Posts Tagged


Reading between the lines about Microsoft ‘pausing optional updates’

Yesterday, a post on the official Windows Release Information site said that Microsoft will, at least temporarily and starting in May, stop sending out the pesky “optional, non-security, C/D Week” patches we’ve come to expect. 

Those “optional” second-monthly patches are usually laden with many dozens of fixes for miscellaneous, minor bugs in Windows. For example, the second-monthly cumulative update for Win10 version 1903 released yesterday lists 31 different fixes, most of which only matter in very specific cases.

For example:

  • Addresses an issue that fails to return search results in the Start menu Search box for users that have no local profile.
  • Addresses an issue that prevents applications from closing. 

…and many more of that ilk.

Starting with Win10 1903, those “optional, non-security, C/D Week” patches aren’t automatically applied to your PC. They aren’t installed when you click Check for updates, either – a horrendous relic of a bygone era. In order to install the patches these days, you have to click on a specific link just for that patch that says Download and install now.

The “optional, non-security, C/D Week” patches are nothing more than a surrogate for a Windows Insider ring devoted to testing non-security patches on a released version of Win10. Microsoft should’ve turned the patches into an Insider ring years ago. But I digress.

Here’s what I don’t get. The official announcement goes like this:

Timing for upcoming Windows optional C and D releases

We have been evaluating the public health situation, and we understand this is impacting our customers. In response to these challenges we are prioritizing our focus on security updates. Starting in May 2020, we are pausing all optional non-security releases (C and D updates) for all supported versions of Windows client and server products (Windows 10, version 1909 down through Windows Server 2008 SP2).

There is no change to the monthly security updates (B release – Update Tuesday); these will continue as planned to ensure business continuity and to keep our customers protected and productive.

That’s the whole announcement.

I see what it’s trying to do – stop releasing “optional, non-security, C/D Week” patches – and that’s a laudable goal. That means fewer people will click and install a beta test version of Win10 without realizing what they’ve stepped into. But the specific wording of the announcement still has me scratching my head.

Here’s the ugly truth: Microsoft isn’t going to stop doing non-security patches. It can’t. Windows is so buggy in its current form that important things go bump in the night and need to be fixed. For example, this fix in the February “optional non-security, C/D Week” patch:

  • Updates an issue that prevents the Windows Search box from rendering properly. 

… tackled a problem that was encountered by thousands (millions?) of users. Then there are specific bugs that cry out for fixing, like this one from yesterday:

  • Addresses an issue that fails to return search results in the Start menu Search box for users that have no local profile. 

Win10 bugs aren’t going away any time soon, and Microsoft would be foolish to ignore them completely.

With that in mind, here’s what I think Microsoft is trying to say:

We won’t be sending out any more bundles of “optional, non-security, C/D Week” patches after April. (Hey, can we get an Insider Ring, folks?)

Patch Tuesday patches continue. Starting in June, the Patch Tuesday patches will include as few non-security patches as possible.

Of course, the point of this exercise is to improve the stability of Windows patches. I’m skeptical – after all, the non-security patches inevitably slipped into Patch Tuesday won’t be tested any more than the security patches. But there is hope. Perhaps by increasing the number of “Won’t Fix” bugs, the resulting patches will be more stable.


And there’s one huge, looming question: How does Win10 version 2004 fit into all of this? Is Microsoft saying that the latest version of Windows will ship so bug-free that it doesn’t need loads of non-security patches?

One can always hope.

We’ll be following intently on

Copyright © 2020 IDG Communications, Inc.

Source link

The ‘optional, non-security’ update for Win10 version 1909, KB 4532695, runs zero for two

Last week Microsoft released KB 4532695, a dual-purpose Win10 version 1903 and 1909 “optional, non-security, C/D Week” patch. Most of us expected a fix for the File Explorer Search bar bugs that have been described and dissected (but not officially acknowledged) for more than two months

I, personally, also held out hope that Microsoft would fix yet another bug in the Internet Explorer JScript engine that warranted a Security Advisory in January. Yes, I know that the “optional, non-security” patches aren’t supposed to fix security holes, but … hope springs eternal.

On the File Explorer Search bugs: Windows guru Rafael Rivera tweeted shortly after the patch hit:

Unfortunately, it’s still a crummy experience. For example, it takes two clicks at times to reset the caret position, stopping you dead in your tracks. Search box continues to be a façade that can’t be right-clicked until it’s activated (e.g. via left-click). Advanced Query Syntax keywords, operators, and filters are no longer highlighted in blue, either. And deleting items didn’t make it in. I doubt we’ll see that get serviced; we’ll likely have to wait for 20H1 release [Win10 version 2004] to get that [feature].

Mayank Parmar, on Windows Latest, says:

Microsoft has yet to acknowledge the new problems with Explorer and there don’t appear to be any workarounds. If you have installed Windows 10 November 2019 Update [version 1909], you have to accept the possibility of experiencing issues with File Explorer and Control Panel.

As best I can tell, Microsoft has never acknowledged the bugs, in spite of fixing them in a series of updates for the still-in-beta Win10 version 2004. They aren’t mentioned on the Release Information Status page.

On the JScript fix, I initially said that KB 4532695 changes the jscript.dll file that’s at the center of the numerous security holes, and hoped that it fixed this latest JScript bug. My hopes were dashed when Mitja Kolsek, of 0patch fame, tweeted:

We tested it and KB4532695 does NOT modify jscript.dll. It does modify mshtml.dll (which we micropatched) but not in a way that would prevent jscript.dll from getting loaded. So it’s really unlikely that this KB does anything for CVE-2020-0674.

Zero for two.

KB 4532695 has drawn lots (and lots!) of fire in the press for putting “Millions” of Win10 users at risk for blue screens. From what I’ve seen, it’s not considerably worse than most “optional, non-security” Win10 patches — but it’s undeniably having lots and lots of installation problems

Fortunately, you’ll only get the patch if you download and install it manually, or if you get suckered into clicking “Download and install now” on an Optional updates available notification.

We’re watching you, KB 4532695, on

Copyright © 2020 IDG Communications, Inc.

Source link

Patch Tuesday arrives with Access error, 1909 in tow, and a promise of no more ‘optional’ patches this year

The patches haven’t yet been out for 24 hours and already we’re seeing a lot of activity. Here’s where we stand with the initial wave of problems.

Malicious Software Removal Tool installation error 800B0109 

Many early patchers found that the MSRT, KB 890830, kept installing itself over and over again. Poster IndyPilot80 says:

It sits at “Installing: 0%” for a couple minutes then goes away. When I hit “Check for Updates” it shows up again and does the same thing.

There are hundreds of reports online of people who found that the MSRT installer threw an 800B0109 and wouldn’t install; or installed but then reinstalled on reboot; showed up multiple times in the Installed Updates list; didn’t show up in the Installed Updates list in spite of running; and several variations on those themes.

Ends up, it was all Microsoft’s fault. By last night, MSRT was behaving itself.

Access ‘3340 query is corrupted’ errors

Günter Born first described this problem, based on reports on German-language sites, including

Microsoft Office security updates released on Patchday (November 12, 2019) cause Access to fail to access databases. An error 3340 ‘Query is corrupted’ will be dropped. …

It appears that a security update for the CVE-2019-1402 vulnerability in each version of Microsoft Office causes this error. Here is the list of Office security updates that you can uninstall.

Office 2010: Description of the security update for Office 2010: November 12, 2019 (KB4484127)

Office 2013: Description of the security update for Office 2013: November 12, 2019 (KB4484119)

Office 2016: Description of the security update for Office 2016: November 12, 2019 (KB4484113)

At least from what I’ve seen so far, uninstalling this security update seems to allow database access again.

Born says that he’s reported the problem to Microsoft, but it doesn’t yet appear on the official Fixes or workarounds for recent issues in Access list.

Re-release of Win10 version 1809

It isn’t clear to me why Microsoft re-released its most stable version of Win10 (at least, I’m still using 1809 on my production machines), but a new one’s out, apparently. At the same time Microsoft announced the re-release of 1809, it also reset the countdown date for version 1809 support:

On November 13, 2018, we re-released the Windows 10 October Update (version 1809), Windows Server 2019, and Windows Server, version 1809. We encourage you to wait until the feature update is offered to your device automatically. …  

Note for Commercial Customers: November 13 marks the revised start of the servicing timeline for the Semi-Annual Channel (“Targeted”) release for Windows 10, version 1809, Windows Server 2019, and Windows Server, version 1809.  Beginning with this release, all future feature updates of Windows 10 Enterprise and Education editions that release around September will have a 30-month servicing timeline.

And you thought Microsoft had abandoned the ridiculous “Semi-Annual Channel (“Targeted”)” bafflegab.

Servicing Stack Updates

Microsoft released new updates for the Servicing Stack on all supported versions of Windows. Notably, Win7 and 8.1 also have new SSUs. (You only have to worry about SSUs if you manually download and install updates. If you use Windows Update, they should be installed automatically. Should.) There’s a complete list of the new SSUs in Security Advisory ADV990001.

Another mysterious ‘exploited’ Internet Explorer security hole

Tell me if this sounds familiar

Yesterday’s patches includes one for an Internet Explorer security hole, dubbed  CVE-2019-1429, an “exploited” vulnerability. Just like the August “exploited” IE zero-day Keystone Kops episode, this appears to be a genuine flaw in IE. Just like the August doppelganger, Microsoft isn’t telling us very much. 

Dustin Childs says it best in his Zero Day Initiative post:

This patch for IE corrects a vulnerability in the way that the scripting engine handles objects in memory. This vague description for memory corruption means that an attacker can execute their code if an affected browser visits a malicious web page or opens a specially crafted Office document. That second vector means you need this patch even if you don’t use IE. Microsoft gives no information on the nature of the active attacks, but they are likely limited at this time. 

No doubt the Chicken Littles of the Windows reporting industry will bill this as a huge threat to 800 million Windows users — or some such drivel. In fact, it’s likely the discovered exploit appeared in a honed attack directed at a major governmental or industrial target.

Until we hear more about it (we haven’t heard of any attacks based on August’s exploit, have we?), you should be fine.

A reprieve from ‘optional non-security’ updates for the rest of the year

This should come as good news for Windows patchers of all stripes.

Microsoft has officially announced that it’s giving up on its practice of releasing (at least) two cumulative updates per month, through the end of this year. Tucked away in a neglected corner of the Windows Release Information page lies this little gem:

Timing of Windows 10 optional update releases (November/December 2019)

There will be no more optional “C” or “D” releases for the balance of this calendar year. Note There will be a December Security Update Tuesday release, as usual.

For those of you who don’t speak the A-B-C-D-E jargon, that means we won’t have second cumulative updates in November or December. The “optional, non-security” patches (which frequently contain fixes for bugs introduced by security updates) are a strange artifact that solidified in early 2017. Prior to that, Microsoft released one cumulative update on the second Tuesday of most months, then patched again at an arbitrary time, should the need arise — primarily to fix bugs introduced by the first patch.

Starting in 2017 or so (it’s difficult to pinpoint a date), somebody decided that it would be good to give Windows patchers a preview of the next month’s non-security patches, generally during the 3rd or 4th week of the month (thus, “C” and “D” week). The approach resembled something of an Insider Preview shot at the next month’s non-security patches. You could get a preview of the next month’s patches, but only if you downloaded and installed them manually, or (horrors!) became a Seeker and clicked “Check for updates.”

It looks like Microsoft is shutting that down, at least for the next two months, and I say good riddance. If there’s to be an Insider Preview ring for each version of Win10, I’m all for it — let people opt in, and give them a reliable way to report bugs. But playing footsie with Seekers just hangs too many innocent bystanders out to dry.

It isn’t clear if we’ll be spared the same indignity with Windows 7 and 8.1 “Monthly Rollup Previews.” Stay tuned.

The end of 1803 and the rise of 1909

As widely advertised, this month’s cumulative update for Win10 version 1803 is destined to be its last (unless we have a major security problem and Microsoft changes things). If you’re running Win10 version 1803, there’s no need to panic; in the normal course of events, you wouldn’t get another security patch until next month anyway. I’ll have more about the journey from 1803 in a subsequent column.

Those who have installed the Win10 1903 November cumulative update, KB 4524570, and rebooted, will see an offer on your Windows Update setting page (screenshot).

1903 after reboot installing 449 Woody Leonhard/IDG

Right now, there’s no pressing reason to click that “Download and install now” link. Let’s wait and see what problems arise. 

Quite a haul for the first 24 hours, eh? 

Thx, @abbodi86, @PKCano, @gborn and many more

Join us for the usual patching follies on

Copyright © 2019 IDG Communications, Inc.

Source link

Microsoft releases emergency IE patches inside ‘optional, non-security’ cumulative updates

I’ve seen a lot of confusion about the security hole known as CVE-2019-1367 and what normal Windows customers should do about it. Part of the reason for the confusion is the way the fix was distributed – the patching files were released on Monday, Sept. 23, but only via manual download from the Microsoft Update Catalog.

On a Monday.

In the past few hours, Microsoft released a hodge-podge of patches that seem to tackle the problem. They’re “optional non-security” and “Monthly Rollup preview” patches, so you won’t get them unless you specifically go looking for them.

As a bit o’ lagniappe, if you use Windows Update to install the sky-is-falling IE patch, you’ll get a bunch of additional marginally-tested patches along for the ride.

Here are the most important Win10 patches that appear to contain the IE/CVE-2019-1367 fix:

  • Win10 1809 and Server 2019 KB 4516077 – build 17763.774.
  • Win10 1803 KB 4516045 – build 17134.1039.
  • Server 2016KB 4516061 – build 14393.3242.

I say “appear to contain” the fix because, as best I can tell, none of the documentation mentions CVE-2019-1367, the security hole that was fixed yesterday in an odd single-purpose cumulative update. These, too, are cumulative updates, but they’re specifically identified as “non-security updates.”

Which is disingenuous, at best. 

Those patches are only available if you click “Check for updates.” Microsoft would traditionally call them “optional, non-security” patches, but with the likely (if undocumented) presence of a separately identified out-of-band security patch, it’s hard to say what to call them. 

We don’t have a cumulative update for Win10 1903 just yet. We do, however, have a manually downloadable out-of-band patch for the IE problem in 1903, KB 4522016.

Over on the Windows 7/8.1 side of the fence, it appears as if the CVE-2019-1367 fix is part and parcel of the two Monthly Rollup Previews just released:

  • Win7 KB 4516048 – “Addresses an issue that may cause an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in the Event Log related to cryptnet.dll.”
  • Win8.1 KB 4516041 – Fixes the bug that prevented IE 11 from running on RT devices.

There’s no indication in the KB articles that either of these Previews fix the IE hole, but an independent check by AskWoody’s @EP shows that the Previews contain the latest IE file. That likely means the security hole has been plugged in the Previews.

At this point, I don’t see why the Windows blogosphere has tied itself in knots warning about the IE/CVE-2019-1367 security hole. Yes, Microsoft has said that it’s been exploited in the wild. No, we don’t have any more information. The folks who know aren’t talking. The most credible story I’ve seen involves a very targeted attack from the (reputedly) Korean group known as DarkHotel.

At any rate, for almost everybody, this appears to be yet another tempest in a teapot. My advice is to sit tight, don’t update anything, and stop using Internet Explorer.

Unless you’ve done something to make DarkHotel angry, of course.

Keep up with the latest on AskWoody.

Copyright © 2019 IDG Communications, Inc.

Source link

What Does Black Tie Optional Mean? – LifeSavvy

Couple dressed in black tie optional formal wear
Dean Drobot/Shutterstock

In the world of dress codes, the term “formal” has gone through a series of changes over the decades. Here’s what the term entails.

Formal once implied “as fancy as it gets,” suggesting white tie or black tie. But today, if someone expects white or black tie attire, they’ll usually specify that. When the dress code just says formal, it usually means something more like black tie optional.

“Black tie optional” and “formal” are two common, nearly interchangeable dress codes for fancy events. Although they’re a little more relaxed than white and black tie, you’ll want to make sure you don’t accidentally show up underdressed.

Black Tie Optional: A Definition

The word “optional” here means yes, you can wear black tie attire—but you don’t have to if you don’t want to or don’t have any.

Since people today typically don’t own many truly formal clothes, this dress code gives guests some welcome flexibility. The hosts expect you to look your best, but they don’t expect you to run out and buy or rent a tuxedo.

Black tie optional can also overlap with cocktail and lounge attire, but when in doubt, it’s always best to go a little dressier.

When to Dress Black Tie Optional

Your black tie optional clothes will work best for these occasions:

  • Weddings
  • Fundraisers
  • Galas
  • Dinner parties

If a dress code for an event isn’t specified, you’re usually safe showing up in nothing fancier than cocktail attire. But if it seems like a classy event, you can play it safe with a black tie optional look.

Black Tie Optional Ideas for Women

Women’s black tie optional clothes include these:

  • Fancy cocktail dresses
  • Evening gowns
  • Suits

You can make your black tie optional look more or less formal, depending on what you choose to wear. A short dress will look less formal, so if you wear one, make sure it’s fancy. For a safe dose of glamour, choose a floor-length gown instead. A luxe suit also works well for women who prefer to wear pants.

Wear your heels or dressy flats, and don’t be shy with accessories. These are typically evening events, so you can go big with statement jewelry and makeup. This is also an appropriate time for low necklines and glitzy fabrics, as long as the look remains classy.

Fancy touches, like clutches and long gloves, suit a black tie optional look too—but as the name suggests, this level of fanciness is optional.

Black Tie Optional Ideas for Men

Men should wear these to formal or black tie optional events:

  • Tuxedos
  • Dark-colored suits
  • White dress shirts

Leave the light linen suits at home, and opt for a color like charcoal or black instead. Similarly, swap out your colored dress shirt for a more formal white one (French cuffs with cufflinks are ideal, but not required). You can also wear a tuxedo if you want.

Keep your tie conservative, in a solid color. Bow ties are also appropriate. Wear shined leather dress shoes and a matching belt, with dress socks to match your suit. Consider accessorizing with a pocket square.

Black tie optional dress codes are meant to save you from the hassle of running out to buy a new, event-specific outfit for a formal occasion. A tuxedo or evening gown is great, but your business suit or cocktail dress will work, too. Show your hosts you appreciate the flexibility by putting together your classiest look with whatever you have on hand.

Source link