7 ms·

"When people had a choice in updates, too many would postpone them. This left our OS susceptible to attacks which made for some bad press for us. If we force up

"When people had a choice in updates, too many would postpone them. This left our OS susceptible to attacks which made for some bad press for us. If we force updates, this won't happen." - some exec, probably

raverbashing 4y ago
And the worse part is that they're not wrong
- II2II 4y ago
  They were wrong in the sense that they used it to condition people to accept non-security updates and they were wrong in the sense that some people are better placed to determine whether any form of update is an unacceptable risk. As things stand today, I only trust updates from community driven open source software projects. With exceptionally few exceptions, commercial software seems to offer the guarantee of delivering undesirable payloads.
  - brookst 4y ago
    I work for one of those very large commercial software companies. In general, I think we do a pretty good job. We absolutely fuck some things up, for sure, for a lot of different reasons. But I promise you there is never any kind of Machiavellian multi-year plan to condition people for upcoming bad behavior. Most of the things we do screw up are from lack of foresight; we are definitely not strong enough at long range planning to run psyops on customers.
shadowgovt 4y ago
If by "bad press" you mean "other users getting fucked over by an entire homogeneous ecosystem of the same OS being a breeding ground for gigantic botnets that criminals were able to turn on services to knock them off the internet," yes. The only real way to address it without the mandatory updates was for the ecosystem to diversify; can't use a Windows exploit to compromise a Mac OS machine. You can imagine why that solution was not on Microsoft's list of recommendations.
- tgsovlerkhgsel 4y ago
  The real way to address this would be to not make users hate updates. That would mean doing as much of the work as possible in the background in a way that doesn't impact the user and making sure the reboot where it actually gets activated doesn't take noticeably longer. It would also mean not doing things that are against the user's interest like moving things around, installing new ads or misfeatures, or breaking things. I don't know anyone who hates or wants to disable Chrome updates, for example (I'm sure such people exist, but it's much less common than Windows updates), despite Chrome updating way more often than once a month. Of course, overcoming the aversion people built over years because of past bad behavior is going to be hard, but forcing people against their will and making updates more disruptive isn't going to help with that aversion. People really dislike being forced to do something, even if they don't actually mind the thing itself that much.
  - kevincox 4y ago
    This is the key. Lots of systems have seamless updates where the only real interruption is a reboot. Android does an A/B update and after a only slightly slow reboot is in the new version. It then does some optimization in the background that can have a slight performance impact. NixOS must be the gold standard here. It downloads and completely installs the new version in the background then a regular-speed reboot is enough to be running the new system. (~10s on my system) But Windows and macOS both have crazy slow update processes. When I had a mac for work I was dumbfounded by how slow the update process was. It regularly took >30min! Those machines are crazy fast, it seems like it could have written a TiB of data in that time so IDK what it is actually doing.
    - atonse 4y ago
      100% agree with this. Point updates of macOS take 20+ minutes on an M1 Max with 32GB of memory and a blazing fast SSD. What could it possibly be doing? Even iOS updates are a bit faster. Is apple even interested in fixing this?
      - 4y ago
ako 4y ago
It’s not just software execs, I’ve actually heard customers asking for auto-update recently as approving and updating it themselves was too cumbersome, or they relied on a department for this that had no time to do this soonish. They literally asked for “auto updates like chrome or Firefox”…
- OkayPhysicist 4y ago
  Auto updates are fantastic if, and only if, the developer can be trusted not to break things for fun. Firefox's auto-updates consist of downloading stuff in the background, prompting me to "restart when you want to apply the update", and then changing next to nothing about my experience of the application between updates. That is the perfect update story. Everyone loves it: the users aren't having their workflows upended, the developers are able to push updates regularly for security problems and the like, the only loser is the graphics designer who got hired because daddy owns the company and needs to constantly re-design the user interface to justify their job. (seriously, people in companies that do this kind of shit, what is it with re-designs? Why?)
hardware2win 4y ago
OSes should update because people dont care.
omgmajk 4y ago
I lost some work a while ago because in Win 10 home you can't easily turn off automatic updates. The amount of hate I got on some forums for suggesting that automatic updates are bad was beyond me. I just upgraded to Pro instead and turned it off in group policies, but I still got hit with an automatic restart at some point.
- daemin 4y ago
  While I have upgraded to Pro and turned off those settings myself, I have not experienced my whole system restarting to do an update. I have had to neuter the TPM modules in my BIOS to prevent Windows 11 from automatically installing though. However the issue that I've had was my Terminal App shutting down by itself, I thought it was a crash but it turns out it was because the Windows Store decided to update it. Now that is complete BS! How can a store arbitrarily decide to update an app while it is still running without asking, without waiting? Even Steam waits to download and update games for when you're not playing one. If it ever did the same thing as what the Windows Store does then there'd be a riot for sure. I guess that it means the Windows Store is just not being used by people at all. For those interested the "fix" for not having Terminal app restart for an update is to download the MSI package, extract it to a directory, and run it from there. That's directly from the Developer's words on Github.
  - ectopod 4y ago
    Thank you! I've had wt just disappear on me a few times now and I've been meaning to investigate. It never occurred to me this was by design.
- cratermoon 4y ago
  Automatic updates to address real issues and security risks are fine, unless you're talking about updates that can't be postponed if you're in the middle of something. What we see, of course, is exactly what the twitter thread posted mentions: some "dickweasel" hijacked the update system to push crapware or do something user-hostile for purposes completely unrelated to what the user would want. James Williams discusses this in his book "Stand Out Of Our Light", and likens it to a GPS that takes you off to places that you never wanted to visit in the course of (maybe) getting you to your intended destination. Of course, you arrive late, if ever, and burned way more gas (or battery) than you needed. But the GPS got you to drive by a specific set of billboards that they wanted you to see.
naikrovek 4y ago
not just bad press. they were called before Congress and asked why updates weren't required.
codalan 4y ago
It's not that updates are necessarily bad. It's when they try to launder in a bunch of "feature" updates (i.e. more spyware, more crapware) with needed security updates. They force the user to make a decision: Do I skip this update and avoid having new "features" from crippling my machine, or do I download the update to prevent my machine from being hacked? If vendors really gaf, they would make is so that you could download needed security updates w/o the rest of the garbage. But then they couldn't force more malware on you.
- Iolaum 4y ago
  This! Security updates bundled with feature updates are what makes updates hostile to the consumer.
  - jjeaff 4y ago
    In their defense, it would be difficult to keep security updates fully separate from feature updates since sometimes replacing a vulnerable feature with a new feature is the easiest fix rather than pushing the new feature, but also issuing a separate fix for those that don't want the new feature. In other words, it's only reasonable to expect security updates for a certain length of time and not indefinitely.
dan-robertson 4y ago
Somehow windows devices are ok at installing security updates and most apple phones are on the latest os version. I’d be interested to know what the actual story at MS was for this. I think the executives there in the past demonstrated pretty good decision making. Here’s[1] someone claiming something about PM’s thinking they knew better than users and maybe there is some hidden OKR incentive driving that reasoning, but my weak understanding is that that person wasn’t really involved in what happened so I don’t know how true it is. [1] https://twitter.com/danluu/status/1504567911565824000 https://twitter.com/danluu/status/1504567911565824000 nitter: https://nitter.fly.dev/danluu/status/1504567911565824000 https://nitter.fly.dev/danluu/status/1504567911565824000

raverbashing 4y ago

And the worse part is that they're not wrong

II2II 4y ago
They were wrong in the sense that they used it to condition people to accept non-security updates and they were wrong in the sense that some people are better placed to determine whether any form of update is an unacceptable risk. As things stand today, I only trust updates from community driven open source software projects. With exceptionally few exceptions, commercial software seems to offer the guarantee of delivering undesirable payloads.
- brookst 4y ago
  I work for one of those very large commercial software companies. In general, I think we do a pretty good job. We absolutely fuck some things up, for sure, for a lot of different reasons. But I promise you there is never any kind of Machiavellian multi-year plan to condition people for upcoming bad behavior. Most of the things we do screw up are from lack of foresight; we are definitely not strong enough at long range planning to run psyops on customers.

shadowgovt 4y ago

If by "bad press" you mean "other users getting fucked over by an entire homogeneous ecosystem of the same OS being a breeding ground for gigantic botnets that criminals were able to turn on services to knock them off the internet," yes. The only real way to address it without the mandatory updates was for the ecosystem to diversify; can't use a Windows exploit to compromise a Mac OS machine. You can imagine why that solution was not on Microsoft's list of recommendations.

tgsovlerkhgsel 4y ago
The real way to address this would be to not make users hate updates. That would mean doing as much of the work as possible in the background in a way that doesn't impact the user and making sure the reboot where it actually gets activated doesn't take noticeably longer. It would also mean not doing things that are against the user's interest like moving things around, installing new ads or misfeatures, or breaking things. I don't know anyone who hates or wants to disable Chrome updates, for example (I'm sure such people exist, but it's much less common than Windows updates), despite Chrome updating way more often than once a month. Of course, overcoming the aversion people built over years because of past bad behavior is going to be hard, but forcing people against their will and making updates more disruptive isn't going to help with that aversion. People really dislike being forced to do something, even if they don't actually mind the thing itself that much.
- kevincox 4y ago
  This is the key. Lots of systems have seamless updates where the only real interruption is a reboot. Android does an A/B update and after a only slightly slow reboot is in the new version. It then does some optimization in the background that can have a slight performance impact. NixOS must be the gold standard here. It downloads and completely installs the new version in the background then a regular-speed reboot is enough to be running the new system. (~10s on my system) But Windows and macOS both have crazy slow update processes. When I had a mac for work I was dumbfounded by how slow the update process was. It regularly took >30min! Those machines are crazy fast, it seems like it could have written a TiB of data in that time so IDK what it is actually doing.
  - atonse 4y ago
    100% agree with this. Point updates of macOS take 20+ minutes on an M1 Max with 32GB of memory and a blazing fast SSD. What could it possibly be doing? Even iOS updates are a bit faster. Is apple even interested in fixing this?
    - 4y ago

ako 4y ago

It’s not just software execs, I’ve actually heard customers asking for auto-update recently as approving and updating it themselves was too cumbersome, or they relied on a department for this that had no time to do this soonish. They literally asked for “auto updates like chrome or Firefox”…

OkayPhysicist 4y ago
Auto updates are fantastic if, and only if, the developer can be trusted not to break things for fun. Firefox's auto-updates consist of downloading stuff in the background, prompting me to "restart when you want to apply the update", and then changing next to nothing about my experience of the application between updates. That is the perfect update story. Everyone loves it: the users aren't having their workflows upended, the developers are able to push updates regularly for security problems and the like, the only loser is the graphics designer who got hired because daddy owns the company and needs to constantly re-design the user interface to justify their job. (seriously, people in companies that do this kind of shit, what is it with re-designs? Why?)

hardware2win 4y ago

OSes should update because people dont care.

omgmajk 4y ago

I lost some work a while ago because in Win 10 home you can't easily turn off automatic updates. The amount of hate I got on some forums for suggesting that automatic updates are bad was beyond me. I just upgraded to Pro instead and turned it off in group policies, but I still got hit with an automatic restart at some point.

daemin 4y ago
While I have upgraded to Pro and turned off those settings myself, I have not experienced my whole system restarting to do an update. I have had to neuter the TPM modules in my BIOS to prevent Windows 11 from automatically installing though. However the issue that I've had was my Terminal App shutting down by itself, I thought it was a crash but it turns out it was because the Windows Store decided to update it. Now that is complete BS! How can a store arbitrarily decide to update an app while it is still running without asking, without waiting? Even Steam waits to download and update games for when you're not playing one. If it ever did the same thing as what the Windows Store does then there'd be a riot for sure. I guess that it means the Windows Store is just not being used by people at all. For those interested the "fix" for not having Terminal app restart for an update is to download the MSI package, extract it to a directory, and run it from there. That's directly from the Developer's words on Github.
- ectopod 4y ago
  Thank you! I've had wt just disappear on me a few times now and I've been meaning to investigate. It never occurred to me this was by design.
cratermoon 4y ago
Automatic updates to address real issues and security risks are fine, unless you're talking about updates that can't be postponed if you're in the middle of something. What we see, of course, is exactly what the twitter thread posted mentions: some "dickweasel" hijacked the update system to push crapware or do something user-hostile for purposes completely unrelated to what the user would want. James Williams discusses this in his book "Stand Out Of Our Light", and likens it to a GPS that takes you off to places that you never wanted to visit in the course of (maybe) getting you to your intended destination. Of course, you arrive late, if ever, and burned way more gas (or battery) than you needed. But the GPS got you to drive by a specific set of billboards that they wanted you to see.

naikrovek 4y ago

not just bad press. they were called before Congress and asked why updates weren't required.

codalan 4y ago

It's not that updates are necessarily bad. It's when they try to launder in a bunch of "feature" updates (i.e. more spyware, more crapware) with needed security updates. They force the user to make a decision: Do I skip this update and avoid having new "features" from crippling my machine, or do I download the update to prevent my machine from being hacked? If vendors really gaf, they would make is so that you could download needed security updates w/o the rest of the garbage. But then they couldn't force more malware on you.

Iolaum 4y ago
This! Security updates bundled with feature updates are what makes updates hostile to the consumer.
- jjeaff 4y ago
  In their defense, it would be difficult to keep security updates fully separate from feature updates since sometimes replacing a vulnerable feature with a new feature is the easiest fix rather than pushing the new feature, but also issuing a separate fix for those that don't want the new feature. In other words, it's only reasonable to expect security updates for a certain length of time and not indefinitely.

dan-robertson 4y ago

Somehow windows devices are ok at installing security updates and most apple phones are on the latest os version. I’d be interested to know what the actual story at MS was for this. I think the executives there in the past demonstrated pretty good decision making. Here’s[1] someone claiming something about PM’s thinking they knew better than users and maybe there is some hidden OKR incentive driving that reasoning, but my weak understanding is that that person wasn’t really involved in what happened so I don’t know how true it is. [1] https://twitter.com/danluu/status/1504567911565824000 https://twitter.com/danluu/status/1504567911565824000 nitter: https://nitter.fly.dev/danluu/status/1504567911565824000 https://nitter.fly.dev/danluu/status/1504567911565824000