with all sorts of corporate security crap that you can't escape and bring otherwise decent hardware to it's knees.
Of course, the evidence that Windows Updates are problematic seems overwhelming but I do wonder if this is a case where the complainant numbers seem large simply because the install base is so massive.
This article isn't advocating for Microsoft, it's advocating AGAINST turning off automatic updates whether that is from a Linux distro, Apple, Microsoft, Google, etc.
Just update your device/computer, if you don't like the OS switch, if you want a specific patch etc, maybe that should be run in a VM which is gated. But for 99% of users, do not recommend they turn off auto updates.
Also, remember that if you are reading this you are probably a power user. You are not my grandmother reading an article by a power user with simple enough to follow instructions to f- her computer up. There are multiple user bases, and your advice to non-tech people can be disastrous for them.
In fact, there's a "run security updates only" option, which Microsoft provides, but which they deliberately and blatantly violated, by pushing their non-security updates through.
If Microsoft wants to stop this happening, then they need to provide a "security updates only" option, THAT ACTUALLY ONLY PROVIDES SECURITY UPDATES. This is not a hard concept.
"Turn off Windows Update" is indeed a suboptimal choice, like you say - what you should ACTUALLY be recommending to users, is to ditch Windows entirely if at all possible, and switch to an OS that is both secure and doesn't ship antifeatures.
He hates Windows 10.
I rate Microsoft a strong sell.
It should be "tell people to use a non-windows OS" instead.
[Ex daily Windows user for 10 years+ now]
Ye gods, people, if MS updates or win 10 defaults offend you so much, switch OS.
If you consider it a crime that the most widely used consumer desktop operating system in the world's latest iteration dares to not be tailored on install to your specific philosophy or preferences, switch! The alternative is free!
Win10 takes it to the other extreme, where it is impossible to disable it. You can only disable it for Wi-Fi and for each network separately. It is insane really and creates all sorts of problems in some use cases.
PS: another problem - some of the Win10 updates caused dozens of incomprehensible errors in Event Viewer on my PC, now I turned on "defer updates" and hope that delay will help MS figure out problematic patches before they will arrive.
Usually I'd say it's their own fault but fuck it, it's Microsoft's fault. Everyone knows Windows licenses are overpriced and that if Microsoft actually cared about collective security they'd bring the price down. Stop pretending you're not a part of infrastructure.
Interruptive updates are _the_ reason many people choose Mac OS X over Windows. Updates are, obviously, important. Restarts (and notifications) are bad and will be postponed and ignored, no matter how hard we try to educated users. Solution: throw all resources to minimize restarts during updates, make everything as automated as possible. I realize that it is harder to do for Windows, due to their idea of putting everything to the kernel, but this only exaggerates the urgent need for something like ksplice to be integrated.
Best i could tell was that MS was trying to update some drivers, this failed badly, had to be reverted, but that still left the relevant patch in the queue, and so Windows would try again on next reboot.
Finally had to resort to some kind of downloaded wizard from Microsoft to blacklist the patch. Not sure if that will be possible on the education version (or am i confusing it with the more recent S edition?).
You can really avoid like 90% of the shit by...
* Not going on shady sites
* Not getting scammed via Phishing
* Not pirating (you know, its really funny how most illegal 'patches' say, oh yeah patch is detected as trojan and its a false positive)
Sadly i have seen various legit tools trigger the same warnings, because the developer used similar low level techniques that malware use to hide their true nature.
Basic thing is that at the CPU level all instructions are legit. And then we pile code upon code on top to try to extract the context and intent of the programmer from the behavior of the code.
In a sense that can quickly devolve into computer "racism".
I disabled windows updates and haven't had a problem since.
Being someone that regularly uses all three major platforms, Windows 10 has definitely been the worst experience.
This is yet another episode in "hey, software isn't just to make you rich". It turns out it runs shit like hospitals. Maybe don't pervert the security tool for marketing purposes.
- it would not potentially brick their computer
- it would not install all kinds of spyware
- it would be a net benefit to the user
- it would not be used to further MS's business goals at the expense of the users
Telling people not to turn of Windows Update is putting the horse behind the cart: Tell Microsoft to start respecting their users, then tell people to turn on Windows update.
Fat chance of that happening though.
KSplice shows that you can update a running system without restart.
Real shame that MS, Chrome etc don't all manage this.
1. Don't use a public IP on your laptop on the internet.
2. Don't run shit or use IE.
Bypass 2 if you're a developer and you are experienced in this stuff.
Seriously, I genuinely want to know, because the people that just got this, are going to continue to get shit in the future.
MacOS has been doing this for some time and while it's not perfect, it's definitely led me to be less concerned about rebooting my Macs.
Any idea if this also prevents security updates?
But hey, I can ask Cortana for some random stuff and have it fail 95 per cent of the time; nice priorities, Nadella!
I would be surprised if there wasn't at least a couple of paragraphs in the eula where people give much more control over to Microsoft.
For apps that don't run on Linux for now, like Adobe, I'd rather move to OSX. Only reason for me to install Windows would be some obscure game that only runs on that platform. I honestly cannot think of any other reason to install Windows.