The Promise--And Problems--Of The New Windows Update

TechWeb - InformationWeek ^ | July 12, 2004 | Fred Langa

[Eagle9]

XP and Windows 2000 users soon will get a new version of Windows Update. Here's the full story, and remember, this is beta software, so be careful, Fred Langa says.

A new version of Windows Update is about to debut. It first appeared as part of the prerelease versions of Service Pack 2 for XP, which is still in beta as of this writing. But the Update software was separately released on its own in a free public beta about two weeks ago. The new Update process (comprising the software that resides on your PC and a new Update site that coordinates with that software) has different defaults and behaves differently from the Update you're probably used to: I suggest you read all the way through this article before deciding whether or not to try the beta on your system.

(click image for larger view)
Screen One The new Update site sports a fresh look and requires installation of a new Update applet.

But beta or not, one way or another, you're going to have to deal with these changes to Windows Update. In the next weeks or months, the final form of this software will be offered to you either as a normal Windows Update for XP and Windows 2000 or as part of the final released SP2 for XP. Once the software is complete and out of beta, Microsoft will work hard to get you to use it, so it's worth the time to learn about it now. Let's take a look:

When you click to the new Update site from Windows XP or 2000, you'll immediately notice that Update looks different. (See Screen One.)

	(click image for larger view)
	Screen Two The new Update site and software may initially require several steps to get set up fully, but the process is straightforward and reasonably well-explained.

When the Update site loads, you'll see a new site layout and graphic design, and you'll be offered a download of the new Update applet, which is mandatory if you wish to use the new site and features.

By the way, the new Update site and process is, at least for now, only for Windows XP and 2000. If you access the new Update site from Windows ME or 98, nothing happens; those versions of Windows revert to the current (old) Update software and site.

But XP and Win2K bring you to the new site. Your initial access to the new site may require several incremental downloads to install the new Update applet and then to install a catalog of available updates. (See Screen Two.)

(click image for larger view)
Screen Three The new Update offers you two major subchoices: Express or Custom installation of updates, giving you either a highly automated or a more manual approach to managing updates for your PC.

Once the new Update software is fully installed and running, you'll reach your first decision point: You must choose between Express and Custom installs for the updates you'll be downloading. The Express Install searches for and installs only "High Priority" updates, roughly analogous to what used to be called "Critical Updates." The Custom Install gives you more flexibility and potentially offers you more Updates: Not only the High Priority updates, as above, but also "Optional Updates," roughly analogous to the "Recommended Updates" in the old Update process. (See Screen Three.)

Note the "Automatic Update" panel in Screen Three. The new Update software defaults to full automatic mode: With no user input required, the software will detect, download, and install whatever updates it deems appropriate for your PC. This setting is convenient for some but can cause problems for others. We'll explore this more fully in a short while.

Unlike the old (current) Windows Update, which tends to be terse and fairly uninformative about the updates it offers, the new Update is far more friendly and open, with plain-English explanations of what the updates are and what they do. (See Screen Four.) And if the explanatory text is still insufficient, a "Details" pull-down provides additional information. (See Screen Five.)

(click image for larger view)				(click image for larger view)
Screen Four The new Update tries to explain the benefits of any available downloads more clearly than the classic Update does...				Screen Five ... with fuller, more technical explanations, including links to relevant Knowledgebase files, available via a "Details" pull-down.

Select An Update Mode

The actual update process hasn't changed much from that of the classic Update, although the appearance of the dialog boxes has been freshened. (See Screen Six and Seven.)

As we mentioned previously, the new Update process is quite conservative: Its default settings assume that everyone will want all "High Priority" (aka "Critical") updates to be downloaded and installed as soon as they're available, with no user input, intervention, or vetting.

(click image for larger view)				(click image for larger view)
Screen Six The new Update installation dialogs function much the same as those in the classic Update process...				Screen Seven ...... but the dialogs have been visually updated to match the look of the new Update site.

This may indeed be a good default choice for "average" users, as many of them never download or install any updates at all! (Witness the many worms in the last year or so that exploited Windows security holes that had been detected and fully patched before the worms were released: The worms succeeded solely because tens of millions of PCs had not been updated, and thus remained vulnerable.)

But odds are, if you're reading this text, you're not exactly an average user, and the default settings may not be ideal for you. That's because, sometimes, security patches introduce new problems or create new instabilities and conflicts. It's been fairly common practice among more experienced users to delay installing security patches for at least several days, so that any unexpected problems with the patch could come to light. In other words, let other users be the guinea pigs for new updates and patches!

Although the new Update defaults to "install everything automatically as soon as it's available," you can fairly easily tame it and thus remain in control of when and how updates will be detected, downloaded, and installed, as Screen Eight shows.

	(click image for larger view)
	Screen Eight The Automatic Update dialog shown here, plus the Settings and Administrator Options in the left-hand navigation bar of the main Update window, provide welcome flexibility in controlling what updates will be detected, downloaded, and installed on your PC.

The Automatic Update agent itself has four modes: It can operate in the default fully automated mode; it can detect and download new update items but not install them until you've given your explicit permission; it can merely inform you of new updates without actually downloading or installing anything; or it can be turned off completely.

Any of the options except the fully automatic one are fine for security-conscious users: These options put you in charge of what gets loaded onto your PC; you can postpone installation of new updates until you're reasonably sure the software is stable and worthwhile. But for casual users, the "set and forget" default mode is probably safer.

You can adjust the Automatic Update Agent settings at any time by clicking on "Pick a time to install updates" in the Automatic Update information panel that appears on the upper right portion of the main Update window. (See Screen Three.) Once the time-setting dialog opens, click on the "More Options" button and you'll then see the full, four-option Automatic Update dialog, as shown in Screen Eight. You also can reach the same dialog by clicking on the "Configure Automatic Updates" link that may appear at the end of an update, as shown in Screen Seven. As is usual with Windows, there are multiple ways to accomplish any given task, and the one that's "right" is whatever works for you.

The Update site itself also offers some additional customizations and controls: The "Settings" option lets you pick.

 

 

Beta Means Unfinished

The new Update seems promising, but there are a couple of caveats:

First, although everything ran smoothly on the six systems I tried it on, this is beta--which is to say, unfinished--software. There almost surely are bugs, and the software may change in major ways before final release. It's always wise to prepare for the worst with any beta software: Don't install it on any machine unless you have a full, current, and bulletproof means of rolling the system back to the way it was before you installed the beta. (For an example, see this article.)

Second, if you do install this beta, take a moment to adjust the Automatic Update agent, as described above, or you may find yourself getting more than you bargained for. For example, if you use XP, and if you accept the default for full automatic installation, then you may find yourself unexpectedly test-driving not just the new Update, but also the huge, potentially problematic beta version of XP's Service Pack 2, which is one of the updates available through the new Update agent. (We'll cover SP2 in future articles, closer to its release date.) To prevent this kind of surprise, turn off or restrict Automatic Updates so that, at the very least, you get to approve which updates are allowed to install on your PC.

Finally, whether or not you try the beta, this new Update (or something very much like it) is almost certainly in your future. You may wish to bookmark this article or otherwise make note of it so you can return here at the appropriate time to refresh yourself on the options the new Update offers.

But for now, please join the discussion: Have you tried the new Update? What has your experience been? Has any of your installed software been broken or adversely affected by the Update Agent or the "sniffing" routines used by the agent to detect and catalog what's on a PC? Have you found instances where Update suggested inappropriate software or failed to report necessary updates? Please share your knowledge by joining in the discussion!

---

To discuss this column with other readers, please visit Fred Langa's forum on the Listening Post.

To find out more about Fred Langa, please visit his page on the Listening Post.

[Hodar]

3 machines ... no problems.

Added plus ... Internet Explorer now AUTOMATICALLY blocks pop-ups. You have to click below the Address bar to allow IE to either open a window, or allow a download.

No stability issues .... going on 5 weeks since installation.

**** This is MY milage and experience; on MY machines. My machines run 24/7 and without incident for ~5 weeks. YOUR milage may vary.

[My2Cents]

Added plus ... Internet Explorer now AUTOMATICALLY blocks pop-ups. You have to click below the Address bar to allow IE to either open a window, or allow a download.

Does that mean it will block adware, spyware, and malware?

[Izzy Dunne]

Internet Explorer now AUTOMATICALLY blocks pop-ups.

Wow.. only a year after Safari and lots of other browsers did it. Microsoft's "designers" are getting better!

What will they think of next?

Maybe something radical like tabbed browsing...

[HipShot]

Best windows update site ever: http://www.debian.org

[Izzy Dunne]

Best windows update site ever: http://www.debian.org

Uhhh... I don't like looking at THIS:

Security Advisories


[03 Jul 2004] DSA-527 pavuk - buffer overflow 
[03 Jul 2004] DSA-526 webmin - several vulnerabilities 
[24 Jun 2004] DSA-525 apache - buffer overflow 
[19 Jun 2004] DSA-524 rlpr - several vulnerabilities 
[19 Jun 2004] DSA-523 www-sql - buffer overflow 
[19 Jun 2004] DSA-522 super - format string vulnerability 
[18 Jun 2004] DSA-521 sup - format string vulnerability 
[16 Jun 2004] DSA-520 krb5 - buffer overflows 
[15 Jun 2004] DSA-519 cvs - several vulnerabilities 
[14 Jun 2004] DSA-518 kdelibs - unsanitised input 

I'll stick with my Macs, thanks.

[HipShot]

Remember that advisories are posted when issues are found during code auditing as well as the appearance of exploits. Patches are available within hours.

Even Apple doesn't patch that quicky.

[ikka]

How do you fix security advisories on Debian?

apt-get update ; apt-get upgrade

That is it, you can even set it to check for new updates every 24 hours if you want.

[Hodar]

Added plus ... Internet Explorer now AUTOMATICALLY blocks pop-ups. You have to click below the Address bar to allow IE to either open a window, or allow a download. Does that mean it will block adware, spyware, and malware?

That is the intent. To the best of my knowledge, IE will now prevent MOST forms of malware from being automatically installed. However, if the user choses to download and install programs with malware built in .... programs like Ad-aware, and Spyware - Search & Destroy will help clean them out. The intent is to help prevent automatic installations, without preventing the user from contaminating his own machine.

[Hodar]

One of the key things about Windows is; unlike the competition (Apple) there are a plethora of motherboard manufacturers, processor manufacturers, memory, North and South Bridge's and components under the sun that need support. Apple has a unique stance, as they 'define' what is, and what is not a 'Mac'.

With that said, Windows users get 'FREE' upgrades and support. You can still download 'FREE' service packs from Win98. With Apple, you must PURCHASE your updates, each and every time.

Apple makes a better machine, it's more stable, and it's easier to use. It's due to complete and utter incompetence, stupidity, and incredably poor business sense that Mac enjoys >10% marketshare instead of the <90% marketshare it had in the early 80's. Needless to say, things haven't improved much in the past 20 years.

For example, if Mac ported it's OS to the x86 processor; I would expect them to take marketshare by storm. Considering that Mac's are now a user interface riding on top of Unix (hence their stabilty), and Unix has existed for the x86 for decades; there is no reason why the Mac OS is not available for x86 machines today. I (personally) have witnessed the Mac OS running on x86 processors in the early 90's.

You can lead a horse to water, but you can't make him drink.

[Eagle9]

Windows ping!

[My2Cents]

It's about time. I know of a number of folks who have switched from MS Internet Explorer to FireFox to avoid such downloads.

[js1138]

**** This is MY milage and experience; on MY machines. My machines run 24/7 and without incident for ~5 weeks. YOUR milage may vary.

Does this mean it will fix my noisy fan?

[Izzy Dunne]

With Apple, you must PURCHASE your updates, each and every time.

Horse puckey - that is a lie.

I have gotten 4 or 5 free updates since the last major release, last November.

there is no reason why the Mac OS is not available for x86 machines today.

Again, Horse puckey.
The technical reasons are few, I'll agree - related to the plethora of machines and manufacturers you mentioned.
But the real reason is economic, and quite valid - Apple is a HARDWARE company. If they released OS X for X86 (there has been a working port for years, as I understand it), their hardware business would dry up immediately, because people will buy stuff that has a lower price, rather than stuff that has a lower cost.

[HAL9000]

With Apple, you must PURCHASE your updates, each and every time.

That statement is wrong and just plain ignorant. Apple only charges for major updates. The majority of updates are free.

[HAL9000]

Apple.com Downloads - Free Software Updates

[Hodar]

I stated "With Apple, you must PURCHASE your updates, each and every time. "

You stated " That statement is wrong and just plain ignorant. Apple only charges for major updates. The majority of updates are free."

So, simple question.... Are you charged for Updates, or not? It's fairly straightforward. You either pay for your updates, or you don't. How can I be ignorant, or as someone else charged 'a liar' if what I allege is true? Microsoft does not charge for any updates whatsoever. No charges for Service Packs, No charges for additional functionality, and no charges on the minor stuff.

[HAL9000]

How can I be ignorant, or as someone else charged 'a liar' if what I allege is true?

First, I didn't say you are an ignorant person. I was criticizing the statement, not you personally.

So, simple question.... Are you charged for Updates, or not?

Apple does charge for major updates. Apple does not charge for minor updates. It's basically the same policy as Microsoft's.

[Bush2000]

Remember that advisories are posted when issues are found during code auditing as well as the appearance of exploits. Patches are available within hours. Even Apple doesn't patch that quicky.

So what. Patching != distribution. There are many, many, many machines that will not be updated.

[Bush2000]

Apple does charge for major updates. Apple does not charge for minor updates. It's basically the same policy as Microsoft's.

That's BS. Service Packs are major updates -- and they're available at no charge.