microsoft has watched people in the past NEVER update their operating system for whatever reason. too much of a pain, "no need", can't deal with the outage caused by a reboot, whatever.
microsoft has also been blamed quite voraciously for "insecure" operating systems allowing worms to spread, when patched systems don't even get infected.
so, because MS is damned if they do, and damned if they don't, Microsoft has chosen to "do" and keep people patched up.
oh the horror.
the culture of blaming Microsoft for things that you or your installed applications do is the cause for this attitude Microsoft has about users not knowing what's good for themselves. THEY DON'T KNOW WHATS BEST; Not when it comes to security. We as users have demonstrated this over and over again.
So MS err on the side of caution, and essentially force updates.
and, yes, Microsoft change things, for reason(s) that you are not aware of, because either a new feature requires a change in a supporting subsystem, or because they believe they've discovered a better way to do something, or through extensive user testing they have discovered a better UI paradigm. or maybe just because they want to.
look, things are NEVER going to remain the same from year to year. your "the good old days" were someone else's "this new stuff sucks so much, why did they change it, it was fine" and that will be true so long as humans use things others create.
sometimes the decisions Microsoft makes are good. sometimes they are bad. yes, the correct decision FOR YOU is crystal clear FOR YOU, but guess what? other people exist, and what's best for them is something else.
so the majority get better representation. positively and negatively. I hate many decisions Microsoft has made, and I recognize that there is no way to please everyone. It is amazing to me how many people do not understand this.
(in this entire comment, I am using the royal "you" and I am not talking about any specific individual.)
do you really believe that they AREN'T working on this? of course they are. the field of software development is extraordinarily young. we still don't know how to do things very well, and we're still discovering new ways to know we aren't doing things well.
> Linux and BSD machines manage it.
it's a matter of target value, and the number of people who would be inconvenienced enough to pay a random to unlock their files on Linux is FAR smaller than for Windows. So attackers go where the money is. Governments overwhelmingly use Windows as a desktop OS as well. Attackers go where the secrets are. etc.
And when you count remote exploits capable of remote code execution, last I read there had been slightly more of those on Linux than Windows. don't quote me on that until I find a source.
> Remote 0-days don't come by that often.
yes they do. not all of them get media attention, though. the most recent monthly patch from MS for Windows 10 included fixes for six of them. All were actively being exploited. SIX.
But does hijacking of servers create that kind of publicity? Sometimes companies have to admit that they have been hacked because of data leak. But do they publicly admit for every breach? Is it in private companies interest to go public with that kind of information? And if they do, does it reach non-technical newspapers?
There was a good thread about Linux kernel security today, a slideshow and video. TLDR; many unsafe practices because of C, bad project management to track bugs, triage bugs, correctly applying patches, correctly map patches with CVEs