Carolyn Napier and Tyler Robinson (MSI team) - Installing apps in Windows Vista

This was nice and interesting, but I still miss one thing from MSI, that seems extremly critical: auto updating. Here is the problem: Almost any software package that interacts with the internet will need to deploy security patches automatically to users. As far as I can tell, MSI really doesn't help you with that at all, while it really should. Essentially, as a software developer, you have two options right now: 1. Within your normal app check regularily whether an update is available and if yes, apply the patch, or 2. write a little background service/program that checks whether a new version is available even while your program is not running. 1 is not ideal, since your software might not run all the time and you might end deploying the securtiy patch too late. Soo, 2 is the way to go. A lot of software packages to it that way today. And the end result is that my system is packed with a lot of programs/services, that start at boot time, that do nothing but check whether an update is available. As far as I can tell this is minimally the case for Java, QuickTime, Realplayer, Logitech Camerasoftware and a couple more which I forgot. This is dreadful! They take memory, they take processor cycles, they might have bugs. But, I can't even blame the developers for doing it that way, since it is really the ony possibility today. The right solution to this should probably look like this:

Within any MSI file provide the ability to specify an URL where patches will be posted by the ISV. Then, let the Microsoft Update engine check these locations for all installed MSI files regularily, like it checks for updates of Office etc. Just integrate third party updates into the Automatic Update feature of Windows, but ONLY requiring extra info in the original MSI file to take advantage of this feature. You would really do the whole Windows platform a great service, since a ton of these super annoying background processes could go away.

ZippyV wrote:

I think possibility number 1 is the way to go now: only check for updates when application is active.

The problem is that there is a class of apps where this is too risky. I fully understand that Realplayer, Java, Quicktime and thelike can't to it that way. If someone just very rarely watches videos in his browser that instantiate the player there is just a way to high likelyhood that he/she will hit some content that has malware against which the patch hasn't been applied at this first viewing.

Also, while there is another class of apps where option 1 would be nice, it seems that a whole lot of ISVs still opt for 2. I as the user pay the price by having countless services wasting my resources. The real solution here is to have a platform service that takes care of this.

There is another twist to this. But first, a disclaimer: If argue under the assumption that MS won't have something like this AutoUpdate for third party MSI packages in Vista. If I am wrong, please disregard.

Wasn't there talk that security would ALWAYS trump nice features in Vista? So, I assume MS at some point had to figure out whether to do AutoUpdate (I operate under the further assumption that they came up with that idea in the first place internally) or integration with restart manager. Hell, how could you decide for restart manager and against AutoUpdate in that case?!? Sure, if you mean by "We improve security only in our code", yes. But if you take the postion that security is an industry problem and once you realise that NOT having auto update for MSI in the platform will lead to significant worse security than having it in, this seems to be a no brainer to me. Am I wrong?

I just feel that having a seperate auto update feature for every app on the system is error prone and will decrease security. Just the sheer number of different configurations will completly confuse users, so that when in doubt they will just shut it off. Also, at some point I just HAD to disable some auto update services on an old machine since they took so much system resources that I was hardly able to use it for anything meaningful anymore.