On Oct. 25, 2001, Microsoft pulled out all the stops in launching Windows XP in New York City. The following day, it was announced that around 20MB of patches and updates for Windows XP Professional (around 12MB for the Home Edition) were already available for download directly from Microsoft. While these patches are important for XP users, the way in which Microsoft prefers to deliver them -- using Windows Update -- has dubious value for IT departments.
It is quite easy to download and install these patches using the Windows Update service; however, it is cumbersome and challenging to locate, download, and then install the XP patches on an individual basis. While you may think I am nitpicking, the difference between the former and the latter approach is the difference between a push and a pull update. I'm going to show you what's in the XP update, and then I'm going to tell you why you should opt for the pull rather than the push method of applying it.
What's covered by the update?
If you have new PCs with XP installed or have already installed or ordered the OS upgrade for some of your machines, this update is not something to ignore. Although some of the downloads are probably not applicable to businesses -- for instance, Windows Movie Maker requires a 3.2MB download to run properly -- other pieces of the update have important security implications. The most important download is a 1.9MB patch needed to fix a security hole in Internet Explorer 6. There is also a 5.2MB download that fixes a vulnerability in Microsoft Virtual Machine. Other problems addressed by the downloads include incompatibilities with some UPS units, an upgrade to the CD-R utilities, a 2.2MB download to improve third-party software compatibility, and several other downloads that are probably necessary for most businesses running XP. Automatic updates may spell trouble
Over the past few months, there has been a lot of talk about Windows XP's Product Activation feature, which forces users to lock each XP copy to specific hardware (unless you purchase a corporate volume license). However, with XP, Microsoft is advancing an older but potentially more onerous technology even harder: Windows Update. For business networks, Windows Update means a change from pull to push technology for systems updates and patches. This poses a major threat to both corporate security and to system stability and usability. With Windows Update, Microsoft gives users the option of having their OS automatically find, accept, and install patches and updates downloaded from the Microsoft Windows Update Web site. With Windows XP, this feature is intertwined with the OS even further than in past versions of Windows. In fact, it's much more difficult and cumbersome to find and download the needed patches for XP mentioned above than it is to use the Windows Update feature. But in my opinion, relying on Windows Update is a very bad idea. Can any security specialist or IT manager concerned with simplifying system maintenance really trust Microsoft to make automatic patches to their systems? If you have any doubts, just recall that the recent Microsoft bulletin MS01-052 was only the latest example of a Microsoft patch where the cure turned out to be worse than the illness. Reasons not to use Windows Update
I can think of four very good reasons why you don't want to choose the Windows Update option:
In a previous column, I took security personnel to task for failing to patch their servers even after several rounds of attacks by the Code Red worm. Nevertheless, automated push patching from Microsoft is definitely not the answer to this problem, even though many managers who don't think through all the implications may jump to adopt this technology -- and not just with Windows XP. See the Windows XP Resource Centre for the latest news on Microsoft's new operating system. Have your say instantly, and see what others have said. Click on the TalkBack button and go to the Microsoft forum. Let the editors know what you think in the Mailroom. And read other letters.