LOGGING ON - Patch as Patch Can Washington Post - By Rob Pegoraro Friday, October 1, 1999; Page E01

It's 9 p.m. on a weeknight and there's nothing good on TV: Time to turn on the computer I'm reviewing and see what it can do. For kicks, I click on that "Windows Update" button on the Windows 98 Start menu.

A few moments later, I'm looking at a list of files that Microsoft says this machine needs to function properly:

Outlook Express "File Attachment" Security Update (1103 KB/ Download Time: 7 min)

Internet Explorer "Window.External.Jscript" Security Update (479 KB/ Download Time: 3 min)

"Dotless IP Address" Security Update (371 KB/ Download Time: 2 min)

Internet Explorer "Frame Spoof" Security Fix (1801 KB/ Download Time: 12 min)

Microsoft virtual machine (4449 KB/ Download Time: 30 min)

Internet Explorer Information and Privacy Update (242 KB/ Download Time: 1 min)

Update to Internet Explorer Components (1820 KB/ Download Time: 12 min)

"Favorites" Security Update (120 KB/ Download Time: {lt} 1 mi)

Microsoft Libraries Update 2.0 (2130 KB/ Download Time: 14 min)

Windows 98 Year 2000 Update 2 (635 KB/ Download Time: 4 min)

Outlook Express Year 2000 Update (139 KB/ Download Time: {lt} 1 min)

One thought: !

Getting all these patches will make the computer more stable, more secure and more Y2K-compliant. But it will also take me almost an hour and a half to fetch them all, not counting time to install them and sit through what I suspect will be a half-dozen reboots. I take the prudent, common-sense course of action: Log off and watch a "Frasier" rerun instead.

What I did, I know, makes me a bad person in some circles: It's vaguely unethical not to keep your software up to date, sort of like not flossing every day. But look on any computer that's not professionally maintained by a help desk (and, I bet, many of the ones that are) and you'll probably see a crop of programs in need of patches, maintenance releases and bug fixes.

Microsoft's own statistics suggest the dimensions of the problem:

"Prior to Windows Update there would be, for example, approximately 70,000 downloads total of a particular technology update," a company spokeswoman said.

"With Windows Update, the download volume on average of a particular technology update jumped to one million for the first two weeks after the update was posted." And so that year 2000 bug fix listed above, for instance, has been downloaded 4.5 million times to date.

Not bad. But given that the installed base of Win 98 had topped 15 million by the end of last year and is projected to hit 49.8 million by the end of this year, according to market researchers IDC, that's not great either. On other platforms, the situation is probably worse.

Before it's going to get better, software developers need to look at what's wrong with the current state of affairs:

The user has to look for bug fixes. If you buy a car and something on it needs to be fixed, GM or Honda will send you a letter telling you to take the car to a dealer for free repairs. But if you buy a program and something on it requires repair, the developer will often tell you nothing. (And too many of the ones that do e-mail these announcements can't resist beaming along ads for their products, meaning that the get-this-patch-now e-mail gets lost amid the buy-this-now pitches.)

It does help that many applications include a "search for updates" command, but its effectiveness depends on the user finding it in the first place -- and few people will take the time to wander up and down all the available menu items.

Bug fixes are too hard to install. After you've found the right Web address, you still have to download the file, wait for the download to complete, figure out where the file went on your hard drive, possibly use a decompression utility on it, find the installer file, run the installer, then possibly reboot.

Bug fixes arrive too often. In the past year, for instance, Netscape released seven versions of its Communicator Web browser--4.07, 4.08, 4.5, 4.51, 4.6, 4.61 and, just Wednesday, 4.7. If there's another update coming next month, why bother with this month's?

"There's such a competitive pressure to release software before it's fully baked," said Eric Bowden, general manager of BugNet, a Lindon, Utah-based firm that tracks bugs and bug-fix updates. "Basically, the [version] 1.0 release is a beta program that people pay for."

It also doesn't help when the developer releases bug fixes that have bugs of their own, necessitating a bug-fix fix; it's equally unhelpful when the developer posts a patch on its Web site, then yanks it without explanation--as Intuit did twice with an updater for the Mac version of Quicken 98.

The best way to keep everyone's software up to date is to do the work for the customer. America Online figured this out years ago; its software automatically installs updates for you. There are security issues to address here--how do you ensure that the update your software has been instructed to download is the real thing and not a virus?--but eventually, something like this will be built into mainstream operating systems.

For instance, Apple's Mac OS 9, due this month, will include an auto-update feature to grab new system software. Likewise, the successor to Windows 98 will check for and fetch updates in the background; when everything's been downloaded, the user will just have to approve installing it.

In the meantime, at least you can get that Windows Update feature to tell you about important updates without your having to ask it first. All it takes is a little program called Critical Update Notifier--an update you'll have to download.

) Copyright 1999 The Washington Post Company

http://search.washingtonpost.com/wp-srv/WPlate/1999-10/01/073l-100199-idx.html

[For educational purposes]

-- Cheryl (Transplant@Oregon.com), October 03, 1999

Answers

Cheryl:

Cute article. P.C. maintenance is much like any other....washing windows for example. I actually met someone here in Texas with the dirtiest windows I'd ever seen. She said, "I COULD wash them, but they'd just get dirty again." It's much the same with P.C.'s (mainframes, vendor software, etc.) You COULD wait, but it's MUCH easier to clean a semi-dirty window than a FILTHY one, and you get to enjoy the correction before it needs to be done again.

-- Anita (notgiving@anymore.com), October 03, 1999.

Evidently, Bob did exactly what he said he did...shut the computer off and went and watched TV instead! If he had commenced downloading, he would have found that these upgrades "autoinstall" and only a few of them require a reboot. Maintaining your PC is as simple as falling down a flight of stairs. Requires virtually no effort at all. Of course, I am speaking of the Microsoft upgrades and not any of the others.

This is how news reporters handle the Y2K situation too. They really dig and do their homework!

The worst part, as I see it, is that before MS came up with this "Windows Update" scheme, you would go to their website and then go to the page dealing with a specific program, and download the patches. You could copy the file to a disk so that you had it for future use...like a major crash or something. Now, you can't do that because of the autoinstall. You can monitor the install using a utility program, or make a backup of the whole system after the patches have been installed, but I kinda liked the old way myself. You can't "uninstall" them either.

-- Don Wegner (donfmwyo@earthlink.net), October 03, 1999.

I ran into exactly this same situation as noted in the beginning post. I found that Microsoft offers a CD with a lot of these fixes on it, but not all of them. It's sort of free, but you pay about $5.00 for the shipping and handling. When I first used their online download site I installed a couple of the fixes there but not all of them, due to the amount of time required. But, the Microsoft download took over my Task Scheduler software and now comes up with a reminder every day that I can't turn off. Before, I could disable the Task Scheduler, but not any more. I can stop it each time I boot up, but next reboot, there it is again. What a pain. Microsoft is *very* insistent that I do these updates, and bugs me every day, darn it all.

-- Gordon (gpconnolly@aol.com), October 03, 1999.