Cleveland, Curveballs and Common Sense Putting 2 and 2 together since 1987.

Forcing updates

Microsoft gets a lot of bad press for security issues, but seriously, how are you supposed to deal with something like this?

For those of you too lazy to read the article, the summary is that a bunch of Windows users are getting hit with some malware that is spreading over the Internet. If you were wondering, I am NOT getting hit with said malware, because I patched my computer a month ago. In essence, Microsoft released a patch to a security flaw in October, a month before exploits were in the wild, and now unpatched users are (surprise surprise) facing problems.

Linux has a couple advantages in the security area over Microsoft. Sure, the code is open-source and peer-reviewed, so anything that is insecure is likely to be discovered pretty quickly. But Linux also doesn’t have something that Microsoft has: computers selling at Wal-Mart.

That shouldn’t be taken entirely literally: I know Linux is being sold (to a limited extent) on pre-built machines at Wal-Mart. But I guarantee you, if you walk into a Wal-Mart electronics department and ask for a novice computer, you’ll get a pre-assembled Dell with Windows Vista (probably Home Basic). There’s definitely a market for computers like this: people who don’t care about computers other than having one so they can check their e-mail and surf the web.

These people don’t know (or don’t care to know) about viruses, worms, malware and spyware. All they use is the stuff that comes out of the box (Internet Explorer comes to mind). They’re not circling the second Tuesday of every month as Patch Day, waiting for new security fixes and service packs.

So what is Microsoft to do? They’ve already tried pushing out updates that install automatically (to some backlash) but these can be canceled or aborted. The article linked above asks if it’s time to start forcing critical updates on users: I don’t think that’s the right idea, but it’s close.

How far are we away from a managed operating system? That is, not an operating system that lives on your computer, but one that lives in the cloud waiting for you to connect? Most houses these days have broadband access, and for people who just want to check their e-mail or surf the web, a managed operating system is just what they need. They don’t want to have to worry about updating or patching, they don’t want to have to worry about spyware infections (although to be fair, neither does the company that manages it – there would have to be some huge restrictions in place). They just want a computer that works, and works well enough so that they can do their stuff and not worry about it.

I think we’re close. And I think it’s a better solution than forcing updates.