Microsoft’s February security update release delayed to March • Hacker News Board

Re: Microsoft’s February security update release delayed to March

#51

Post by notalaser » Thu, Feb 16, 2017, 6:18 PM UTC

throwawayish wrote: post #43

notalaser wrote: post #18

Earlier quoted context omitted.

Like I said, it's not entirely impossible (a while ago I was using checkrestart on my Debian machine with pretty good results), but the result is still somewhat clunky. There are a lot of things that aren't so easily checked: changes in interpreted code (needrestart can, fortunately, deal with Java, Perl, Python and Ruby, but I don't know how well, and there's no shortage of packages that rely on old-fashioned bash s…

Yes, clustering and virtualizing things is pretty much how this has been handled at a scale, be it modern web applications, (Open)VMS or mainframes. It's simpler and has other advantages to architect the application for this than to do the custom integration work required to make it work on a process/application level.

> (Open)VMS

It'll eventually get reinvented :-).

Re: Microsoft’s February security update release delayed to March

#52

Post by yuhong » Thu, Feb 16, 2017, 8:02 PM UTC

acqq wrote: post #47

yuhong wrote: post #6

Also see https://bugs.chromium.org/p/project-zero/issues/detail?id=99...

I'd like to know if the "project zero" publishes to everybody the security issues discovered in Google products before Google has a chance to update the software? Or does this policy exist only for the other companies? Can we even know?

https://bugs.chromium.org/p/project-zero/issues/detail?id=86...

Re: Microsoft’s February security update release delayed to March

#53

Post by ocdtrekkie » Fri, Feb 17, 2017, 1:01 AM UTC

jedberg wrote: post #3

ocdtrekkie wrote: post #2

Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board. If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)

It has nothing to do with cumulative updates. They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time. So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingl…

As an enterprise IT admin who has handled Windows update deployment for over six years... you missed the point.

The updates should all ship on Patch Tuesday for the reasons above. The problem is that "an issue" has interfered with "all updates" because "all updates" is now "one update".

For instance, one of the things that most articles did not cover about this issue is that Adobe released a new version of Flash Player on Tuesday to coincide with Patch Tuesday, when Microsoft would've released theirs as well. IE and Edge get their Flash Player updates from Microsoft through Windows Update now.

However, that didn't happen this month, because the cumulative broke. And so now people can look at the Chrome and Firefox Flash Player updates and exploit the remote code execution vulnerabilities in IE and Edge, which are now at risk.

In other examples, Microsoft has released updates which broke things like network printing on Windows 10. Enterprises had to make the choice to either not be able to print, or not get security updates until Microsoft finally fixed it two months later. Without the ability to pick and choose updates, when an update has a problem or compatibility issue, companies are going to end up just stopping updates, which is bad for everyone. In the past, we'd just hold the problematic update, but with cumulatives, it's not possible.