7 ms·

Taring everything with the same brush. There was a time, not so long ago, when it was impossible to install Windows over the Internet because so many other mach

Taring everything with the same brush. There was a time, not so long ago, when it was impossible to install Windows over the Internet because so many other machines were compromised and your machine would, with certainty, also end up compromised before it had gotten as far as applying the latest service pack. Then we got automatic updates, and we all breathed a sigh of relief because things got better. We had empirical evidence that other people do not keep their systems secure. And now apparently all automatic updates are bad, because people think I should trust them to be competent and proactive, when I know for a fact that other people are not competent and proactive. Or because people think it is the vendors problem, yet don't want vendors to push the necessary fixes. Yes, some vendors suck. But the solution isn't to demand they stop making fixes. And the solution isn't to demand they stop pushing fixes, since we know in most cases the fixes won't be voluntarily applied until it's too late. I say it is a requirement for a competent vendor to push the best version of their software. The problem I see is a disagreement between consumers and vendors on what that best version should be. And not all vendors are like that.

mattnewton 6y ago
It’s funny you mention Microsoft, because I have a windows machine to play games on. It regularly updates itself and re-enables telemetry I had disabled, shows spammy news in the start menu and ads for Microsoft products in my toolbar, and reinstalls skype every time I try to get rid of it.
- rhn_mk1 6y ago
  Keeping Windows behind a whitelist firewall seems to be a good idea.
  - boring_twenties 6y ago
    Even better, in the Recycle Bin.
- naavis 6y ago
  I wonder if there are some differences between Windows 10 versions (like Home, Professional etc) there. I have never had that happen. I have Windows 10 Pro.
  - mmphosis 6y ago
    I have Windows 10 Pro. It is horrible. And, I have no choice in any of it. Advertisements pop up at random times. I am constantly turning things off, and they get turned back on again. I am diligent about checking for updates at the end of my work day, and then turning off scheduled updates. I cannot afford to wait for a "Do not turn off your computer" screen.
    - oauea 6y ago
      > Advertisements pop up at random times Do you have a screenshot?
      - deleted 6y ago
        [deleted]
      - mmphosis 6y ago
        https://i.postimg.cc/8ckbcS5D/Screenshot.png https://i.postimg.cc/8ckbcS5D/Screenshot.png
        oauea 6y ago
        That's McAfee/HP, not Windows. It probably came preinstalled by whoever sold you the laptop. Uninstall all preinstalled crapware or just do a clean windows reinstall when you buy a laptop.
    - shawnz 6y ago
      I assure you, being diligent about checking for updates is more than enough to solve that issue and there is no need to disable updates in addition. If you install them regularly, then you will not be interrupted. You will only be interrupted if you don't do that for weeks. If you don't believe me, then just try it. Don't base your decisions on FUD from tech bloggers about how terrible the update process is.
- Chris2048 6y ago
  Windows 10 "pre-installs" a load of BS Casino/Farmville-esque games. Not install, "pre-install" as in the files to install are there, but it's not actually installed so you can't remove them via the usual method, you have to find the right PowerShell commands. These are the games advertised/installed from the start menu / tiles.
- bentcorner 6y ago
  It sounds like many of you would appreciate the LTSC version of Windows: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/ltsc-what-is-it-and-when-should-it-be-used/ba-p/293181 https://techcommunity.microsoft.com/t5/windows-it-pro-blog/l...
  - __MatrixMan__ 6y ago
    Wow, a version of Windows without all the stuff I hate about Windows. Will investigate, thanks.
  - dreamcompiler 6y ago
    I'm thinking about buying my first-ever Windows box just to run MS Flight Sim. This looks like it might be a good option for that.
  - 0xffff2 6y ago
    Isn't that the version that requires a volume license to run?
  - deleted 6y ago
    [deleted]
stormdennis 6y ago
I think it's preferable not to push fixes as long as people are made aware of the risks they're running. So there should be an automatic opt-in but an option to opt out with suitable warnings issued at the time.
stan_rogers 6y ago
Now explain how fucking about with features or UIs makes sense.
jacquesm 6y ago
There is nothing wrong with automatic security updates, I make that pretty clear in the article and don't understand why you come to the conclusion that I wrote that 'all automatic updates are bad'. The second bullet in the list reads: "should be incremental and security or bug fixes only"
- tspiteri 6y ago
  Maybe web browsers are an extreme case, but I think your model would only work for long term releases. It is not reasonable to expect browser vendors to backport all security fixes to all releases so that users on old releases get essential security fixes. So while I do agree that your model should be the default, I see nothing wrong in allowing people who want to live on the edge to have a release with updates that do affect the interface (I use Fedora not CentOS, and I want the updates).
  - Silhouette 6y ago
    It is not reasonable to expect browser vendors to backport all security fixes to all releases so that users on old releases get essential security fixes. Why? We built software and supported old releases for decades just fine until the current toxic culture of pushing out frequent, often poorly-tested changes over the Internet came along. Jacques has this one right. There are different reasons for updates, and conflating them is a problem. It would be in everyone's best interests if we rapidly patched security vulnerabilities. It might be in a user's best interests to receive a fix for a bug that was preventing the software from functioning properly, if the user wants that functionality. It might be in a user's best interests to receive an update that adds support for some new hardware or online service or data format, if the user is interested in compatibility with those things. None of the cases above implies any loss of existing functionality or change in existing UI, though. Updates can do those things as well, but we should clearly distinguish those from updates for reasons like security, robustness or compatibility, and it is not obvious that the same update procedures will be appropriate for all of these cases.
a_imho 6y ago
Once upon a time I shared an office with sysadmins. Patch Tuesday was not something to be taken lightly. On the serious side, imo the fundamental problem is control. Opinions align along the lines how strong one feels about their computing freedom.
- deleted 6y ago
  [deleted]
badsectoracula 6y ago
People use computers to do things. When automated updates make it harder for them to do the things they want to do, especially out of no action on their own, they are going to dislike the automatic updates. And when trying to avoid the automated updates - which is what they see as the source of making it harder to do the things they want to do - is met with automated updates being forced even harder on them, they're going to dislike those automated updates even more. The key isn't to not have automated updates, it is for those automated updates to not make it harder for people to do the things they want to do with their computers. Automated updates should be as transparent and frictionless as possible. Take a hint out of the Linux kernel: Linus realized very early that updating the kernel should not break people's programs because that would cause them to not update the kernel. So the kernel developers try their hardest to avoid breaking people's programs. And this ends with kernel updates being one of the safest updates on a Linux system you can do. Everything should be like kernel updates.
- rlayton2 6y ago
  Your first sentence hits the nail on the spot. For instance, I open up the Prusa slicer software (for 3d printing) and it says there is an update. I didn't open the software to update it, so I always click no - I opened this because I need to 3D print something, and I don't know what the time commitment of updating the software is. I'll go update it now that I am thinking about it, but this is a general pattern.
  - boring_twenties 6y ago
    It's the same thing with those godawful "hey, check out this new feature" popups that are all the rage these days. Or better yet, "check out this old feature that you probably forgot about." That's not useless information, but somehow they picked the worst possible time to present it: when I'm trying to do something else. Usually, I don't even remember an hour later what it was trying to offer me. All I remember is being aggravated by something annoying that was in my way.
  - TecoAndJix 6y ago
    ...and every time i go to print on mine i quickly hit the orange button (skip) when it says "new firmware available"! I just want to print. Plus, not being able to update from SD makes the process a chore in itself. That being said, I think automatic updates are a good thing when it goes from optional to required. At the corporation I am employed, we deploy via SCCM and have a window where the user can kick off the install. For example, if a cumulative update is pushed on Monday, we give the user until Thursday to install the patch on their own. Then, at 1PM on Thursday, a countdown begins to let them to know they need to save their work because this IS happening. That takes the blame away from the information system (hey, we gave you all week) and on to the user for poor time management. The alternative is your infrastructure turns into swiss cheese with vulnerabilities.
fiblye 6y ago
10 years ago, I found some software updates annoying. 5 years ago, I found most of them aggravating. Now, I find them to be outright harmful except for rare cases. It's very common for (particularly mobile software) to just break the product entirely. Features I regularly used and depended on--sometimes even the main features--are just deleted. Gone, with zero chance of using it again. Sometimes ads are thrown in, adding a major vulnerability. Other times they reduce/cripple features, yet somehow worsen performance despite doing less. Sometimes they wipe data. Sometimes they update and suddenly require a google or facebook login to use "for convenience" (inconveniencing me who never needed to login before). Updates before used to be bugfixes and cleanup, and major upgrades came out every year or two and you'd have to manually opt in to those by going to their site and downloading a new version, or going out and paying for it. Now your old, functional software is wiped from your system and replaced with a bad imposter using the same identity. I'll begrudgingly install OS updates sometimes, but only weeks or months after release when all the downsides and upsides are easy to consider. The chances of me coming across some harmful vulnerability in the wild is far less likely than the reality of dealing with a harmful, work-destroying update. I haven't encountered the former in over a decade. I've dealt with the latter several times this year.
- shawnz 6y ago
  Can you give me an example of the last time you faced a harmful, work-destroying update? Because that hasn't occurred to me in any product for years, and I always install manufacturer updates the day they are released.
  - fiblye 6y ago
    There was a recent update to some PLC software that I use daily that integrates with other software for the display device and allows both to execute at once. It recently broke won't allow both pieces of software to run in test/monitoring mode simultaneously without crashing and without saving. This is software meant to be used on actual, moving, industrial hardware. A few updates have been released this year since that bug, but none have addressed this issue. I've had to be very careful when working on active machinery because it's very easy to accidentally trigger it, and each time comes with the risk of accidentally breaking some very expensive machinery (or injuring people).

mattnewton 6y ago

It’s funny you mention Microsoft, because I have a windows machine to play games on. It regularly updates itself and re-enables telemetry I had disabled, shows spammy news in the start menu and ads for Microsoft products in my toolbar, and reinstalls skype every time I try to get rid of it.

rhn_mk1 6y ago
Keeping Windows behind a whitelist firewall seems to be a good idea.
- boring_twenties 6y ago
  Even better, in the Recycle Bin.
naavis 6y ago
I wonder if there are some differences between Windows 10 versions (like Home, Professional etc) there. I have never had that happen. I have Windows 10 Pro.
- mmphosis 6y ago
  I have Windows 10 Pro. It is horrible. And, I have no choice in any of it. Advertisements pop up at random times. I am constantly turning things off, and they get turned back on again. I am diligent about checking for updates at the end of my work day, and then turning off scheduled updates. I cannot afford to wait for a "Do not turn off your computer" screen.
  - oauea 6y ago
    > Advertisements pop up at random times Do you have a screenshot?
    - deleted 6y ago
      [deleted]
    - mmphosis 6y ago
      https://i.postimg.cc/8ckbcS5D/Screenshot.png https://i.postimg.cc/8ckbcS5D/Screenshot.png
      - oauea 6y ago
        That's McAfee/HP, not Windows. It probably came preinstalled by whoever sold you the laptop. Uninstall all preinstalled crapware or just do a clean windows reinstall when you buy a laptop.
  - shawnz 6y ago
    I assure you, being diligent about checking for updates is more than enough to solve that issue and there is no need to disable updates in addition. If you install them regularly, then you will not be interrupted. You will only be interrupted if you don't do that for weeks. If you don't believe me, then just try it. Don't base your decisions on FUD from tech bloggers about how terrible the update process is.
Chris2048 6y ago
Windows 10 "pre-installs" a load of BS Casino/Farmville-esque games. Not install, "pre-install" as in the files to install are there, but it's not actually installed so you can't remove them via the usual method, you have to find the right PowerShell commands. These are the games advertised/installed from the start menu / tiles.
bentcorner 6y ago
It sounds like many of you would appreciate the LTSC version of Windows: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/ltsc-what-is-it-and-when-should-it-be-used/ba-p/293181 https://techcommunity.microsoft.com/t5/windows-it-pro-blog/l...
- __MatrixMan__ 6y ago
  Wow, a version of Windows without all the stuff I hate about Windows. Will investigate, thanks.
- dreamcompiler 6y ago
  I'm thinking about buying my first-ever Windows box just to run MS Flight Sim. This looks like it might be a good option for that.
- 0xffff2 6y ago
  Isn't that the version that requires a volume license to run?
- deleted 6y ago
  [deleted]

stormdennis 6y ago

I think it's preferable not to push fixes as long as people are made aware of the risks they're running. So there should be an automatic opt-in but an option to opt out with suitable warnings issued at the time.

stan_rogers 6y ago

Now explain how fucking about with features or UIs makes sense.

jacquesm 6y ago

There is nothing wrong with automatic security updates, I make that pretty clear in the article and don't understand why you come to the conclusion that I wrote that 'all automatic updates are bad'. The second bullet in the list reads: "should be incremental and security or bug fixes only"

tspiteri 6y ago
Maybe web browsers are an extreme case, but I think your model would only work for long term releases. It is not reasonable to expect browser vendors to backport all security fixes to all releases so that users on old releases get essential security fixes. So while I do agree that your model should be the default, I see nothing wrong in allowing people who want to live on the edge to have a release with updates that do affect the interface (I use Fedora not CentOS, and I want the updates).
- Silhouette 6y ago
  It is not reasonable to expect browser vendors to backport all security fixes to all releases so that users on old releases get essential security fixes. Why? We built software and supported old releases for decades just fine until the current toxic culture of pushing out frequent, often poorly-tested changes over the Internet came along. Jacques has this one right. There are different reasons for updates, and conflating them is a problem. It would be in everyone's best interests if we rapidly patched security vulnerabilities. It might be in a user's best interests to receive a fix for a bug that was preventing the software from functioning properly, if the user wants that functionality. It might be in a user's best interests to receive an update that adds support for some new hardware or online service or data format, if the user is interested in compatibility with those things. None of the cases above implies any loss of existing functionality or change in existing UI, though. Updates can do those things as well, but we should clearly distinguish those from updates for reasons like security, robustness or compatibility, and it is not obvious that the same update procedures will be appropriate for all of these cases.

a_imho 6y ago

Once upon a time I shared an office with sysadmins. Patch Tuesday was not something to be taken lightly. On the serious side, imo the fundamental problem is control. Opinions align along the lines how strong one feels about their computing freedom.

deleted 6y ago
[deleted]

badsectoracula 6y ago

People use computers to do things. When automated updates make it harder for them to do the things they want to do, especially out of no action on their own, they are going to dislike the automatic updates. And when trying to avoid the automated updates - which is what they see as the source of making it harder to do the things they want to do - is met with automated updates being forced even harder on them, they're going to dislike those automated updates even more. The key isn't to not have automated updates, it is for those automated updates to not make it harder for people to do the things they want to do with their computers. Automated updates should be as transparent and frictionless as possible. Take a hint out of the Linux kernel: Linus realized very early that updating the kernel should not break people's programs because that would cause them to not update the kernel. So the kernel developers try their hardest to avoid breaking people's programs. And this ends with kernel updates being one of the safest updates on a Linux system you can do. Everything should be like kernel updates.

rlayton2 6y ago
Your first sentence hits the nail on the spot. For instance, I open up the Prusa slicer software (for 3d printing) and it says there is an update. I didn't open the software to update it, so I always click no - I opened this because I need to 3D print something, and I don't know what the time commitment of updating the software is. I'll go update it now that I am thinking about it, but this is a general pattern.
- boring_twenties 6y ago
  It's the same thing with those godawful "hey, check out this new feature" popups that are all the rage these days. Or better yet, "check out this old feature that you probably forgot about." That's not useless information, but somehow they picked the worst possible time to present it: when I'm trying to do something else. Usually, I don't even remember an hour later what it was trying to offer me. All I remember is being aggravated by something annoying that was in my way.
- TecoAndJix 6y ago
  ...and every time i go to print on mine i quickly hit the orange button (skip) when it says "new firmware available"! I just want to print. Plus, not being able to update from SD makes the process a chore in itself. That being said, I think automatic updates are a good thing when it goes from optional to required. At the corporation I am employed, we deploy via SCCM and have a window where the user can kick off the install. For example, if a cumulative update is pushed on Monday, we give the user until Thursday to install the patch on their own. Then, at 1PM on Thursday, a countdown begins to let them to know they need to save their work because this IS happening. That takes the blame away from the information system (hey, we gave you all week) and on to the user for poor time management. The alternative is your infrastructure turns into swiss cheese with vulnerabilities.

fiblye 6y ago

10 years ago, I found some software updates annoying. 5 years ago, I found most of them aggravating. Now, I find them to be outright harmful except for rare cases. It's very common for (particularly mobile software) to just break the product entirely. Features I regularly used and depended on--sometimes even the main features--are just deleted. Gone, with zero chance of using it again. Sometimes ads are thrown in, adding a major vulnerability. Other times they reduce/cripple features, yet somehow worsen performance despite doing less. Sometimes they wipe data. Sometimes they update and suddenly require a google or facebook login to use "for convenience" (inconveniencing me who never needed to login before). Updates before used to be bugfixes and cleanup, and major upgrades came out every year or two and you'd have to manually opt in to those by going to their site and downloading a new version, or going out and paying for it. Now your old, functional software is wiped from your system and replaced with a bad imposter using the same identity. I'll begrudgingly install OS updates sometimes, but only weeks or months after release when all the downsides and upsides are easy to consider. The chances of me coming across some harmful vulnerability in the wild is far less likely than the reality of dealing with a harmful, work-destroying update. I haven't encountered the former in over a decade. I've dealt with the latter several times this year.

shawnz 6y ago
Can you give me an example of the last time you faced a harmful, work-destroying update? Because that hasn't occurred to me in any product for years, and I always install manufacturer updates the day they are released.
- fiblye 6y ago
  There was a recent update to some PLC software that I use daily that integrates with other software for the display device and allows both to execute at once. It recently broke won't allow both pieces of software to run in test/monitoring mode simultaneously without crashing and without saving. This is software meant to be used on actual, moving, industrial hardware. A few updates have been released this year since that bug, but none have addressed this issue. I've had to be very careful when working on active machinery because it's very easy to accidentally trigger it, and each time comes with the risk of accidentally breaking some very expensive machinery (or injuring people).