Hacker News new | ask | show | jobs
by cm2187 3321 days ago
Another lesson learned: don't bundle your security updates with your cool new features nobody wants, Microsoft. This will aggravate the problem as more people/companies will defer updates.
3 comments

I always had auto updates turned on until Windows' malicious behaviors in recent years:

https://thenextweb.com/microsoft/2015/09/11/microsoft-is-aut...

This one consumes me several gigabytes on my C drive without my permission.

https://www.tenforums.com/windows-updates-activation/55185-w...

This one acts like malware.

And this one: http://www.pcworld.com/article/3039827/windows/7-ways-window...

I don't know why I'd choose a operating system does that.

It pushed some telemetry updates, which arouses some privacy concerns (only after Microsoft's aggressive attitudes about Windows 10 promotion, before that I was OK with its telemetry updates. I'm aware sometimes telemetry tracking means good.)

And much more.

All of these behaviors make me think that I'd rather lose my data than suffer from these "features".

Yes, Microsoft is converting an operating system to a web page where they can track your usage. Have you tried with tweaking software like http://winaero.com ?
Not yet, thanks for the recommendation!
> I don't know why I'd choose a operating system does that.

Me either. Stop using Windows.

Were people not updating to more modern OSes because they didn't want new features or because they didn't want to spend the money on new licenses and testing software compatibility?

And how sure are we that they didn't install security updates out of sheer laziness or hubris?

People who run systems that store sensitive information and systems should take computer seriously more serious than the people on Hacker News. I would never allow my my smartphone, let alone computers and servers to run unpatched software. Why is this acceptable for people who have critical systems and data?

Critical systems should not have installed an operating system that collects metadata on virtually anything the user does: telemetry. https://arstechnica.com/information-technology/2017/04/micro... (Privacy)

Especially if the company that develops the os in question shows a track like this one: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=microsoft+w.... (Security)

I also wonder how long it will take before the shiny new anti-piracy instruments will be abused by a member of the intelligence community, a low-level politician or perhaps embedded into desktop OSes. http://pimg-fpiw.uspto.gov/fdd/50/148/096/0.pdf (You are not the owner of your files)

It's always easy to accuse the user rather than who exploited the vulnerability in the first place or who does not backport security patches when users obviously do not like the new versions of a software. - https://www.netmarketshare.com/operating-system-market-share... - https://www.extremetech.com/computing/227693-windows-drops-b...

Frankly speaking, Microsoft has gone too far into abuse, lock-ins and presumptions.

As a personal comment, I have an old Windows 7 laptop I use with some win32 software, I do not have the slightest intention of upgrading to Windows 10 (not for laziness or hubris, but because IMO the product is not worth the price). And if it was a critical system, than Microsoft Windows would not really be considered among the options.

I'm not advocating for using Windows for critical systems that store tons of user data, but I am advocating that if you do use it, you should use versions that are still supported and make sure you patch it ASAP.

But should Microsoft be expected to back port patches to old OSes in perpetuity?

Oh that's fair, if a product is unsupported, use it air-gapped or at least in a reasonably controlled environment...

Again, pretending and forcing upgrades is not the solution. The practise perpetrated by Microsoft has been described again and again as an "aggressive effort to push upgrades". https://www.theguardian.com/technology/2016/mar/15/windows-1...

The issue is not the upgrade per se, but the "imperfection" of the upgrade process (wanted euphemism) and the fact that many consider W10 a worse os if compared to W7.

Otherwise nobody would complain.

I would personally use an enterprise Linux distro for something like health records and other critical data, but you can Windows 10 similar to how you use Windows 7, and it's a faster OS. You just need to spend some time to get your settings in place.

I was in the same camp of you as Windows 10 vs 7 until I saw how much Windows 10 sped up an old machine of mine.

Critical systems that require long term support is what Win10 Enterprise LTSB was designed for, which you get with Software Assurance.
Microsoft Software Assurance is something very distant from real SwA.

> https://www.microsoft.com/en-us/licensing/licensing-programs...

> https://en.wikipedia.org/wiki/Software_assurance

Users don't want to upgrade, many I know would rather use linux or macs. Microsoft should acknowledge the thing and fix what's wrong. IT departments these days are trying to convince the people they work with.

OS editions

- 10: Home [wipb + cb], Pro [wipb + cb + cbb], Education [wipb + cb + cbb], Enterprise [wipb + cb + cbb], Enterprise LTSB [ltsb], S

- 8: Core, Pro, Enterprise, RT

- 7: Starter, Home Basic, Home Premium, Professional, Ultimate, Enterprise

vs

- Debian: unstable, testing, stable, old-stable

- macOS: developers beta, public beta, released

- BSDs: current, stable, release, old-release

I am unsure if the Windows mess can be considered a "naming scheme", the single thing I have very clear is that there's something terribly broken (maybe the whole marketing fuss thing).

Win10 also has an insider program too.
And that's even more bewildering ... Needless complexity over needless complexity.
> Critical systems should not have installed an operating system that collects metadata on virtually anything the user does

Thing is, the more of that data they have, the more likely they are to prioritise testing those use cases.

So it's a trade-off - do you want telemetry, or do you want a higher risk of bugs - you have to pick one.

Just to mention two alternative ways to get data: bug reports, product feedbacks. You can ask for logs, system diagnostics, backtraces... One may have less data, but probably of a superior quality.

Outsmarting sysadmins, developers and users is not the first need.

If one is not gathering enough data because many are not able to find the tools and/or the website for the reports, that's a usability issue and that is what should be solved.

I seriously think telemetry is the wrong solution for the matter.

New versions of Windows also work slower (especially on old hardware), require more disk storage, contain spyware (telemetry) and advertisement that user cannot disable. And contain no new useful features. No wonder people don't want to upgrade. I think Microsoft should have stopped developing new OS with Windows 7 and release only security and bug fixes.
I disabled updates on my Windows 7 last September when I feared that I'd wake up to a Windows 10 machine like my wife did when her laptop updated to Windows 10. Unfortunately I can't seem to resume updates and fear that I may be vulnerable to WannaCrypt. (Some recent updates succeeded but I don't know if i patched for it)
Disabling updates is the worst possible solution. Just click no on the windows 20 upgrade dialogue (or just upgrade, it's pretty good).

Refusing to patch your system because of this is ridiculous (and yes some blame does lie with MS For pushing people to this)

> Disabling updates is the worst possible solution

If so, more blame lies at the feet of those that make it the only solution.

> Just click no on the windows 20 upgrade dialogue

Would that it were so simple. But Microsoft chose to mean "yes" by the "close this [annoying] window" button, with Windows 10; who knows what they'll come up with for Windows 20.

> (or just upgrade, it's pretty good)

For you, sure. Some people like to make their own choices.

> Refusing to patch

For most people that disabled updates, it wasn't a "refusal to patch", so much as a (read: the only) relief from annoyance.

Disabled the SMB services yet? Win + R -> services.msc

I routinely disable services (until things stop working and I have to figure where I went too far) and luckily I'd disabled this one on my Win7 gaming box, even though the updates came through as well (I just manually vet updates, and have a bunch of them blacklisted for adding telemetry).

Are you sure this is enough? At least on WinXp, port 445 is opened by a kernel driver and is still opened after stopping the SMB service.
Disabling services is good, but beware that they may be re-enabled during a software update. Once a service is disabled, you have to monitor that is remains so.
Wouldn't it be a great feature of Windows update to warn its users that once manually disabled services are now being forced to be active?
I'm not sure, I only learned to manage services when I was already on Windows 7.
The recent cumulative rollups should include it and should be clearly labeled.
Thanks I've been searching for this but with no luck. Do you have a link?

(I've disabled SMB V1 as has been suggested in this subthread. I've also run MS Defender with latest virus sigs and so far it hasn't reported anything)

Thanks Yu! I'm checking.

Have a great day.

Your safest option then is to disable SMB.
Just SMBv1 in this case, here is how: https://support.microsoft.com/en-gb/help/2696547/how-to-enab...

Also, decent AV and anti spam and don't open email attachments without some prior analysis. Backups - good backups and check them at least weekly.

Actually just do all the boring stuff that IT Security have been recommending for years.

Thanks. Done it
Why do you fear updating to Windows 10?
a) telemetry

b) I'm worried my fairly nicely working Win7 environment will not work so well after updating to 10, as much as I want to get current with some genuinely useful features.

I'm generally a Microsoft "fan", but this is one of the many reasons I hate on them as much as Linux fans.

Sounds reasonable, thanks for replying!
I never "upgrade" from one Windows OS to another. Always done a clean install. I postponed the upgrade because it's literally a couple of days' time project for me to get my dev environment up to speed. I also planned to purchase a new SSD before doing the new install (kill two birds with a single stone.)

Unfortunatelh I've been so busy with project deadlines that I haven't had a weekend I could dedicate to the new install and set up.

I guess I'm forced to now.