5 ms·

Microsoft’s February security update release delayed to March

54 points by amitmittal1993 10y ago

ocdtrekkie 10y ago
Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board. If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)
- jedberg 10y ago
  It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingly as best fit their needs. Some enterprises just run the updates that night and let everyone know to expect some slowness or downtime, and some of them only let the update run on their testing machines so they can validate the update in their environment before allowing it out to all the other machines. But the main point is that the updates are predictable because that is what the customers asked for.
  - pilif 10y ago
    > It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue. If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and hold the one patch back until next month. Of course you could also create a new cumulative update containing only 9 patches, but I assume that's more difficult to do and will require more testing.
    - jedberg 10y ago
      If anything the cumulative patch is better, not worse. It's much harder to validate nine individual patches than a single cumulative update. What happens if patch seven fails? How about six? How about six and seven? There are an exponential number of failure cases with multiple patches vs one.
      - danieldk 10y ago
        What are these security fixes that they fail so much? Although there are of course tough bugs with tough fixes, the vast majority presumably consists of off-by-ones, simple buffer overflows, use-after-free, etc.
        pawadu 10y ago
        Because the PC is an open platform, people can modify it in all kind of ways. A patch can for example fail if the user has for one reason or another removed or disabled a system component that is needed to validate or processes that patch. I think the cumulative patches work fairly well, they install much faster than the old ones. I am however troubled by the amount of security fixes Microsoft has to do every month. This shows that security is mostly an afterthought at Redmond.
        oblio 10y ago
        Not really. It was in the bad old days, pre-XP SP1. Nowadays it's part of the design process for everything. I think it's more due to the sheer surface. And for comparison, I think Ubuntu updates almost as much. It just reboots less due to architectural differences.
        pawadu 10y ago
        I think Ubuntu (and almost all other Linux distros) suffer from the same problem: there is no real security coordination during development. Compare that to OpenBSD which very rarely needs to do emergency security updates. With that said, Canonical updates the whole system and all applications. Microsoft updates only the core system, even Office is not updated unless you manually opt in.
  - danieldk 10y ago
    enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.
    - danieldk 10y ago
      To the downvoters: Red Hat, et al. can roll out security updates on running systems. Except for kernel updates, though kexec avoids long restarts.
      - notalaser 10y ago
        This is a somewhat unpleasant semi-misconception. You can, indeed, update everything but the kernel without rebooting. In fact, I suspect you could even replace the kernel image and the modules while they're running (but this will certainly break any attempt to load modules at a later point without rebooting first). (Edit: most distributions choose to keep the old image along in case the new one breaks. It's relatively unfrequent now, but back in 2003...) Generally, however, processes don't get restarted after updates and libraries don't get reloaded, so without rebooting, you're still running the unpatched versions. I don't know if RHEL has a clever way to figure out what needs to be restarted (it's not entirely impossible, thanks to systemd), but pretty much everyone under "et al." has this problem. See Peter Larsen's comment here: https://lwn.net/Articles/702664/ https://lwn.net/Articles/702664/ for a more authoritative take on this, I deserted to BSD land long ago... tl;dr Rolling out the updates without restarting is one thing, and it's done, and Microsoft could do it too, they just take the easy route. Applying them without restarting is a very different and far murkier story.
        AgentME 10y ago
        An important part to me is that usual linux updates don't cause the next reboot to take longer, or require multiple reboots. You can install the update without rebooting; it only applies on the next reboot.
  - ocdtrekkie 10y ago
    As an enterprise IT admin who has handled Windows update deployment for over six years... you missed the point. The updates should all ship on Patch Tuesday for the reasons above. The problem is that "an issue" has interfered with "all updates" because "all updates" is now "one update". For instance, one of the things that most articles did not cover about this issue is that Adobe released a new version of Flash Player on Tuesday to coincide with Patch Tuesday, when Microsoft would've released theirs as well. IE and Edge get their Flash Player updates from Microsoft through Windows Update now. However, that didn't happen this month, because the cumulative broke. And so now people can look at the Chrome and Firefox Flash Player updates and exploit the remote code execution vulnerabilities in IE and Edge, which are now at risk. In other examples, Microsoft has released updates which broke things like network printing on Windows 10. Enterprises had to make the choice to either not be able to print, or not get security updates until Microsoft finally fixed it two months later. Without the ability to pick and choose updates, when an update has a problem or compatibility issue, companies are going to end up just stopping updates, which is bad for everyone. In the past, we'd just hold the problematic update, but with cumulatives, it's not possible.
yuhong 10y ago
Also see https://bugs.chromium.org/p/project-zero/issues/detail?id=992 https://bugs.chromium.org/p/project-zero/issues/detail?id=99...
- acqq 10y ago
  I'd like to know if the "project zero" publishes to everybody the security issues discovered in Google products before Google has a chance to update the software? Or does this policy exist only for the other companies? Can we even know?
  - yuhong 10y ago
    https://bugs.chromium.org/p/project-zero/issues/detail?id=860 https://bugs.chromium.org/p/project-zero/issues/detail?id=86...
namtrac 10y ago
Since Flash update is now bundled with Windows Updates it means that Edge users will be using vulnerable Flash for one more month, wow :/
- B1FF_PSUVM 10y ago
  Flash still exists? I used to avoid annoyances by not having Flash. Now, thanks to the hard work of WHATWG on HTML5, I'm scrod.
- kyriakos 10y ago
  wasn't edge originally supposed to be updated via store?
- billpg 10y ago
  The "Disable Falsh" button is under Advanced Settings on Edge. Switched it off and I barely notice anything is missing these days.
  - popey456963 10y ago
    True, but for the 90% of users of Edge that aren't technical, going into advanced settings and disabling flash is probably beyond their abilities.
akerro 10y ago
One foreign government organisation must be hacked this month, but NSA doesn't have enough time, so they asked MS to delay patches.
- mtgx 10y ago
  It did cross my mind as well. Considering the whole Russia drama right now, I wonder if the NSA just asked Microsoft to delay its patches for this month so it doesn't interrupt the agency's on-going operations against Russia. I doesn't help that Microsoft has been moving in a direction where it provides less and less information about what its updates do these days, while sneaking through dozens of new root certificates at once every now and then. http://www.theverge.com/2017/1/25/14381174/microsoft-thailand-government-surveillance-thai-censorship-encryption http://www.theverge.com/2017/1/25/14381174/microsoft-thailan... http://www.networkworld.com/article/2348143/security/microsoft--silently--restores-root-certificates-that-users-distrust-and-remove.html http://www.networkworld.com/article/2348143/security/microso... https://hexatomium.github.io/2016/10/11/unannounced-root-cert-update/ https://hexatomium.github.io/2016/10/11/unannounced-root-cer... https://hexatomium.github.io/2015/06/26/ms-very-quietly-adds-18-new-trusted-root-certs/ https://hexatomium.github.io/2015/06/26/ms-very-quietly-adds...
- sanifsdd 10y ago
  Do you use a pay_pal account, because you can get an additional 1600 every week to your check just working on the internet 4 hours every day.. check this link.. http://bit.ly/2atnA1a http://bit.ly/2atnA1a
- staticelf 10y ago
  What do you base that on? Faith? :)
  - akerro 10y ago
    Previous leaks :) Google is in relationship with NSA Yahoo let them tap their cables Now it's MS turn
- DCKing 10y ago
mtgx 10y ago
I don't get it. So because of one issue, they're not going to deliver any other security patch either?
- noinsight 10y ago
  Microsoft stopped distributing individual patches, all updates are now rolled up into one package. Therefore, if one patch causes issues, none of them can be released. Windows 10 already worked like that, last fall they started doing the same for older OS'es. See: https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/ https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/...
  - mtgx 10y ago
    More of a reason to call that bundling "dumb". Seriously, think about all the different issues Windows 10 has caused to people's computers. So if one issue damages a computer, they can't send any of the other updates to that model of laptop? They should be striving towards higher modularity, not a lower one.
- r721 10y ago
  There are speculations that Windows Update itself could be broken: http://www.computerworld.com/article/3170633/microsoft-windows/windows-update-issues-may-be-at-root-of-februarys-patch-delay.html http://www.computerworld.com/article/3170633/microsoft-windo... https://www.askwoody.com/2017/what-happened-to-the-february-patches/ https://www.askwoody.com/2017/what-happened-to-the-february-...
  - acqq 10y ago
    I've followed the links. The argument "if the patch is broken on, for example, Windows 10 but not on Windows 7 they could still release for Windows 7" is wrong: once the patches for Windows 7 are available every criminal can investigate them and then apply the results to the unpatched (delayed) 10 systems. So it's either all platforms or none. Now they distribute all patches in one month together, so they possibly limited themselves to "all or nothing" also for one platform. But regarding all platforms, they only had the choice of releasing all platforms delayed: e.g. one or two weeks or the whole month. If the issue is not trivial, as probably isn't, the whole month alternative wins.

Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board. If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)

jedberg 10y ago
It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingly as best fit their needs. Some enterprises just run the updates that night and let everyone know to expect some slowness or downtime, and some of them only let the update run on their testing machines so they can validate the update in their environment before allowing it out to all the other machines. But the main point is that the updates are predictable because that is what the customers asked for.
- pilif 10y ago
  > It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue. If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and hold the one patch back until next month. Of course you could also create a new cumulative update containing only 9 patches, but I assume that's more difficult to do and will require more testing.
  - jedberg 10y ago
    If anything the cumulative patch is better, not worse. It's much harder to validate nine individual patches than a single cumulative update. What happens if patch seven fails? How about six? How about six and seven? There are an exponential number of failure cases with multiple patches vs one.
    - danieldk 10y ago
      What are these security fixes that they fail so much? Although there are of course tough bugs with tough fixes, the vast majority presumably consists of off-by-ones, simple buffer overflows, use-after-free, etc.
      - pawadu 10y ago
        Because the PC is an open platform, people can modify it in all kind of ways. A patch can for example fail if the user has for one reason or another removed or disabled a system component that is needed to validate or processes that patch. I think the cumulative patches work fairly well, they install much faster than the old ones. I am however troubled by the amount of security fixes Microsoft has to do every month. This shows that security is mostly an afterthought at Redmond.
        oblio 10y ago
        Not really. It was in the bad old days, pre-XP SP1. Nowadays it's part of the design process for everything. I think it's more due to the sheer surface. And for comparison, I think Ubuntu updates almost as much. It just reboots less due to architectural differences.
        pawadu 10y ago
        I think Ubuntu (and almost all other Linux distros) suffer from the same problem: there is no real security coordination during development. Compare that to OpenBSD which very rarely needs to do emergency security updates. With that said, Canonical updates the whole system and all applications. Microsoft updates only the core system, even Office is not updated unless you manually opt in.
- danieldk 10y ago
  enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.
  - danieldk 10y ago
    To the downvoters: Red Hat, et al. can roll out security updates on running systems. Except for kernel updates, though kexec avoids long restarts.
    - notalaser 10y ago
      This is a somewhat unpleasant semi-misconception. You can, indeed, update everything but the kernel without rebooting. In fact, I suspect you could even replace the kernel image and the modules while they're running (but this will certainly break any attempt to load modules at a later point without rebooting first). (Edit: most distributions choose to keep the old image along in case the new one breaks. It's relatively unfrequent now, but back in 2003...) Generally, however, processes don't get restarted after updates and libraries don't get reloaded, so without rebooting, you're still running the unpatched versions. I don't know if RHEL has a clever way to figure out what needs to be restarted (it's not entirely impossible, thanks to systemd), but pretty much everyone under "et al." has this problem. See Peter Larsen's comment here: https://lwn.net/Articles/702664/ https://lwn.net/Articles/702664/ for a more authoritative take on this, I deserted to BSD land long ago... tl;dr Rolling out the updates without restarting is one thing, and it's done, and Microsoft could do it too, they just take the easy route. Applying them without restarting is a very different and far murkier story.
      - AgentME 10y ago
        An important part to me is that usual linux updates don't cause the next reboot to take longer, or require multiple reboots. You can install the update without rebooting; it only applies on the next reboot.
- ocdtrekkie 10y ago
  As an enterprise IT admin who has handled Windows update deployment for over six years... you missed the point. The updates should all ship on Patch Tuesday for the reasons above. The problem is that "an issue" has interfered with "all updates" because "all updates" is now "one update". For instance, one of the things that most articles did not cover about this issue is that Adobe released a new version of Flash Player on Tuesday to coincide with Patch Tuesday, when Microsoft would've released theirs as well. IE and Edge get their Flash Player updates from Microsoft through Windows Update now. However, that didn't happen this month, because the cumulative broke. And so now people can look at the Chrome and Firefox Flash Player updates and exploit the remote code execution vulnerabilities in IE and Edge, which are now at risk. In other examples, Microsoft has released updates which broke things like network printing on Windows 10. Enterprises had to make the choice to either not be able to print, or not get security updates until Microsoft finally fixed it two months later. Without the ability to pick and choose updates, when an update has a problem or compatibility issue, companies are going to end up just stopping updates, which is bad for everyone. In the past, we'd just hold the problematic update, but with cumulatives, it's not possible.

yuhong 10y ago

Also see https://bugs.chromium.org/p/project-zero/issues/detail?id=992 https://bugs.chromium.org/p/project-zero/issues/detail?id=99...

acqq 10y ago
I'd like to know if the "project zero" publishes to everybody the security issues discovered in Google products before Google has a chance to update the software? Or does this policy exist only for the other companies? Can we even know?
- yuhong 10y ago
  https://bugs.chromium.org/p/project-zero/issues/detail?id=860 https://bugs.chromium.org/p/project-zero/issues/detail?id=86...

namtrac 10y ago

Since Flash update is now bundled with Windows Updates it means that Edge users will be using vulnerable Flash for one more month, wow :/

B1FF_PSUVM 10y ago
Flash still exists? I used to avoid annoyances by not having Flash. Now, thanks to the hard work of WHATWG on HTML5, I'm scrod.
kyriakos 10y ago
wasn't edge originally supposed to be updated via store?
billpg 10y ago
The "Disable Falsh" button is under Advanced Settings on Edge. Switched it off and I barely notice anything is missing these days.
- popey456963 10y ago
  True, but for the 90% of users of Edge that aren't technical, going into advanced settings and disabling flash is probably beyond their abilities.

akerro 10y ago

One foreign government organisation must be hacked this month, but NSA doesn't have enough time, so they asked MS to delay patches.

mtgx 10y ago
It did cross my mind as well. Considering the whole Russia drama right now, I wonder if the NSA just asked Microsoft to delay its patches for this month so it doesn't interrupt the agency's on-going operations against Russia. I doesn't help that Microsoft has been moving in a direction where it provides less and less information about what its updates do these days, while sneaking through dozens of new root certificates at once every now and then. http://www.theverge.com/2017/1/25/14381174/microsoft-thailand-government-surveillance-thai-censorship-encryption http://www.theverge.com/2017/1/25/14381174/microsoft-thailan... http://www.networkworld.com/article/2348143/security/microsoft--silently--restores-root-certificates-that-users-distrust-and-remove.html http://www.networkworld.com/article/2348143/security/microso... https://hexatomium.github.io/2016/10/11/unannounced-root-cert-update/ https://hexatomium.github.io/2016/10/11/unannounced-root-cer... https://hexatomium.github.io/2015/06/26/ms-very-quietly-adds-18-new-trusted-root-certs/ https://hexatomium.github.io/2015/06/26/ms-very-quietly-adds...
sanifsdd 10y ago
Do you use a pay_pal account, because you can get an additional 1600 every week to your check just working on the internet 4 hours every day.. check this link.. http://bit.ly/2atnA1a http://bit.ly/2atnA1a
staticelf 10y ago
What do you base that on? Faith? :)
- akerro 10y ago
  Previous leaks :) Google is in relationship with NSA Yahoo let them tap their cables Now it's MS turn
DCKing 10y ago

mtgx 10y ago

I don't get it. So because of one issue, they're not going to deliver any other security patch either?

noinsight 10y ago
Microsoft stopped distributing individual patches, all updates are now rolled up into one package. Therefore, if one patch causes issues, none of them can be released. Windows 10 already worked like that, last fall they started doing the same for older OS'es. See: https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/ https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/...
- mtgx 10y ago
  More of a reason to call that bundling "dumb". Seriously, think about all the different issues Windows 10 has caused to people's computers. So if one issue damages a computer, they can't send any of the other updates to that model of laptop? They should be striving towards higher modularity, not a lower one.
r721 10y ago
There are speculations that Windows Update itself could be broken: http://www.computerworld.com/article/3170633/microsoft-windows/windows-update-issues-may-be-at-root-of-februarys-patch-delay.html http://www.computerworld.com/article/3170633/microsoft-windo... https://www.askwoody.com/2017/what-happened-to-the-february-patches/ https://www.askwoody.com/2017/what-happened-to-the-february-...
- acqq 10y ago
  I've followed the links. The argument "if the patch is broken on, for example, Windows 10 but not on Windows 7 they could still release for Windows 7" is wrong: once the patches for Windows 7 are available every criminal can investigate them and then apply the results to the unpatched (delayed) 10 systems. So it's either all platforms or none. Now they distribute all patches in one month together, so they possibly limited themselves to "all or nothing" also for one platform. But regarding all platforms, they only had the choice of releasing all platforms delayed: e.g. one or two weeks or the whole month. If the issue is not trivial, as probably isn't, the whole month alternative wins.