4 ms·

TLDR: Microsoft is using WannaCry as an opportunity to complain about the NSA and as an opportunity to tell people they need to update their software. I person

TLDR: Microsoft is using WannaCry as an opportunity to complain about the NSA and as an opportunity to tell people they need to update their software. I personally think that it's great to get the message across that people need to keep their operating systems up-to-date. I see too many non-technical people thinking in dangerous ways: * "I don't want to update software, because the new software could have bugs which might be a security risk." I used to work for a well-known Fortune 500 that thought this way. But _all_ software is vulnerable in one way or another and by keeping it up to date, you also get the most recent security patches. Software vendors generally aren't putting major resources into securing old versions of their software. * "I've got anti-virus software installed on my computer and we've got a firewall on our network". And maybe that will help you at some point, but if you don't update your OS, that's like having bullet-proof windows and leaving your front door unlocked.

mstade 9y ago
I wonder how much of the never-upgrade mentality is down to Microsoft insisting on being backwards compatible back till basically the Jurassic period, and providing support for obsolete software for years and years. Their intention is commendable, but there's something to be said for sometimes breaking things for what is hopefully the greater good. The rust package manager issue that was on HN the other week comes to mind, where a package called NUL (I think) wreaked havoc on Windows systems because of backwards compatibility with DOS. My point is: why rush to upgrade when you've got "support" anyway? For varying definitions of support.
- ambulancechaser 9y ago
  I'm not sure that your point makes sense. If Microsoft insists on backwards compatibility, then you _can_ upgrade with "no worries". This policy seems to encourage people to upgrade as the new OS will honor the old mechanisms. In an OS where there was no commitment to backwards compatibility you would have an incentive to not change anything when it works. > My point is: why rush to upgrade when you've got "support" anyway? This is a different point. But you seem to be criticizing the decision by Microsoft to focus on backwards compatibility and support for old operating systems, two things that seem to be commendable.
  - mstade 9y ago
    No, my apologies, I'm not being very clear then. I don't mean to criticise Microsoft here, in fact I think their commitment to backwards compatibility is commendable and I think history proves they've at least tried to get people on the automatic updates track. Execution hasn't been flawless, for sure, but we're in better place now than we were 15-20 years ago. And I'm also not trying to draw any conclusions with my post. I'm genuinely wondering whether the fact that Microsoft has been so committed to backwards compatibility has fostered a kind of mentality where people and indeed developers don't upgrade, simply because they know they won't be abandoned anyway. It's always easier not to change anything, and if the message is typically "you'll be fine" anyway then where's the incentive? The "you'll be safer, probably" message doesn't seem to me like it's working. You're probably right that I'm not making much sense, I'm finding it a bit hard to put my thoughts into words here.
- kakarot 9y ago
  No people fear updates from M$ because M$ has a bad history of bricking devices and pushing hidden privacy-harming updates without consorting their users. Or maybe it's the fact that Windows has to restart after every single software update. Really it's astounding that Microsoft provides this kind of awful updating experience and then inseminates propoganda into people's minds that those who don't auto update their W10 boxes are stupid and endangering themselves. If you use Windows 10 in general, you are stupid and endangering yourself.
  - Piskvorrr 9y ago
    I could agree with the first sentence; the rest...not. (AFAIK, Win10 was not affected by the SMB vulnerability, no?)
    - kakarot 9y ago
      Windows doesn't restart after every update for you? You don't believe Microsoft is engaged in propaganda campaigns, specifically the idea that not updating is being a "bad user"? You don't believe that by using Win10, you aren't legitimizing the "OS as Malware" concept and endangering yourself to a huge remote attack surface?
      - Piskvorrr 9y ago
        Can't see the original now, someone flagged it. Even so: - Yes, there are IIRC updates not requiring restart ("not every" <=> "some exist that do not have the property"). - Not updating your existing system is indeed dangerous. Updating your Windows system...is sometimes even more dangerous: I was on the receiving end of "Where do you want to go today? Never mind, you want to upgrade to WinX; stop whining, we know you want it!" That said, there are far more dangerous MS FUD campaigns, I think. - The final question is quite different to your original claim, IIRC; but yes, Win10 IMNSHO falls squarely under "malware," and thus I'm not using it. Not even using Windows, FWIW. Even better, the GWX fiasco helped me persuade people to move off Windows altogether.
  - sctb 9y ago
- pjmlp 9y ago
  PC are now a commodity in most countries (sadly not in all), so unless there is a very compelling reason to upgrade, no one among non technical users will do it, even less when the new OS isn't compatible with their existing software.
hannob 9y ago
> * "I've got anti-virus software installed on my computer and we've got a firewall on our network". Which is in large parts due to irresponsible marketing given to these people by AV companies.
- ropiku 9y ago
  Afaik AV wouldn't even protect against WannaCry until after its signature was already in the wild, when it was too late. But Windows update would've prevented the SMB hole by which it spread in networks.
drzaiusapelord 9y ago
>as an opportunity to tell people they need to update their software. How are defining update? I don't think anyone has issues with security updates but being force-fed a new version of Windows10 every 6 months is questionable especially when its a true re-imaging of the PC and a migration of apps and data, often screwing up in some way mostly with putting in older or buggy drivers that the end user has replaced with newer ones on the previous version. Every update has broke my trackpad on my laptop and badly hurt my gaming performance on my desktop until I could find the proper nvidia drivers. On top of having to deal with all the UI changes and other changes, none of which seem documented in a easy end-user digestible way. Also some of which have to be discovered by sysadmins like Win10 Pro now ignoring GPOs to block the store, for example. I think MS is going to use anything to justify an evergreen Windows 10. I'm not sure that's a good thing. I'm not more secure with the current version with this issue patched compared to the previous version with this issue patched. Its the same level of security. I dislike it when companies disingenuously conflate feature updates with security updates. These are two entirely different things. I think is Win10 moved at a much slower pace for feature upgrades, say every 12-18 months, people wouldn't be so wary of it. Instead, MS is forcing things down the throats of customers that are not desired or asked for. Worse, it validates a "ship and fix later" approach that will always lead to poor quality software. Lastly, MS is just being downright dishonest. Most of the infected weren't Win10 or 8/7 users too lazy to update, but old copies of XP still in use. Those XP users have auto-update running, but MS has chosen EOL it. Fine, but don't browbeat Win10 users sick of endless and buggy feature updates because of it. The two have nothing in common.
discreditable 9y ago
> I see too many non-technical people thinking in dangerous ways Large IT organizations are just as bad. Instead of patching proactively, they prefer to delay patches indefinitely. Reddit /r/sysadmin and other public forums have been a mess of "which KB do I install to block WannaCry?" type questions for the past several days.

mstade 9y ago

I wonder how much of the never-upgrade mentality is down to Microsoft insisting on being backwards compatible back till basically the Jurassic period, and providing support for obsolete software for years and years. Their intention is commendable, but there's something to be said for sometimes breaking things for what is hopefully the greater good. The rust package manager issue that was on HN the other week comes to mind, where a package called NUL (I think) wreaked havoc on Windows systems because of backwards compatibility with DOS. My point is: why rush to upgrade when you've got "support" anyway? For varying definitions of support.

ambulancechaser 9y ago
I'm not sure that your point makes sense. If Microsoft insists on backwards compatibility, then you _can_ upgrade with "no worries". This policy seems to encourage people to upgrade as the new OS will honor the old mechanisms. In an OS where there was no commitment to backwards compatibility you would have an incentive to not change anything when it works. > My point is: why rush to upgrade when you've got "support" anyway? This is a different point. But you seem to be criticizing the decision by Microsoft to focus on backwards compatibility and support for old operating systems, two things that seem to be commendable.
- mstade 9y ago
  No, my apologies, I'm not being very clear then. I don't mean to criticise Microsoft here, in fact I think their commitment to backwards compatibility is commendable and I think history proves they've at least tried to get people on the automatic updates track. Execution hasn't been flawless, for sure, but we're in better place now than we were 15-20 years ago. And I'm also not trying to draw any conclusions with my post. I'm genuinely wondering whether the fact that Microsoft has been so committed to backwards compatibility has fostered a kind of mentality where people and indeed developers don't upgrade, simply because they know they won't be abandoned anyway. It's always easier not to change anything, and if the message is typically "you'll be fine" anyway then where's the incentive? The "you'll be safer, probably" message doesn't seem to me like it's working. You're probably right that I'm not making much sense, I'm finding it a bit hard to put my thoughts into words here.
kakarot 9y ago
No people fear updates from M$ because M$ has a bad history of bricking devices and pushing hidden privacy-harming updates without consorting their users. Or maybe it's the fact that Windows has to restart after every single software update. Really it's astounding that Microsoft provides this kind of awful updating experience and then inseminates propoganda into people's minds that those who don't auto update their W10 boxes are stupid and endangering themselves. If you use Windows 10 in general, you are stupid and endangering yourself.
- Piskvorrr 9y ago
  I could agree with the first sentence; the rest...not. (AFAIK, Win10 was not affected by the SMB vulnerability, no?)
  - kakarot 9y ago
    Windows doesn't restart after every update for you? You don't believe Microsoft is engaged in propaganda campaigns, specifically the idea that not updating is being a "bad user"? You don't believe that by using Win10, you aren't legitimizing the "OS as Malware" concept and endangering yourself to a huge remote attack surface?
    - Piskvorrr 9y ago
      Can't see the original now, someone flagged it. Even so: - Yes, there are IIRC updates not requiring restart ("not every" <=> "some exist that do not have the property"). - Not updating your existing system is indeed dangerous. Updating your Windows system...is sometimes even more dangerous: I was on the receiving end of "Where do you want to go today? Never mind, you want to upgrade to WinX; stop whining, we know you want it!" That said, there are far more dangerous MS FUD campaigns, I think. - The final question is quite different to your original claim, IIRC; but yes, Win10 IMNSHO falls squarely under "malware," and thus I'm not using it. Not even using Windows, FWIW. Even better, the GWX fiasco helped me persuade people to move off Windows altogether.
- sctb 9y ago
pjmlp 9y ago
PC are now a commodity in most countries (sadly not in all), so unless there is a very compelling reason to upgrade, no one among non technical users will do it, even less when the new OS isn't compatible with their existing software.

hannob 9y ago

> * "I've got anti-virus software installed on my computer and we've got a firewall on our network". Which is in large parts due to irresponsible marketing given to these people by AV companies.

ropiku 9y ago
Afaik AV wouldn't even protect against WannaCry until after its signature was already in the wild, when it was too late. But Windows update would've prevented the SMB hole by which it spread in networks.

drzaiusapelord 9y ago

>as an opportunity to tell people they need to update their software. How are defining update? I don't think anyone has issues with security updates but being force-fed a new version of Windows10 every 6 months is questionable especially when its a true re-imaging of the PC and a migration of apps and data, often screwing up in some way mostly with putting in older or buggy drivers that the end user has replaced with newer ones on the previous version. Every update has broke my trackpad on my laptop and badly hurt my gaming performance on my desktop until I could find the proper nvidia drivers. On top of having to deal with all the UI changes and other changes, none of which seem documented in a easy end-user digestible way. Also some of which have to be discovered by sysadmins like Win10 Pro now ignoring GPOs to block the store, for example. I think MS is going to use anything to justify an evergreen Windows 10. I'm not sure that's a good thing. I'm not more secure with the current version with this issue patched compared to the previous version with this issue patched. Its the same level of security. I dislike it when companies disingenuously conflate feature updates with security updates. These are two entirely different things. I think is Win10 moved at a much slower pace for feature upgrades, say every 12-18 months, people wouldn't be so wary of it. Instead, MS is forcing things down the throats of customers that are not desired or asked for. Worse, it validates a "ship and fix later" approach that will always lead to poor quality software. Lastly, MS is just being downright dishonest. Most of the infected weren't Win10 or 8/7 users too lazy to update, but old copies of XP still in use. Those XP users have auto-update running, but MS has chosen EOL it. Fine, but don't browbeat Win10 users sick of endless and buggy feature updates because of it. The two have nothing in common.

discreditable 9y ago

> I see too many non-technical people thinking in dangerous ways Large IT organizations are just as bad. Instead of patching proactively, they prefer to delay patches indefinitely. Reddit /r/sysadmin and other public forums have been a mess of "which KB do I install to block WannaCry?" type questions for the past several days.