5 ms·

> unfortunately, not everyone keeps their systems totally up to date for various reasons Because patching requires a quick risk calculation. Should I patch to

> unfortunately, not everyone keeps their systems totally up to date for various reasons Because patching requires a quick risk calculation. Should I patch to the bleeding edge and get the latests security but risk a regression bug, or do I wait a bit so I can run a full regression test? On my machines, sure I like to stay on the latest and greatest. But I'm sure there are plenty of companies that got bitten because some critical software they rely on didn't play well with the latest OS upgrade. Blame game notwithstanding, it comes down to a business disruption risk. Of course, the right answer is to test the patches as they come out in a non-production environment, and go from there based on results. But I can see where some companies wouldn't have the resources devoted to do that on a frequent basis, which is unfortunate.

sillysaurus3 9y ago
Similar to this, I didn't patch my OS X laptop for something like three months because the darn update was a firmware update. It said something along the lines of "Make sure your laptop doesn't lose power, and make sure you have a full backup before starting." Uh-huh. I do have a full backup, but clicking that "Later" button was far more valuable than dealing with the 0.001% chance of disaster. And I'm a security guy. If I don't care enough to update every day, what do other people do? (There's not much reason to keep a personal laptop up to date when you're not interesting enough to be targeted and not in the habit of running random internet programs. Or rather, a few months of lag is fine, as long as you're paying attention to what the updates are for.) I think we just don't like to acknowledge the fact that updates sort of suck, yet we bash people and shame them for not doing them. I mean, we don't have many other tools to force them to update, but surprise surprise when people are just concealing the fact that they don't update at all. Even in corporate settings.
- wybiral 9y ago
  Platforms should maybe get better at differing security patches from other types of updates to help make the choice easier. But, I suppose, at a certain point any sufficiently old setup is simply no longer supported because it becomes too difficult to align the security patches with old versions.
  - ethbro 9y ago
    This. It still amazes me that MS hasn't done a better job of this. I'd be interested to hear a heavyweight enterprise sysadmin's take on this, but my experience and read is that it's "toss it at the wall and see what sticks". Which is crazy when MS knows all of the following things: (a) which files the patch changes, (b) how it changes those files, (c) which programs a customer uses, & (d) which MS files get loaded by which customer programs. In days where we can do ISA-to-ISA conversion on the fly, you'd think it wouldn't be rocket science to be able to say "Warning! This patch may effect operation of commonly used programs X, Y, and Z". Or at least have an admin tool to provide that information.
    - SimbaOnSteroids 9y ago
      That sounds sounds like a problem perfect for a startup to tackle.
    - Spooky23 9y ago
      Microsoft does a pretty good job at this, but some patches disrupt certain configuration. The latest round, for example, impacts printing for many people on Windows 7. This is part of what I do. We do a risk assessment -- SMB and Kerberos get patched no matter what, everything else depends on a test cycle and may be deferred for up to 6 mo.
      - pixl97 9y ago
        >Microsoft does a pretty good job at this, but What? With the large monolithic patches that Microsoft has moved to, they have got worse, much worse, recently. It does make it easier to patch everything at once quickly, but if one thing goes wrong, you have to back it off and lose all protections.
        Spooky23 9y ago
        Unless you were doing external vulnerability assessment, that granularity was a false sense of security. Rolling back sometimes re-introduced old bugs.
brazzledazzle 9y ago
Most of the time a security patch doesn't break software. There are exceptions and disasters have of course happened but you're kind of conflating general updates, upgrades and security patching. You can even canary test patches against percentages of your userbase since it's really simple with a Windows environment. Patching windows itself is probably the easiest thing to patch in an enterprise environment. The real reason these companies/organizations don't patch Windows is because they don't prioritize it and/or they're lazy.
- ingenuous2 9y ago
  You speak in certainties about vagaries. There are plenty of companies where "most of the time it's not broken" is a big problem. Possibly bigger than the cost of a security issue (I don't know, because this is both hypothetical and I'm an outsider to the issues at play). To not acknowledge that others would value a different part of the risk curve lacks perspective.
  - neltnerb 9y ago
    I mean, in my line of work Windows Update suddenly running and rebooting means fire risks. I wish I could connect the computer to the network so I could monitor equipment remotely, but it's too much risk. I hope utilities take the same measures. Certainly some work computers are vulnerable to all mess of viruses from not having gotten updates in years.
    - FeepingCreature 9y ago
      > I mean, in my line of work Windows Update suddenly running and rebooting means fire risks. With all due respect, if that's the case you should not be running Windows.
      - neltnerb 9y ago
        I agree in spirit, but there's always a balance. And to clarify, I meant "risk" in the "failure analysis" sense. I didn't intend to imply that such risks should go unmanaged. Disconnecting from the internet is part of that risk management, but of course it is multi-layered. I can't buy an Emerson control system for a small reactor getting reconfigured every other week, and LabView on an un-networked Windows computer is perfectly fine. I would not use a PC (with any OS) to control a 10 kg reactor though. At least directly. I think it'd be okay to use a PC to coordinate discrete controllers as long as they couldn't change state without a command (i.e. latching valves and the like) and as long as there was a backup safety that didn't have a computer in the loop. Safeties that do things like shut off furnaces if temperature sensors break or valves that shut off flow if it becomes too high or detect a flame are common, analogous to a fuse on a circuit board. You sure hope not to use them, but they'll suffice for unexpected situations. But there's definitely a risk that has to be managed, and connecting infrastructure and industrial equipment to the internet is not managing it very well!
abandonliberty 9y ago
Also the security patch channel has been incredibly abused to deliver non-patches.
- cbhl 9y ago
  Windows 10 has tons of security patches in it. Yes, it also has some UI changes that are less than great, but, seriously, stop using Windows XP already.
  - throwaway2048 9y ago
    So you are just going to ignore the fact that Microsoft abused the security patch channel to automatically "upgrade" people to windows 10?
    - cbhl 9y ago
      OS updates should come through the normal security patch channel! That's how OS X does it, and that's how Chrome OS does it.
      - acqq 9y ago
        Still, Microsoft misused the channel. They made it intrusive, misleading and impossible to control more than once.
      - reitanqild 9y ago
        OS updates should come through the normal security patch channel! Except when you are "updated" from a full, paid version to a spyware/adware-ridden version. Seriously: I think Windows 10 is great, technically and usability wise. But MS need to learn that they can't have it both ways: Paid xor ads. (I can think of two exception: inside the store app and inside settings for onedrive.)
      - kakarot 9y ago
        Well, it's not how most Linux distros do it. If your update has breaking changes, it's not a security update. There is no good reason to excuse Microsoft for maliciously disguising updates as security patches in order to manipulate the non tech-savvy into switching to their new unprecedentedly invasive OS. Especially when, as you said, the UI is worse. The entire UX of Windows 10 is worse, every time I have to use it for something I get physical anxiety from claustrophobia. I really don't like that I have to install untrusted 3rd party software on my computer in order to prevent my operating system from automatically ruining my user experience and spying on me.
johnny99 9y ago
You're giving people too much credit. A lot of people, and companies, totally ignore their software. There's no risk calculation; they're not thinking about it at all.

sillysaurus3 9y ago

Similar to this, I didn't patch my OS X laptop for something like three months because the darn update was a firmware update. It said something along the lines of "Make sure your laptop doesn't lose power, and make sure you have a full backup before starting." Uh-huh. I do have a full backup, but clicking that "Later" button was far more valuable than dealing with the 0.001% chance of disaster. And I'm a security guy. If I don't care enough to update every day, what do other people do? (There's not much reason to keep a personal laptop up to date when you're not interesting enough to be targeted and not in the habit of running random internet programs. Or rather, a few months of lag is fine, as long as you're paying attention to what the updates are for.) I think we just don't like to acknowledge the fact that updates sort of suck, yet we bash people and shame them for not doing them. I mean, we don't have many other tools to force them to update, but surprise surprise when people are just concealing the fact that they don't update at all. Even in corporate settings.

wybiral 9y ago
Platforms should maybe get better at differing security patches from other types of updates to help make the choice easier. But, I suppose, at a certain point any sufficiently old setup is simply no longer supported because it becomes too difficult to align the security patches with old versions.
- ethbro 9y ago
  This. It still amazes me that MS hasn't done a better job of this. I'd be interested to hear a heavyweight enterprise sysadmin's take on this, but my experience and read is that it's "toss it at the wall and see what sticks". Which is crazy when MS knows all of the following things: (a) which files the patch changes, (b) how it changes those files, (c) which programs a customer uses, & (d) which MS files get loaded by which customer programs. In days where we can do ISA-to-ISA conversion on the fly, you'd think it wouldn't be rocket science to be able to say "Warning! This patch may effect operation of commonly used programs X, Y, and Z". Or at least have an admin tool to provide that information.
  - SimbaOnSteroids 9y ago
    That sounds sounds like a problem perfect for a startup to tackle.
  - Spooky23 9y ago
    Microsoft does a pretty good job at this, but some patches disrupt certain configuration. The latest round, for example, impacts printing for many people on Windows 7. This is part of what I do. We do a risk assessment -- SMB and Kerberos get patched no matter what, everything else depends on a test cycle and may be deferred for up to 6 mo.
    - pixl97 9y ago
      >Microsoft does a pretty good job at this, but What? With the large monolithic patches that Microsoft has moved to, they have got worse, much worse, recently. It does make it easier to patch everything at once quickly, but if one thing goes wrong, you have to back it off and lose all protections.
      - Spooky23 9y ago
        Unless you were doing external vulnerability assessment, that granularity was a false sense of security. Rolling back sometimes re-introduced old bugs.

brazzledazzle 9y ago

Most of the time a security patch doesn't break software. There are exceptions and disasters have of course happened but you're kind of conflating general updates, upgrades and security patching. You can even canary test patches against percentages of your userbase since it's really simple with a Windows environment. Patching windows itself is probably the easiest thing to patch in an enterprise environment. The real reason these companies/organizations don't patch Windows is because they don't prioritize it and/or they're lazy.

ingenuous2 9y ago
You speak in certainties about vagaries. There are plenty of companies where "most of the time it's not broken" is a big problem. Possibly bigger than the cost of a security issue (I don't know, because this is both hypothetical and I'm an outsider to the issues at play). To not acknowledge that others would value a different part of the risk curve lacks perspective.
- neltnerb 9y ago
  I mean, in my line of work Windows Update suddenly running and rebooting means fire risks. I wish I could connect the computer to the network so I could monitor equipment remotely, but it's too much risk. I hope utilities take the same measures. Certainly some work computers are vulnerable to all mess of viruses from not having gotten updates in years.
  - FeepingCreature 9y ago
    > I mean, in my line of work Windows Update suddenly running and rebooting means fire risks. With all due respect, if that's the case you should not be running Windows.
    - neltnerb 9y ago
      I agree in spirit, but there's always a balance. And to clarify, I meant "risk" in the "failure analysis" sense. I didn't intend to imply that such risks should go unmanaged. Disconnecting from the internet is part of that risk management, but of course it is multi-layered. I can't buy an Emerson control system for a small reactor getting reconfigured every other week, and LabView on an un-networked Windows computer is perfectly fine. I would not use a PC (with any OS) to control a 10 kg reactor though. At least directly. I think it'd be okay to use a PC to coordinate discrete controllers as long as they couldn't change state without a command (i.e. latching valves and the like) and as long as there was a backup safety that didn't have a computer in the loop. Safeties that do things like shut off furnaces if temperature sensors break or valves that shut off flow if it becomes too high or detect a flame are common, analogous to a fuse on a circuit board. You sure hope not to use them, but they'll suffice for unexpected situations. But there's definitely a risk that has to be managed, and connecting infrastructure and industrial equipment to the internet is not managing it very well!

abandonliberty 9y ago

Also the security patch channel has been incredibly abused to deliver non-patches.

cbhl 9y ago
Windows 10 has tons of security patches in it. Yes, it also has some UI changes that are less than great, but, seriously, stop using Windows XP already.
- throwaway2048 9y ago
  So you are just going to ignore the fact that Microsoft abused the security patch channel to automatically "upgrade" people to windows 10?
  - cbhl 9y ago
    OS updates should come through the normal security patch channel! That's how OS X does it, and that's how Chrome OS does it.
    - acqq 9y ago
      Still, Microsoft misused the channel. They made it intrusive, misleading and impossible to control more than once.
    - reitanqild 9y ago
      OS updates should come through the normal security patch channel! Except when you are "updated" from a full, paid version to a spyware/adware-ridden version. Seriously: I think Windows 10 is great, technically and usability wise. But MS need to learn that they can't have it both ways: Paid xor ads. (I can think of two exception: inside the store app and inside settings for onedrive.)
    - kakarot 9y ago
      Well, it's not how most Linux distros do it. If your update has breaking changes, it's not a security update. There is no good reason to excuse Microsoft for maliciously disguising updates as security patches in order to manipulate the non tech-savvy into switching to their new unprecedentedly invasive OS. Especially when, as you said, the UI is worse. The entire UX of Windows 10 is worse, every time I have to use it for something I get physical anxiety from claustrophobia. I really don't like that I have to install untrusted 3rd party software on my computer in order to prevent my operating system from automatically ruining my user experience and spying on me.

johnny99 9y ago

You're giving people too much credit. A lot of people, and companies, totally ignore their software. There's no risk calculation; they're not thinking about it at all.