Heavily discussed at time of publication 7 months ago:<p><a href="https://news.ycombinator.com/item?id=14340286" rel="nofollow">https://news.ycombinator.com/item?id=14340286</a>
> Microsoft needs to make Windows Update better.<p>Microsoft especially needs to do two things:<p>1) respect the DHCP settings that tethered devices provide (Android provides option 43/ANDROID_METERED) and NOT suck every data plan dry when on the road (maybe would be worth to expose an API to applications "the primary internet connection is metered, do not suck dry", given how huge any kind of update is these day)<p>2) give users the fucking option to only subscribe for security updates and not for the latest "feature" set. I know many people who disabled Windows 7 auto-updates after every other month MS would re-enable the W10 update nagware screen. This is way beyond hostile behavior, not even Apple goes this low. I went Apple once Win8 was coming out, definitely not going back until MS either gets a grip or makes W10 LTSB (the one on a "stable" track e.g. for embedded devices, without nagware, ads or other bullshit) available for general sale.<p>oh, and 3) provide a Windows 7 Service Pack 3 and installation media with all the updates preinstalled. Having to either upgrade by hand or mess around with ISOs is not exactly customer friendly.
Here's how Windows Update "works" for me: "installs" an untold number of patches, does an untold number of reboots, then displays that the update "failed", and undoes all said patches, with the same number of reboots, to bring my PC back to where it was before the update.<p>Failures have generic error messages that don't point to any useful information from the (abysmally bad) MS forums.<p>So yes, it is disabled. Once every few months, I try again, and usually get the same result.<p>I have multiple backups of everything, so hopefully if WannaCry 2 hits, I'll survive. Or maybe not, but in the meantime, I'm sorry but I can't spend all my time watching my PC doing updates that don't update anything.
A comment at the end of the article:<p>>Lost productivity to malware = 0hrs. Lost productivity to windows auto updates = 28 hrs. Sitting here right now losing time and money to an unauthorized update. I know how to avoid malware on my work laptop.<p>That's a bit like how some people (who weren't THERE) think the Y2K-thing was a non-event: they didn't see all the work that got done fixing things before the big day.
I think a lot of the hate for Windows Update is because of how slow it is.<p>I have a Windows machine I use for gaming. Its started about once a month and whenever I turn it on it is almost unusable for the first 30 minutes because its checking for updates and installing them. This is totally on Microsoft and their bloated update mechanism.
Windows update worked a lot better for me when there was the notification of updates. I shut my computer down every day, so I would update my computer every Tuesday when I turned it off.<p>Now, they have completely broken my work flow for staying up to date. There are no "active hours", if my computer is on, I am using it. No, I don't want you downloading updates without my permission, I am actually trying to use my internet without latency and bandwidth issues.<p>I understand I am not the majority of users, but it is very clearly the power users that understand windows update that are creating blog posts on how to disable windows update, so maybe to avoid the cobra effect Microsoft should cater to such power users even if the majority of people aren't going to use those features.<p>As it is, for me, a more effective work flow would be to disable automatic updates and just check every Tuesday when I don't actively need my internet or mind my computer rebooting. The problem is, I am fallible. If only there was some way to remind me.
Security fails when a large percentage of the your customers think it's too painful to use.<p>That's a failing of your software, not the customer.<p>OSX and Chrome gets it right. It's possible.
> Sometimes, updates will annoy you<p>Unfortunately, that is an understatement. If you are using a Windows computer at home, it's one thing. If you are responsible for a company network of 80+ clients, Windows updates (pre Windows-10, at least, I have no experience with Windows 10, yet) are a little bit like Russian roulette.<p>It's one thing if an update breaks third-party software; I suspect this usually means the third-party software did some questionable things begin with or is just crawling with bugs (I am looking at you, Siemens!).<p>But if Windows updates break functionality like, say, communication with a WSUS, or booting properly (I could go on and on and on...), it is my responsibility to at least do some research how this month's update may affect my users, instead of blindly installing anything Microsoft throws my way.<p>I wholeheartedly agree that keeping systems up to date is very important. But unless Microsoft gets its act together and makes updating as painless as on, say, Debian or CentOS, I am going to have mixed feelings on the subject.
I think it's great that Microsoft are pushing updates but it's slowly wearing me down. Keep in mind I'm 100% on board with getting security updates out as broadly as possible as fast as possible.<p>But for the last two days Windows Update has gone rogue and started gobbling up CPU. GOG Galaxy has gone nuts as well, I uninstalled it but I can't uninstall Windows Update. I can't even <i>stop</i> Windows Update, it'll go into the "Stopping" state but ... no dice.<p>It's like literally everything is coming for my CPU [1] for updates updates updates. It's a 6700K so there's 8 threads at 4GHz being used 60%...<p>I'll probably re-install Windows 10 over the Christmas break and cross my fingers.<p>[1] <a href="https://imgur.com/a/8hZXE" rel="nofollow">https://imgur.com/a/8hZXE</a> (Windows Update is <i>Service Host: Local System (3)</i> along with <i>Update Orchestrator Service</i> and <i>Remote Access Connection Manager</i>.
I normally have a lot of time for Troy Hunt, but on this one I'm not sure I agree with him.<p>If Windows Update provided only essential updates for security and stability by default, and if it did so transparently so everyone could see exactly what was being done and why, and if it did so with minimal interruption to the user's real work, he would have a decent argument. But none of those things is the case.<p>Look at the comments on the article, or here, or on countless other forums since the Windows 10 fiasco started. Heck, look at Troy's own acknowledgement:<p><i>I've had Windows Update make me lose unsaved work. I've had it sitting there pending while waiting to rush out the door. I've had it install drivers that caused all manner of problems. I've had it change features so that they work differently and left me confused. I've had it consume bandwidth, eat up storage capacity and do any number of unexplainable things to my machines.</i><p>I've seen those things too, and more. I've seen unfortunately timed updates cripple a sales team right before a crucial demo, months in the making, that was supposed to close a £1M deal... in a small business that closes perhaps 2-3 such deals a year and relies on them to pay everyone's salary. Not much point worrying about encrypted filesystems if your business went bust already.<p>The fundamental problem here is that <i>Microsoft is no longer trustworthy</i>. They have demonstrated, repeatedly, that through both negligence and malice they will break systems that install their updates. The Microsoft that some of us trusted back when we bought our Windows 7 machines is not the Microsoft of the past few years, but we're stuck with those machines now, so we have to find the least risky path forwards taking into account as many potential problems as we can. It is far from clear to me, on the evidence to date, that accepting all of Microsoft's updates by default is safer than rejecting all of them by default.
Initially Windows 10 felt fresh and nice, combined with all the other 'nice' things Microsoft have been up to...i was happy. Being able to ssh from windows cmdline...excellent stuff. But...<p>...with every stupid update, and after every boot up Windows insists on settings, programs and games it wants you to have. Should i have to curate my own powershell script to disable and remove some of the shit that gets forced on me. I paid for my OS, why do i get to suffer like this. Microsoft please sort this out, you're pushing me away. You know, looking at the Steam for Linux game list now, we're getting close to a point where the Gamer in me might see an opportunity to leave.
I just hate the moving platform that Windows has become. Windows 7 did plenty of updates already and they could take forever or incidentally break something, but an installed system would essentially stay the same. As of Windows 10, anything can happen at any time. You install a system, do nothing and the next day it has Candy Crush on it. (Yes, you can fiddle with the registry, but WTF??) New functionality is pushed and with it, default behavior changes. The most annoying one that comes to mind was default printer management. From one day to the next, the default printer started changing. Every time there is one more thing to remember to turn off or work around, but it won’t be enough, because at a random point in the future, Microsoft will decide you want it differently. Sometimes they ask—Edge opening to show some release notes and conveniently using the opportunity to offer to make itself the standard browser—but not using the standard browser in the first place already pisses me off and that question is really one too far. Recently a family member clicked the wrong button, making Firefox disappear, resulting in a panic call because they “lost” their bookmarks, logins, etc. /rant<p>There are many improvements since Windows 7 that I can appreciate, but those practices—together with the increasing privacy violations—are a complete shame.
On the other hand python virtualenvs, npm, docker containers almost never get updated and people almost religiously fight for the ability to freeze packages at specific versions.
Well, yeah, obviously a bad idea. But the real question everyone in "security" should be asking themselves is "if the idea of having better security is such an easy sell to even the vaguely-clued-in, what have we implemented so poorly that people still use insecure practices? Or go out of their way to disable security?"<p>The article's point here is that no matter how much windows update might suck, you still need to use it. And that's the problem with security people in general. It's not like they "think their shit doesn't stink" it's that they everyone must put up with whatever level of stench because security is just that important. Which gives them zero incentive to reduce the smell. They'll probably just blame the developers for fucking up the distribution mechanism the same way they blame developers for having the temerity to write bugs.<p>Unfortunately, the impression I get is that "the security community's" answer is that users do things like disabling windows update because security hasn't been sanctimonious enough towards the unwashed masses, and we should just get on with taking away all of end users' control over their systems for their own good.
It continues to amaze me that Windows is so terrible at system updates when pretty much every Linux distro out there has done it in a more-or-less sane way since day 1. openSUSE doesn't require sitting at the shutdown and startup screens for hours when I install a single update. Ubuntu doesn't forcibly reboot itself if I leave it unattended. CentOS doesn't disguise new "features" and nagware as critical security updates. Slackware doesn't burn through my mobile data constantly downloading updates. Even Android seems to do a better job than Windows, and Windows Update alone has existed for longer than Android has at all.<p>If Microsoft knew how to do system updates in a way that wasn't an absolute fucking pain, then I'd be a lot less tempted to just turn off automatic updates on Windows.
If Microsoft et al. want me to leave Windows Update enabled, they either need to push way less updates (security updates only track) or at least make the install process faster (which would probably be helped by not pushing new features). Losing two days of progress on a video encode[0] due to a reboot when "you aren't using your PC", or pulling out my laptop to do something time-critical to be greeted with 20 minutes of configuring Windows updates, means I'm turning it off ("download and notify to install" Group Policy setting). These are real problems; malware is only a _potential_ problem (largely mitigated by keeping offline backups).<p>[0] Fairly ridiculous x265 settings on a laptop CPU, as I'm not keeping the source files so want to ensure optimal quality.
You see a lot of this kind of thing in HN threads as well, (including using older unmainted/vulnerable browsers), where there is presumably a subset of users who have very strong feelings about automatic updates and are also blind to the security implications of disabling them.<p>Keep your machines and software updated with the latest patches people. Keep your parents and non technical friends machines updated with the latest security updates. Don't ever tell them to disable it because your heavily customized windows 7 setup broke a little bit one time after a huge windows update.
I actually agree with the person commenting the original article:<p>> The "security updates" situation reminds me of organized crime's protection racket: Either pay us to "protect" you or bad things will happen. In the case of automatic "security" updates -- and not just Microsoft's -- we're compelled to pay in computers and programs that are corrupted with unwanted new behaviors. If you don't accept those, well then your computer will be insecure. So "pay up" or else.
The thing I don't understand is the insistent nagging and it's persistence that a restart NOW is really needed and then often forcing you to restart.<p>This all worked perfectly on windows 7. It downloaded in the background and would install whenever I restarted the system myself. No nagging, ever. Of course, I get why some people might have problems with automatic downloads or automatic installation on restarts, but I feel it was still worlds apart from the current windows 10 behavior and a good compromise between staying up to date and getting annoyed. So why has this actually changed? Why does it need to nag all the time now and force-restart in the middle of the workday? Who gains form this?
In the newest AWS Workspaces images, Windows Update is disabled. I'm having to enable it manually on newly-deployed Workspaces. (Probably a bug that will get reverted on their next refresh.)
The biggest issue is reboots. They interrupt workflow. They stop the user using the computer for several minutes: the updates are applied after the reboot instead of being applied and then switching to the new binaries, the user has to save all their work manually, the user has to restart their applications manually, and the reboots often make new updates available requiring further reboots... Reboots are a DOS attack. Don't DOS attack your users.<p>The same goes for "feature" updates that break the existing workflow.
Having used a Chromebook, I hope someday desktop operating systems can become as easy to update. All you really ever have to do is restart and things are up to date. Mostly similar with Android on the Google Pixel phones. Google is oddly ahead of the curve with making updates really painless.<p>Of course, inconvenient or not, it's pretty hard to deny that disabling updates is a stupid proposition.
Holy fuck, CNET actually tells people to turn off Windows Update?!<p>I'm starting to think published tech advice should be treated like legal or financial advice. If you give out stinkers like this and they turn out to be violently harmful to its readers, you are liable for it.<p>Microsoft doesn't get off free —they've been cocking this up consistently— but turning off WU is antivax level stupidity.
A Windows Insider Here, and while I'm enjoying the Ubuntu Subsystem on my machine, I somewhat regret opting in. I hate waiting for hours just for getting some negligible updates & patches for Windows Defender AV or a software I don't use like Paint 3D, Mixed Reality Viewer, etc . Still, I like showing off my fancy terminal to other Windows noobs.
# of times I've lost Valuable data because of malware: 0
# of times I've lost valuable data because of Windows Update: ~10
# of times malware has made my computer unbootable: 0
# of times windows update has Made my computer unbootable: 2
For those who uses windows primally for gaming in its home protected network, it's better not to update windows forever, because a new patches and fixes only make windows slower.
I find the Windows Update in windows10 pretty good :-) Not as good as OS X update mechanism, but it's miles ahead of what we had in previous Windows :-)
If only Microsoft could separate feature updates from security and bugfixes... Oh wait they can! They are!<p>I'm using Enterprise LTSB. Solid as a rock. Windows as a service: they haven't done anything since 1607 that I want.
As a Sys admin i can say only F<i></i> YO(( very much:
- delay windows update by 2 days
- see what happens
- ohhh no 1% users blue screen 10% auto update on
- watt for final path
- still blue screen of dead
- wait for new windows path
- install on 10% more machine do snapshots
- wiat for new pathes
- install on 10% machines
- ok its now works without issue
- install on 100% PC