3 ms·
> It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stop
by pilif 10y ago
> It has nothing to do with cumulative updates.
well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue.
If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and hold the one patch back until next month.
Of course you could also create a new cumulative update containing only 9 patches, but I assume that's more difficult to do and will require more testing.
- jedberg 10y agoIf anything the cumulative patch is better, not worse. It's much harder to validate nine individual patches than a single cumulative update. What happens if patch seven fails? How about six? How about six and seven? There are an exponential number of failure cases with multiple patches vs one.
- danieldk 10y agoWhat are these security fixes that they fail so much? Although there are of course tough bugs with tough fixes, the vast majority presumably consists of off-by-ones, simple buffer overflows, use-after-free, etc.
- pawadu 10y agoBecause the PC is an open platform, people can modify it in all kind of ways. A patch can for example fail if the user has for one reason or another removed or disabled a system component that is needed to validate or processes that patch. I think the cumulative patches work fairly well, they install much faster than the old ones. I am however troubled by the amount of security fixes Microsoft has to do every month. This shows that security is mostly an afterthought at Redmond.
- oblio 10y agoNot really. It was in the bad old days, pre-XP SP1. Nowadays it's part of the design process for everything. I think it's more due to the sheer surface. And for comparison, I think Ubuntu updates almost as much. It just reboots less due to architectural differences.
- pawadu 10y agoI think Ubuntu (and almost all other Linux distros) suffer from the same problem: there is no real security coordination during development. Compare that to OpenBSD which very rarely needs to do emergency security updates. With that said, Canonical updates the whole system and all applications. Microsoft updates only the core system, even Office is not updated unless you manually opt in.
- proactivesvcs 10y agoThen patch seven fails, and it is re-offered. Pre-cumulative updates, it was very rare for there to be a pre-requisite / dependency list each month.
- ocdtrekkie 10y agoIndeed. A single poor update that breaks everything can cost an enterprise the ability to get security updates in general as well. About a year ago we had to choose between having current security updates and being able to print because Microsoft screwed something up in an update.