4 ms·

Unless I'm missing something, this article really seems unreasonably harsh. He cites two bad updates within the past months (one for Windows 7, one for Exchange

by sjm-lbm 12y ago

Unless I'm missing something, this article really seems unreasonably harsh. He cites two bad updates within the past months (one for Windows 7, one for Exchange) that have had to be pulled due to issues, but it seems like well over half the article is devoted to complaints about patches for Windows 10 - an (officially) unreleased product.

debacle 12y ago
You can look through the author's blog history. One in three is an anti-Microsoft diatribe.
chokolad 12y ago
As soon as I saw the author's name, I closed the browser. Author is rabidly anti-MS
exelius 12y ago
Yeah, this article is FUD. The Windows 10 piece is stupid - it's a pre-release OS, these things happen. It's why they haven't released the OS yet, so I'd say their QA process worked. Pre-release OSes don't go through the same level of QA - if you don't like it, you should use a supported OS. Second, with Exchange updates, there's kind of an unspoken understanding that there is no way MS can test every scenario their users will throw at Exchange. So updates are often released that can cause edge case issues, with the understanding that their large customers will test the updates in a test environment before deploying them. If issues come up, Microsoft can pull the update. These kinds of retractions are not uncommon with server software.
- Ded7xSEoPKYNsDd 12y ago
  How long can you responsibly run Exchange on the internet after a security patch was released? The recent Drupal SQL injection [1] showed that attackers have databases of fingerprinted services, just waiting for an update that shows them how to exploit these systems. Reverse engineering the binary patches for Exchange and building a reliable exploit out of them probably takes longer than it did in the case of that SQL injection in Drupal. But how long a testing period is too long? 1: https://www.drupal.org/PSA-2014-003 https://www.drupal.org/PSA-2014-003
  - exelius 12y ago
    In the case of something like a corporate Exchange server, you can run an IDS/IPS system in front of them to block any specific exploits. Even then, enterprise configurations of Exchange are usually quite unique to the company, so there's a low likelihood of a security problem being exposed to the outside.
stinos 12y ago
This. It's a bit harsh, sometimes arrogant, filled with 'I don't like MS' kind of speak instead of focussing on facts. The article does does state some real problems though, that cannot be denied. However, extrapolating that to a general trend like "there is no QA anymore" (which is at least how I interpreted the article) seems just wrong.
bsg75 12y ago
He makes a valid point about the seemingly unnecessary ties between components during an upgrade. The same pattern can be seen when updating Office for Mac. Every single time the Office updater insists I close all browsers, including Chrome and Firefox, to apply a Word or Excel update. Nothing from any other vendor exhibits this pattern on a Mac (a Unix system BTW). The author may have an anti-MS history, but he is spot on in questioning these unnecessary tie-ins. I use Mac, Linux desktops, and Windows regularly, and these simple user interaction failures make the latter a pain to work with.
- deleted 12y ago
  [deleted]

by sjm-lbm 12y ago

debacle 12y ago

You can look through the author's blog history. One in three is an anti-Microsoft diatribe.

chokolad 12y ago

As soon as I saw the author's name, I closed the browser. Author is rabidly anti-MS

exelius 12y ago

Yeah, this article is FUD. The Windows 10 piece is stupid - it's a pre-release OS, these things happen. It's why they haven't released the OS yet, so I'd say their QA process worked. Pre-release OSes don't go through the same level of QA - if you don't like it, you should use a supported OS. Second, with Exchange updates, there's kind of an unspoken understanding that there is no way MS can test every scenario their users will throw at Exchange. So updates are often released that can cause edge case issues, with the understanding that their large customers will test the updates in a test environment before deploying them. If issues come up, Microsoft can pull the update. These kinds of retractions are not uncommon with server software.

Ded7xSEoPKYNsDd 12y ago
How long can you responsibly run Exchange on the internet after a security patch was released? The recent Drupal SQL injection [1] showed that attackers have databases of fingerprinted services, just waiting for an update that shows them how to exploit these systems. Reverse engineering the binary patches for Exchange and building a reliable exploit out of them probably takes longer than it did in the case of that SQL injection in Drupal. But how long a testing period is too long? 1: https://www.drupal.org/PSA-2014-003 https://www.drupal.org/PSA-2014-003
- exelius 12y ago
  In the case of something like a corporate Exchange server, you can run an IDS/IPS system in front of them to block any specific exploits. Even then, enterprise configurations of Exchange are usually quite unique to the company, so there's a low likelihood of a security problem being exposed to the outside.

stinos 12y ago

This. It's a bit harsh, sometimes arrogant, filled with 'I don't like MS' kind of speak instead of focussing on facts. The article does does state some real problems though, that cannot be denied. However, extrapolating that to a general trend like "there is no QA anymore" (which is at least how I interpreted the article) seems just wrong.

bsg75 12y ago

He makes a valid point about the seemingly unnecessary ties between components during an upgrade. The same pattern can be seen when updating Office for Mac. Every single time the Office updater insists I close all browsers, including Chrome and Firefox, to apply a Word or Excel update. Nothing from any other vendor exhibits this pattern on a Mac (a Unix system BTW). The author may have an anti-MS history, but he is spot on in questioning these unnecessary tie-ins. I use Mac, Linux desktops, and Windows regularly, and these simple user interaction failures make the latter a pain to work with.

deleted 12y ago
[deleted]