4 ms·

I have been in IT for over 20 years now. I have had orders of magnitude more problem with updates than with malware/viruses/hackers. The thing is with malware

I have been in IT for over 20 years now. I have had orders of magnitude more problem with updates than with malware/viruses/hackers. The thing is with malware/viruses/hackers sooner or later something will get through any defences, so you need robust recovery system anyway. And most updates that brake systems are not even security updates. I wouldn't mind automated security updates, but many many many maybe most vendors pile whatever happens to compile to their updates so that they customers can test it for them. Firefox on mobile just fucked us in the ass (extension we developed for client doesn't work anymore and we can't fix it. And since we have support contract we will probably have to eat the cost of whatever alternative we have to build.).

burntoutfire 6y ago
> I have had orders of magnitude more problem with updates than with malware/viruses/hackers. Maybe that's precisely because the updates are preventing you from being owned?
- wolco 6y ago
  The % of security fixes vs speed ui improvements is 100 to 1. Very rarely do we get issues that require forced updates that a once a year limit on these types of updates would be ideal.
scarface74 6y ago
I have been in IT for over 20 years now. I have had orders of magnitude more problem with updates than with malware/viruses/hackers. Until you get hit by this.... https://www.giac.org/paper/gcih/201/microsoft-iis-superfluous-decoding-vulnerability/100349 https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou... It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.
- unionpivo 6y ago
  Oh we(organizations I have worked for) have been hit several times (not IIS, but once it was several wordpress sites we used, once it was outlook, once we never figured out - probably inside job, ... ). But that was 3, 4 times in 20 years. Updates its 3,4 times per year. Like I said order of magnitude difference

burntoutfire 6y ago

> I have had orders of magnitude more problem with updates than with malware/viruses/hackers. Maybe that's precisely because the updates are preventing you from being owned?

wolco 6y ago
The % of security fixes vs speed ui improvements is 100 to 1. Very rarely do we get issues that require forced updates that a once a year limit on these types of updates would be ideal.

scarface74 6y ago

I have been in IT for over 20 years now. I have had orders of magnitude more problem with updates than with malware/viruses/hackers. Until you get hit by this.... https://www.giac.org/paper/gcih/201/microsoft-iis-superfluous-decoding-vulnerability/100349 https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou... It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.

unionpivo 6y ago
Oh we(organizations I have worked for) have been hit several times (not IIS, but once it was several wordpress sites we used, once it was outlook, once we never figured out - probably inside job, ... ). But that was 3, 4 times in 20 years. Updates its 3,4 times per year. Like I said order of magnitude difference