The SANS Internet Storm Center remarks on the challenges of fixing Java vulnerabilities, since Sun’s installer only checks once a month by default—based on when you installed it, not on a standard schedule.

Well, it’s worse than that. My Windows 2000 box at work was easy. I just went into Control Panel, opened the Java Plugin, and told it to update. At home, on our Windows XP box, I had to go through multiple reboots just to get the installer started.

It wasn’t XP that was the problem, though: It was Norton Internet Security. First it disabled all network access from Firefox when I installed the new version. Then it blocked access to the Java updater, so whenever I clicked on “Install” it would just disappear instead of launching the installer. I resolved it (for now) by disabling Norton while I did the install…but I had to reboot in order to get as far as the first step again.

It occurred to me today that if you lay out the three major players in computer operating systems and the three major players in web browsers, the results track remarkably well.

  • Windows and Internet Explorer. The dominant player. Obtained that position by being good enough, cheap enough, and promoted enough to win a protracted two-way battle. Detractors claim the victory was primarily due to marketing and business practices, not quality. Plagued by a public perception of insecurity. Currently trying to maintain that lead against an opponent unlike any they’ve faced before. Believes itself to be technically superior to the other options.
  • Linux and Firefox. Open source product with a core team and hundreds of volunteer contributors. Originally created as a replacement for a previous major player. Very extensible. Promoted as a more secure alternative, but has faced growing pains with its own security problems. Highly regarded among many computer power users, beginning to gain mainstream acceptance and challenging the dominant player. Believes itself to be technically superior to the other options.
  • Mac OS and Opera. Has been there since the beginning. Constantly innovating, pioneering ideas that get wider exposure when their competitors adopt them. Very dedicated fan base that never seems to grow enough to challenge the dominant player. Has been declared doomed time and time again, but keeps going strong. Believes itself to be technically superior to the other options.

It breaks down, of course. Traditional UNIX is missing from the OS wars, though it provides a nice analogy to Netscape for Firefox. The battle lines don’t quite track either, since the previous wars were Windows vs. Mac and IE vs. Netscape. And Safari’s missing entirely. But it’s interesting to see the same three roles in play.

Just a day after Firefox decided to jump from 1.1 to 1.5 (triggering far more discussion than the numbering change really deserved), Microsoft has announced the official name for Longhorn: Windows Vista.

Okaaay. Yeah, I can see the connection: a vista is something you see through a window. But at that point, why not just go for broke and call it Ventanas or something?

Yeah, no one wants to use numbers anymore. It’s kind of like in the mid-1990s when it was taboo to tack a number onto the title of a movie sequel. As if having a 7 on Star Trek: Generations or a 4 on Alien: Resurrection would have scared off more viewers than the movies themselves.

Meanwhile, we’re left with yet another version name that does nothing to help you keep track of which version is newer. XP? 2003? Vista? MX? CS? Tiger, Leopard and Jaguar?

The internet is a hostile place. Viruses, worms, and worse are constantly trying to break or break into your computer. Software developers are constantly fixing the holes that can let them in. It’s become critical to keep your system up to date. Unfortunately this can be very frustrating, even for a power user, for one simple reason: you have to keep track of each program individually.

Sure, the operating systems have their own centralized places. Microsoft has Windows Update, and Apple has Software Update. But every application that exposes itself to the network directly or opens untrusted files has to be updated, and there are many that aren’t part of the operating system.

So Symantec has Live Update. Real Player has its own updater. iTunes and QuickTime for Windows can update themselves. Adobe Reader has an update function. Firefox is redesigning its update system. Games check for updates when they connect to the network.

But wouldn’t it be nice if Windows would grab the Acrobat updates overnight, instead of waiting until the next time you launched it? Wouldn’t you like to be able to patch everything on your system at once and just not worry about it? As a software developer, wouldn’t you like to be able to let someone else deal with the update problem instead of re-inventing the wheel yet again?
Continue reading

We finally replaced our 4-year-old Windows Me computer with a new Dell (I’d had enough of building computers a few weeks ago) and it arrived yesterday. Katie had already asked me to upgrade her Mac while she made pizza for an office party. I had planned to finish installing Tiger first, but once you get past a couple of options and the EULA it’s all a matter of waiting for it to finish.

There’s something oddly exhilarating about simultaneously setting up both a Mac and a PC.

Of course I spent the next few hours registering the pre-installed software and updating everything. Run Windows Update. Reboot. Run LiveUpdate for Norton Internet Security. Reboot. Run Office Update (twice). It’s nice that Dell will pre-install stuff for you, but given that the computer is built to order, you’d think they could apply the updates before shipping.

With today’s hostile internet, it would greatly benefit not just new computer owners but the world at large if Microsoft (and Apple and Red Hat, while we’re at it) would take a cue from SuSE and Mandrake and tie their update systems into the setup process.

To Microsoft’s credit, Windows XP setup gives you a chance to turn on automatic updates, and recommends it to the point of “Well, if you really want to turn it off, you can, but you’ll be sorry!” And I’m reasonably certain Windows Firewall was turned on by default (i.e. it’s on now, and I don’t remember turning it on), though Norton supersedes a lot of its functionality. Depending on the default firewall rules, that should mitigate the impact of any worms that happen to pick your IP address before you run Windows Update.

Correction: It seems Windows Firewall wasn’t on as I thought. Norton Personal Firewall kept asking me whether I wanted to disable redundant rules (makes sense) or disable Windows Firewall entirely (I told it no—twice), so I assumed it was running. I hope it was only off because Norton was pre-installed.

Microsoft’s automatic update system is now offering an update to the Windows Installer. That’s the program that handles all those .msi files you use to install new applications, keeps track of what’s currently installed, and lets you uninstall them.

And it needs to reboot after installing?

WHY? What low-level system file did they have to change? There is a Windows Installer service, but it’s not running, and even if it were, they should just be able to restart the service. Why do I have to reboot the entire #@!$ computer because I agreed to install an update to something that isn’t running? Is the design so broken it can’t update itself?

I’ve never had to reboot a Linux box after upgrading RPM, Yum, or Apt (the equivalent software on many Linux systems). Never, in the seven years I’ve been using Linux.

And you know, it would have been nice to know that this update would require a restart before I decided, “what the heck, it doesn’t look like anything that’ll require me to restart, I might as well grab it now.” Telling me that some updates may require a restart is like labeling a box of cookies “Processed in the same state as a peanut farm.” It’s useless. It gets ignored. Kind of like this rant probably will.

Update 1: I’d love to make this change to the dialog box:

No, it’s not F*ing OK but you’re going to make me restart anyway!
Mouldypunk (link dead)

Update 2 (years later): “OK I guess” would have at least been amusing. And thank you sooooo much, Gnome Software, for bringing this behavior to Linux. There’s a reason I still use the command line to install updates.