Microsoft’s February security update release delayed to March
blogs.technet.microsoft.com
Microsoft’s February security update release delayed to March
1–10 of 53 posts
Re: Microsoft’s February security update release delayed to March
#2Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board.
If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)
Re: Microsoft’s February security update release delayed to March
#3Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board. If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)
It has nothing to do with cumulative updates.
They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time.
So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingly as best fit their needs.
Some enterprises just run the updates that night and let everyone know to expect some slowness or downtime, and some of them only let the update run on their testing machines so they can validate the update in their environment before allowing it out to all the other machines.
But the main point is that the updates are predictable because that is what the customers asked for.
Re: Microsoft’s February security update release delayed to March
#4Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board. If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)
It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…
> It has nothing to do with cumulative updates.
well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue.
If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and hold the one patch back until next month.
Of course you could also create a new cumulative update containing only 9 patches, but I assume that's more difficult to do and will require more testing.
Re: Microsoft’s February security update release delayed to March
#5Earlier quoted context omitted.
It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…
> It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue. If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and…
If anything the cumulative patch is better, not worse. It's much harder to validate nine individual patches than a single cumulative update.
What happens if patch seven fails? How about six? How about six and seven? There are an exponential number of failure cases with multiple patches vs one.
Re: Microsoft’s February security update release delayed to March
#6Re: Microsoft’s February security update release delayed to March
#7Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board. If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)
It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…
enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time.
If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.
Re: Microsoft’s February security update release delayed to March
#8Earlier quoted context omitted.
> It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue. If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and…
If anything the cumulative patch is better, not worse. It's much harder to validate nine individual patches than a single cumulative update. What happens if patch seven fails? How about six? How about six and seven? There are an exponential number of failure cases with multiple patches vs one.
What are these security fixes that they fail so much? Although there are of course tough bugs with tough fixes, the vast majority presumably consists of off-by-ones, simple buffer overflows, use-after-free, etc.
Re: Microsoft’s February security update release delayed to March
#9Earlier quoted context omitted.
It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…
enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.
To the downvoters: Red Hat, et al. can roll out security updates on running systems. Except for kernel updates, though kexec avoids long restarts.
Re: Microsoft’s February security update release delayed to March
#10Earlier quoted context omitted.
It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…
enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.
Even if that were the case, many enterprises would still want to perform testing before deployment or require updates to be part change management.