Linked by Thom Holwerda on Wed 30th Jul 2008 21:56 UTC, submitted by peskypescado
Windows I have written about if before: updating programs on your computer - if you're not using a Linux distribution, that is - is a total and utter mess. On Windows and Mac OS X, there are roughly four ways of updating applications. The application notifies of new updates, and then downloads them when you click 'yes', the application updates from within the application itself, or the application requires a special update program running in the background. These are all quite annoying, since they interfere with your workflow (as opposed to, say, running "apt-get upgrade" every morning). The fourth method is the official vendor channel, Windows/Microsoft Update in Windows and Software Update in Mac OS X. Paul Ellis argues that to alleviate the mess, Microsoft should open up Microsoft Update for everyone else - and similar arguments are made concerning Apple's Software Update.
Order by: Score:
TCO
by cyclops on Wed 30th Jul 2008 22:35 UTC
cyclops
Member since:
2006-03-12

Linux big advantage has always been maintenance, but it can archive this with the open-source nature of the Distribution.

Reply Score: 4

Client side app only?
by _txf_ on Wed 30th Jul 2008 22:44 UTC
_txf_
Member since:
2008-03-17

It doesn't have to be such a big deal...

Can't microsoft just implement an infrastructure into windows and then provide an api so that third party apps can use windows update to connect to third party servers? This would be very much the way 3rd party repositories would be added in any linux distro.

The obvious security problem would be malware using the service to do nasty things, but that would be no different to the way things are now. The advantage with a centralized app is that updates can be blacklisted/whitelisted by a downloading a list from microsoft OR by user intervention for more obscure but user trusted apps.

Unfortunately even with this architecture in place many wouldn't bother simply because in windows land there is never any consistent framework, api or will to follow the ONE consistent way even from within microsoft itself let alone 3rd party.

Edited 2008-07-30 22:47 UTC

Reply Score: 5

RE: Client side app only?
by peskypescado on Wed 30th Jul 2008 22:48 UTC in reply to "Client side app only?"
peskypescado Member since:
2008-07-08

I don't know how much of a concern malware should be, because if you have malware running on your system already they can do whatever they want. They can make it install new software or even update existing software already.

This really is no different than adding additional repositories in Linux.

Reply Score: 2

RE[2]: Client side app only?
by _txf_ on Wed 30th Jul 2008 22:52 UTC in reply to "RE: Client side app only?"
_txf_ Member since:
2008-03-17

You're probably right...But I still think having a centralized blacklist/Whitelist ability is useful for users (who might not entirely trust an app for whatever reason). Also Allowing a user to whitelist an app for updates shifts responsibility from microsoft to the user for maintainance of any given app and makes certification a lot simpler by not making it mandatory

Edited 2008-07-30 22:54 UTC

Reply Score: 3

RE[2]: Client side app only?
by lemur2 on Thu 31st Jul 2008 12:30 UTC in reply to "RE: Client side app only?"
lemur2 Member since:
2007-02-17

I don't know how much of a concern malware should be, because if you have malware running on your system already they can do whatever they want. They can make it install new software or even update existing software already.

This really is no different than adding additional repositories in Linux.


There is a slight difference. It has been revealed that "updates to Windows update" can be made to install automatically on a Windows machine regardless of the settings of that machine. Such an update does not "ask permission" ... it just downloads & installs.

This amounts to "push technology" ... this is also known as a "back door".

http://en.wikipedia.org/wiki/Backdoor_(computing)

Once you have a mechanism to allow automatic "updates to Windows update" to be installed & run on a Windows system without the machine owners knowledge or consent, then of course that further provides a mechanism to install anything at all on a Windows system without the machine owners knowledge or consent. (All you have to do is update Windows update, make the updated Windows update then download & install whatever you want, and finally you can even put Windows update back the way it was and hope that nobody has noticed).

You don't get such a thing on a Linux system. Updates are alerted via a deamon running in the system tray ... but you then have to manually click on the system tray icon, and enter the system root password before even the available updates are shown to you. After that you have to manually confirm again that you want to install the indicated updates.

Anyway ... the fact that Windows update is actually a backdoor means IMO that it is unlikely that Microsoft will allow other third parties to use it.

Reply Score: 4

RE: Client side app only? - 3rd party repos
by jabbotts on Thu 31st Jul 2008 13:47 UTC in reply to "Client side app only?"
jabbotts Member since:
2007-09-06

Adding third party repositories for each application starts to suck pretty quick. Maemo Linux is trying to get all third party package maintainers to move there stuff to the official "extras" repo for the same reason.

I think MS offering an open API that learns a different source for each updatable program will get messy very quickly. MS would really need to open up the centralized Windows Update to non-MS products but that means hosting programs and updates for things directly competing against Office and such.

It would be a benefit to the Windows end user though more than a few of the anti-MS camp members will be threatened by the prospect of loosing the repository competitive argument.

I benefit from it on the *nix side and wouldn't find it unwelcome for my Windows boots but I think there are too many conflicting business interests in the win32/win64 paranah tank.

Reply Score: 2

well and good
by stabbyjones on Wed 30th Jul 2008 22:48 UTC
stabbyjones
Member since:
2008-04-15

Companies wouldn't be interested in going through microsoft certification to get the update verefied. the 360 is a prime example of how much dev's do to get the MS stamp.

would you rather spend time and money getting Microsoft to okay the update. or use your own internal testing and release it over the net?

I imagine that Apple may do it a different way but it could be more of the same.

Another thing would be that Microsoft would have to support those apps and i'm sure they'd enjoy the extra costs...

"i installed an update to firefox through windows update and it keeps crashing!!!"

"have you tried internet explorer? it's awesome."

*click*

Reply Score: 2

RE: well and good
by Liquidator on Thu 31st Jul 2008 06:36 UTC in reply to "well and good"
Liquidator Member since:
2007-03-04

I don't see the problem... Microsoft just has to implement into Windows a table that any software vendor could use to list an update URL. Then each time you get connected to the Internet, Windows checks each update URL that is listed in the table, and check for available updates from third-party vendors. No need to charge or to verify anything. Microsoft wouldn't have to support third-party apps, if it's a standardised framework, any vendor could add an update entry. It's not less secure than what we have now. Currently, if you have a virus, it doesn't need such a system to download further remote malicious code.

Reply Score: 6

a marginal benefit.
by troc on Wed 30th Jul 2008 23:35 UTC
troc
Member since:
2006-05-01

Updates are a fringe benefit. I think what the article should really be getting at are the benefits of open, standardized, not-for-profit and peer reviewed software and their associated management and distribution systems.

Updates in this context are but an pleasant side effect. Wake up and smell the coffee.

Reply Score: 2

Crazy Idea
by JPowers27 on Wed 30th Jul 2008 23:38 UTC
JPowers27
Member since:
2008-07-30

Use the same method as Eclipse. During installation each program would register itself with the Update Program. Then when Update Program was run, it would go out to each site and check for updates.

This isn't a very hard way to do things. It would leave the user with only having to run/schedule a single update program. MS wouldn't need to cache all the updates nor would the programs have to by certified.

The list of update locations could also be managed via an utility to allow the user to see where updates are being pulled from.

This is also the same way some Linux distributions work.

Reply Score: 6

This was done before..
by DrillSgt on Thu 31st Jul 2008 00:18 UTC
DrillSgt
Member since:
2005-12-02

and it worked great. There was a program called Cybermedia Oil Change that I used with Windows 95. I think MS bought the company maybe and turned it into Windows Update? Either way, the product was discontinued, and it handled all of this nicely, meaning Windows Updates, installed software updates, etc. It even handled updates from Creative and such for hardware drivers. I was pissed when it was discontinued. It came out in 1996 I believe, or close to it.

Reply Score: 5

I think Apple is testing this...
by optimusg4 on Thu 31st Jul 2008 00:27 UTC
optimusg4
Member since:
2005-07-06

...in a way. In Leopard, they've opened up SU to printer vendors to deliver driver updates through that. Of course, that's for the basic print functionality; it doesn't help much for those with AIO machines.

Reply Score: 1

BITS
by Square on Thu 31st Jul 2008 03:22 UTC
Square
Member since:
2005-10-01

Background Intelligent Transfer Service
http://en.wikipedia.org/wiki/Background_Intelligent_Transfer_Servic...

windows update uses it I belive

As far as I know any software can use it to provide auto-update. Ive seen a few MMOs give the option to use it to keep the client updated without having to start it

Its not as clean as using the windows update GUI (as you have to use the program you want to update to adjust BITSs settings), but the tools are there without having to have a specialized update tool for managing auto-updates

Reply Score: 2

RE: BITS
by ba1l on Thu 31st Jul 2008 11:48 UTC in reply to "BITS"
ba1l Member since:
2007-09-08

BITS is a download system - nothing more. All it gets you is the ability to download files.

The issue here isn't that it's hard to download updates. It isn't. There are a hundred HTTP or FTP client libraries you could use to do that. It's that there's no central update mechanism, like the repositories approach used in most Linux systems.

Yes, you can write your own updater system, possibly using BITS to actually do the downloading. That still leaves you writing your own updater system, which can't be managed using the same tools as Microsoft's, has to be installed separately, and has to triggered somehow (running in the background, for example).

That's what happens now, and why a typical Windows machine has half a dozen auto-update processes running at all times, and half the remaining programs have built-in auto-update mechanisms.

Why can't a third-party application just register some kind of update channel with Windows Update, give it a public key so it can verify that the updates come from you, and let it handle everything for you. Even better - system administrators could then use Microsoft's tools to distribute updates for all applications, not just Microsoft's.

Reply Score: 2

RE[2]: BITS
by lemur2 on Thu 31st Jul 2008 12:37 UTC in reply to "RE: BITS"
lemur2 Member since:
2007-02-17

Why can't a third-party application just register some kind of update channel with Windows Update, give it a public key so it can verify that the updates come from you, and let it handle everything for you. Even better - system administrators could then use Microsoft's tools to distribute updates for all applications, not just Microsoft's.


Basically Microsoft can't allow this because Windows Update is a backdoor.

Microsoft can't give third parties access to a backdoor mechanism to Windows ... that is just asking for trouble. It would easily become even more of a security headache than the loophole that Windows Update already is.

Reply Score: 3

Hell yeah!!
by WorknMan on Thu 31st Jul 2008 03:30 UTC
WorknMan
Member since:
2005-11-13

This has been my #1 requested feature for a long time ... see this post I made recently:

http://www.osnews.com/thread?322502

And while they're add it, they should display a big-ass UAC style dialog box with a skull and crossbones icon whenever an app tries to place itself in the startup group!

Reply Score: 2

AmiUpdate
by Jeddacarn on Thu 31st Jul 2008 04:12 UTC
Jeddacarn
Member since:
2006-09-10

It seems you mean something like AmiUpdate...

But personally I don't see a benefit in all this. When the user needs to upgrade they can go to the web site and download the updated software, what is wrong with that?

Reply Score: 1

RE: AmiUpdate
by jabbotts on Thu 31st Jul 2008 13:56 UTC in reply to "AmiUpdate"
jabbotts Member since:
2007-09-06

option 1
open Windows Update, Update all

Option 2
open Widnows Update, update Windows and Office
open Mcafee update, update AV
open zonealarm update, update firewall
update adobe
update firefox
update gpu driver from vendor site
update audio driver from vendor site
...
...
...
...

I wouldn't mind getting updates by Option 1 versus the current method in Option 2.

Reply Score: 4

RE: AmiUpdate
by mabhatter on Thu 31st Jul 2008 17:07 UTC in reply to "AmiUpdate"
mabhatter Member since:
2005-07-17

It seems you mean something like AmiUpdate...

But personally I don't see a benefit in all this. When the user needs to upgrade they can go to the web site and download the updated software, what is wrong with that?


So you open every piece of software and check the "update now" button? What about software that doesn't have an internal way to get updates? How would you know where to get it? Companies rearrange their download pages all the time. Most importantly, how would you know there EVEN IS an update!!! Do you have the web pages marked for EVERY SINGLE APP you have installed... do you check them often for security problems? ... will your Girlfriend or Grandmother do that?

I think there's varying degrees, from Microsoft hosting all the updates in Windows update directly, to building an apt-get style list of repositories anybody can add too. With Windows such a common target, Microsoft would obviously want to lock anything on their end down to only preferred versions (for them $$) and charge vendors for the space, like the hundred thousand dollar fees they charge for WHQL drivers.

A list of repositories would still get trashed when every spyware vendor put their stuff in there... and being able to MAKE spyware without user intervention is actually a FEATURE of Windows, not a bug... so any update service would be required to hide things to make Marketing happy... meaning it would be highly dangerous.

It would be nice to have a common interface, perhaps just add an "update now" button to the common developer templates and push people to fill it out? .. and keep it up on the developer's end!

Reply Score: 2

update service
by damp on Thu 31st Jul 2008 07:47 UTC
damp
Member since:
2006-03-19

Microsoft allready have this feature in someway. Microsoft sell System Center Essentials or its bigger family members- which have a WSUS intergratet, one can deploy msi or exe installeres through these. So microsoft has the knowhow they "only" have to come up with someway to administer this, and I think this is where the idea falls apart.

Reply Score: 3

The solution is clearly in sight...
by wazoox on Thu 31st Jul 2008 14:09 UTC
wazoox
Member since:
2005-07-14

updating programs on your computer - if you're not using a Linux distribution, that is - is a total and utter mess.

That's easy, then : just use GNU/Linux (like I and many other do).

Reply Score: 1

You're kidding, right?
by rockwell on Thu 31st Jul 2008 14:19 UTC
rockwell
Member since:
2005-09-13

Updates on Windows and OS X are a "total and utter mess"?

Let's see ... "Updates are ready for your computer" .. Click .. Click ... done, or maybe a restart.

Gee, that was hard.

Linux updates: There are 3,400 bugfixes and security patches available for your system. ... Click .. Click ... ERROR: Depency failure. Or, ... restart ... X won't startup.

For apps ... updates are few and far between on Mac and Windows, because the apps are written by pros, not the snot-nosed "community".

Yah. Windows and Mac have it all wrong.

Edited 2008-07-31 14:21 UTC

Reply Score: 1

RE: You're kidding, right?
by Thom_Holwerda on Thu 31st Jul 2008 16:26 UTC in reply to "You're kidding, right?"
Thom_Holwerda Member since:
2005-06-29

Let's see ... "Updates are ready for your computer" .. Click .. Click ... done, or maybe a restart.

Gee, that was hard.


Rinse, repeat for Firefox. Rinse, repeat for Java. Rinse, repeat Photoshop. Rinse, repeat Notepad++. Rinse, repeat Miranda. Rinse, repeat, etc. etc. etc. etc.

It's a total and utter mess. It has always been, and since all those OS developers and users are rusted stuck with 30 year old ideas about application delivery, it's not going to get better anytime soon.

Reply Score: 2

RE[2]: You're kidding, right?
by sbergman27 on Thu 31st Jul 2008 16:42 UTC in reply to "RE: You're kidding, right?"
sbergman27 Member since:
2005-07-24

Rinse, repeat for Firefox. Rinse, repeat for Java. Rinse, repeat Photoshop. Rinse, repeat Notepad++. Rinse, repeat Miranda. Rinse, repeat, etc. etc. etc. etc.

Hi Thom,

You assert that. But I do not find the evidence you present to be particularly convincing. Sometimes evolution is the right thing. Sometimes revolution is the right thing.

You want a revolution, I suspect.

Well, let's watch how well WebKit does against Gecko. WebKit is reasonably revolutionary. I happen to be a WebKit fan, and also a Gecko fan, and am watching this competition with great interest.

Take Care,
Steve

Edited 2008-07-31 16:49 UTC

Reply Score: 2

RE[3]: You're kidding, right?
by Beta on Thu 31st Jul 2008 17:37 UTC in reply to "RE[2]: You're kidding, right?"
Beta Member since:
2005-07-06

Well, let's watch how well WebKit does against Gecko. WebKit is reasonably revolutionary. I happen to be a WebKit fan, and also a Gecko fan, and am watching this competition with great interest.


What’s revolutionary about WebKit?
It has a minor advantage (thats evolution) of being simpler to update, but that promise isn’t always going to be there as it gets larger. And it has nothing like XUL which is the basis for Miro, Songbird, etc.

Gecko is powering the Web’s current evolution, no one else.
Nay-sayers, Opera is brilliant but has no market share to encourage anyone. Safari is much in the same boat, and only has a few % share due to iTunes software updates (and that minor blip in the phone space called iPhone)

Reply Score: 2

RE[4]: You're kidding, right?
by sbergman27 on Thu 31st Jul 2008 17:44 UTC in reply to "RE[3]: You're kidding, right?"
sbergman27 Member since:
2005-07-24

Gecko is powering the Web

Actually IE, for all its faults, is powering the web on the client side. Sorry to say it, but honesty compels.

In the FOSS arena, Gecko currently has more market share, but less technical finesse. Like I say, let's watch.

Edited 2008-07-31 17:46 UTC

Reply Score: 2

RE[5]: You're kidding, right?
by lemur2 on Fri 1st Aug 2008 03:41 UTC in reply to "RE[4]: You're kidding, right?"
lemur2 Member since:
2007-02-17

"Gecko is powering the Web
Actually IE, for all its faults, is powering the web on the client side. Sorry to say it, but honesty compels. In the FOSS arena, Gecko currently has more market share, but less technical finesse. Like I say, let's watch. "

IE 6 usage is in decline. The rate of uptake of Gecko-based browsers is higher than the rate of increase of IE 7.

According to W3Schools:

http://www.w3schools.com/browsers/browsers_stats.asp

IE 6 + IE 7 = almost static at about 54% of the total. IE 7 has only very recently taken over from IE 6.

Firefox is increasing and has hit 41%.

It is starting to get quite close now, and there is most decidedly no one browser "powering the web".

OTOH, if you wanted to pick out any one browser to "target" for your webpage (given that these browser all interpret the same HTML differently to each other) ... then Firefox is most decidely out in front as the browser to write for.

Sorry to say it, but honesty compels ...

Reply Score: 2

RE[6]: You're kidding, right?
by sbergman27 on Fri 1st Aug 2008 04:16 UTC in reply to "RE[5]: You're kidding, right?"
sbergman27 Member since:
2005-07-24

You are living in a fantasy world, Lemur2.

I wish I lived in it, too.

Quoting W3Schools numbers as being representative of general use is rather telling about your mindset, don't you think?

I'm a big FOSS fan. But we must rely upon truth, and not upon clever deception, to attain our goals.

Edited 2008-08-01 04:32 UTC

Reply Score: 2

RE[7]: You're kidding, right?
by lemur2 on Fri 1st Aug 2008 10:31 UTC in reply to "RE[6]: You're kidding, right?"
lemur2 Member since:
2007-02-17

You are living in a fantasy world, Lemur2.

I wish I lived in it, too.

Quoting W3Schools numbers as being representative of general use is rather telling about your mindset, don't you think?

I'm a big FOSS fan. But we must rely upon truth, and not upon clever deception, to attain our goals.


The numbers reported are indeed very variable, depending on the agenda of the party doing the reporting, but the trends are quite consistent:

Here is a low estimate:
http://www.tgdaily.com/content/view/38653/113/

W3 counter has a mid-range estimate firefox @ 29% and IE @ 60%
http://www.w3counter.com/globalstats.php

The numbers are all over the place, really:
http://en.wikipedia.org/wiki/Usage_share_of_web_browsers

All of these counters differ wildly in the reported usage rates, but they all agree (more or less) on the trends in the figures.

Of course the actual count of firefox use in the US is lower than anywhere else.

The US is quite a bit backwards in many respects, I suppose. In my country, firefox usage rate is perhaps double what it is reported to be in the US ...

...

... that is the world that I live in.

PS: Incidentally my own conclusions were: "IE 6 usage is in decline; The rate of uptake of Gecko-based browsers is higher than the rate of increase of IE 7; there is most decidedly no one browser "powering the web"; and if you wanted to pick out any one browser to "target" for your webpage then Firefox is most decidely out in front as the browser to write for."

Those are all supportable in light of the trends regardless of what actual figures you decide to use.

IE 6 is declining. IE 7 is behind firefox, and not increasing as fast. Do the maths based on the TRENDs in the face of woolly figures like these.

Edited 2008-08-01 10:44 UTC

Reply Score: 2

RE[2]: You're kidding, right?
by google_ninja on Thu 31st Jul 2008 16:54 UTC in reply to "RE: You're kidding, right?"
google_ninja Member since:
2006-02-05

The .net answer is what is called "1-click deployment".

Basically means you publish the application manifest on a site, which includes versions of all the assemblies. When the app runs, it hits up that site looking for any changes, if there are changes it syncs itself up with the latest version, only downloading the bits that are needed.

If you want to see it in action, check out scott hanselmans babysmash (the only public facing 1-click app i could think of) here http://www.hanselman.com/babysmash/download.htm

Reply Score: 2

RE: You're kidding, right?
by Soulbender on Fri 1st Aug 2008 11:09 UTC in reply to "You're kidding, right?"
Soulbender Member since:
2005-08-18

Let's see ... "Updates are ready for your computer" .. Click .. Click ... done, or maybe a restart.


Good thing you didn't have any 3rd party applications installed, eh?

Reply Score: 2

RE: You're kidding, right?
by Soulbender on Fri 1st Aug 2008 11:11 UTC in reply to "You're kidding, right?"
Soulbender Member since:
2005-08-18

For apps ... updates are few and far between on Mac and Windows, because the apps are written by pros, not the snot-nosed "community".


That's the funniest thing I've read all day. Pros. Hehehehe.

Reply Score: 2

Agreed
by motang on Thu 31st Jul 2008 15:03 UTC
motang
Member since:
2008-03-27

I can agree with the article, it is so much easier to keep my Ubuntu systems update to date as opposed to my Windows XP Pro system.

Reply Score: 3

Comment by moleskine
by moleskine on Thu 31st Jul 2008 15:08 UTC
moleskine
Member since:
2005-11-05

I'd imagine this idea - of centralizing software updates via the Microsoft OS update mechanism or similar - has been thought of countless times but rejected by software houses on commercial grounds.

There's no upside in it. An outfit like Adobe loses a measure of independence and hocks itself to Microsoft. In turn Microsoft get the blame if something goes wrong with third-party software and expose themselves horribly to a ton of bricks from regulators. The regulators would be worried about Microsoft using its monopoly to extort fees from and force methods on competitors by way of software upgrade processes on Microsoft servers.

So the present system may be crap but I'd guess most big Windows outfits have decided it is the least bad crap.

Yes, Linux is way ahead in this regard. All I have to do is aptitude safe-upgrade and the job is done. If there are serious unresolved bugs in the new software, I will be given the chance to cancel the upgrade process. The whole thing has worked like a charm for several years now on the distro I use. And despite other posts in this thread, no the result is not full of dependency conflicts. It just works, and what's more it works from servers I can trust not to be infected with malware or advertising rubbish.

Reply Score: 2

Are You MAD?
by hylas on Thu 31st Jul 2008 18:38 UTC
hylas
Member since:
2005-07-10

"Microsoft should open up Microsoft Update for everyone else ..."

Are you MAD? Microsoft Update?
Microsoft Update is a train wreck. God only knows what evil lurks there.
O-M-G! Think about what you are proposing dear man.

Off the top of my head I can think of several things much, much better, dependency-wise too.
Here, is a better solution, from some good folks.

AutoPatcher:

http://en.wikipedia.org/wiki/AutoPatcher

http://www.autopatcher.com/whatsautopatcher/

Reply Score: 2

RE: Are You MAD?
by Adurbe on Fri 1st Aug 2008 10:45 UTC in reply to "Are You MAD?"
Adurbe Member since:
2005-07-06

"Microsoft should open up Microsoft Update for everyone else ..."

Are you MAD? Microsoft Update?
Microsoft Update is a train wreck. God only knows what evil lurks there.
O-M-G! Think about what you are proposing dear man.

Off the top of my head I can think of several things much, much better, dependency-wise too.
Here, is a better solution, from some good folks.

AutoPatcher:

http://en.wikipedia.org/wiki/AutoPatcher

http://www.autopatcher.com/whatsautopatcher/


On the plus side it would speed up the migration away from windows ;)

Reply Score: 2

RE: Are You MAD?
by Soulbender on Fri 1st Aug 2008 10:58 UTC in reply to "Are You MAD?"
Soulbender Member since:
2005-08-18

Why should we trust the closed-source product from "some good folks" more than Windows Update?

Reply Score: 2