Is this my week to babysit the idiots... 3

[Kjonnnn]

I've been going around this week, making sure everyone virus software has the latest updates (even though I have them set to check everyday. I've had people disable the software.)

And, on some of the newer machines, I have windows download the security patches from MS and wait for the users install them. I've also been going around making sure that the users have installed those patches before the 16th. Would believe I had 3 users blow it off, saying they don't trust MS so they NEVER do the updates?

Guess who's gonna be set on auto.

 

[Kjonnnn]

EDEMIERE
Quite true. LOL

For example, I had a lady here who has been going to the "supplies" people to get another mouse. She tried about 3 different ones. She finally calls me to say the type of "mice" they've been buying must be defective because because it takes sooo long for her to delete and open things with her mouse. She wanted me to come up and look at her mouse and fix it.

At that point, my mind had one of those "illegal operations" moments where my eyes were just flittering until my brain could comprehend what she had said.

My response, "Dear, its not your mouse. You have a very slow computer." (133 mhz w/32mb RAM).

 

[wbg34]

Chevrolet doesn't build cars with all the updated parts in the trunk for the dealerships to install. Chevrolet builds cars with known bad parts fixed at the factory. And it is counterintuitive in the extreme to think that rewriting a CD is more costly than re-engineering a vehicle assembly line or a parts supply chain.
This really isn't a valid point. First, When a recall is issued, if a car is past the point in the assembly line, then the car will generaly have the recall part installed elsewhere(I've seen it in person working on an engine line). Secondly there is no rewriting a CD once an OS is burned on it.
Finally, I and others have already said and given examples where Microsoft does the exact things that you are claiming that they don't. Microsoft does update their distributions they are called service releases. It is almost impossible to find a windows 2000 cd that has the original code on it. Having OEMs install a ready SP on software that wasn't patched with it is the only thing that makes sense. Otherwise the OEM's would have to scrap their entire inventory of software each time a new SP is released.

 

[edemiere]

wbg34

Which we all know would be weekly...

Cheers!

 

[manarth]

There's a good reason for microsoft not automatically updating the CD - not everyone wants to install a service pack.

What if a company were using a proprietary app, which (unbeknown to the programmers) was actually using an "exploit" to do the job it was doing? M$ release a patch, the company realise what's happened, so they remove the patch.

Microsoft then update their CDs - if the company then buys some more PCs, any copy of Windows they buy (or OEM) is patched with this patch they don't want!


For the sake of consistency, once a product is released, any updates should be applied optionally, not automatically.

I think the MS Windows Update site and the Service Pack distribution is a good approach to staying current.

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[sleipnir214]

wbd34:
Again, I'm not expecting anyone to discard anything. But an OEM does not order an infinite supply of software to install (For that matter, OEM's don't install from CDs anyway -- it takes to long. But we'll not worry about that right now). When the supply of the unpatched software runs out, the newly-ordered software should be already fixed.

And you're right. Items that are on the assembly line may leave the factory that with defects an OEM or dealership may have to correct. But only until the bad items are flushed form the assembly line. It does not take an infinite amount of time for items to leave the assembly line.

Yes, Mi&cent;ro$oft has produced service releases of OSes. Sort of: I recall a &quot;Windows 95 OSR-2&quot;. But the first Windows NT install I ever did had kernel build 1385 on the CD, and so did the last -- 7 years later. And a Google search using the term '&quot;Windows 2000&quot; &quot;service release&quot;' does show three appropriate hits out of the first 100 links. But none of them actually show that the software was ever available.

manarth:
Software that relies on &quot;exploits&quot; does so for at least one of the following two major reasons: the programmer is lazy or the OS API is insufficiently documented.

There's nothing I can do about the former. But Mi&cent;ro$oft's actually publishing in its entirety the calls made available by the Win32 API would go a long way to preventing the latter.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[wbg34]

Sleipner,
(For that matter, OEM's don't install from CDs anyway -- it takes to long. But we'll not worry about that right now).
You are absolutely correct, but you fail to realize that they provide the CD media that goes with the PC. That media needs to match the OS that is installed. Therefore, you run into the same problems with inventory.
As for the Service Releases I don't know about win2k because I haven't purchased any copies since sp1. However, a year ago when I bought my first copy of Winxp pro it was xp pro SR1. I searched google for Windows XP sr1 and also found no relevant hits that showed it existed yet I have the CD that is SR1.

 

[sleipnir214]

wbb34:
Of course OEMs provide the media. But they don't order an infinite supply of CD sets to box with their machines. Sooner or later they will exhaust the on-hand supply and have to order more. The new ones, if Mi&cent;ro$oft were fulfilling its obligations, would have pre-patched the OS on the new CDs.


Did your CD have the patch already installed, or was there an &quot;SP1&quot; directory on the CD which the user is expected to install himself?


Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[skiflyer]

If you set up a new installation CD properly, you can inline the service pack such that it gets installed automatically with the OS. It's not a difficult process, and I know I've seen several howto's on the topic packaged with MS SP's in the past.

I think your point is valid as a great idea, but I think calling it an obligation is going a bit far. They have and do sell their software as is, with the SP's and patches available via a web site. It's not as if there're any regulations about how OS's must be patched or whatnot.

If you go buy Redhat in the store, you better patch it up too... I don't care if they update their distributions along the way, with the exception of what's printed on the box you don't know when that distro was last updated, and if anything critical has changed in the meantime. The store you shopped at may be slow on sales and your copy might be a year old.

-Rob

 

[sleipnir214]

Aren't car manufacturers obliged to not sell vehicles with known critical defects? Gun manufacturers? Appliance manufacturers? Toy manufacturers? Toothbrush manufacturers? Shoelace manufacturers?

Why should a software vendor be held to a different standard? Why should Mi&cent;ro$oft specifically be held to a different standard, especially since other OS vendors, both open-source and proprietary, do update their software distributions?


I have never claimed that every software vendor should update their distributions minute-by-minute. I have never claimed that every software store must obtain and stock minute-by-minute-updated distributions. I have never said that any software is perfect nor never in need of updating.

What I have said is that large sets of bug fixes, particularly those the vendor itself defines as &quot;Critical Updates&quot; should be preinstalled in the distribution.

RedHat published version 7.0 of their software in September, 2000. They then released 7.1 in April, 2001. Then 7.2 in October, 2001. RedHat 8.0 was released in September, 2002.

If I purchased RedHat 7.x in August, 2002, I have no reasonable expectation that the OS I purchase have all the updates that would be included in version 8.0. I have no reasonable expectation that RedHat owes me a free copy of the new version once it comes out. I will happily update my older software.

But I do have a reasonable expectation that when I buy their software in August, 2002, that what I get is not 7.0 with an additional CD of bugfixes to bring my software to an equivalent of version 7.3. RedHat, as well as SuSE, Debian, Mandrake, IBM, Compaq, Apple and others provide periodic updates to their OS distributions. What I get from them is software with periodic updates preinstalled.

All I want from Mi&cent;ro$oft is the same fulfillment of obligation I expect from the company that makes my shoelaces.


Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[Stevehewitt]

Really?! So you mean like Windows NT 5 (Windows 2000) and Windows NT 5.5 (Windows XP)?

Sounds like an update with all service packs and previously know bug fixes built in to it. Just like the Linux distro's

 

[lionelhill]

There are a few cases where the patches/service packs can be a problem. For instance Analytical equipment controlled by windows-based software. Often the equipment talks to the controlling-computer via network connections, and sometimes patches that fix network security make it so secure that the controlling computer and analytical instrument can no longer talk to each other.
Obviously this is partly the fault of the people who wrote the analytical software package, but considering that they are highly unlikely to want to update their software, and certainly aren't going to be too quick about it, I still need to avoid patches that cause trouble...

Incidentally, how many home computers do you reckon get sold with firewall option off by default? I don't know from personal experience, but talking to friends I suspect it's quite a few. Why?

 

[sleipnir214]

Stevehewitt:
If the codebases for Windows NT, Windows 2000, and Windows XP were the same, you'd be right.

According to Gary McGraw (co author of Building Secure Code: How to Avoid Security Problems the Right Way), NT comprised ~25million lines of source code, 2000 comprised ~35million, and XP about 40million.

So unless the bugfixes for NT took 15 million additional lines of code to fix, I doubt they share significant code bases. Just like the Linux distros when their distribution version major numbers increment. RedHat 7.3 to Redhat 8.0 represented a significant change in the code base.

What I want is for Mi¢ro$oft to publish Windows XP version 1.1, which would have preinstalled Service Pack 1 plus any changes to the default configuration to plug known configuration security holes. Just like the Linux distros.


lionelhill:
Mi¢ro$oft seems perfectly happy to alter the code base in ways which will cause 3rd-party software to barf. At least when it means they can make money doing it.

Remember the hew and cry when people found out that some 3rd-party software that ran on NT wouldn't run on 2000?

Remember the weeping and gnashing of teeth when people found out that a lot of 3rd-party software that ran on NT would not run on XP?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[Stevehewitt]

Would I be right in saying your not Microsoft's biggest fan?

 

[sleipnir214]

Stevehewitt:
<sarcasm>
That would be correct. Mi&cent;ro$oft's biggest fan is, by definition, Bill Gates.
</sarcasm>



Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[greyted]

Stevehewitt,
Try this link, out of date but he really has a (long) rant.

http://www.euronet.nl/users/frankvw/IhateMS.html

Ted

&quot;The difference between a misfortune and a calamity is this: If Gladstone fell into the Thames, it would be a misfortune. But if someone dragged him out again, that would be a calamity.&quot;
Benjamin Disraeli.

 

[Kjonnnn]

Somebody obviously didnt have enough to do.

 

[theoxyde]

sleipnir214:
What I want is for Mi¢ro$oft to publish Windows XP version 1.1, which would have preinstalled Service Pack 1

They already do. Probably 9 out of 10 Windows XP boxes on the shelf have SP1 pre-installed. It is not advertized as a newer version (like Win98SE) but it is there. In some cases where the CDs were already produced, the service pack is on a separate CD, but that is typically a very limited-time run.

You can also build your own (called slipstreaming). The service packs can update the install files and replace them with the fixed ones.

plus any changes to the default configuration to plug known configuration security holes.

Can't help you there... that's what Windows Update is for. Even so, once an install that is pre-loaded with SP1 is installed, Windows Update completes in about 20 minutes over a dial-up connection (depending on connection speed).

All this to say, &quot;It's not that bad!&quot; MS already does much of what you are wanting no matter how much you want to believe otherwise. To quote Aldous Huxley, &quot;Facts do not cease to exist because they are ignored&quot;.

All I want from Mi¢ro$oft is the same fulfillment of obligation I expect from the company that makes my shoelaces.

Hmm... since when can you &quot;download&quot; a fix for your shoelaces? You usually must return them to the manufacturer or store. The physical object analogy just doesn't hold water (even the automobile one) because of the significantly easier and much more convenient method of getting it fixed (Windows Update).

As for the cliche spelling of Microsoft...

http://www.penny-arcade.com/view.php3?date=2002-07-22

 

[sleipnir214]

theoxyde:
If what you say is true about XP, fine. But I'd sure hate to buy that 10^th box. The trouble is, since Mi&cent;ro$oft won't telling me what patches are installed, I can't know if I've spent my money on a flawed product until I get it home. Sounds like a crap shoot to me.


Are you saying that Mi&cent;ro$oft does not have an ethical responsibility to publish products with known critical flaws repaired, or just complaining about my analogies?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[ANFPS26]

Microsoft Operating Systems should be just like a loaf of bread in the grocery store. They should have a sell-by date and gathered up and replaced when updates are available. IMHO. They could afford to do this. Maybe Bill Gates could get by on a 400% mark-up instead of a 500% mark-up.

Jim

 

[Stevehewitt]

[RANT]

WHAT IS WRONG WITH USING WINDOWS UPDATE!!!

[/RANT]