8 ms·

“Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unles

“Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key” Another incentive to stop using questionable AV software (since this was implemented because they can't get their act together).

sergers 9y ago
at initial patch release, not even all the well known had the registry key setting in place.... so its not just about questionable AV software when big corps considered "safe" (debatable) didnt have "their act together" either. there was a list posted yesterday on compatibility that is continued to be updated: https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLpzAtckQxYiuirADzf3cL42FQ/htmlview?sle=true#gid=0 https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLp...
sambe 9y ago
You can’t just stop using AV software I’m told. The key is checked for everyone, including people with no AV. Contrary to the sensational headlines, it is implied to be a temporary measure. It’s not really clear whether you’d have to only do this manually once, or on every subsequent update.
- JdeBP 9y ago
  The questions and answers in Microsoft's own doco imply once. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660
  - sambe 9y ago
    That makes sense to me, but then why the need for AV to repeatedly set the key?
- cube2222 9y ago
  If you do it once, it may be that your AV isn't compatible with the patch and will cause your system to bluescreen and maybe not even turn on, so no, you really shouldn't do that.
  - sambe 9y ago
    If you have no AV, you can be pretty sure that’s not an issue.
LeifCarrotson 9y ago
Note that one of the antivirus software vendors that does this correctly is, in fact, Microsoft Defender. If you haven't installed dodgy third-party AV, you're fine.
- koolba 9y ago
  Which third-party AV isn't dodgy?
  - lucb1e 9y ago
    clamav Unfortunately I have no reason to use it, though. I don't even know whether it's any good. But at least I know it's not dodgy!
    - bitwize 9y ago
      In terms of catching viruses that are out there in the wild, ClamAV is the least good antivirus solution. But hey, open source and completely auditable!
    - verall 9y ago
      Clamav (clamWin) will happily false positive and quarantine all sorts of files on a windows box, occasionally including required system files. I've tried it on 3 different boxes at different times over the past ~5 years and the amount of false positives was insane every time. I don't think its ready to be run on Windows boxes unless you are a power user willing to manually verify ~100 files are not actually malware.
  - Feniks 9y ago
    Malwarebytes? Not really an AV I guess.
- tedunangst 9y ago
  You're not fine if you've disabled Windows Defender.
craftyguy 9y ago
No, another incentive to stop using Windows. 3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates, and Microsoft should not be relying on 3rd party applications to determine whether or not their customers receive critical OS security updates (and of all things, hilariously defaulting to 'no')
- untog 9y ago
  It isn't relying on it - MS recommends people use Defender, which works fine. But unfortunately not everyone is doing that.
  - mark-r 9y ago
    Ironically Defender was preventing me from receiving Windows updates, so I had to turn it off. I assume that means I'm in a catch-22.
  - craftyguy 9y ago
    Seems like the EU and/or the FTC would want to talk to microsoft about microsoft requiring microsoft's AV to be installed before microsoft will update the OS.
    - untog 9y ago
      But they don't - third party AV software can update the registry key.
- Arnavion 9y ago
  >3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates It is because these (misbehaved) 3rd party applications do things that cause the mitigations update to make computers unusable. >and of all things, hilariously defaulting to 'no' It does not default to "no" since the default is to run MSE / Defender.
  - JadeNB 9y ago
Feniks 9y ago
The bane of open software: users can install any trash they want to.
- petecox 9y ago
  Perhaps one advantage of the walled-garden of Windows S. No virus checker needed if every piece of software is vetted by an online repository and everything runs in its own sandbox
josefx 9y ago
Microsoft could at least pop up a nag screen every 15 minutes to notify the user that their AV software is crap and needs to be removed. The average user wont know that their AV is actively keeping their OS unpatched.

sergers 9y ago

at initial patch release, not even all the well known had the registry key setting in place.... so its not just about questionable AV software when big corps considered "safe" (debatable) didnt have "their act together" either. there was a list posted yesterday on compatibility that is continued to be updated: https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLpzAtckQxYiuirADzf3cL42FQ/htmlview?sle=true#gid=0 https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLp...

sambe 9y ago

You can’t just stop using AV software I’m told. The key is checked for everyone, including people with no AV. Contrary to the sensational headlines, it is implied to be a temporary measure. It’s not really clear whether you’d have to only do this manually once, or on every subsequent update.

JdeBP 9y ago
The questions and answers in Microsoft's own doco imply once. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660
- sambe 9y ago
  That makes sense to me, but then why the need for AV to repeatedly set the key?
cube2222 9y ago
If you do it once, it may be that your AV isn't compatible with the patch and will cause your system to bluescreen and maybe not even turn on, so no, you really shouldn't do that.
- sambe 9y ago
  If you have no AV, you can be pretty sure that’s not an issue.

LeifCarrotson 9y ago

Note that one of the antivirus software vendors that does this correctly is, in fact, Microsoft Defender. If you haven't installed dodgy third-party AV, you're fine.

koolba 9y ago
Which third-party AV isn't dodgy?
- lucb1e 9y ago
  clamav Unfortunately I have no reason to use it, though. I don't even know whether it's any good. But at least I know it's not dodgy!
  - bitwize 9y ago
    In terms of catching viruses that are out there in the wild, ClamAV is the least good antivirus solution. But hey, open source and completely auditable!
  - verall 9y ago
    Clamav (clamWin) will happily false positive and quarantine all sorts of files on a windows box, occasionally including required system files. I've tried it on 3 different boxes at different times over the past ~5 years and the amount of false positives was insane every time. I don't think its ready to be run on Windows boxes unless you are a power user willing to manually verify ~100 files are not actually malware.
- Feniks 9y ago
  Malwarebytes? Not really an AV I guess.
tedunangst 9y ago
You're not fine if you've disabled Windows Defender.

craftyguy 9y ago

No, another incentive to stop using Windows. 3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates, and Microsoft should not be relying on 3rd party applications to determine whether or not their customers receive critical OS security updates (and of all things, hilariously defaulting to 'no')

untog 9y ago
It isn't relying on it - MS recommends people use Defender, which works fine. But unfortunately not everyone is doing that.
- mark-r 9y ago
  Ironically Defender was preventing me from receiving Windows updates, so I had to turn it off. I assume that means I'm in a catch-22.
- craftyguy 9y ago
  Seems like the EU and/or the FTC would want to talk to microsoft about microsoft requiring microsoft's AV to be installed before microsoft will update the OS.
  - untog 9y ago
    But they don't - third party AV software can update the registry key.
Arnavion 9y ago
>3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates It is because these (misbehaved) 3rd party applications do things that cause the mitigations update to make computers unusable. >and of all things, hilariously defaulting to 'no' It does not default to "no" since the default is to run MSE / Defender.
- JadeNB 9y ago

Feniks 9y ago

The bane of open software: users can install any trash they want to.

petecox 9y ago
Perhaps one advantage of the walled-garden of Windows S. No virus checker needed if every piece of software is vetted by an online repository and everything runs in its own sandbox

josefx 9y ago

Microsoft could at least pop up a nag screen every 15 minutes to notify the user that their AV software is crap and needs to be removed. The average user wont know that their AV is actively keeping their OS unpatched.