News for hackers. Stuff that matters.

A comment on The way Microsoft patched a recent bug raised some eyebrows.

Re:The way Microsoft patched a recent bug raised some eyebrows by userbinator on Tuesday November 21, 2017 @01:52AM (#15746175)
Contrary to the tone of the article, I wish more of the small and very-likely-security-related patches would come in the form of "actual patches" like this --- and also distributed as actual diffs instead of whole-file-replacements, since this greatly improves the user experience; those of you who have experienced Windows Update taking tens of minutes to download and apply updates may be disappointed and irritated to realise that even if the actual changes are tiny, as in this case, applying the update involves downloading the entire file again. If there are 10 updates which affect a total of 5 KB in a 20MB file, for each one that's installed, you end up redownloading the whole thing, or 200MB of bandwidth used (wasted) to make 5KB of changes. It's not even smart enough to jump to and download just the latest version of all the selected updates.

Another advantage of the small and localised changes, besides rapid and efficient application (and reversion), is the ability to do it to all in-memory copies of the file in addition to the one on disk, eliminating the need to reboot.

A company like Microsoft that has solid and complex software development and security practices in place would never deem manually binary editing as acceptable.

Perhaps what we need is better tooling to make this process easier, and I guess in general a more "bidirectional" view of binaries vs. source --- small changes in source should correspond to proportionally small changes in binaries, and also proportionally small updates for end-users.

The current "binaries are sacred and shall only be the outputs of long and complex build processes" attitude is neither efficient nor optimal from the perspective of the end-user experience, or even developers sometimes --- for example, changing a one-letter typo in a string constant and testing the change should not involve hours of compilation, deployment, and installation, but be closer to the minutes it would take to do it in a hex editor.

I posted more on this topic recently: https://news.ycombinator.com/item?id=15729874

[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by hvidgaard on Tuesday November 21, 2017 @02:21AM (#15746284)
Apart from the downloading time, which varies depending on the connection - the vast majority of time during a windows update is spend calculating exactly what to update. Sitting on a 1gbps connection with a state of the art SSD, and it still takes a long time to update.
[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by cbhl on Tuesday November 21, 2017 @03:10AM (#15746475)
That trade-off is likely intentional -- Microsoft is pushing work onto your computer to save their datacenter bandwidth.
[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by tallanvor on Tuesday November 21, 2017 @03:55AM (#15746665)
More likely because Microsoft knows that a lot of computers don't have that much free space, so only sending you what you need means using less of your disk space. Also, users often have data caps, so keeping the amount of downloaded small helps them there as well.
[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by hvidgaard on Tuesday November 21, 2017 @04:59AM (#15746878)
No, it's not about a trade off. The system needs to figure out what to update, and if it is safe to do. There was an article from MS some time ago on the topic. Most of it has to do with shared dlls I believe, but the details are a bit hazy.
[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by gt640k on Tuesday November 21, 2017 @02:02AM (#15746217)
Do patches as binary diffs get us most of the way there?
[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by Dehstil on Tuesday November 21, 2017 @04:44AM (#15746829)
They can, but you need the right tooling to make sure small changes don't dramatically change your binaries.

https://dev.chromium.org/developers/design-documents/softwar...

[ Parent | on HN ]
Re:The way Microsoft patched a recent bug raised some eyebrows by userbinator on Tuesday November 21, 2017 @02:17AM (#15746267)
I don't think so. Compilers may change the output binary drastically, due to optimisations and other things, despite the source changes being small and localised. I'd argue that such behaviour, while desirable when creating a new binary, is counterproductive when trying to make a "minimal diff" of an existing one to fix something and not make other unnecessary changes at the same time.

There's also this to consider: https://blog.regehr.org/archives/294

[ Parent | on HN ]