Posts Tagged

Update

Come on, Microsoft! Is it really that hard to update Windows 10 right?

Yesterday, on Patch Tuesday, as I was finishing up the column that follows lamenting the sorry state of Windows 10 patches and providing copious examples of things gone very wrong, a big, fat example landed in my lap (but happily not in my laptop). Word emerged that Microsoft had accidentally leaked news about a new Server Message Block (SMB) bug with a maximum severity rating, a.k.a. SMBGhost. The leak also said that this bug wasn’t patched in that day’s releases.

I’ll get back to this latest outrage, but first, let’s review the past several months.

I’ve written a lot about Microsoft’s Windows 10 patch foul-ups. Frankly, I’m tired of it. But you know what else I’m tired of? Another month with yet more show-stopping Windows 10 update messes.

And I don’t even use Windows 10 as my main desktop. I primarily use Linux Mint on my desktops and Chromebooks, with Debian Linux running on the side, as laptops. Woe to all of you who have to rely on Windows for work.

I mean, when I look at the Windows 10 patching landscape, I can almost understand why some of you are still sticking with Windows 7. It may be out of date and vulnerable to potential attacks, but at least when you patched it, you didn’t have to wonder what would happen the next time you rebooted your computer.

In February, we saw a standalone security patch — that’s a thing again? — KB 4524244. It was a screw-up. It knocked out a bunch of machines, primarily HP PCs with Ryzen processors. If you had Secure Boot enabled — which you’re supposed to have to keep your PC “safe” — your PCs wouldn’t reboot normally and, in the worst cases, you would have to restore your system. Oh, and even that might fail. Does Microsoft know how to give us a fun time, or what?

Microsoft finally pulled that patch. Thanks, guys, for closing the computer door after the bytes have all ran away.

Then there was KB 4532693. That one, the trusty Woody Leonhard tells us, gobbled desktop icons and moved files on Windows 10 1903 and 1909. It also caused trouble with Windows Server containers up to and including this tidbit: “32-bit applications or processes running inside the container might silently fail.” I love silent failures. Don’t you?

And silent is what Microsoft has been about fixing this one. As I write this, on March 10, these problems are alive, well and causing trouble. Aren’t you glad you paused your updates? Oh, you didn’t? I’m so sorry.

OK, so much for specifics, although if you want more about the details of these and other Windows patch shenanigans, follow Woody. He knows his stuff, and he’ll keep you informed about when to pause updates and how to go about it.

What I want to know is why Microsoft Windows quality assurance (QA) has become a joke, with our machines as the punchline.

I don’t get it. Microsoft introduced its Windows 10 Insider “slow, fast and release rings to avoid just this kind of nonsense. Windows Insider got its start way back on Sept. 30, 2014. Microsoft has had plenty of time to get the bugs out of this program.

And the latest count I’ve seen has 10 million people enrolled in the Windows Insider program. That’s a lot of beta-testers. No other software testing program even comes close.

To quote Microsoft, “Slow ring builds include Quality Update service packages to fix key issues and also receive the latest Microsoft Security Response Center security fixes shortly after public availability.” So why do the updates fail so hard?

Well, maybe as Woody — smart guy, that Woody — pointed out a few years back, the Insider program is much more marketing than it is a beta-tester program. His preferred term for the beta-testers: “cannon fodder.” In addition, Microsoft doesn’t really do a decent job of helping Insiders post helpful beta reports.

And of those 10 million Insiders, how many are providing useful information? Quick! Which version of Windows 10 are you running? To find out, press the Windows logo key + R, type “winver” in the Open box, and then select OK. Did you know that? Without that basic information, an Insider “bug” report is useless. Microsoft needs to make better use of all those brave early adopters.

Finally, I don’t know how many people Microsoft has working on Windows 10 QA, how much money it pours into the program, and what the expertise level of those people is. But because the results speak louder than words, I do know that Win10 QA is understaffed and under-resourced, with staff that aren’t as experienced as they should be.

Now, about that SMB bug, the latest bombshell from Microsoft. I’m not sure there is a patch for it yet. In case you don’t remember, SMB security holes are the ones responsible for the infamous WannaCry and NotPetya ransomware.

And now, as I wrap this up, it appears that the Patch Tuesday patch will also be delayed. I presume because Microsoft now needs to shoehorn an emergency patch into the Patch Tuesday roundup.

Come on, Microsoft! Enough is enough. Get your QA act together already!

Copyright © 2020 IDG Communications, Inc.



Source link

February Win10 1903 and 1909 cumulative update causing desktops to disappear

Shortly after this month’s massive Patch Tuesday dump dropped, several people reported that when they rebooted after installing the patch, their desktops appeared to be wiped clean — icons went missing, wallpaper replaced, desktop data nowhere to be seen.

Last night, Lawrence Abrams on BleepingComputer came up with a comprehensive diagnosis:

Based on the reports by affected users, it appears that a bug in the KB4532693 update is loading up a temporary profile to be used during the update process and failing to restore the user’s profile when done. 

Which explains all of the symptoms I’ve seen [1, 2, 3, 4, 5].

Many people are in a tizzy — their desktop icons are gone, they can’t log onto their usual Admin account, and their files most definitely aren’t where they left them. Abrams has a bit of reassurance:

The good news is that the update is not wiping your data, but rather renaming the original user profile in the C:Users folder. If you are affected by this issue, you can look in C:Users and see if you have a renamed profile ending in .000 or .bak.

I’ve seen several reports that uninstalling the KB 4532693 patch solves the problem.

Günter Born picked up the baton overnight (U.S. time) and has come up with a tantalizing observation:

Currently I’m collecting information about the root cause. One user reported, that a bunch of 50 machines was affected, all using AVIRA antivirus, while the other machines without issues didn’t have AVIRA installed. But this is only a single voice. 

Of course, Microsoft hasn’t said anything. The official Win10 Release Information Status page hasn’t been updated since November. The Feedback Hub is useless, as usual (try searching for “KB 4532693”). The official Answers Forum doesn’t have a clue.

So we’re back to helping Microsoft crowdsource patching bug reports for its multibillion-dollar product.

Did your desktop disappear after installing this month’s patches? Are you running Avira or Avast? Please let us know on AskWoody.

I swear, if somebody tells me again how Windows patches are getting better, I’m gonna bust a blood vessel. 

Copyright © 2020 IDG Communications, Inc.





Source link

What’s in the latest Firefox update? Firefox 73 adds to usability and accessibility options

Mozilla this week released Firefox 73, a minor upgrade whose most notable addition was a new default setting for page zooming.

Software engineers working on the open-source browser also patched six vulnerabilities, half of them labeled “High,” Mozilla’s second-most-serious threat rating. As usual, some of the flaws might be used by criminals.

“We presume that with enough effort some of these could have been exploited to run arbitrary code,” the firm wrote of two of the bugs.

Firefox 73 can be downloaded for Windows, macOS and Linux from Mozilla’s site. Because Firefox updates in the background, most users need only relaunch the browser to get the latest version. To manually update on Windows, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose “About Firefox.” (On macOS, “About Firefox” can be found under the “Firefox” menu.) The resulting page shows that the browser is either up to date or describes the refresh process.

Mozilla last upgraded the browser on Jan. 7, or five weeks ago.

From this point forward, Mozilla will refresh the browser every four weeks. Firefox 74 will end a gradual reduction to the intervals between upgrades: Mozilla announced the release speed-up in September, when it said the original six-week span would be shortened to five weeks, then to four.

Zoom-zoom

Firefox’s faster release tempo comes at a price: the distinct possibility that each upgrade will boast fewer new features, fewer improvements and enhancements. Firefox 73 is proof, as Mozilla was able to highlight just two changes evident to end users.

The first was a new user-set global default for the page zoom level. Rather than monkey with zoom for each site individually – to, for instance, zoom in to make text more readable for older eyes – users can set a default level higher or lower than 100% as the new baseline.

To change the default zoom (which remains at 100% if the user declines to modify it), users must open Preferences (on macOS) or Options (Windows), then under the “General” tab locate “Language and Appearance.” Select the desired default zoom from the box under “Zoom.”

That number – 110%, for instance – becomes the new baseline for all sites. Users can still manually increase or decrease zoom with keystroke combinations or from the menu.

firefox 73 default zoom Mozilla

Firefox 73’s new zoom default lets users set a baseline to, for example, zoom in to 120% on every site. For anyone who is constantly zooming, this saves tons of time.

The other addition trumpeted by Mozilla in Firefox 73’s release notes was labeled “readability backplate” and designed to collaborate with Windows’ high contrast mode. The latter is a setting that replaces the original colors of, say, a website’s text and background, with high contrast combinations for easier reading by people with vision issues.

Previously, Firefox has simply disabled background images when the user enabled high contrast mode. In Firefox 73, the readability backplate “places a block of background color between the text and background image,” Mozilla said. “Now, websites in High Contrast Mode are more readable without disabling background images.”

Days are numbered for TSL 1.0 and TSL 1.1

Mozilla, like other browser makers, is knee-deep in putting an end to the outdated encryption protocols of TLS (Transport Layer Security) 1.0 and 1.1.

More than a year ago, in October 2018, Mozilla announced that the two standards, TLS 1.0 and TLS 1.1, would lose Firefox support in March 2020. That’s next to now.

In a Feb. 6 post, Thyla van der Merwe, the cryptography engineering manager at Mozilla, promised that the upcoming Firefox 74 would give the boot to the pair. “Expect Firefox 74 to offer TLS 1.2 as its minimum version for secure connections when it ships on 10 March 2020,” she wrote.

Although van der Merwe said that Firefox would retain an override button (which has been appearing on warnings when users try to reach a website encrypted by TSL 1.0 or TSL 1.1), she noted that with telemetry trends being what they were, “It’s unlikely that the button will stick around for long.”

The next version, Firefox 74, will release on March 10.



Source link

It’s not too late to get an Extended Security Update license for Windows 7

Worried about the future of your Win7 machine? Welcome to the family.

Right now, we have a promise that Microsoft will fix the “Stretch” wallpaper bug it rolled out last month, and there’s some hope that it will fix the Internet Explorer JScript engine security hole CVE-2020-0674 noted last month in Security Advisory ADV200001. We don’t know how/when the fix(es) will be distributed, or if Microsoft will soften its “no free Win7 patches after January 14” edict in some other way.

Other than that, Win7 customers are on their own — you either pay for a year of Extended Support, get your machine locked down and pray for Microsoft’s largess, or just throw the old doorstop away.

In December, Gregg Keizer wrote about the alternative — buy an Extended Security Update license from a cloud service provider. Just one little problem: CSPs aren’t set up to sell licenses by the ones and twos. It’s a manually intensive process that simply doesn’t pay for the effort.

One CSP I know has risen to the occasion, offering to get licenses for small businesses, even businesses with just one PC. Amy Babinchak, who owns Harbor Computer Services, puts it this way: “We want to make it as easy as possible for as many businesses as possible to continue receiving Windows 7 patches. It’s a manual process, so expect some delays, but we’ll try our best to get every machine with a valid Win7 Pro or Ultimate license hooked into the Extended Security Update system.”

Patch Lady Susan Bradley has been following the procedure intently and offers these tips:

  1. You have to have a valid Windows 7 Pro or Ultimate license. No pirated keys allowed.
  2. If you have an unused Win7 Pro key, but are still running Win7 Home, you can still use Windows Anytime Upgrade to move from Home to Pro. (Click Start, type Anytime Upgrade. When you get to the screen that asks if you have a key, enter it. Be patient .. the upgrade can take HOURS depending on the speed of the computer. Once the PC’s rebooted, activate the key in the system section.)
  3. The free upgrade from Win7 to 10 still works. Is it legal? Probably not. But Microsoft is totally ignoring that and letting the machines activate.
  4. Can you still buy a Win7 license if you don’t have a new one? Yes, but man it’s hard to ensure that you are buying it from a reputable place online. Everything looks a bit scammy to me.  And certainly don’t buy it from an ebay vendor. There are a few on Amazon that look okay and not too scammy, but be careful. If it’s too good to be true or too cheap to be a proper license, it’s probably not one.

If your system’s up to it, and you don’t mind parting with $70 or so, you can fill out Harbor Computer Services’ License Request and Payment form, and give it a whirl. As Bradley notes:

A healthy Win7 machine should have no problem installing the ESU key and activating it.  A not so healthy one … you may have to manually install missing updates and run the Windows update troubleshooter to get it to a healthy condition.

The first Extended Security Update should arrive next Tuesday, although we don’t have an official announcement just yet. Now would be a good time to fill out the form, if you want to keep your “genuine” Win7 Pro or Ultimate machine officially patched.

Questions? Hit us on AskWoody.com.

Copyright © 2020 IDG Communications, Inc.



Source link

The ‘optional, non-security’ update for Win10 version 1909, KB 4532695, runs zero for two

Last week Microsoft released KB 4532695, a dual-purpose Win10 version 1903 and 1909 “optional, non-security, C/D Week” patch. Most of us expected a fix for the File Explorer Search bar bugs that have been described and dissected (but not officially acknowledged) for more than two months

I, personally, also held out hope that Microsoft would fix yet another bug in the Internet Explorer JScript engine that warranted a Security Advisory in January. Yes, I know that the “optional, non-security” patches aren’t supposed to fix security holes, but … hope springs eternal.

On the File Explorer Search bugs: Windows guru Rafael Rivera tweeted shortly after the patch hit:

Unfortunately, it’s still a crummy experience. For example, it takes two clicks at times to reset the caret position, stopping you dead in your tracks. Search box continues to be a façade that can’t be right-clicked until it’s activated (e.g. via left-click). Advanced Query Syntax keywords, operators, and filters are no longer highlighted in blue, either. And deleting items didn’t make it in. I doubt we’ll see that get serviced; we’ll likely have to wait for 20H1 release [Win10 version 2004] to get that [feature].

Mayank Parmar, on Windows Latest, says:

Microsoft has yet to acknowledge the new problems with Explorer and there don’t appear to be any workarounds. If you have installed Windows 10 November 2019 Update [version 1909], you have to accept the possibility of experiencing issues with File Explorer and Control Panel.

As best I can tell, Microsoft has never acknowledged the bugs, in spite of fixing them in a series of updates for the still-in-beta Win10 version 2004. They aren’t mentioned on the Release Information Status page.

On the JScript fix, I initially said that KB 4532695 changes the jscript.dll file that’s at the center of the numerous security holes, and hoped that it fixed this latest JScript bug. My hopes were dashed when Mitja Kolsek, of 0patch fame, tweeted:

We tested it and KB4532695 does NOT modify jscript.dll. It does modify mshtml.dll (which we micropatched) but not in a way that would prevent jscript.dll from getting loaded. So it’s really unlikely that this KB does anything for CVE-2020-0674.

Zero for two.

KB 4532695 has drawn lots (and lots!) of fire in the press for putting “Millions” of Win10 users at risk for blue screens. From what I’ve seen, it’s not considerably worse than most “optional, non-security” Win10 patches — but it’s undeniably having lots and lots of installation problems

Fortunately, you’ll only get the patch if you download and install it manually, or if you get suckered into clicking “Download and install now” on an Optional updates available notification.

We’re watching you, KB 4532695, on AskWoody.com.

Copyright © 2020 IDG Communications, Inc.





Source link