top | item 15959423

Don't tell people to turn off Windows Update

63 points| Nitishshah700 | 8 years ago |troyhunt.com

118 comments

order
[+] merricksb|8 years ago|reply
Heavily discussed at time of publication 7 months ago:

https://news.ycombinator.com/item?id=14340286

[+] hungerstrike|8 years ago|reply
I see a lot of articles that are dupes, but nobody ever says anything. Just curious - Are we all allowed to talk about something twice or not? Looks like plenty of people commented on this posting of the story, so I'm left wondering - what's the intention of this comment?

I don't see anything in the guidelines about duplicates here - https://news.ycombinator.com/newsguidelines.html

Are moderators responsible for pointing this out or just regular users? Who eventually marks something as a dupe? Is it in response to a comment like this?

Is this actually the most highly rated comment or did mods put it there?

(Again - just curious!)

[+] mschuster91|8 years ago|reply
> Microsoft needs to make Windows Update better.

Microsoft especially needs to do two things:

1) respect the DHCP settings that tethered devices provide (Android provides option 43/ANDROID_METERED) and NOT suck every data plan dry when on the road (maybe would be worth to expose an API to applications "the primary internet connection is metered, do not suck dry", given how huge any kind of update is these day)

2) give users the fucking option to only subscribe for security updates and not for the latest "feature" set. I know many people who disabled Windows 7 auto-updates after every other month MS would re-enable the W10 update nagware screen. This is way beyond hostile behavior, not even Apple goes this low. I went Apple once Win8 was coming out, definitely not going back until MS either gets a grip or makes W10 LTSB (the one on a "stable" track e.g. for embedded devices, without nagware, ads or other bullshit) available for general sale.

oh, and 3) provide a Windows 7 Service Pack 3 and installation media with all the updates preinstalled. Having to either upgrade by hand or mess around with ISOs is not exactly customer friendly.

[+] whywhywhywhy|8 years ago|reply
> not even Apple goes this low.

Apple goes just as low, OS X asks me every day to update to High Sierra and the option is only "Later" and it can't be swiped away quickly like a normal notification.

I ran an iPhone 4 for until the iPhone 7 launch, I used to keep it on iOS7 because after iOS4 rendered my 3G unusable I knew to no longer update. Every single morning it would ask me to update, which I had to carefully dismiss. It would always download the update filling up my phone to the brim which I would have to then manually delete. If my phone was full it would give me another option offering to temporarily delete apps (Which it claimed would have data restored from iCloud but I knew they would not).

My Mothers iPad auto-updated locking her out of her painting app (Brushes, as used by David Hockney), I had to use a dodgy 3rd party app to extract her documents or they'd be lost for good.

At least Microsoft gives you options to downgrade and supports old OSes, unlike Apple who stops handing out the encryption keys.

[+] nikanj|8 years ago|reply
Re:2, I've never had a mac reboot on me without my explicit decision to do so. Contrast with the countless times Windows has fucked me over.

Scenario: hook up laptop to projector etc, make sure everything works. Step out for 30 minutes to chat with people coming to see your presentation. Come back, just to realize Windows did the good old "say Uncle in 5 minutes, or I'll start installing updates" thing.

[+] simias|8 years ago|reply
Exactly, I was surprised that TFA brushed away the terrible handling of updates, especially of late. "Sometimes, updates will annoy you" is quite an understatement when it involves having a whole different OS being installed without your consent.

I definitely do not tell people to turn Windows Update off but I also definitely do not try to convince to turn it on because I don't want them to hold me accountable if something weird happens. That's where MS messed up, turning updates on should be a no-brainer, not a compromise. It's easy to lose trust, it's hard to regain it.

[+] bionoid|8 years ago|reply
3) Include an accurate description of each update, so you can determine if it is worth installing or not.
[+] aldanor|8 years ago|reply
> not even Apple goes this low

That's an interesting new standard of bad behaviour :)

[+] polygot|8 years ago|reply
There's a way to choose the business branch instead of the comsumer branch, which might delay some of the feature updates. Iirc there was an option to delay features by up to 180 days, but that doesn't actually stop the updates though.
[+] emmelaich|8 years ago|reply
Disaggregating security patches from feature sets would vastly increase the permutations they would have to test.
[+] bambax|8 years ago|reply
Here's how Windows Update "works" for me: "installs" an untold number of patches, does an untold number of reboots, then displays that the update "failed", and undoes all said patches, with the same number of reboots, to bring my PC back to where it was before the update.

Failures have generic error messages that don't point to any useful information from the (abysmally bad) MS forums.

So yes, it is disabled. Once every few months, I try again, and usually get the same result.

I have multiple backups of everything, so hopefully if WannaCry 2 hits, I'll survive. Or maybe not, but in the meantime, I'm sorry but I can't spend all my time watching my PC doing updates that don't update anything.

[+] kbwt|8 years ago|reply
I have the same problem with Windows 7. "Applying updates" until just over 80%, then "Update failed, reverting changes..." followed by a reboot. It goes through this cycle 3 times before finally booting to the desktop. Each attempt takes between 30 minutes and an hour.

I followed all the instructions from Microsoft to reset Windows Update and ran their "Fix It" assistant multiple times. Guess I just won't be booting into Windows anymore, I only used it for a single game anyway.

[+] imtringued|8 years ago|reply
I had the same problem. Don't waste your time like I did by searching for a solution beyond reinstalling windows. Reinstallation is the only way.
[+] gandhium|8 years ago|reply
Yes. I had the same situation, tried everything (except installing Windows anew) - nothing helped.

And at this time I'm not concerned about patiently waiting for ~1 hour, I'm worried that someday that "update+fail" cycle will botch my system.

[+] foobar1962|8 years ago|reply
A comment at the end of the article:

>Lost productivity to malware = 0hrs. Lost productivity to windows auto updates = 28 hrs. Sitting here right now losing time and money to an unauthorized update. I know how to avoid malware on my work laptop.

That's a bit like how some people (who weren't THERE) think the Y2K-thing was a non-event: they didn't see all the work that got done fixing things before the big day.

[+] pooper|8 years ago|reply
Sorry, friend but you are wrong on this. A simple change would fix the problem which is don't restart the computer! You can update anything and do anything when the computer is plugged in but please don't restart the computer or at least let users decide when they want to restart their computers. Even fedora does a better job with software updates. There is a checkbox when you turn off or restart the computer. If you check it, fedora will install updates and shut down/reboot. Why is this so difficult?

Security without usability is worthless.

[+] jmkni|8 years ago|reply
> This malware is tracking everything I type, but at least it's not slowing me down
[+] youdontknowtho|8 years ago|reply
I don't even know what to say to the guy you are replying to. Holy...just wow. Can you imagine trying to fix something when some of your users are just unwilling to let you try anything to fix it?
[+] Grollicus|8 years ago|reply
I think a lot of the hate for Windows Update is because of how slow it is.

I have a Windows machine I use for gaming. Its started about once a month and whenever I turn it on it is almost unusable for the first 30 minutes because its checking for updates and installing them. This is totally on Microsoft and their bloated update mechanism.

[+] hengheng|8 years ago|reply
Windows machines need to be on for about half a day every week. I know no other device that needs this kind of attention, apart from helicopter gas turbines that are best kept slowly spinning.
[+] sandworm101|8 years ago|reply
Same with my work computers. They randomly decide it's update time and i sit spinning in my chair for half an hour. Then spend another half hour seeing if updating broke anything.
[+] BlackFly|8 years ago|reply
Windows update worked a lot better for me when there was the notification of updates. I shut my computer down every day, so I would update my computer every Tuesday when I turned it off.

Now, they have completely broken my work flow for staying up to date. There are no "active hours", if my computer is on, I am using it. No, I don't want you downloading updates without my permission, I am actually trying to use my internet without latency and bandwidth issues.

I understand I am not the majority of users, but it is very clearly the power users that understand windows update that are creating blog posts on how to disable windows update, so maybe to avoid the cobra effect Microsoft should cater to such power users even if the majority of people aren't going to use those features.

As it is, for me, a more effective work flow would be to disable automatic updates and just check every Tuesday when I don't actively need my internet or mind my computer rebooting. The problem is, I am fallible. If only there was some way to remind me.

[+] throwaway13337|8 years ago|reply
Security fails when a large percentage of the your customers think it's too painful to use.

That's a failing of your software, not the customer.

OSX and Chrome gets it right. It's possible.

[+] romanovcode|8 years ago|reply
I don't get it. How is updates painful? You do not have to restart your PC when they show up, just like on MacOS - you can click "Restart Later".
[+] SaltySolomon|8 years ago|reply
OS X has a much smaller installerbase, and even they manage to screw it up.

Chrome is a piece of software that is much less complex and has a much shorter cycle time than a PC.

So you are pretty much comparing apples to oranges.

[+] cleeus|8 years ago|reply
OSX gets it right? Yeah, by delaying many security updates. I admit though when they do updates, you barely notice.
[+] pjmlp|8 years ago|reply
I guess you have not been paying attention to macOS news.
[+] krylon|8 years ago|reply
> Sometimes, updates will annoy you

Unfortunately, that is an understatement. If you are using a Windows computer at home, it's one thing. If you are responsible for a company network of 80+ clients, Windows updates (pre Windows-10, at least, I have no experience with Windows 10, yet) are a little bit like Russian roulette.

It's one thing if an update breaks third-party software; I suspect this usually means the third-party software did some questionable things begin with or is just crawling with bugs (I am looking at you, Siemens!).

But if Windows updates break functionality like, say, communication with a WSUS, or booting properly (I could go on and on and on...), it is my responsibility to at least do some research how this month's update may affect my users, instead of blindly installing anything Microsoft throws my way.

I wholeheartedly agree that keeping systems up to date is very important. But unless Microsoft gets its act together and makes updating as painless as on, say, Debian or CentOS, I am going to have mixed feelings on the subject.

[+] taspeotis|8 years ago|reply
I think it's great that Microsoft are pushing updates but it's slowly wearing me down. Keep in mind I'm 100% on board with getting security updates out as broadly as possible as fast as possible.

But for the last two days Windows Update has gone rogue and started gobbling up CPU. GOG Galaxy has gone nuts as well, I uninstalled it but I can't uninstall Windows Update. I can't even stop Windows Update, it'll go into the "Stopping" state but ... no dice.

It's like literally everything is coming for my CPU [1] for updates updates updates. It's a 6700K so there's 8 threads at 4GHz being used 60%...

I'll probably re-install Windows 10 over the Christmas break and cross my fingers.

[1] https://imgur.com/a/8hZXE (Windows Update is Service Host: Local System (3) along with Update Orchestrator Service and Remote Access Connection Manager.

[+] Silhouette|8 years ago|reply
I normally have a lot of time for Troy Hunt, but on this one I'm not sure I agree with him.

If Windows Update provided only essential updates for security and stability by default, and if it did so transparently so everyone could see exactly what was being done and why, and if it did so with minimal interruption to the user's real work, he would have a decent argument. But none of those things is the case.

Look at the comments on the article, or here, or on countless other forums since the Windows 10 fiasco started. Heck, look at Troy's own acknowledgement:

I've had Windows Update make me lose unsaved work. I've had it sitting there pending while waiting to rush out the door. I've had it install drivers that caused all manner of problems. I've had it change features so that they work differently and left me confused. I've had it consume bandwidth, eat up storage capacity and do any number of unexplainable things to my machines.

I've seen those things too, and more. I've seen unfortunately timed updates cripple a sales team right before a crucial demo, months in the making, that was supposed to close a £1M deal... in a small business that closes perhaps 2-3 such deals a year and relies on them to pay everyone's salary. Not much point worrying about encrypted filesystems if your business went bust already.

The fundamental problem here is that Microsoft is no longer trustworthy. They have demonstrated, repeatedly, that through both negligence and malice they will break systems that install their updates. The Microsoft that some of us trusted back when we bought our Windows 7 machines is not the Microsoft of the past few years, but we're stuck with those machines now, so we have to find the least risky path forwards taking into account as many potential problems as we can. It is far from clear to me, on the evidence to date, that accepting all of Microsoft's updates by default is safer than rejecting all of them by default.

[+] sshagent|8 years ago|reply
Initially Windows 10 felt fresh and nice, combined with all the other 'nice' things Microsoft have been up to...i was happy. Being able to ssh from windows cmdline...excellent stuff. But...

...with every stupid update, and after every boot up Windows insists on settings, programs and games it wants you to have. Should i have to curate my own powershell script to disable and remove some of the shit that gets forced on me. I paid for my OS, why do i get to suffer like this. Microsoft please sort this out, you're pushing me away. You know, looking at the Steam for Linux game list now, we're getting close to a point where the Gamer in me might see an opportunity to leave.

[+] thijsvandien|8 years ago|reply
I just hate the moving platform that Windows has become. Windows 7 did plenty of updates already and they could take forever or incidentally break something, but an installed system would essentially stay the same. As of Windows 10, anything can happen at any time. You install a system, do nothing and the next day it has Candy Crush on it. (Yes, you can fiddle with the registry, but WTF??) New functionality is pushed and with it, default behavior changes. The most annoying one that comes to mind was default printer management. From one day to the next, the default printer started changing. Every time there is one more thing to remember to turn off or work around, but it won’t be enough, because at a random point in the future, Microsoft will decide you want it differently. Sometimes they ask—Edge opening to show some release notes and conveniently using the opportunity to offer to make itself the standard browser—but not using the standard browser in the first place already pisses me off and that question is really one too far. Recently a family member clicked the wrong button, making Firefox disappear, resulting in a panic call because they “lost” their bookmarks, logins, etc. /rant

There are many improvements since Windows 7 that I can appreciate, but those practices—together with the increasing privacy violations—are a complete shame.

[+] Grollicus|8 years ago|reply
On the other hand python virtualenvs, npm, docker containers almost never get updated and people almost religiously fight for the ability to freeze packages at specific versions.
[+] finnthehuman|8 years ago|reply
Well, yeah, obviously a bad idea. But the real question everyone in "security" should be asking themselves is "if the idea of having better security is such an easy sell to even the vaguely-clued-in, what have we implemented so poorly that people still use insecure practices? Or go out of their way to disable security?"

The article's point here is that no matter how much windows update might suck, you still need to use it. And that's the problem with security people in general. It's not like they "think their shit doesn't stink" it's that they everyone must put up with whatever level of stench because security is just that important. Which gives them zero incentive to reduce the smell. They'll probably just blame the developers for fucking up the distribution mechanism the same way they blame developers for having the temerity to write bugs.

Unfortunately, the impression I get is that "the security community's" answer is that users do things like disabling windows update because security hasn't been sanctimonious enough towards the unwashed masses, and we should just get on with taking away all of end users' control over their systems for their own good.

[+] yellowapple|8 years ago|reply
It continues to amaze me that Windows is so terrible at system updates when pretty much every Linux distro out there has done it in a more-or-less sane way since day 1. openSUSE doesn't require sitting at the shutdown and startup screens for hours when I install a single update. Ubuntu doesn't forcibly reboot itself if I leave it unattended. CentOS doesn't disguise new "features" and nagware as critical security updates. Slackware doesn't burn through my mobile data constantly downloading updates. Even Android seems to do a better job than Windows, and Windows Update alone has existed for longer than Android has at all.

If Microsoft knew how to do system updates in a way that wasn't an absolute fucking pain, then I'd be a lot less tempted to just turn off automatic updates on Windows.

[+] stordoff|8 years ago|reply
If Microsoft et al. want me to leave Windows Update enabled, they either need to push way less updates (security updates only track) or at least make the install process faster (which would probably be helped by not pushing new features). Losing two days of progress on a video encode[0] due to a reboot when "you aren't using your PC", or pulling out my laptop to do something time-critical to be greeted with 20 minutes of configuring Windows updates, means I'm turning it off ("download and notify to install" Group Policy setting). These are real problems; malware is only a _potential_ problem (largely mitigated by keeping offline backups).

[0] Fairly ridiculous x265 settings on a laptop CPU, as I'm not keeping the source files so want to ensure optimal quality.

[+] orf|8 years ago|reply
You see a lot of this kind of thing in HN threads as well, (including using older unmainted/vulnerable browsers), where there is presumably a subset of users who have very strong feelings about automatic updates and are also blind to the security implications of disabling them.

Keep your machines and software updated with the latest patches people. Keep your parents and non technical friends machines updated with the latest security updates. Don't ever tell them to disable it because your heavily customized windows 7 setup broke a little bit one time after a huge windows update.

[+] dvfjsdhgfv|8 years ago|reply
I actually agree with the person commenting the original article:

> The "security updates" situation reminds me of organized crime's protection racket: Either pay us to "protect" you or bad things will happen. In the case of automatic "security" updates -- and not just Microsoft's -- we're compelled to pay in computers and programs that are corrupted with unwanted new behaviors. If you don't accept those, well then your computer will be insecure. So "pay up" or else.

[+] Grumbledour|8 years ago|reply
The thing I don't understand is the insistent nagging and it's persistence that a restart NOW is really needed and then often forcing you to restart.

This all worked perfectly on windows 7. It downloaded in the background and would install whenever I restarted the system myself. No nagging, ever. Of course, I get why some people might have problems with automatic downloads or automatic installation on restarts, but I feel it was still worlds apart from the current windows 10 behavior and a good compromise between staying up to date and getting annoyed. So why has this actually changed? Why does it need to nag all the time now and force-restart in the middle of the workday? Who gains form this?

[+] stephengillie|8 years ago|reply
In the newest AWS Workspaces images, Windows Update is disabled. I'm having to enable it manually on newly-deployed Workspaces. (Probably a bug that will get reverted on their next refresh.)