The patching conundrum: When is good enough good enough?

As Günter Born recently reported at Born’s Tech and Windows World, KB4592438 has a bug that triggers a blue screen of death when you run the chkdsk c: /f command, leaving the hardware unable to boot. Several others confirmed the issue independently in the various venues and forums. Still others graciously decided to risk their systems and install the update and when they ran the command had zero issues. I tested it myself and also didn’t see a blue screen of death.

So, what is a patcher to do?  Install an update that might cause issues? Or don’t install updates and risk attacks?

It’s a conundrum that points to the problem with patches: they aren’t always perfect. In fact, most of the time patches are not perfect. But they’re good enough for the majority of those that install patches.

In this specific case, there is also conflicting information that the chkdsk command should not be used on SSD drives in general. While I love the speed benefits from SSD drives, I make sure I have a full image of the hard drive for any key machine I might need to put back into production quickly. I literally have experienced an abrupt SSD hard drive failure and had to quickly swap in a new drive and restore the machine from backup. It is also why I keep a spare supply of SSD hard drives for emergencies. SSD drives can and do suddenly stop working. Plan accordingly.

When you see issues with patches reported online, unless the update problems are widespread and damaging to systems, Microsoft typically does not block or remove patches. If you have opted into Microsoft telemetry, each time an update successfully installs and your system reboots, Microsoft receives that information and knows the system survived the experience. 

Over the years, Microsoft has made it harder for users to block telemetry. Recently, it even started flagging the use of hosts files as a security issue if you attempt to use them to block telemetry. This process of reporting issues with updates is one reason that I encourage enabling telemetry. I want Microsoft to know about the pain it’s caused with updates. In fact, many years ago, Microsoft EU put together a funny video called “We feel your pain” about its supposed feedback program. (In the spoof video, feedback buttons allow you to give direct physical pain to the exact developer who coded the part of the program that gave you pain.)

Copyright © 2020 IDG Communications, Inc.

Source link

Read More