LOGGING ON - Patch as Patch Can
Washington Post - By Rob Pegoraro
Friday, October 1, 1999; Page E01
It's 9 p.m. on a weeknight and there's nothing good on
TV: Time to turn on the computer I'm reviewing and see
what it can do. For kicks, I click on that "Windows
Update" button on the Windows 98 Start menu.
A few moments later, I'm looking at a list of files that
Microsoft says this machine needs to function properly:
Outlook Express "File Attachment" Security Update
(1103 KB/ Download Time: 7 min)
Internet Explorer "Window.External.Jscript" Security
Update (479 KB/ Download Time: 3 min)
"Dotless IP Address" Security Update (371 KB/
Download Time: 2 min)
Internet Explorer "Frame Spoof" Security Fix (1801 KB/
Download Time: 12 min)
Microsoft virtual machine (4449 KB/ Download Time:
30 min)
Internet Explorer Information and Privacy Update (242
KB/ Download Time: 1 min)
Update to Internet Explorer Components (1820 KB/
Download Time: 12 min)
"Favorites" Security Update (120 KB/ Download Time:
{lt} 1 mi)
Microsoft Libraries Update 2.0 (2130 KB/ Download
Time: 14 min)
Windows 98 Year 2000 Update 2 (635 KB/ Download
Time: 4 min)
Outlook Express Year 2000 Update (139 KB/ Download
Time: {lt} 1 min)
One thought: !
Getting all these patches will make the computer more
stable, more secure and more Y2K-compliant. But it will
also take me almost an hour and a half to fetch them all,
not counting time to install them and sit through what I
suspect will be a half-dozen reboots. I take the prudent,
common-sense course of action: Log off and watch a
"Frasier" rerun instead.
What I did, I know, makes me a bad person in some
circles: It's vaguely unethical not to keep your software
up to date, sort of like not flossing every day. But look
on any computer that's not professionally maintained by a
help desk (and, I bet, many of the ones that are) and
you'll probably see a crop of programs in need of
patches, maintenance releases and bug fixes.
Microsoft's own statistics suggest the dimensions of the
problem:
"Prior to Windows Update there would be, for example,
approximately 70,000 downloads total of a particular
technology update," a company spokeswoman said.
"With Windows Update, the download volume on
average of a particular technology update jumped to one
million for the first two weeks after the update was
posted." And so that year 2000 bug fix listed above, for
instance, has been downloaded 4.5 million times to date.
Not bad. But given that the installed base of Win 98 had
topped 15 million by the end of last year and is
projected to hit 49.8 million by the end of this year,
according to market researchers IDC, that's not great
either. On other platforms, the situation is probably
worse.
Before it's going to get better, software developers need
to look at what's wrong with the current state of affairs:
The user has to look for bug fixes. If you buy a car and
something on it needs to be fixed, GM or Honda will
send you a letter telling you to take the car to a dealer for
free repairs. But if you buy a program and something on
it requires repair, the developer will often tell you
nothing. (And too many of the ones that do e-mail these
announcements can't resist beaming along ads for their
products, meaning that the get-this-patch-now e-mail gets
lost amid the buy-this-now pitches.)
It does help that many applications include a "search for
updates" command, but its effectiveness depends on the
user finding it in the first place -- and few people will
take the time to wander up and down all the available
menu items.
Bug fixes are too hard to install. After you've found the
right Web address, you still have to download the file,
wait for the download to complete, figure out where the
file went on your hard drive, possibly use a
decompression utility on it, find the installer file, run the
installer, then possibly reboot.
Bug fixes arrive too often. In the past year, for instance,
Netscape released seven versions of its Communicator
Web browser--4.07, 4.08, 4.5, 4.51, 4.6, 4.61 and, just
Wednesday, 4.7. If there's another update coming next
month, why bother with this month's?
"There's such a competitive pressure to release software
before it's fully baked," said Eric Bowden, general
manager of BugNet, a Lindon, Utah-based firm that
tracks bugs and bug-fix updates. "Basically, the
[version] 1.0 release is a beta program that people pay
for."
It also doesn't help when the developer releases bug
fixes that have bugs of their own, necessitating a bug-fix
fix; it's equally unhelpful when the developer posts a
patch on its Web site, then yanks it without
explanation--as Intuit did twice with an updater for the
Mac version of Quicken 98.
The best way to keep everyone's software up to date is
to do the work for the customer. America Online figured
this out years ago; its software automatically installs
updates for you. There are security issues to address
here--how do you ensure that the update your software
has been instructed to download is the real thing and not
a virus?--but eventually, something like this will be built
into mainstream operating systems.
For instance, Apple's Mac OS 9, due this month, will
include an auto-update feature to grab new system
software. Likewise, the successor to Windows 98 will
check for and fetch updates in the background; when
everything's been downloaded, the user will just have to
approve installing it.
In the meantime, at least you can get that Windows
Update feature to tell you about important updates
without your having to ask it first. All it takes is a little
program called Critical Update Notifier--an update
you'll have to download.
¸ Copyright 1999 The Washington Post Company
search.washingtonpost.com
[For educational purposes] |
