back to article Windows 10 bombshell: Microsoft to KILL OFF Patch Tuesday

Microsoft has shown off some of the new security mechanisms embedded in Windows 10, and revealed a change to its software updates. Windows supremo Terry Myerson reckons the revised security patch rollout – effectively ditching the monthly Patch Tuesday – will shame Google. "Google takes no responsibility to update customer …

  1. Chemist

    "Of course you haven't noticed a change in behaviour in your distro, you already have that "feature""

    As I've been using Linux from the mid-90s I'd notice especially as I run 6 machines + several VM. Only reboots for kernel updates - changes to the desktop environment occasionally request logout/in

    Can we have some comments from other users about this

  2. Bloakey1

    <snip>

    "Lucky you ... really, I doubt you are telling the truth ... coming from somebody who does not re-install Windows even when it is borked with virii ... I know how to manually remove the shit."

    Thank you for an erudite well informed post.

  3. MissingSecurity

    @Chemist

    I am in the same boat and the only thing I can think of it is that the GUI will ask you to install than restart after you update, but since I just use yum to update, I've never had to restart (minus Kernel) so I don't know.

    I can't remember if the GUI asked me prior or not. My laptop is is at Fedora 20 currently.

  4. Willie T

    Training recommended?

    @gollux - If you are responsible for a Windows 2012 R2 server and it is installing patches and rebooting overnight without your knowledge or approval then perhaps you should consider some basic training on the O/S you are managing.

    I had a co-worker who often used a phrase in meetings (going way back to the Windows NT days) to describe the difference between machines that blue-screened frequently compared to ones that ran for months at a time with no issues: "Any idiot can run setup.exe". If you are moderately educated as to the capabilities of your OS and best practices for operations you will have much more success regardless of which flavor you choose to run.

  5. Anonymous Coward
    Anonymous Coward

    "Now when they get good enough to not require any restart except for kernel patches and give you fair warning that a system restart is needed, then I'll bite."

    Show me how Microsoft can get out of the file-lock system they're currently in without breaking everything before it. That is the chief reason behind restarts: locked system files held by critical (as in try and stop it and Windows panics) and currently-running (that's why the files are locked) system components.

  6. Charles 9 Silver badge

    "Well, don't look at the majority of Linux distros if you decide to jump ship. With the advent of systemd, they'll all be rebooting at the drop of a hat."

    Given that you can supposedly stop and restart init (which systemd is supposed to replace) without rebooting, how does systemd make things any different, unless you're saying systemd ties itself to the kernel, which I've yet to see. Why don't you PROVE that systemd forces more reboots.

  7. This post has been deleted by its author

  8. This post has been deleted by its author

  9. Robert Helpmann?? Silver badge
    Childcatcher

    Clipboard Firewall

    I was hoping for a bigger jump in security, with a greater range of tools for corporate admins. This bit is like MS took a look at a Qubes whitepaper and had a single takeaway. Too, the manageability of updates is a big concern, so it is nice to see tweaks to that. Of course, the OS is still in testing, but I would be a lot more impressed if they had built-in white-listing tools for apps or device control or any number of security measures that currently require a complex set of third party tools. In fact, what I really want is for them to build a robust security framework first and then put all the rest together around it.

  10. Anonymous Coward
    Anonymous Coward

    "but it would be a way of stopping idiots^W non-technically minded Windows users accidentally cut-and-pasting sensitive data directly to their social media applications"

    You were better with "idiots" - this (technically minded) anonymous pleb once typed his password into IRC, with SSH open on the IP I was connected to IRC with, and an IRC username very similar (4 chars) to the SSH username that the password went with.

    I've never changed a password so quick in all my life. I blame touch typing and not paying attention to which window the input was going to... idiot either way :)

  11. Anonymous Coward
    Anonymous Coward

    Oops!

    CompuServe forum chat and had SysOp password in the clipboard. Oops! From then on, I don't use the copy/paste even in my password programs for any sensitive passwords. Having to type that crap^H^H^H^H complex passwrods does wonders for mental agility (anti-Alzheimers). After few repititions it comes to mind right away! When it don't.... uh oh.

  12. Buzzword

    Just like Windows Phone

    "Google takes no responsibility to update customer devices, and refuses to take responsibility to update their devices..."

    Microsoft did the same with Lumia devices running Windows Phone 7.x: no upgrades to Windows 8. They really can't claim some sort of moral high ground here.

  13. DryBones
    Mushroom

    Re: Just like Windows Phone

    "Google takes no responsibility to update customer devices, and refuses to take responsibility to update their devices..."

    Good grief, I can smell that pile of bullshit from here. Smells like curry kimchee... (with apologies to Indians and Koreans). CARRIERS and MANUFACTURERS WON'T LET Google push new OS updates directly to their customers. That was a requirement they dictated to Google, in order to accept their OS onto phones that could get on their networks. In some ways it's good, in many ways it's bad. Mostly bad, because they want to add their own crapware to the OS image. Motorola is the best of those, they're pretty on-the-ball about things and light on the skinning. Samsung? Fuggetaboutit.

    Nexus devices (yes, I use them, no I'm not employed by them) have an almost direct update path from Google, rather similar to Apple's delivery route. They can do that because they have a similar number of devices to test the builds for.

  14. Charles 9 Silver badge

    Re: Just like Windows Phone

    But now with Android the dominant phone platform, you'd think Google would have the muscle to push back and INSIST on them being able to update Android themselves, regardless of manufacturer, as a matter of security. Make it a condition of carrying the Play Store and all of Google's special Android sauce. What manufacturer (apart from those like Amazon who have their own infrastructure) would refuse to carry that and hamstring their phones? Why wasn't this forced with Lollipop?

  15. big_D Silver badge

    Re: Just like Windows Phone

    You would have thought, but the last web browser exploit they didn't bother patching older versions, just said that people should move to 4.4.4 or later. Great, when you phone supports that, but if you are stuck on 4.1 or 4.2 you are SOL.

  16. RoninRodent

    Re: Just like Windows Phone

    > But now with Android the dominant phone platform, you'd think Google would have the muscle to push back and INSIST on them being able to update Android themselves, regardless of manufacturer, as a matter of security. Make it a condition of carrying the Play Store and all of Google's special Android sauce. What manufacturer (apart from those like Amazon who have their own infrastructure) would refuse to carry that and hamstring their phones? Why wasn't this forced with Lollipop?

    Google: Release updates in a timely fashion or else.

    Carriers: Ok, we will stop using Android then.

    Google: ...

    That is why. Android might be popular because it is convenient and free to use but it is not the only option.

    Google recognised this and de-coupled everything they could from the base OS and included it in Google Play. This allows them to push as many updates as possible via Play whilst side-stepping the carriers. Try disabling Play and see what still functions. It is not a perfect solution but this is a battle Google really can't win as they have no real options. Push the carriers too hard and they drop Android. Release the updates themselves and carriers can't add their crapware so they drop Android. Include the carriers crapware themselves and Google then take the blame.

  17. big_D Silver badge

    Re: Just like Windows Phone

    @RoninRodent one of the reasons why I never by a carrier branded phone.

  18. Paul Shirley

    Re: Just like Windows Phone

    "Google recognised this and de-coupled everything they could from the base OS and included it in Google Play."

    ...and the same people that complain about G's failure to override the carriers also complain loudly about Play services, the only way G has found to override them!

    I can understand why some people think G could do more, the daily drip feed of 'Google are evil, Google are abusing their power, Google only do what's right for Google' clearly is affecting some (along with all the other BS being spouted). But they're fighting carriers with a decade more experience being genuinely evil. Even Microsoft playing Google against them couldn't get carriers to allow direct push updates without built in delays.

  19. Anonymous Coward
    Anonymous Coward

    Re: Just like Windows Phone

    "Google: Release updates in a timely fashion or else.

    Carriers: Ok, we will stop using Android then."

    Google: And abandon the dominant phone platform for what? Hmm...? What other platform is out there that you can use that wouldn't get crushed by Android (or GASP...Apple) in nothing flat? Not even Windows can get far into the phone market. So I'd choose my phones carefully. because if you leave and others stay, there could be a big shakeup in the carrier wars.

  20. GitMeMyShootinIrons
    FAIL

    Re: Just like Windows Phone

    "Microsoft did the same with Lumia devices running Windows Phone 7.x: no upgrades to Windows 8. They really can't claim some sort of moral high ground here."

    Rather showing your ignorance of Windows Phone. Behind the GUI, Windows Phone 7 was essentially a different OS - an evolution of the Windows CE Kernel. Windows Phone 8 was based on the NT kernel. Asking MS to upgrade all 7.x devices to 8.x would have been somewhat akin to Google telling all Chrome OS users to upgrade to Android. As it was, after the release of 8, Microsoft released 7.8 that bought some of the 8 feature set (and some cross-compatibility) to 7. So, your argument is somewhat void.

  21. John Sanders
    Holmes

    Re: Just like Windows Phone

    And this is why Android sub-systems keep being decoupled more and more from the core AOSP.

    Obviously this doesn't make some in the Android community happy as they will scream Google is making Android closed source.

    Some days one can't just win.

    By the way I am still awaiting to find a single one of the millions of hacked Android phones that seem to be circulating around according to Apple, MS and friendly press.

    However, I keep finding lots of Windows XP, 7 and 8.1 PCs infected with crap every other week.

  22. Roo
    Windows

    Re: Just like Windows Phone

    Behind the GUI, Windows Phone 7 was essentially a different OS - an evolution of the Windows CE Kernel. Windows Phone 8 was based on the NT kernel. Asking MS to upgrade all 7.x devices to 8.x would have been somewhat akin to Google telling all Chrome OS users to upgrade to Android"

    That doesn't actually explain why MS could not have released WP8 for WP7 hardware. I suspect the real reason is down to the way MS set the spec for the hardware and that spec changed from 7->8, and MS really don't want to expend any effort supporting > 1 hardware cfg.

  23. veti Silver badge

    Re: Just like Windows Phone

    Windows Phone 7 was released in October 2010, and supported until October 2014. That's four years, for those following at home. Windows Phone 8 was released in October 2012 - if you bought a Win 7 phone after that, you have only yourself to blame. So you should have had a minimum of two years' full support.

    All WP8 phones can be upgraded to WP8.1, which MS promises to support until July 2017, in case you don't feel like taking advantage of the free upgrade to Windows 10 before then.

    There's a lot you can criticise Microsoft for, but they do take extended support seriously.

  24. oldtaku

    Yeah, I'm fine with constant stream of patches IF you don't have to reboot for them. OPtherwise I'm still only gonna reboot every few weeks.

  25. Paul Shirley

    I'm not fine with any automatic update or deferring reboots. Been caught too many times wondering why my PC doesn't start properly after putting off the reboot for days, or the time wasted trying to guess which accumulated patch broke it.

    ...and intercepting the 'more adverts in Skype', 'Win10 upgrade nagware' or the regular offer of broken device drivers is pretty vital to me.

  26. Russle

    why are they still releasing anything?

    The updates were broken everytime! for a percentage of users everytime.

    Redmond FAILED to figure out how to manage the simple process of upgrading computer software.

    Microsoft = Spy machine

  27. Anonymous Coward
    Anonymous Coward

    The thing that bothers me

    is if the plan is as implemented in this years Preview builds, that you don't get a choice (okay, the home user guinea pigs don't get a choice) of whether to install each and every one, but only when to reboot. You could easily see how that would appeal to any software house, let alone Microsoft if they believe each patch will do only what it's supposed to; not break things; not introduce vulnerabilities; not brick customer's machines.

    A reasonable person would dismiss out of hand that any responsible company would do that. What it would take would be an organization pathologically-averse to admitting it's mistakes, led by people who think their job is to be infallible and, thus so divorced from reality, that they cannot see themselves rushing about like British Cabinet Ministers wrecking the country because they think they are saving it.

    I mean, I'm not going to vote for them, but it won't give me any satisfaction to watch them screw the ones who do.

    What would give me satisfaction would be to have Hazel Blears in one end of a massive linear accelerator, and David Blunkett at the other, and see what would be produced from colliding them. 60 million ID cards, perhaps? Think of the pictures!

  28. EffEvilBill

    Glass houses

    I see they aren't above childish jabs at others to inflate themselves.

    This approach of constant updates brings to mind my concert going days.

    Imagine you (the user) are crowd surfing. Being passed from one group of people to another in the audience and that MS is those many hands of the audience holding you up moving you about.

    The trouble is, as has been my observation, those surfers always get dropped.

    I can only imagine a sequestered machine that has no access to the web, becoming as useful as a Chromebook in BFE. Furthermore, if they don't make the updates priority before any other online activity after a dormant spell, they leave the machine just as vulnerable as those they pointed out.

  29. thomas k.

    new beta testers

    So, home users will be beta testing the patches for enterprise users now?

  30. Jack of Shadows Silver badge

    Re: new beta testers

    No. Everyone who uses a retail license is now a beta-tester, which includes a whole heck of a lot of SMB/SOHO people out there. No it may be an unannounced "planned feature" for businesses that sign up for the "Windows 365 account type:X", InTune feature, or whatever, that they are no longer counted as Guinea pigs, but hey, I can't claim any insight in that direction. Talk to Mary Foley or Paul Thurott.

    Hell, if that weren't their intention now, I may have done some work for Microsoft. Ouch.

  31. The little voice inside my head

    Is it realle that hard to patach things up after you know what is wrong? if it is, stfu, if not then ms is really a bad enterprise not worth of any business, stfu,

  32. Anonymous Coward
    Anonymous Coward

    Or maybe trying to patch in a heterogeneous computing environment is a Hard problem. You can't test for EVERY scenario because there are simply too many of them. And yes, Linux has its teething troubles, too. Driver issues and the occasional spontaneous reboot forced me back to Windows after a six-month stint last year.

  33. Anonymous Coward
    Anonymous Coward

    Updates?

    Who knew?

  34. WiWa

    Reboot!!!

    As badly as microsoft windows is made, there will be daily reboots, yet another reason to change to Linux/BSD/Solaris if you haven't already done that.

  35. Anonymous Coward
    Anonymous Coward

    Non-disruptive patching

    Now that's a feature customers want. You would have thought that after 20 years of being in the business they would have figured it out by now.

  36. Terje

    The more information is released about windows 10 the more I feel I will live a happy life with windows 7 for yet another release cycle.

  37. Roo
    Windows

    A Welcome Rearrangement of the Deck Chairs

    I guess the Titanic reference is inevitable, but I like think of Microsoft as being a bit like a battered old cruise liner full of hard-bitten G&T junkies & hard working staff on a tour of the Far East. They've done the Pacific, they want to move on to somewhere more exotic where the cool kids get their kicks. ;)

  38. Test Man

    Thank God we're getting rid of "Patch Tuesday". I remember how it was before and it was much better when updates were released as they were done.

    I always thought that the excuse for "Patch Tuesday" (businesses like to have a date when they know patches are coming) was a bit weak, because they can and should be implementing their own patch schedule, and not stop others from getting the patches as soon as it's available if they want it.

  39. Stuart Castle

    Looking at this from a business point of view, I suspect "Patch Tuesday" was started so that Sys admins could actually set aside some time in their potentially busy schedules so that they could test patches both adequately and quickly.

    You say that business can and should be implementing their own patch schedule. They should, but when Patch Tuesday started, Microsoft did not offer a coherent way for ANYONE to do this, and only started offering them two years later. Even now, they only offer a way to do this if you have a Windows Server available on the network. Something which is not cheap, and may not be feasible for small businesses, who may have a few PCs but don't have someone they can dedicate to running a server.

    For these people, there may also be the problem of link usage. If they know that all their PCs are going to be using the link to the internet at a given time on a given day, they can schedule anything time sensitive (such as IP based telephone calls) so it does not happen at that time. They can, if they are savvy, also set up their PCs so that they power up at this time, thus enabling the company to save power (and therefore money). OK, so Windows Update will check when the PC is powered up anyway, but this might still cause problems with Link use..

    I think Microsoft are going about this the right way. Consumer get the updates whenever they are released, but businesses have a set schedule that they can use. I suspect Microsoft have been a bit slow to introduce this because it is quite a massive change for Windows Update, and if it goes wrong, the effects will be felt world wide. I also suspect that they introduced the fast and slow tracks in Windows Update on windows 10 to test the backend changes required (the Consumer edition being the fast track, and the Business edition being the slow).

  40. veti Silver badge

    I've never quite understood that justification.

    How much meaningful compatibility testing can a sysadmin actually do? Granted, they should have better-than-anyone-else knowledge of what software is in use within the company, but they know next to nothing of the day-to-day use cases for that software, let alone the edge cases.

    Example: I use a piece of software that outputs documentation, using MS Word. When Office was upgraded from 2010 to 2013, this software broke. Not immediately - it only breaks when outputting a large (>300 page) document, and it took me several days of experimentation (and some months of exploring workarounds and compromises) to be sure of the cause. Sysadmins didn't have a clue about that, and I wouldn't expect them to - their role is limited to "giving me the option to roll back to Office 2010". (Which they did, when I moaned loudly enough.)

    So sysadmins sit and test every patch in a Windows release? Yeah, right. Sounds more likely to me that they'll boot up every program once, then spend another hour on tech news sites looking for people whinging about functionality broken by the update.

  41. lansalot

    "He also said that the patching system had been updated to allow much tighter control over branch offices and remote users, who may not have decent bandwidth. Patches can be distributed peer-to-peer, and the timing of the installations can be set to ensure update downloads do not interfere with day-to-day operations."

    Already does - it's called BranchCache, and has worked with WSUS since 2008. Time of day for installation is a simple group policy setting, been around for years. None of that is new.

  42. TRT Silver badge

    Peer-to-peer trusted system updates?

    Why is a klaxon going off in my head?

  43. Terje

    Re: Peer-to-peer trusted system updates?

    Because you have almost but not quite reached a sufficient level of paranoia.

    Once you start seeing flashing red lights and reach for a helmet while heading for the bunker complex, then you are well on your have a basic working level of scepticism and paranoia.

  44. Ken Hagan Gold badge

    Re: Peer-to-peer trusted system updates?

    "Why is a klaxon going off in my head?"

    Because you've forgotten about the possibility of digital signing?

  45. Roo
    Windows

    Re: Peer-to-peer trusted system updates?

    "Because you've forgotten about the possibility of digital signing?"

    Nah, those are there to make required to make patches from the feds look legit. I suspect that won't even qualify as a joke within 12-24 months after release of Win 10. Soon every home will have it's own Stuxnet. :)

  46. Yugguy

    Never mind controlling enterprise patching

    None of my Windows devices at home allow automatic updating, let alone automatic update downloading. I will choose WHEN and WHICH are downloaded thanks.

  47. regadpellagru
    FAIL

    reboot fest

    I'm probably the only one to bother about the following:

    1- every day or so, my laptop will have to reboot

    2- I'll never have the same OS booting between week N and week N+1

    3- 2 will make my OS behave funny/bizarrely/buggyly

    And what's worse, I'll never know which patch is bad, has to be removed, because they happen so frequently.

    What is really pissing me off in W7 is the weekly patching. I really hoped they'd aggregate patches, like Apple is doing, so that you'd only install/reboot once per quarter.

    But no, MS doesn't learn ...

  48. Anonymous Coward
    Anonymous Coward

    What Microsucks is actually saying is...

    ...that Windows 10 is so poor it needs daily updates. No wonder they are giving it away.

  49. Anonymous Coward
    Meh

    Re: What Microsucks is actually saying is...

    that <insert flavour of Linux> is so poor it needs daily updates. No wonder they are giving it away.

    See works either way.

  50. BobRocket

    Why wait till Tuesday

    Rolling updates/bug fixes seems reasonable to me, once every time period my PC checks in to see if there is an update, it would be nice if Windows asked if I wanted it now or would like it later (they would assume I was always up for it, it would be common decency to ask first).

    The bit that worries me is 'as well as pushing other software "innovations,"' (well that and the orphan comma)

    As long as I can turn it off I'm happy

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2018