4 ms·

For anyone wondering why the one (1) day extra, microsoft has a fixed patching schedule. The patches were released on june 11 patch tuesday. They needed the ext

For anyone wondering why the one (1) day extra, microsoft has a fixed patching schedule. The patches were released on june 11 patch tuesday. They needed the extra day to check if it was included in the june 11 patches.

gpm 7y ago
Does anyone else think that microsoft's policy here is ridiculous? "We know your stuff is broken to the point of being insecure and a risk to your business because we screwed up when making it. We know how to fix it. We've done the work to fix it. No we won't actually fix it until a few days from now.
- CGamesPlay 7y ago
  No. If you sold cars and realized that there were some buttons you could push on the AC unit that would cause it to catch fire, you wouldn’t remotely shut off my car to perform the repairs while I was driving down the highway. The customers who “need” patches have a business to run, and forcing their computer to reboot in the middle of the workday for some service that may not be exposed at all on their network would be a good reason to avoid Microsoft products for said customer.
  - cf498 7y ago
    Are there actually businesses who just use the normal windows updater? (Ignoring smaller businesses without IT departments for a second). I assumed the forced patching at boot/reboot was a consumer version thing? A unforeseen update from microsoft can just shut down your business?
    - CGamesPlay 7y ago
      The same line of reasoning applies to IT departments as well, though. If you force corporate IT departments to spend all their time installing your daily updates, the cost of ownership of your product for the company goes way up and the department heads will start looking for cheaper alternatives. Exceptions could surely be made for critical vulnerabilities, especially those being exploited in the wild, but this is a low-severity DoS. As another commenter said, if you made this an off-schedule hotfix you would have to do it for basically every bug.
    - technion 7y ago
      Whilst servers are in a different category, multiple Windows Updates have changed the way updates work. Look at the Dual Scan situation[0]. People who had central management applied one update and suddenly found desktops also accepting updates from the Internet. Then you've got the fact that "Professional Edition" was once a perfectly fine solution for businesses, but suddenly the ability to properly control updates like you suggest required Enterprise Edition. These aren't the only issues. There's always someone who points out that if you have basically unlimited free time you can stay on top of all of it, but at the end of the day a lot of businesses still find surprise updates happening. I just got a sales call for a third party business product with the tagline "Disable Updates automatically applying (Yes, REALLY!)" as a listed feature. Finally you can top it all off with the BYOD trend, where people often expect to run their own machines without management software. [0] https://www.thewindowsclub.com/dual-scan-windows-update https://www.thewindowsclub.com/dual-scan-windows-update
      - cf498 7y ago
        Thanks for the insight
  - dustinmoris 7y ago
    If Windows Server has been developed in such a way that a patch would just randomly reboot in the middle of the day or if anything would just reboot it unknowingly to the ops team then this is an OS problem and a reason why Windows Server is unfit to be used for servers rather than a patch problem. A patch should be released as soon as possible and the OS should make it possible for the OPs team to install a patch at their own convenience and then there is no reason to withhold a patch ever. Sounds like a fundamental Windows issue and not a business practise issue.
    - PeterStuer 7y ago
      I fundamentally disagree with your point of 'a patch should be released as soon a possible'. A patch releases the fix, but by necessity also puts a bright target on the vulnerability it fixes by providing the information on potential exploitable vulnerabilities in the system being patched. From that moment on it is a race between reverse engineering exploit writers and system maintainers to get their work done first. Having coordination and predictable planning where possible allows companies to include security maintenance into the workload, rather than to have to constantly scramble and react to unforeseen and unpredictable wildfires. It is not about 'convenience', it is a component of a mature security process.
      - SmellyGeekBoy 7y ago
        Security by obscurity. Surely the information on the vulnerability is already out there by the time the patch is released?
        onli 7y ago
        No, not necessarily. That's the point of those disclosure timelines.
        Dylan16807 7y ago
        Security by obscurity can work just fine when it's a two week extension on a bug that has existed for years.
  - steelframe 7y ago
    > If you sold cars and realized that there were some buttons you could push on the AC unit that would cause it to catch fire, you wouldn’t remotely shut off my car to perform the repairs while I was driving down the highway. I'm just gonna leave this here. https://www.theverge.com/2019/1/31/18205774/nio-ota-update-traffic-china-es8 https://www.theverge.com/2019/1/31/18205774/nio-ota-update-t... Okay, so this instance was likely human error, but the manufacturer should make it very difficult for you to get yourself into this situation. I'm counting the days until one of the many new EVs on the road is force-updated (i.e., for something like a recall due to malfunctioning brakes), causing the car to become unavailable when the owner needs it.
- jedberg 7y ago
  You appear to be arguing against monthly "patch Tuesday". The reason that exists is for their enterprise customers. They used to release patches as they were ready, but it got to the point where there were patches every day, and corporate IT became a huge mess because every computer had different patches. Also, IT could never certify if a particular patch would break their internal apps. By having patch Tuesday, it lets the IT department accept the patch only on their test machines, certify their internal apps, and then push out the patch to their other hosts in a controlled fashion, while auditing that everyone actually got the patch. So while it's annoying, it was necessary to support enterprise IT.
  - saurik 7y ago
    That seems like a policy decision that can and should be made by the company, not Microsoft: Microsoft should feel free to release patches on any day they want, and if a common accepted practice is for IT departments to have a staged rollout of cleared patches, that sounds awesome. If I want "patch Tuesday" or even "patch Wednesday", it seems trivial for me to just do that myself.
    - londons_explore 7y ago
      Except for security patches, as soon as anyone has access to the patches, they can start designing code to exploit unpatched systems. If you patch on Wednesday, and everyone else patches on Tuesday, an attacker can look at Tuesday's patch and exploit your systems overnight.
    - Spooky23 7y ago
      Microsoft doesn’t want to — they want to bundle as much as possible into patch releases these days, and push as many things into new builds as possible.
    - jedberg 7y ago
      It was made at the request of the companies so there could be a coordinated day. Once the patches are out they can be exploited, so having a coordinated day helps to ensure everyone can get patched in time. Again, Microsoft only changed because their customers asked, basically demanded, that they do it that way. It wasn't really MS's decision, it was them responding to their biggest customers.
Operyl 7y ago
Yep. If a patch is scheduled to go out within 14 days of the 90 days, they will work with you a bit. But that's the absolute max.
hibbelig 7y ago
The _intent_ was to release this patch on June 11, but Microsoft didn't make it.
- deleted 7y ago
  [deleted]

gpm 7y ago

Does anyone else think that microsoft's policy here is ridiculous? "We know your stuff is broken to the point of being insecure and a risk to your business because we screwed up when making it. We know how to fix it. We've done the work to fix it. No we won't actually fix it until a few days from now.

CGamesPlay 7y ago
No. If you sold cars and realized that there were some buttons you could push on the AC unit that would cause it to catch fire, you wouldn’t remotely shut off my car to perform the repairs while I was driving down the highway. The customers who “need” patches have a business to run, and forcing their computer to reboot in the middle of the workday for some service that may not be exposed at all on their network would be a good reason to avoid Microsoft products for said customer.
- cf498 7y ago
  Are there actually businesses who just use the normal windows updater? (Ignoring smaller businesses without IT departments for a second). I assumed the forced patching at boot/reboot was a consumer version thing? A unforeseen update from microsoft can just shut down your business?
  - CGamesPlay 7y ago
    The same line of reasoning applies to IT departments as well, though. If you force corporate IT departments to spend all their time installing your daily updates, the cost of ownership of your product for the company goes way up and the department heads will start looking for cheaper alternatives. Exceptions could surely be made for critical vulnerabilities, especially those being exploited in the wild, but this is a low-severity DoS. As another commenter said, if you made this an off-schedule hotfix you would have to do it for basically every bug.
  - technion 7y ago
    Whilst servers are in a different category, multiple Windows Updates have changed the way updates work. Look at the Dual Scan situation[0]. People who had central management applied one update and suddenly found desktops also accepting updates from the Internet. Then you've got the fact that "Professional Edition" was once a perfectly fine solution for businesses, but suddenly the ability to properly control updates like you suggest required Enterprise Edition. These aren't the only issues. There's always someone who points out that if you have basically unlimited free time you can stay on top of all of it, but at the end of the day a lot of businesses still find surprise updates happening. I just got a sales call for a third party business product with the tagline "Disable Updates automatically applying (Yes, REALLY!)" as a listed feature. Finally you can top it all off with the BYOD trend, where people often expect to run their own machines without management software. [0] https://www.thewindowsclub.com/dual-scan-windows-update https://www.thewindowsclub.com/dual-scan-windows-update
    - cf498 7y ago
      Thanks for the insight
- dustinmoris 7y ago
  If Windows Server has been developed in such a way that a patch would just randomly reboot in the middle of the day or if anything would just reboot it unknowingly to the ops team then this is an OS problem and a reason why Windows Server is unfit to be used for servers rather than a patch problem. A patch should be released as soon as possible and the OS should make it possible for the OPs team to install a patch at their own convenience and then there is no reason to withhold a patch ever. Sounds like a fundamental Windows issue and not a business practise issue.
  - PeterStuer 7y ago
    I fundamentally disagree with your point of 'a patch should be released as soon a possible'. A patch releases the fix, but by necessity also puts a bright target on the vulnerability it fixes by providing the information on potential exploitable vulnerabilities in the system being patched. From that moment on it is a race between reverse engineering exploit writers and system maintainers to get their work done first. Having coordination and predictable planning where possible allows companies to include security maintenance into the workload, rather than to have to constantly scramble and react to unforeseen and unpredictable wildfires. It is not about 'convenience', it is a component of a mature security process.
    - SmellyGeekBoy 7y ago
      Security by obscurity. Surely the information on the vulnerability is already out there by the time the patch is released?
      - onli 7y ago
        No, not necessarily. That's the point of those disclosure timelines.
      - Dylan16807 7y ago
        Security by obscurity can work just fine when it's a two week extension on a bug that has existed for years.
- steelframe 7y ago
  > If you sold cars and realized that there were some buttons you could push on the AC unit that would cause it to catch fire, you wouldn’t remotely shut off my car to perform the repairs while I was driving down the highway. I'm just gonna leave this here. https://www.theverge.com/2019/1/31/18205774/nio-ota-update-traffic-china-es8 https://www.theverge.com/2019/1/31/18205774/nio-ota-update-t... Okay, so this instance was likely human error, but the manufacturer should make it very difficult for you to get yourself into this situation. I'm counting the days until one of the many new EVs on the road is force-updated (i.e., for something like a recall due to malfunctioning brakes), causing the car to become unavailable when the owner needs it.
jedberg 7y ago
You appear to be arguing against monthly "patch Tuesday". The reason that exists is for their enterprise customers. They used to release patches as they were ready, but it got to the point where there were patches every day, and corporate IT became a huge mess because every computer had different patches. Also, IT could never certify if a particular patch would break their internal apps. By having patch Tuesday, it lets the IT department accept the patch only on their test machines, certify their internal apps, and then push out the patch to their other hosts in a controlled fashion, while auditing that everyone actually got the patch. So while it's annoying, it was necessary to support enterprise IT.
- saurik 7y ago
  That seems like a policy decision that can and should be made by the company, not Microsoft: Microsoft should feel free to release patches on any day they want, and if a common accepted practice is for IT departments to have a staged rollout of cleared patches, that sounds awesome. If I want "patch Tuesday" or even "patch Wednesday", it seems trivial for me to just do that myself.
  - londons_explore 7y ago
    Except for security patches, as soon as anyone has access to the patches, they can start designing code to exploit unpatched systems. If you patch on Wednesday, and everyone else patches on Tuesday, an attacker can look at Tuesday's patch and exploit your systems overnight.
  - Spooky23 7y ago
    Microsoft doesn’t want to — they want to bundle as much as possible into patch releases these days, and push as many things into new builds as possible.
  - jedberg 7y ago
    It was made at the request of the companies so there could be a coordinated day. Once the patches are out they can be exploited, so having a coordinated day helps to ensure everyone can get patched in time. Again, Microsoft only changed because their customers asked, basically demanded, that they do it that way. It wasn't really MS's decision, it was them responding to their biggest customers.

Operyl 7y ago

Yep. If a patch is scheduled to go out within 14 days of the 90 days, they will work with you a bit. But that's the absolute max.

hibbelig 7y ago

The _intent_ was to release this patch on June 11, but Microsoft didn't make it.

deleted 7y ago
[deleted]