And by settings you mean undocumented registry entries that people found and altered to break core services on purpose? If you start altering undocumented things there's no real assurances that it will work the same way (or state maintained) during an update.

> Microsoft still didn't document what data they are exfiltrating

Basic diagnostic data: https://docs.microsoft.com/en-us/windows/configuration/basic...

Full diagnostic data: https://docs.microsoft.com/en-us/windows/configuration/windo...

> silent updates, that you cannot control them or disable them

You get plenty of control over updates including how "silent" they are, you just cannot disable them entirely.

But is limiting the ability to disable them for the greater good? We still have huge Windows XP botnets running rampant on the internet because people would completely disable updates, get infected, and then start causing harm to their neighbors.

I've read quite a few people that want to disable Windows Update, but they never provide a plan or route for receiving security updates. They just simply opt to run an insecure machine because an update annoyed them one time, and that would be fine if it didn't impact others.

Windows 10 doesn't seem to respect the user as much as previous releases.

* People who would seek to disable updates on their computer.

* People who would take negative views on those who refuse to vaccinate their children.

I'm in both camps, at least where Windows is involved. I'm much more willing to update the average Linux or BSD (including macOS) because I still actually trust those updates.

Reset settings: there was something like that, that's true, but the last time it happened, it was like a year ago, and I do think this is a case of "don't attribute malice to something that can by caused by a mistake".

Didn't still document: Half a month ago they put the windows diagnostic data viewer into windows, you can look up all telemetry that's getting sent back home.

Reset settings: still happens. The worse thing is, that firewall rules for application packages have version numbers in them, so when you change the rule, and the package updates... you rule is ineffective. And no, Bing doesn't to know, what I'm searching local start menu for.

Didn't still document: so you know what "cV" or "iKey" values mean? Still, where's the "off" option? Mozilla doesn't get the telemetry from me, and there is an universe of difference, how trustworthy Mozilla is compared to Microsoft.

1. Those people then are saying how bad and full of viruses Windows it's, even if it's only their fault. It's good for technically not-inclined users. And MS is only loosing here, as well as those users.

2. This is how you get botnets, which then take your worldwide DNS down. But yeah, it's only up to these people. Why would I care about botnets DDoS'ing half the net? And why would I care that companies are handling my sensitive personal data on insecure computers? Yeah, no worries. It should only be up to them...

That's a good argument for making security updates on-by-default. It's not a good argument for making all updates on-whether-you-like-it-or-not.

This is how you get botnets, which then take your worldwide DNS down.

The solution to botnets is to cut offending devices off the Internet at the ISP level. You can't trust local security measures in this context anyway.

And why would I care that companies are handling my sensitive personal data on insecure computers?

You're complaining about the security of sensitive personal data, in a discussion about an OS that can literally deploy arbitrary updates and upload arbitrary information to a third party for use in unknown ways? Your concerns about your privacy are fair, but I think you're on the wrong side of the debate here.

Have you heard of Group Policy and WSUS? I guess its Enterprise versions only, but anyone who cares deeply about their IT Infrastructure should be running Windows Server and all those services.

https://docs.microsoft.com/en-us/windows/deployment/update/w...

That's not a popular opinion among the subset of users who refuse to apply patches, but it's the correct one from the perspective of security and public policy.

There are plenty of ways around it: maintain your own patching infrastructure and you can do whatever you want. Use Linux and you can do whatever you want. But it's an absolutely correct decision to push patches onto the unwashed masses even if it upsets them.

We would be better off as a society if vaccinations were mandatory too, but we also have some vocal idiots there too.

And does that include all the non-security patches that change things around in ways maybe I don't want?

Or immediately installing security patches even if they're broken and compromise normal functioning of the system?

I don't see even a moral/ethical argument for mandating those kinds of updates.

Now, is anybody actually going to enforce that? No, of course not. But on the principle of the thing, you are being negligent, and justifying it to yourself on the basis that you're too smart to get a virus. The anti-vaxxer parallel is extremely relevant here, if everybody thinks like that then we have a problem.

Speaking in generals, it's absolutely a correct decision to have automatic/mandatory patching, whichever way you want to look at it. As for specific patches: sure, on a case-by-case basis there may be bad patches that need to be rolled back. You can do that on Windows, and again, you always retain the option to simply not connect your PC to the internet and it makes both of us happy - I don't have to deal with another zombie box on the internet and you don't have to deal with a patch you don't like.

At the end of the day you're just going to have to trust Microsoft to put out good patches. But if you don't trust them, why are you running their operating system? Do you have similar concerns about upstreams in the Linux community? You know patches can break things there too, right?

I don't see any evidence that giving someone who knows what they're doing the ability to control which updates they deploy and when will cause them to become part of a botnet. Are you suggesting that Windows 10 Enterprise should be similarly constrained for the same reason?

And even if systems do become part of a botnet, the correct solution to that problem is to cut off the offending systems at ISP level anyway, not to rely on their own local security in any particular respect.

But on the principle of the thing, you are being negligent

Objecting to a system that requires automated deployment of arbitrary updates, including updates that may upload arbitrary data, is not only not negligent, it may be positively required for regulatory compliance depending on your circumstances.

The anti-vaxxer parallel is extremely relevant here, if everybody thinks like that then we have a problem.

No it isn't, and this naive and superficial analogy really needs to die.

At the end of the day you're just going to have to trust Microsoft to put out good patches.

Microsoft have proved, beyond any reasonable doubt, that such trust is unjustified. Try again.

But if you don't trust them, why are you running their operating system?

Because the Microsoft of a few years ago that produced Windows 7 is a very different Microsoft to today's that produced Windows 10.

Do you have similar concerns about upstreams in the Linux community? You know patches can break things there too, right?

And yet in many years of running many systems for multiple organisations, the total downtime I have experienced due to Debian unattended security updates is 0, and the number of reports I have ever read of others suffering a bad update through that channel is also 0.

Its not like the "Enterprise" version of Win10 is much more expensive. It gets way more expensive if you want to run a Windows Domain server, but that starts to leave the realm of SOHO users.

This is interesting! Can you expand? Where or how can one still upgrade to 10 now? AFAIK even the free upgrade extension for those using assistive technologies has been withdrawn.