Microsoft’s February security update release delayed to March

https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/

by amitmittal1993 • 9 years ago

54 50 9 years ago

blogs.technet.microsoft.com

ocdtrekkie3• 9 years ago

Wow. That is a BIG screw up if they're having to push an entire month's security updates across the board.

If anyone from Microsoft reads this: This is why cumulative updates suck, and you shouldn't force them on everyone. :)

jedberg2• 9 years ago

It has nothing to do with cumulative updates.

They push once a month because back in the day they pushed whenever they had an update, and enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time.

So MS and the enterprises agreed on a specific day of the month that updates would get pushed, so that the enterprises could plan accordingly as best fit their needs.

Some enterprises just run the updates that night and let everyone know to expect some slowness or downtime, and some of them only let the update run on their testing machines so they can validate the update in their environment before allowing it out to all the other machines.

But the main point is that the updates are predictable because that is what the customers asked for.

pilif• 9 years ago

It has nothing to do with cumulative updates.

well. Let's say you have 10 security flaws to patch. 9 patches are fine, but in 1 you have detected a show-stopping issue.

If all you can deploy is one cumulative update, then that one issue is stopping the whole update. If you can deploy patches one-by-one (all on the same patch day, yes, but still separate from each other), then you can ship 9 patches for 9 holes and hold the one patch back until next month.

Of course you could also create a new cumulative update containing only 9 patches, but I assume that's more difficult to do and will require more testing.

microtonal3• 9 years ago

enterprises really hated that because it meant that sometimes 1000s of computers were all out of commission running updates at the same time.

If a computer has to go out of commission for a security update, you are doing it wrong (as an OS vendor). Doing cumulative updates is only band-aid. The real solution is make the OS modular and reliable enough to replace/restart components while it is running.

ocdtrekkie3• 9 years ago

As an enterprise IT admin who has handled Windows update deployment for over six years... you missed the point.

The updates should all ship on Patch Tuesday for the reasons above. The problem is that "an issue" has interfered with "all updates" because "all updates" is now "one update".

For instance, one of the things that most articles did not cover about this issue is that Adobe released a new version of Flash Player on Tuesday to coincide with Patch Tuesday, when Microsoft would've released theirs as well. IE and Edge get their Flash Player updates from Microsoft through Windows Update now.

However, that didn't happen this month, because the cumulative broke. And so now people can look at the Chrome and Firefox Flash Player updates and exploit the remote code execution vulnerabilities in IE and Edge, which are now at risk.

In other examples, Microsoft has released updates which broke things like network printing on Windows 10. Enterprises had to make the choice to either not be able to print, or not get security updates until Microsoft finally fixed it two months later. Without the ability to pick and choose updates, when an update has a problem or compatibility issue, companies are going to end up just stopping updates, which is bad for everyone. In the past, we'd just hold the problematic update, but with cumulatives, it's not possible.

yuhong2• 9 years ago

Also see https://bugs.chromium.org/p/project-zero/issues/detail?id=99...

acqq2• 9 years ago

I'd like to know if the "project zero" publishes to everybody the security issues discovered in Google products before Google has a chance to update the software? Or does this policy exist only for the other companies? Can we even know?

yuhong2• 9 years ago

https://bugs.chromium.org/p/project-zero/issues/detail?id=86...

namtrac• 9 years ago

Since Flash update is now bundled with Windows Updates it means that Edge users will be using vulnerable Flash for one more month, wow :/

B1FF_PSUVM• 9 years ago

Flash still exists?

I used to avoid annoyances by not having Flash. Now, thanks to the hard work of WHATWG on HTML5, I'm scrod.

kyriakos• 9 years ago

wasn't edge originally supposed to be updated via store?

billpg• 9 years ago

The "Disable Falsh" button is under Advanced Settings on Edge. Switched it off and I barely notice anything is missing these days.

popey456963• 9 years ago

True, but for the 90% of users of Edge that aren't technical, going into advanced settings and disabling flash is probably beyond their abilities.

akerro4• 9 years ago

One foreign government organisation must be hacked this month, but NSA doesn't have enough time, so they asked MS to delay patches.

mtgx3• 9 years ago

It did cross my mind as well. Considering the whole Russia drama right now, I wonder if the NSA just asked Microsoft to delay its patches for this month so it doesn't interrupt the agency's on-going operations against Russia.

I doesn't help that Microsoft has been moving in a direction where it provides less and less information about what its updates do these days, while sneaking through dozens of new root certificates at once every now and then.

http://www.theverge.com/2017/1/25/14381174/microsoft-thailan...

http://www.networkworld.com/article/2348143/security/microso...

https://hexatomium.github.io/2016/10/11/unannounced-root-cer...

https://hexatomium.github.io/2015/06/26/ms-very-quietly-adds...

staticelf• 9 years ago

What do you base that on? Faith? :)

akerro4• 9 years ago

Previous leaks :)

Google is in relationship with NSA

Yahoo let them tap their cables

Now it's MS turn

DCKing2• 9 years ago

I wish people thought a bit more critically when invoking NSA conspiracies in these matters. If the NSA was the primary cause, wouldn't it be much easier to simply silently exclude those specific unwanted updates from an otherwise regular Patch Tuesday, instead of having Microsoft announce very publicly and vocally that something is 'off' in this patching round?

Not saying the NSA doesn't influence Microsoft or others to withhold patches, but seeing the invisible hand of the NSA everywhere is not helpful for determining and criticizing when they do influence things. People seem to be able to suspend their critical thinking too easily whenever the NSA can be invoked.

akerro4• 9 years ago

It was a joke.

mtgx3• 9 years ago

I don't get it. So because of one issue, they're not going to deliver any other security patch either?

r721• 9 years ago

There are speculations that Windows Update itself could be broken:

http://www.computerworld.com/article/3170633/microsoft-windo...

https://www.askwoody.com/2017/what-happened-to-the-february-...

acqq2• 9 years ago

I've followed the links. The argument "if the patch is broken on, for example, Windows 10 but not on Windows 7 they could still release for Windows 7" is wrong: once the patches for Windows 7 are available every criminal can investigate them and then apply the results to the unpatched (delayed) 10 systems. So it's either all platforms or none.

Now they distribute all patches in one month together, so they possibly limited themselves to "all or nothing" also for one platform.

But regarding all platforms, they only had the choice of releasing all platforms delayed: e.g. one or two weeks or the whole month. If the issue is not trivial, as probably isn't, the whole month alternative wins.

noinsight• 9 years ago

Microsoft stopped distributing individual patches, all updates are now rolled up into one package. Therefore, if one patch causes issues, none of them can be released.

Windows 10 already worked like that, last fall they started doing the same for older OS'es.

See: https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/...

mtgx3• 9 years ago

More of a reason to call that bundling "dumb".

Seriously, think about all the different issues Windows 10 has caused to people's computers. So if one issue damages a computer, they can't send any of the other updates to that model of laptop?

They should be striving towards higher modularity, not a lower one.

Microsoft’s February security update release delayed to March

Related Stories