Windows 10 patches – will you get them no matter what?

Ever since the Windows 10 Insider Preview came out, people have been speculating about how Windows Update will work in the new release.

We’ve known for a while that Microsoft is moving away from the “once a month, here’s a tranche of patches” approach that it famously introduced back in 2003.

Patch Tuesday, as it was known for years, quietly became Update Tuesday.

Microsoft’s “advance notification” bulletin, in which the number and nature of (but no detail about) forthcoming patches (ahem, updates) were announced the week before each Update Tuesday, quietly vanished.

And just last week, Sophos Security Chet Chat presenter Chester Wisniewski and I discussed these very developments [at time 6’39”]:

CW: This week was Update Tuesday, and I’m not going to talk about the fixes; I’m just going to say, “Go get them.” And for future Chet Chats, unless there’s something significant that has a reason to call out a particular patch – because of super-high risk, or a big change to the operating environment – I don’t know that there’s really much point in spending eight minutes talking about a SQL privilege escalation bug.

PD: I’ll second that. And, of course, Microsoft is, understandably, trying to soften us all up, ready for the Windows 10 “rolling update” model. […] Why wait a month when you can wait 24 hours?

CW: Exactly! Ask a given user what version of Chrome they have on their desktop, and you’ll be able to answer that question for yourself.

(Audio player above not working? Download MP3 or listen on Soundcloud.)

The blogosphere has been pondering these issues, too, with the consensus being that the entry-level version won’t allow you to delay or defer updates at all.

If you want to be the master of your own destiny in respect of Windows patches, bloggers have been saying, you’ll need the Pro or Enterprise versions instead.

This inference seems mainly to have been based on wording quoted from the official Windows 10 Specifications page:

Windows 10 Home users will have updates from Windows Update automatically available. Windows 10 Pro and Windows 10 Enterprise users will have the ability to defer updates.

Intriguingly, the Specifications page doesn’t include those words any more, because it now says simply:

Windows 10 Home users will have updates from Windows Update automatically available.

That’s listed under Feature deprecation – wording that adds more confusion, because “deprecation” means “still there, but available for use only with disapproval.”

It certainly looks as though Windows 10 updates are automatic-only in the official Windows 10 Insider Preview, as you will see if you search for automatic updates in the Technical Preview (version 9926) and the Insider version (10074):

So!

If Home users will be getting updates no matter what, and if this is, at least in part, a way of shaking out problems for Pro and corporate users (who will, after all, be paying more), is that a bad thing?

To be honest, we’d prefer a world with choice, so our gut reaction is, “Yes, it’s bad.”

But we’d also prefer a world where the majority of computer systems are not days, weeks, months or even years behind fixing holes that crooks already know how to exploit.

So our hearts are saying, “No, it’s not a bad thing.”

As Chester observed in the podcast, when asked, “Why wait a month when you can wait 24 hours,” we already have complex products like Google’s Chrome browser that update without asking, and without even asking if you want to be asked, and the wheels haven’t come off.

Let’s just hope, as we hoped in the podcast, that Windows 10 Pro and corporate users will be willing to take updates sooner rather than later, too.

By all means stage your updates so that you don’t swamp your network or your helpdesk with requests.

But let’s make a collective pledge never to get stuck in the Windows XP situation ever again, where we’re so far behind that we’ve created for ourselves a brand new excuse not to move forward.

Why wait seven years – or, for that matter, a month – when you can wait 24 hours?