Oracle Java 'no longer the greatest risk' to US Windows PC users

It wouldn't matter.

Every manufacturer deliberately chooses to do things in entirely different ways.

Chrome updates within the browser itself AND has a scheduled task

Adobe has an update service AND a scheduled task.

IE is covered under Windows Update (if you're lucky) or - well - nothing at all.

Quicktime has to be running Apple Update services and be in the taskbar to update properly.

Your firewall and antivirus will have an update mechanism of their own.

Basically, the tools are there - scheduled tasks can keep anything up to do on a user-customisable schedule.

Now stop them, and then manually install an update. Bam. They're back, with their manufacturer's settings again. Kill the service? The scheduled task will restart it. Turn off the scheduled task? The service will still try to update. Try removing both? The next install or update will put them straight back.

Either the user needs to be in control, or the software manufacturer. In Windows, NOBODY, no matter how well-intentioned does either. There are package management systems. Nobody uses them. There are updaters. Each manufacturer rolls their own (Flash in Chrome updates on a different schedule to Flash in IE, which is different to, say, Adobe reader, despite all being Adobe products).

Like malware, manufacturers do this deliberately, because then it stays on your machine, shows up in their stats and "not having it" stops lots of stuff working.

Let's not even get into that updates break stuff all the time on Windows, removing functionality and breaking existing features in the name of "modern" software.

Provide an executable. Have it check for update on run. It's not hard. It doesn't need to update at any point until you decide to NEXT LOAD IT. Why bother with all the services and tasks and everything if you're going to be burdening your update infrastructure with unnecessary updates that the user isn't choosing to install anyway? Because it keeps the name alive.

And, technically, Chrome and Firefox collectively stopped Java being the #1, by stopping it working in the browser. Oracle have done NOTHING about it - not to secure it, not to stop it, not to fix it, not to get it back in your browser using more modern APIs. They absolutely DO NOT CARE. That's the problem, not Windows. The situation is the same on many platforms for the same software. Java on Linux works because of things like OpenJDK, not Oracle.

Similarly for Apple Quicktime. Nobody uses it, nobody cares, the installers and way it operates haven't changed in over a decade. The menu still appeared in Control Panel last I looked. Same for ActiveX sides of Flash player. Same for Java.

This is legacy stuff that nobody cares about to even bother to GET WORKING again in a modern browser, or even create a fuss about it being forcibly turned off by the browser makers.

That's the problem. Not that there's no viable update mechanism. If anything, there are too many, and the basic one that your AV uses is probably the best. Every now and then, check a website and suggest the user update. It's that simple.

"The whole burden of installation, automatic updates, and removal is still on the developers."

You obviously haven't used the Windows Store yet. This was fixed back in Windows 8.

"Don't they have a decent package manager yet"

Windows Installer and App-V are way way ahead in terms of capability of anything I'm aware of in the Open Source world. For instance how do you stream parts of applications on demand in the background as needed while the rest transparently installs under Linux then?

Re: itunes unpatched

And all the other things Quicktime gets/got co-installed with. Quite often *without* an opt-out box..

Re: Puzzled

Well one of the things that sometimes remains on my unpatched list for a while is LibreOffice. Secunia can't download and install the update so it waits until I have an hour or so to sit with the box and patch it (If I patch one thing the WHOLE damn thing is getting done including new scans until only EOL stuff is on the list). I'm not overly worried about it because even though I like the software, I know it doesn't have wide adoption. And I don't use browsers all that much. Truth be told, it's mostly a quick check of my gmail so it's a very low risk site from the malware perspective.

I know I've seen other things that applied to as well, but I can't recall what they were now.

I also sometimes see "update pending" messages for things that should have been patched. So I manually patch them instead.

Re: Why don't people update?

You forgot:

Manufacturers trying to ram other things in, disguised as an update. For example, browser toolbars and Windows 10.

Re: Why don't people update?

Number 2) - inconvenience is the big one for me.

I remember having to give a presentation once with a Windows system and it insisted on a huge update while I was doing the intro.

After that I used a Mac or Linux box. Do the bloody updates when I say so, without umpteen reboots

Windows requires rebooting when updating Windows components.

I've had Microsoft Security Essentials, Firefox, Windows Defender, Notepad++ and a host of other programs update themselves and the worst that happens is that the program restarts.

Re: because they cost money

That may be true for business applications, which do tend to represent a significant investment for a company, but this is the stuff that is Free... In case of some you have to actively employ Scorched Earth techniques to keep your system free of them.

So I don't really think your argument about money and dog-brained users would apply here.

"Woof" by the way..

Re: QuickTime update only for Windows Vista and 7

Nope Secunia takes that into account. Bought a new laptop for my mother last week and was doing the updates (now I can officially say I've worked with it and it's dog barf). After I finished MS updates I installed PSI and got a clean scan. No, I wasn't installing Apple related stuff, but they moved Flash into the OS as well, and it didn't show up in the Secunia scan.