Skip to content

Comment on New Metasploit 0-day exploit for IE 7, 8 & 9 on Windows XP, Vista, and 7parent

Comments

>I have absolutely no influence at Microsoft. Why are you asking me to talk further over how I would do their software architecture differently? There is absolutely no hope of changing anything, at all, by doing that. It's a waste of time. That's why there was no "proposed solution" anywhere in my comment

You compared Chrome favorably to Windows Updates and criticized WU throughout your post, which lead me to believe you had some insight on how to make updates painless beyond "Microsoft, just make it better.".

>Or is it your argument that people don't turn off Windows automatic updates? Because even Coding Horror has a rather popular post from 2005 on how to disable it (http://www.codinghorror.com/blog/2005/05/xp-automatic-update...), and that's targeted at a technical audience, so frankly I'm not yet convinced that anybody who thinks that disabling Windows automatic updates isn't a popular thing to do is someone that I should spend any time debating this with.

First, Windows 7/8 are much better than XP in this regard. Second, the point of difference between us is that you're not ascribing any blame on the user at all for turning off updates.

Here's the dialog box for turning it off. It states the following:

http://cloud.addictivetips.com/wp-content/uploads/2008/11/wi...

> Never check for updates, not recommended. Your computer will be more vulnerable to security threats and performance problems without the latest updates.

To go to a car analogy, updating your OS is like servicing your car which comes with inconveniences such as having to find a few hours in your busy life and not having access to your car for a few hours, having to take a taxi or bus to home or work, or skipping gym, watching TV or going to a movie. Who's fault is it primarily if the car catches fire on the highway because it wasn't serviced because taking car to service was too much work?

Your arguments amount to something like, "it's solely the car makers' fault to require expensive service that takes a long time that leads to users not servicing cars for months, they should learn to make cars that don't need service, do I need to take my bicycle for service? They should learn from that."

If my friends or relatives either turned off automatic updates or stopped servicing their car, I would strongly recommend them not to do that. You may be of a different opinion regarding updates i.e "yes they suck and are a waste of time, no need to do it".

Another point of contention is your anecdote of "most users turn off automatic updates". Most? Can you come up with some reference to that beyond your personal anecdote?

>The fact alone that Microsoft pushes browser updates through the exact same channel as kernel updates makes their update process very wrong

That's a better idea, but should we have different channels for Remote Desktop? Windows Media Player critical updates? Why are these any less critical than IE updates? I guess that would further confuse normal consumers some of which don't even know what a browser is.

If you're an admin, you can already pick and choose updates.

http://ie.microsoft.com/testdrive/ieblog/2009/Aug/25_Interne...

Should Microsoft make updates better? Yes. Should user not turn off automatic updates even if it's "annoying"? Yes.

>If you insist on having me come up with an entirely new way to engineer software for Microsoft, I expect to be paid for that.

>And I'm still reading patio11's latest post on kalzumeus, so my rates just went up.

Thanks for graciously agreeing to insighfully comment on HN for all of us. I feel obliged to pay your for amazingly modest comments with no grandstanding or condenscenion for which we're all very grateful , do you accept Paypal?

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.