Hacker News Reader

Comment by ImaCake | Hacker News Reader

Sometimes those computers are running critical medical equipment that fails on the latest update. There are good reasons not to update. Try and have a little bit of an open mind so that you are not being dumb.

View on HN

A friend of mine had been contracted to record a webcast with a few fairly important and wealthy businessmen. The company that contracted him provided him with some equipment, they set up some slides to appear in the background, and then their Windows 10 laptop suddenly rebooted on my friend.

They delayed the webcast for about two hours, hoping it would come back, but the laptop didn't finish in that time so they just had to go without. "Funny" thing is that it was his reputation that took the hit, not Microsoft's nor the contracting company's.

Exactly. Windows 10 automatic updates have a history of bricking machines to endless bootloops. I've had it happen eg. with broken microcode updates.

Not to mention mundane stuff like broken display drivers that render machines unusable and so on.

It's insane not to disable automatic updates on Windows if you run critical systems.

The only "dumb" thing I can think of is critical medical equipment being on a network that can hit Windows Update. It is on people Windows for production tasks that may be jeopardized by updates to responsibly handle themselves. I practice what I preach: my video encoder rig lives on a network that explicitly drops connections to Windows Update--but the machine is also firewalled away from the internet at large and only visits trusted websites as part of production tasks. Neither half of this responsibility is tenable without the other.

I am expressly not saying that "forcing" Windows 10 updates on users is a good idea--but I'm sympathetic, and I'm not saying it's not--but if you are running something like "critical medical equipment", it should already be incumbent upon you to be doing it right.

Microsoft already provide a completely different version of Windows 10 that can be used for critical systems - https://docs.microsoft.com/en-us/windows/deployment/update/w... These systems would almost certainly not be downloading Windows Updates directly over the internet.

Or you can just simply block outbound traffic by default and allow what you actually need.

No more forced updates. No more telemetry.

Windows telemetry will by-pass the Windows firewall. You need to run a dedicated firewall box (that is not running Windows)

This is incorrect.

I've run packet analysis to confirm that the built-in firewall blocks, among other things, telemetry - what is your source for this?

How do you analyze decrypted data !? Or did you manage to block all outgoing windows data !? It was all over the news a year or two ago. All sources seem to be gone now though.

There is simply no traffic on the wire other than what you actually allow. The telemetry doesn't bypass Windows firewall.

Please stop spreading misinformation.

Some windows domains are white-listed and will bypass both firewall and hosts file unless you block all HTTPS traffic.

https://superuser.com/questions/1207878/does-windows-firewal...

As I stated before, setting the outbound policy to drop all traffic will work.

You then allow whatever you need for your trusted executables (not svchost.exe).

Computers running critical medical equipment possibly shouldn't be attached to the internet, in which case they'll never see these updates.

Yeah, I encounter this closed-minded opinion all the time... some of us just can’t live with a ‘might not work on Tuesday’ computer. I’ve purchased over 200 laptops with Windows 7 downgrade this year. I throw the windows 10 discs right in the trash. I imagine I am not alone.

For critical equipment, there's "lots of things that are not Windows" (1. too many moving parts is not a good thing, as demonstrated, 2. an office OS is not a good fit for such equipment anyway); if you insist on this particular kind of pain, there's Windows Embedded. (Yes, it costs extra, but ought to be more resilient and shouldn't suffer from the tribulations inflicted upon consumer versions; of course, the "ought" is still at MS's discretion)

Reply on news.ycombinator.com