Computer Question:Windows Updates?

[bsfins]

I come home to change into my monkey suit for the afternoon, check a couple emails, and items watched on EBay...The little bubble on the right hand corner of my desktop pops up..."Windows Updates Available" 1 Critical,8 optional....I noticed alot of them optional ones, were for stuff...I've got no clue about, Clicking the Knowledge base trying to read it, It might as well be Mandarin Chinese...

Alot of the Stuff,.Net Framework,Media Center stuff,Windows Live essentials,Games for Windows,Do I really need this Shit?

I ask because I've already got Framework Vers.(whatever),Because they told me I needed it to run modded Versions of old games.I installed windows Live Because Bioshock2 said it required it to run the game....IE Compatability stuff, I quit using IE....

I understand these are optional Should I still keep these up to date? Possibly because I might be leaving myself open for a loop hole,for hackers and viruses...Or whatever?

For me the important things are, My Antivirus updates, Malaware updates,spyware crap,my video drivers,and certain other program updates....

Modified to add...Some of the stuff, I understand...The biggest SD card I've got is 16 GB,So unless I buy a card bigger than 32 GBs, there isn't a need for the update....Those I get...some of these others not so much....Thanks for light anyone is able to shed....

[Pappy13]

Personally I always do all the updates, even the optional ones.  I figure the most current software is probably the best even though that's not always true.  It's probably true a lot more often than it's not though and even if you are not using the software, then it probably won't matter if you do update it.

For me the risk versus reward indicator falls over to the reward side.  Your mileage may vary.  Besides, if you ever do an update that seems to cause problems you can always roll back the changes provided you have system restore turned on.

[Spider-Dan]

Ever since Microsoft came out with Windows Genuine Advantage, I don't do Automatic Windows Updates.  That "security update" was really just glorified spyware that nagged you if it thought you had a pirated copy of Windows, which is actually useful (for the user) to about 0.00000001% of the population.  And it would be one thing if it was just annoying people with unlicensed copies... but even people with real, legitimate copies were caught in the net.

No thanks.  If there's a specific update I need, I'll download it and install it myself.

[fyo]

Ever since Microsoft came out with Windows Genuine Advantage, I don't do Automatic Windows Updates.  That "security update" was really just glorified spyware that nagged you if it thought you had a pirated copy of Windows, which is actually useful (for the user) to about 0.00000001% of the population.  And it would be one thing if it was just annoying people with unlicensed copies... but even people with real, legitimate copies were caught in the net.

No thanks.  If there's a specific update I need, I'll download it and install it myself.

If you don't like WGA, uncheck it. It isn't a forced update. Just like newer versions of IE, if for some reason you want to keep your IE6/7 chugging away.

[Spider-Dan]

If you have automatic updates turned on, you don't pick which updates to install and which not to.

Furthermore, even if you have it set to automated download but manual install, how are you supposed to know what new unwanted software MS is pushing on you?  When "Windows Genuine Advantage" came out, there was no way to know what it would actually do, much less that it could ruin your legitimate system.

MS can roll out a new security update called "Windows Security Assurance" and do the same thing or worse, and you wouldn't know until it's too late.

[Pappy13]

MS can roll out a new security update called "Windows Security Assurance" and do the same thing or worse, and you wouldn't know until it's too late.

Unless of course you have Windows System Restore turned on and then you can just roll it back a day and undo the changes.  I've been using Windows since about '94 and not once have I had a problem after doing a windows update.  Not saying it doesn't happen, just that it's very rare and it can be undone in most cases.  A single bad software release shouldn't stop anyone from doing regular updates.

[Spider-Dan]

Unless of course you have Windows System Restore turned on and then you can just roll it back a day and undo the changes.

That would only be a viable solution if you found out that this new Windows Security Assurance was, in fact, an undesirable spyware program... within 1 day of installing the update.  Which, again, would require you to know the exact day that this new program was installed.

Sorry, but MS has breached its trust on this one.  If I cannot depend on MS not to install self-serving faux-security updates, then I'd rather roll the dice with standard malware/viruses.  Those can at least be thwarted by cautious PC usage and anti-malware programs.

[fyo]

That would only be a viable solution if you found out that this new Windows Security Assurance was, in fact, an undesirable spyware program... within 1 day of installing the update.  Which, again, would require you to know the exact day that this new program was installed.

That would depend very much on your System Restore settings.

In any event, there's OFTEN a better "official" way of rolling back patches: The uninstall scripts in your Windows folder, appropriately named after each individual Knowledge Base article describing that patch. Since Microsoft didn't want you to uninstall this particular patch, they neglected to provide an uninstall script for it. (You can search for one, though, and they are readily available from reputable sources).

Sorry, but MS has breached its trust on this one.  If I cannot depend on MS not to install self-serving faux-security updates, then I'd rather roll the dice with standard malware/viruses.  Those can at least be thwarted by cautious PC usage and anti-malware programs.

Sometimes.

Remote code execution exploits do happen. Sometimes these are in the wild before MS issues a patch, but NOT patching isn't going to improve your odds

[Spider-Dan]

In any event, there's OFTEN a better "official" way of rolling back patches: The uninstall scripts in your Windows folder, appropriately named after each individual Knowledge Base article describing that patch. Since Microsoft didn't want you to uninstall this particular patch, they neglected to provide an uninstall script for it.

Which kind of defeats the purpose of the uninstall script: the unwanted patch that you are trying to avoid can't be easily removed.

(You can search for one, though, and they are readily available from reputable sources).

Yeah, but that's no different than finding a malware cleanup script.

Remote code execution exploits do happen. Sometimes these are in the wild before MS issues a patch, but NOT patching isn't going to improve your odds

I can still manually reduce the chance of getting compromised by where I go and what I do.  I can't do that if MS is installing malware through Windows Update.

[Pappy13]

That would only be a viable solution if you found out that this new Windows Security Assurance was, in fact, an undesirable spyware program... within 1 day of installing the update.  Which, again, would require you to know the exact day that this new program was installed.

Not true as already pointed out.  WGA is not spyware, most updates can be uninstalled after the fact and depending on your system restore settings you can often roll back weeks at a time.  If you want a little more objective discussion on WGA, look here.

Sorry, but MS has breached its trust on this one.  If I cannot depend on MS not to install self-serving faux-security updates, then I'd rather roll the dice with standard malware/viruses.  Those can at least be thwarted by cautious PC usage and anti-malware programs.

To each his own.  If you'd rather roll the dice with viruses than update your PC because of one poor software release that happened years ago, then be my guest.  And it's not just viruses that you're opening yourself up to by not updating, it's also possible hardware/software conflicts, missing features, missing bug fixes, missing peformance improvements etc.  By not updating you'll be causing more problems for yourself then you would avoid. 

[fyo]

I can still manually reduce the chance of getting compromised by where I go and what I do.  I can't do that if MS is installing malware through Windows Update.

I think you're vastly overestimating your ability to control that.

Flash plugins, PDF plugins, Apple's own PDF plugin... all have had (or have, in the case of Apple) remote code execution exploits over the past few years. So have various audio plugins and even image rendering. Considering that most forums (including this one) allow you to embed images and (yes) flash directly in your message, just perusing a forum is exposing yourself unless you've disabled pretty much everything in your browser.

[Spider-Dan]

Not true as already pointed out.  WGA is not spyware, most updates can be uninstalled after the fact and depending on your system restore settings you can often roll back weeks at a time.  If you want a little more objective discussion on WGA, look here.

It seems that your cited link indicates that MS has admitted that WGA dials home once every 2 weeks without notification or permission.  Sounds like spyware to me.

I was actually talking about a hypothetical new MS software, but in the case of WGA, according to MS's own glossary, it meets the definition of both malware and backdoor trojan.

To each his own.  If you'd rather roll the dice with viruses than update your PC because of one poor software release that happened years ago, then be my guest.  And it's not just viruses that you're opening yourself up to by not updating, it's also possible hardware/software conflicts, missing features, missing bug fixes, missing peformance improvements etc.

Hardware/software conflicts?  It's exponentially more likely that an update would break something that's already working.  If there's something that's not working because I don't have a needed update, I'll install the update that I need to make it work.  Pretty simple.

Missing features, bug fixes, and performance improvements are not worth a potential 20% chance (according to the article you cited) of having my legitimate copy of Windows flagged as unauthorized.  Most of the bug fixes I actually want are contained in updates to non-Microsoft applications (e.g. Firefox, Flash Player), which is outside the scope of Windows Update anyway.

[Spider-Dan]

I think you're vastly overestimating your ability to control that.

Flash plugins, PDF plugins, Apple's own PDF plugin... all have had (or have, in the case of Apple) remote code execution exploits over the past few years.

You're talking about web browser plugins.  Given that a) I don't use IE and b) Windows Update does not update Firefox or any of those third-party browser plugins, you aren't making a very strong case.

If we were talking about something like Linux (where the built-in update will also download and install security fixes for damn near every piece of software for your computer), then that would be one thing.  But given that Windows Update won't patch any browser but IE and won't patch non-MS plugins, where's the benefit?

[fyo]

You're talking about web browser plugins.  Given that a) I don't use IE and b) Windows Update does not update Firefox or any of those third-party browser plugins, you aren't making a very strong case.

The browser is (probably) the gateway for most of the data that arrives on your computer, but even if you're using Firefox, it's exceptionally difficult to avoid various Microsoft components. There are those that Firefox will use more or less automatically (like Media Player) and there are those that Windows uses "on its own" on files you have downloaded or that have been cached by the browser. Say you download an image from somewhere. Most people would use Microsoft's built in Picture Viewer, but let's assume you use Irfanview or something else. Even then you are not in the clear. Anytime you open the Windows file explorer and access the folder that image is in, Windows will process the file (even if you tell it not to display thumbnails). The same goes for movies and many other types of media.

If we were talking about something like Linux (where the built-in update will also download and install security fixes for damn near every piece of software for your computer), then that would be one thing.  But given that Windows Update won't patch any browser but IE and won't patch non-MS plugins, where's the benefit?

Yes, it would be extremely nice to have a unified update module that handled all (well-behaved) installed programs. There's nothing preventing Microsoft from opening up their update process and allowing third-parties to serve secure, verified patches over it. Sadly, I doubt that's going to happen anytime soon, so we're stuck with a billion programs each managing their own -- and if you haven't updated e.g. your image viewer in a long time (say you haven't used it) and load a malicious image, you are screwed even if you viewer tells you that there's an upgrade available. (That's for all the programs that don't stick a process in start up and continually and eternally monitor the state of its parent program).

[Spider-Dan]

So, to summarize:

 - Windows Update has been used to distribute unwanted, difficult-to-remove spyware programs from Microsoft in the past
 - Nevertheless, one should run Windows Update anyway, because the security risk outweighs the risk from Microsoft
 - However, the security fixes from Windows Update will not patch the most common vectors of infection: Flash Player, browser plugins, and your web browser itself (if running a non-IE browser)

What is the benefit of running Windows Update, again?