Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

doublepulsar.com

Post reply on HN
Print view View original

91–100 of 109 posts

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#91

Post by serf »

bitwize wrote: post #43
craftyguy wrote: post #24

Earlier quoted context omitted.

No, another incentive to stop using Windows. 3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates, and Microsoft should not be relying on 3rd party applications to determine whether or not their customers receive critical OS security updates (and of all things, hilariously defaulting to 'no')

Windows isn't going anywhere, if for no other reason than because Microsoft Excel is basically electronic paper to the business world -- and there is simply no adequate substitute for it. (No, neither OpenOffice Calc nor any of the Web-based offerings -- including Microsoft's own -- count.) Coping with Windows is a fact of life. Get used to it.

>Coping with Windows is a fact of life. Get used to it.

echoes from 1998.

http://www.catb.org/~esr/halloween/

Your use of the word 'coping' is telling.

p.s. I can't remember the last time I touched MS software outside of a VM.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#92

Post by JadeNB »

Arnavion wrote: post #28
craftyguy wrote: post #24

Earlier quoted context omitted.

No, another incentive to stop using Windows. 3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates, and Microsoft should not be relying on 3rd party applications to determine whether or not their customers receive critical OS security updates (and of all things, hilariously defaulting to 'no')

>3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates It is because these (misbehaved) 3rd party applications do things that cause the mitigations update to make computers unusable. >and of all things, hilariously defaulting to 'no' It does not default to "no" since the default is to run MSE / Defender.

> > and of all things, hilariously defaulting to 'no'

> It does not default to "no" since the default is to run MSE / Defender.

I think that it's reasonable to read the grandparent's post as meaning "defaulting to 'no' under certain conditions on the system". It would surprise me if there weren't plenty of users out there who have legacy workflows with antiquated antivirus software still running, either because they set it up and haven't changed it or because their local tech geeks set it up and they don't know how to change it. I know that, as I've tried gradually (and unsuccessfully) to ease back into Windows after a long time away, it's been hard for me to believe in Defender as a full AV solution, and my first instinct was to run old favourites like ClamAV as an extra layer of defence.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#93

Post by serf »

inetknght wrote: post #76
Arnavion wrote: post #62

Earlier quoted context omitted.

The real-time scanning slows down processes that access a large number of files, like code compiles in general and importing node modules in particular.

I haven't noticed Windows Defender causing significant slowdowns for processes which access lots of files except when it does a full system scan (which is not often). Even then, it's only barely noticeable.

I've disabled defender due to high CPU usage on machines that had to slice mpegs into jpegs with near constant work.

The machine was slicing up 11 channels of 24fps videos into jpegs, so 264 jpegs/s at 720p and 24 bit color.

I've had friends and coworkers that have hit the same CPU issues with big git repos and defender.

It seems like Defender has problems with getting hit with tons of small files in quick succession, but really I know very little about it.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#94

Post by Santosh83 »

newman314 wrote: post #86
mesofile wrote: post #52

It's worth noting that Windows Update may also fail to apply the Meltdown/Spectre patch if other conditions aren't met. Some are mentioned on the KB page [1] but they don't mention another common scenario, which is that if your system firmware is not ready to accept the update, Windows Update will not apply it, and _it won't tell you_ that it's not applying it -- it will simply say 'Your device is up to date'. I had…

There's a lot of confusing information out there as you have found out. This link helps clarify the steps needed. https://doublepulsar.com/important-information-about-microso... Pay specific attention to the dataflow. Registry keys have to be set in a certain order in order for a) the patch to download and install and b) actually enable. If there is not a BIOS fix (I'm in the same boat as you), the other hope is that…

Seems like Intel has released updated microcode: https://news.ycombinator.com/item?id=16111433

but sadly no mention of what Windows users are supposed to do.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#95

Post by ENOTTY »

Wow using a hypervisor to inject below the kernel to avoid KPP is nuts. Never knew the AVs did that. What are they going to do when Microsoft begins to use Hyper-V to enforce CredGuard[1]?

[1]: https://blogs.technet.microsoft.com/ash/2016/03/02/windows-1...

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#96

Post by Feniks »

B1FF_PSUVM wrote: post #74
unstatusthequo wrote: post #60

Finally a fix for forced reboots!

You could still get the reboots without updates ... which is what I've been getting for a few weeks now on a cheap tablet: loads update, reboots in the night, update fails. Rinse, repeat. (I don't care, an update took down the sound last year. For all I know the next one will make the gizmo totally malfunction ... MS don't care for that cheapo segment either, the wanton demands for disk space are astounding, and they…

Throw Enterprise LTSB on old/low spec hardware. Thats my preferred Win10: stable, bloat free and it only gets the updates beta tested by the regular users.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#97

Post by user5994461 »

viraptor wrote: post #45
jpalomaki wrote: post #31

Earlier quoted context omitted.

From the article: "There is a problem where some anti-virus vendors are using techniques to bypass Kernel Patch Protection by injecting a hypervisor which they use to intercept syscalls and make assumptions about memory locations — memory locations which are now changing with the Meltdown fixes." Difficult situation for Microsoft. If you install applications which mess with the operating system in unsupported ways yo…

I'm not sure it's that difficult for Microsoft. Unless I misunderstand something, the requirement is on the antivirus systems already registered with Microsoft. They had half a year. MS could force vendors to patch their shit in a few weeks by giving them an ultimatum: in January, either you don't interfere with kernel patching, or we're showing your customers "you antivirus is stopping you from receiving latest secu…

>>> I'm not sure it's that difficult for Microsoft.

Yes it is.

AV use various hacks and exploits to hijack calls to the kernel. How did you think they notify you of an infected file before you open the infected file? The AV intercepts kernel API calls to list and open files.

I wouldn't be surprised if the patch for meltdown/spectre breaks these techniques. Generally speaking, these techniques will crash the system if they didn't work as intended. Microsoft doesn't want AV to BSOD millions of computers so they don't update when they detect an AV. It's perfectly reasonable to me.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#98

Post by AlfeG »

Arnavion wrote: post #62
inetknght wrote: post #26

Earlier quoted context omitted.

I'm real curious what kind of development you're doing with node.JS where Windows Defender causes trouble.

The real-time scanning slows down processes that access a large number of files, like code compiles in general and importing node modules in particular.

Why not just exclude nodemodules folder and temp/cache? This helps me enough.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#99

Post by josefx »

gtirloni wrote: post #2

“Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key” Another incentive to stop using questionable AV software (since this was implemented because they can't get their act together).

Microsoft could at least pop up a nag screen every 15 minutes to notify the user that their AV software is crap and needs to be removed. The average user wont know that their AV is actively keeping their OS unpatched.

Re: Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set

#100

Post by Piskvorrr »

jpalomaki wrote: post #31
craftyguy wrote: post #24

Earlier quoted context omitted.

No, another incentive to stop using Windows. 3rd party applications should NOT be responsible for insuring that the OS can receive critical security updates, and Microsoft should not be relying on 3rd party applications to determine whether or not their customers receive critical OS security updates (and of all things, hilariously defaulting to 'no')

From the article: "There is a problem where some anti-virus vendors are using techniques to bypass Kernel Patch Protection by injecting a hypervisor which they use to intercept syscalls and make assumptions about memory locations — memory locations which are now changing with the Meltdown fixes." Difficult situation for Microsoft. If you install applications which mess with the operating system in unsupported ways yo…

Might for example cause a backslash when people stop updating their systems.

So, again, the "where do you want to go today?" company decides "never mind, this is where you are going: we're stopping updates because you might have thought about it."

Post reply on HN