Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft’s February security update release delayed to March

blogs.technet.microsoft.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Microsoft’s February security update release delayed to March

#41

Post by throwawayish »

IsmaOlvey wrote: post #27
notalaser wrote: post #12

Earlier quoted context omitted.

This is a somewhat unpleasant semi-misconception. You can , indeed, update everything but the kernel without rebooting. In fact, I suspect you could even replace the kernel image and the modules while they're running (but this will certainly break any attempt to load modules at a later point without rebooting first). (Edit: most distributions choose to keep the old image along in case the new one breaks. It's relativ…

If memory serves, Microsoft cannot actually do it, due to differences in file system semantics. In Windows, it's not possible to replace a file that's in use.

DLLs and other components installed system-wide are almost never the same file: Updates install new versions of most DLLs into the SxS system and compatible applications load newer versions when they are restarted.

Re: Microsoft’s February security update release delayed to March

#42

Post by throwawayish »

notalaser wrote: post #12
microtonal wrote: post #9

Earlier quoted context omitted.

To the downvoters: Red Hat, et al. can roll out security updates on running systems. Except for kernel updates, though kexec avoids long restarts.

This is a somewhat unpleasant semi-misconception. You can , indeed, update everything but the kernel without rebooting. In fact, I suspect you could even replace the kernel image and the modules while they're running (but this will certainly break any attempt to load modules at a later point without rebooting first). (Edit: most distributions choose to keep the old image along in case the new one breaks. It's relativ…

Applying updates without degrading service has always been somehwat difficult to do; but it can be done in ways similar to "graceful reloading" that is relatively widely used in web servers. However, it requires custom integration work, which means you need a capable sysadmin and perhaps a developer or two to implement it, so usually you just don't. Clean restarts also avoids bugs that you might introduce there.

Re: Microsoft’s February security update release delayed to March

#43

Post by throwawayish »

notalaser wrote: post #18
catdog wrote: post #15

Earlier quoted context omitted.

> Generally, however, processes don't get restarted after updates and libraries don't get reloaded, so without rebooting, you're still running the unpatched versions. It's possible determine what processes run outdated library code. There are tools which hook into the package manager which do this, like https://github.com/liske/needrestart

Like I said, it's not entirely impossible (a while ago I was using checkrestart on my Debian machine with pretty good results), but the result is still somewhat clunky. There are a lot of things that aren't so easily checked: changes in interpreted code (needrestart can, fortunately, deal with Java, Perl, Python and Ruby, but I don't know how well, and there's no shortage of packages that rely on old-fashioned bash s…

Yes, clustering and virtualizing things is pretty much how this has been handled at a scale, be it modern web applications, (Open)VMS or mainframes. It's simpler and has other advantages to architect the application for this than to do the custom integration work required to make it work on a process/application level.

Re: Microsoft’s February security update release delayed to March

#44

Post by ocdtrekkie »

pilif wrote: post #4
jedberg wrote: post #3

Earlier quoted context omitted.

It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…

> It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue. If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and…

Indeed. A single poor update that breaks everything can cost an enterprise the ability to get security updates in general as well. About a year ago we had to choose between having current security updates and being able to print because Microsoft screwed something up in an update.

Re: Microsoft’s February security update release delayed to March

#45

Post by proactivesvcs »

jedberg wrote: post #5
pilif wrote: post #4

Earlier quoted context omitted.

> It has nothing to do with cumulative updates. well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue. If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and…

If anything the cumulative patch is better, not worse. It's much harder to validate nine individual patches than a single cumulative update. What happens if patch seven fails? How about six? How about six and seven? There are an exponential number of failure cases with multiple patches vs one.

Then patch seven fails, and it is re-offered. Pre-cumulative updates, it was very rare for there to be a pre-requisite / dependency list each month.

Re: Microsoft’s February security update release delayed to March

#46

Post by mtgx »

noinsight wrote: post #39
mtgx wrote: post #22

I don't get it. So because of one issue, they're not going to deliver any other security patch either?

Microsoft stopped distributing individual patches, all updates are now rolled up into one package. Therefore, if one patch causes issues, none of them can be released. Windows 10 already worked like that, last fall they started doing the same for older OS'es. See: https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/...

More of a reason to call that bundling "dumb".

Seriously, think about all the different issues Windows 10 has caused to people's computers. So if one issue damages a computer, they can't send any of the other updates to that model of laptop?

They should be striving towards higher modularity, not a lower one.

Re: Microsoft’s February security update release delayed to March

#47

Post by acqq »

yuhong wrote: post #6

Also see https://bugs.chromium.org/p/project-zero/issues/detail?id=99...

I'd like to know if the "project zero" publishes to everybody the security issues discovered in Google products before Google has a chance to update the software? Or does this policy exist only for the other companies? Can we even know?

Re: Microsoft’s February security update release delayed to March

#48

Post by digi_owl »

throwawayish wrote: post #41
IsmaOlvey wrote: post #27

Earlier quoted context omitted.

If memory serves, Microsoft cannot actually do it, due to differences in file system semantics. In Windows, it's not possible to replace a file that's in use.

DLLs and other components installed system-wide are almost never the same file: Updates install new versions of most DLLs into the SxS system and compatible applications load newer versions when they are restarted.

Unless they bring their own version, something that has been a issue at least once.

Re: Microsoft’s February security update release delayed to March

#49

Post by xenophonf »

microtonal wrote: post #7
jedberg wrote: post #3

Earlier quoted context omitted.

It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…

enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.

Please note that some security patches can be installed using hotpatching. Here, have some sample code:

https://www.codeproject.com/Articles/1043089/HotPatching-VER...

The executable needs to be compiled with support for hotpatching, and this doesn't address all possible exploit vectors.

Re: Microsoft’s February security update release delayed to March

#50

Post by IsmaOlvey »

JdeBP wrote: post #35
IsmaOlvey wrote: post #27

Earlier quoted context omitted.

If memory serves, Microsoft cannot actually do it, due to differences in file system semantics. In Windows, it's not possible to replace a file that's in use.

Your memory is serving you incorrectly. * https://news.ycombinator.com/item?id=11415366

Unlinking and replacing are not the same thing.
Post reply on HN