5 ms·

I think companies are pushing updates way too aggressively to those who have auto update on. Is there some reason why phased release isn't more common among OS

I think companies are pushing updates way too aggressively to those who have auto update on. Is there some reason why phased release isn't more common among OS/firmware updates? Auto update does not have to mean "update my device the day new versions are out". Edit: Is this related to public disclosure of security bugs? If so, the community should change their standard so that public disclosure doesn't happen until a week after the update is available. This would allow for phased rollouts.

cesarb 7y ago
> If so, the community should change their standard so that public disclosure doesn't happen until a week after the update is available. The update being available is public disclosure! For an experienced reverse engineer, comparing the files before and after the update is usually enough to pinpoint the security issue.
- therein 7y ago
  I can't seem to be able to find a link to it right now but there was even this one project/website that dumped the bindiffs for each Windows Update and their disassembly.
- ivan_gammel 7y ago
  No, it is not necessarily so. First phase of rollout can happen to the users and businesses under NDA.
  - saagarjha 7y ago
    Betas are partly NDA'd to some extent, but this has historically been enforced quite poorly.
- diebeforei485 7y ago
  Don't most iOS bugs these days require multiple security exploits in order to work? I'm not sure it's always that simple to find a reliable exploit just based on what code has changed (because lots of code has changed). If there is an obvious to find, easily-exploitable bug, the update could be pushed to everyone (the way updates are pushed today). There is a balance to strike here. If issues with auto update cause enough people turn auto update off, I'm not sure it's helping security. Finally - Apple already has a beta programs including public betas. Are those binaries not already used to find exploits? Essentially, I'm not convinced a phased update (with public security disclosure slightly later) would lead to worse security than we have today.
GauntletWizard 7y ago
Doesn't matter what the security community does - The security fixes are often obvious enough in the binary delta (Comparing all of the changed files on one system to another) that cracking teams can discover the flaws that were fixed within 24h, and have exploits available in 48. That's what drives the pace of these updates - The very real fear that fixes reveal your hand to the malware community.
- danieldk 7y ago
  I guess they could separate security and bug fixes from other changes (features).
- diebeforei485 7y ago
  Apple has beta releases including a public beta program. Don't these beta releases also reveal information to the malware community?
  - GauntletWizard 7y ago
    Beta programs are about new features, not about security fixes. Those that are included are typically incidental. They're more likely to be deliberately held back/in a separate branch from beta programs so as not to reveal them.
someonehere 7y ago
macOs management tools for enterprises like Jamf allow you to explicitly set deferral for updates for 30 days to avoid situations like this. I may actually set this for my company since we try and patch within two weeks of a general security patch release.
encom 7y ago
What OS X and Windows, IOS, Android and probably lots of others need, is Long Term Support releases. I'm so sick and tired of my phone and computer switching up major features and UI every year, because some UX person wants to not get fired. Releasing a new major version of your OS yearly is insane.
- Joeri 7y ago
  On windows you can choose to get feature updates with a 4 month delay if you have windows pro (set updates to "Semi-Annual Channel" instead of "Semi-Annual Channel (Targeted)", and yes microsoft are indeed terrible with naming things). I never had issues with windows updates on that branch. There is also windows enterprise long term servicing branch (LTSB), which gets feature updates every 3 years (but is meant more for things like point of sale systems, not for regular PC's). On macOS you can stay one major release behind. So, stay on mojave until the successor to catalina is released, then upgrade to catalina. You still get security fixes and full software ecosystem support, but far fewer issues with buggy updates. On android and iOS you don't really have good options to my knowledge.
  - justinclift 7y ago
    > On macOS you can stay one major release behind. Wikipedia is indicating two major releases have support, not just one ("End of support date" in the table): https://en.wikipedia.org/wiki/MacOS#Release_history https://en.wikipedia.org/wiki/MacOS#Release_history As a data point when doing stuff in a High Sierra macOS VM earlier today, Homebrew still seems to be making binary packages for High Sierra too. So the "two releases behind" seems right.
  - kiwijamo 7y ago
    Second the recommendation to stay on Mojave. I do this for my $WORK laptop and it still gets back-ported security updates. $WORK's IT department has advised Apple users to hold off upgrading to 10.15 and it seems they have good reason to continue dispensing that advice, still...!
    - 7y ago
daveFNbuck 7y ago
I have auto update turned on and I'm still on 10.15.3.

cesarb 7y ago

> If so, the community should change their standard so that public disclosure doesn't happen until a week after the update is available. The update being available is public disclosure! For an experienced reverse engineer, comparing the files before and after the update is usually enough to pinpoint the security issue.

therein 7y ago
I can't seem to be able to find a link to it right now but there was even this one project/website that dumped the bindiffs for each Windows Update and their disassembly.
ivan_gammel 7y ago
No, it is not necessarily so. First phase of rollout can happen to the users and businesses under NDA.
- saagarjha 7y ago
  Betas are partly NDA'd to some extent, but this has historically been enforced quite poorly.
diebeforei485 7y ago
Don't most iOS bugs these days require multiple security exploits in order to work? I'm not sure it's always that simple to find a reliable exploit just based on what code has changed (because lots of code has changed). If there is an obvious to find, easily-exploitable bug, the update could be pushed to everyone (the way updates are pushed today). There is a balance to strike here. If issues with auto update cause enough people turn auto update off, I'm not sure it's helping security. Finally - Apple already has a beta programs including public betas. Are those binaries not already used to find exploits? Essentially, I'm not convinced a phased update (with public security disclosure slightly later) would lead to worse security than we have today.

GauntletWizard 7y ago

Doesn't matter what the security community does - The security fixes are often obvious enough in the binary delta (Comparing all of the changed files on one system to another) that cracking teams can discover the flaws that were fixed within 24h, and have exploits available in 48. That's what drives the pace of these updates - The very real fear that fixes reveal your hand to the malware community.

danieldk 7y ago
I guess they could separate security and bug fixes from other changes (features).
diebeforei485 7y ago
Apple has beta releases including a public beta program. Don't these beta releases also reveal information to the malware community?
- GauntletWizard 7y ago
  Beta programs are about new features, not about security fixes. Those that are included are typically incidental. They're more likely to be deliberately held back/in a separate branch from beta programs so as not to reveal them.

someonehere 7y ago

macOs management tools for enterprises like Jamf allow you to explicitly set deferral for updates for 30 days to avoid situations like this. I may actually set this for my company since we try and patch within two weeks of a general security patch release.

encom 7y ago

What OS X and Windows, IOS, Android and probably lots of others need, is Long Term Support releases. I'm so sick and tired of my phone and computer switching up major features and UI every year, because some UX person wants to not get fired. Releasing a new major version of your OS yearly is insane.

Joeri 7y ago
On windows you can choose to get feature updates with a 4 month delay if you have windows pro (set updates to "Semi-Annual Channel" instead of "Semi-Annual Channel (Targeted)", and yes microsoft are indeed terrible with naming things). I never had issues with windows updates on that branch. There is also windows enterprise long term servicing branch (LTSB), which gets feature updates every 3 years (but is meant more for things like point of sale systems, not for regular PC's). On macOS you can stay one major release behind. So, stay on mojave until the successor to catalina is released, then upgrade to catalina. You still get security fixes and full software ecosystem support, but far fewer issues with buggy updates. On android and iOS you don't really have good options to my knowledge.
- justinclift 7y ago
  > On macOS you can stay one major release behind. Wikipedia is indicating two major releases have support, not just one ("End of support date" in the table): https://en.wikipedia.org/wiki/MacOS#Release_history https://en.wikipedia.org/wiki/MacOS#Release_history As a data point when doing stuff in a High Sierra macOS VM earlier today, Homebrew still seems to be making binary packages for High Sierra too. So the "two releases behind" seems right.
- kiwijamo 7y ago
  Second the recommendation to stay on Mojave. I do this for my $WORK laptop and it still gets back-ported security updates. $WORK's IT department has advised Apple users to hold off upgrading to 10.15 and it seems they have good reason to continue dispensing that advice, still...!
  - 7y ago

daveFNbuck 7y ago

I have auto update turned on and I'm still on 10.15.3.