If you ever wondered why techs don't update right away....

[Leslieann]

Things like this are why techs hate automatic/forced updates.
We tend to take a wait and see approach or simply skip them entirely, because you need time to properly evaluate them, especially these days since MS certainly is not doing it the right way (virtual machines instead of real machines).

"Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure"
https://tech.slashdot.org/story/18/03/28/2010240/microsofts-windows-7-meltdown-fixes-from-january-and-february-made-pcs-more-insecure


Don't forget, they also just found another bug in Intel's latest chips called "Branchscope", so even if you buy a new one to avoid Specter and Meltdown, you may be getting something less secure, or some new vulnerability.
https://segmentnext.com/2018/03/28/intel-chips-face-new-threat-branchscope/


I'm not saying don't update anything ever, I'm just saying if you are waiting for the next patch to fix things or the next processor to have a fix, don't. While updates are not a bad, often those patches (especially rushed ones) create more problems than they fix, and many of the vulnerabilities are often easily plugged by not being an idiot, and running some sort of anti-malware. Those get patched and are updated far more often than Windows, not only are they more nimble, but their business model revolves around stomping out problems as often and quickly as possible, as opposed to Microsoft who decides if something is worth patching (because $$$$) or to shelve it and hope no one notices (which is why win10 is vulnerable to some of the same things as XP was). 

As for hardware, I have always found and stated that it's better to buy what you can, when you can, otherwise you will be perpetually waiting on the next thing coming down the line.

There is always threats and vulnerabilities, known and unknown, buying the latest and greatest just means more unknown, that applies to software and hardware. Don't let them rule your life.

[tp4tissue]

I'm going to turn off internet before i go to sleep...

[davkol]

Meanwhile, Willy Tarreau:

Most consumers don't realize the risks they're taking by *buying products running on outdated kernels.* Most people don't care, some find it convenient as it allows them to download some applications to "root" their devices by exploiting some unfixed bugs (which then basically become the only bugs the vendors care to fix when they do). Others are just used to reboot their home router in the basement once in a while because it just hangs every 3 weeks for no apparent reason (_but it's a cheap one, surely it's expected_). And of course everyone believes the vendors when they claim that they still backport important fixes into their kernels. This is wrong at best and in fact almost always a lie in practice.

[…]

It's unknown how many exploitable vulnerabilities are present in these kernels, however it's *certain that all of them are at least locally exploitable,* allowing for example a browser plugin to inject malware code into the system and *take full control* of the device to steal data or participate to internet attacks. And if you don't care about security issues, just think about some of these bugs that I have encountered on various devices running outdated kernels, some of which disappeared after I managed to rebase and rebuild the kernel […]

[Leslieann]

The problem I have with many guys talking about this stuff is it's often one sided and often only from their perspective, like the comment about backporting fixes or old kernels and such, here's why this is a problem...  Update your 2 year old Android... Go ahead, I'll wait... Oh, wait, you can't. Unless you rooted it and installed a custom rom.

Let's try the other perspective...
Try and disable a problematic update for Win10. Got it? Cool. Tomorrow MS will re-issue that update and you get to start over again. I hope you took notes.


Food for thought...
Why is it your computer gives you root access by default, but your cell phone needs to be hacked in order to have the same control?
Which is less secure, Android Froyo which is several years old without root or Android Oreo which is relatively recent, but with root?

The answer to both, are actually related.

[davkol]

Why is it your computer gives you root access by default, but your cell phone needs to be hacked in order to have the same control?

It's not like Microsoft hasn't tried… Remember the early days of Secure Boot?

That's a part of the war on universal computing.

[Blaise170]

Security is really just an illusion in most instances anyways. No matter how well you try to protect yourself, there will always be some entity spying on you or some malicious code that hasn't been discovered in the wild yet. Even if you are the hyper paranoid type and using Tails+Tor, there is still some flaw that could be exploited when found. The only way to be 100% secure is to not use technology in the first place.

[davkol]

Security is really just an illusion in most instances anyways. No matter how well you try to protect yourself, there will always be some entity spying on you or some malicious code that hasn't been discovered in the wild yet. Even if you are the hyper paranoid type and using Tails+Tor, there is still some flaw that could be exploited when found. The only way to be 100% secure is to not use technology in the first place.

Recommended reading: A Taxonomy of Privacy by Daniel J. Solove

[MajorKoos]

Walk into any banking IT department and this is standard operating procedure.  People having meetings to discuss who's going to be on the team which evaluates whether it's worth doing a PoC to determine whether they're going to test the patch.

[ThoughtArtist]

I'm going to turn off internet before i go to sleep...

That's actually more logical than leaving a wide open net connection on all night for no reason at all.

Simply "hanging up" the net connection like in the old days with dial-up modems could at least lessen the exposure to potential hacks.

I'm sure national intelligence agencies would rather you not do that "for your own safety" though.

[Findecanor]

I'm sure NSA loves Connected Standby ...

[tp4tissue]

I'm sure NSA loves Connected Standby ...

No mouse activity..

Time for sn00p mode !!

[Altis]

Not just automatic/forced/arm-twist updates, but permanent ones that you're stuck with forever are brutal.

And not just for security reasons, but major bugs or feature changes that people don't like. iOS is like this... once you update, the device can never be reverted back. If it's chalk-full of bugs and horrible UI/UX changes, then that's just too bad. Oh, and if it stills the device down to the point where it's unusable and needs to be replaced -- that's a real shame, isn't it.

[Blaise170]

There's a reason I'll never buy an iPhone for myself. Sure I can save blobs after jailbreaking but there's only so much you can do to the phones to customize them. The first thing I did after buying my OnePlus 5t was replace recovery with TWRP, install custom OS, and root it. I want control over my device.

[SBJ]

There's a reason I'll never buy an iPhone for myself. Sure I can save blobs after jailbreaking but there's only so much you can do to the phones to customize them. The first thing I did after buying my OnePlus 5t was replace recovery with TWRP, install custom OS, and root it. I want control over my device.

I am by no means a fanatic for either system.
Both have their advantages and flaws in MY opinion.
I do have the itch to root a phone and customize it the way I want though. So I've been leaning towards the Sony XZ2.

[Leslieann]

Before you buy a phone, research the heck out of it on XDA forums if you plan on doing anything to it.

Let's use the Galaxy S4 as an example
When released the AT&T model had a locked sim card but unlocked bootloader, unfortunately the first (or second) OTA  update locked the bootloader. Those first unlocked ones fetch a serious premium if you can find one that has not been updated. A locked bootloader means even if you root it, you may not be able to install another rom. At best you can use a modified stock rom. While rom builders are getting good at working around the limitation, it's still a limitation. Locked sim means you cannot port out without authorization.

Here is how carriers stack up, at least with Samsung phones as they are the worst. They will work with carriers and lock it down how they wish, other manufacturers may or may not.
AT&T - locked sim and boot loader
Verizon - locked bootloader, unlcoked sim
Sprint - HAHAHA* TL/DR run away.
T-mobile fully unlocked.
You pay a premium for the T-mobile and unlocked because they are unlocked.

Other brands and models have variations, this is the norm for Samsung though. Samsung are also extremely easy to brick and they are extremely unforgiving. LG often plays games with partitioning which can be a nightmare to root, but they are very forgiving when you screw up. HTC is very forgiving if you mess up and, at least they used to, offer an easy way to root. I have no experience with Sony. Beware OnePlus, they do some shady things, they started out well but have gone downhill.

As for Iphone vs Android
Iphone screen to body ratio is/was pathetic, I also hate IOS and how locked down it is, BUT, at least they do proper updates on a regular basis. Android is nice and open, but updates are a hassle unless you root and rom, and even then it's not easy and Google is a bastard about Gapps and spying.  I run Android with a custom rom and very limited Google background systems with as much firewalled as I can.


* Sprint not only locks both, but removes the unlock menu in software, this way they can legally tell you it cannot be unlocked and transfer carriers. They planned for this and was doing those to their phones for a bit before the new FTC law, which they helped write, creating this exemption in the process. They were also placing locks on high end models until 2 years of use (a blacklist), and then after the FCC rule change they placed a hold on them insisting even if the phone was paid off that you couldn't port out with the phone until you used it for a full year on Sprint. When I bought my S4 it was free, a month later they placed an ETF hold on it, saying I needed to use it for a year on Sprint contract. I was considering using Sprint prepaid with it, which I had used for 14 years prior but instead I bought a Verizon mainboard (which was compatible) and ported out. I have not looked back and refuse to do anything with that company.

[SBJ]

Before you buy a phone, research the heck out of it on XDA forums if you plan on doing anything to it.

Yeah that's the plan. The phone is just starting to hit the streets and I'm not upgrading phone until sometime in Q4 this year. So that'll leave plenty of time to see what I can get away with.

[Blaise170]

OnePlus has definitely done some shady things with OxygenOS which is exactly why I removed it. The main issue with updates on Android is fragmentation, manufacturers like Samsung don't want to keep pushing out updates to old hardware because then you won't buy their latest devices. I will never buy another Samsung product after the nightmare that is my Galaxy S4 Active, considering that even after rooting I still can't do much with it since AT&T not only had an exclusive contract for the Active, but also made sure to lock the bootloader. The fact that I can't even factory reset without manually restoring a bunch of stuff is awful. I blame manufacturer's 100% on almost every issue I've ever encountered on Android. Sure Google doesn't have a spotless record, but I trust them with my data far more than a lot of other companies.

[katushkin]

In the last 6 months we've had two forced Win 10 architecture updates **** our domain controllers at work. Somehow they managed to stop the devices using network time and they used their own CMOS time, which was for whatever reason an hour behind. This then synced across all domain controllers, putting everyone's systems behind an hour, but still in the same TZ, so other applications refused connections basically breaking everything.

TL;DR, forced updates have ground our business to a halt twice in the last 6 months.

[tp4tissue]

In the last 6 months we've had two forced Win 10 architecture updates **** our domain controllers at work. Somehow they managed to stop the devices using network time and they used their own CMOS time, which was for whatever reason an hour behind. This then synced across all domain controllers, putting everyone's systems behind an hour, but still in the same TZ, so other applications refused connections basically breaking everything.

TL;DR, forced updates have ground our business to a halt twice in the last 6 months.

Pretty normal.. Happens in database software all the time.. backup failed.. applications hang.. everyone blames everyone else.. 50 phone calls to India.. 2 weeks minimum..

[Leslieann]

2 weeks for the businesses I work for means you're fired, especially if you caused it.

[katushkin]

Two days for a priority 1 incident is the point that you lose your job as a third party support contractor. If you can't fix something in two weeks then you shouldn't be supporting it in the first place.

[Altis]

In the last 6 months we've had two forced Win 10 architecture updates **** our domain controllers at work. Somehow they managed to stop the devices using network time and they used their own CMOS time, which was for whatever reason an hour behind. This then synced across all domain controllers, putting everyone's systems behind an hour, but still in the same TZ, so other applications refused connections basically breaking everything.

TL;DR, forced updates have ground our business to a halt twice in the last 6 months.

That's nuts.

Forced/permanent updates are such an awful idea, but tech companies know they only need to convince the masses to go along with it, who largely don't know any better.

[katushkin]

Well our infrastructure guys said they had stopped auto reboots on all our important servers, and our updates are meant to be pushed out via group policy, but there you go.

[tp4tissue]

Two days for a priority 1 incident is the point that you lose your job as a third party support contractor. If you can't fix something in two weeks then you shouldn't be supporting it in the first place.

Most things get fixed in 2 days..

But we get the 2 weeks thing at least once/twice a year..

And we're still on contract with the same indian crew 6 years running ever since oracle went india.

[MajorKoos]

Well our infrastructure guys said they had stopped auto reboots on all our important servers, and our updates are meant to be pushed out via group policy, but there you go.

Updates are not typically pushed via GPO.
Rather, one uses a GPO to configure windows to update from somewhere like WSUS or SCOM in place of windows update.
If that GPO rolls back for some reason windows will revert to default, i.e. windows update + auto install.
Sounds like that's what happened to the DCs - someone screwed up the GPOs which  rolled back the windows update settings.

1) How did they break GPOs twice (which would have prevented both incidents)?
2) Why do those super important servers have internet access enabled (which would have prevented both incidents)?
3) Why didn't they fix the BIOS time after the first incident (which would have at least prevented the second incident)?