|
Yes, that makes a lot of sense. But how do you know when it is 'safe' to install whatever updates are pending for a particular server? Do you have a 'sacrificial goat' to install them on first, or if not, how _do_ you do it?
|
|
|
|
|
Oh, that's easy. I have a virtual machine that I use as the 'sacrificial goat'. At some point during the week before maintenance I'll set up the 'Update Shrine', pray to the Gods of Redmond, turn around counter-clockwise 0010 times, then sacrafice the VM Goat. If the update is a service pack then I find a help desk technician to sacrafice prior to the Goat.
Oh yeah...on a completely unrelated subject...anyone looking for a job as a help desk tech...Vista's SP is due out soon 
|
|
|
|
|
Tee hee 
|
|
|
|
|
Paul Sanders (AlpineSoft) wrote: Make sure you have Windows Update turned on...
I so completely disagree on this.
You should update regularly sure, but you should do it manually.
Often automatic updates install stuff that is not yet supported for your product. Small eg.: IE7.
V.
I found a living worth working for, but haven't found work worth living for.
|
|
|
|
|
Hi,
I agree with you, actually. I have my computer set up to download them automatically but to install them manually. Then, if it all goes pear shaped, at least I know why.
|
|
|
|
|
I have Windows Update notify me that there are updates ready for download. Then I manually download overnight (so as not to tie up resources when I'm working), then finally do a manual install of only thoses I find necessary. That's for my laptop. The CSR desktops are all identical, so I check them about once a week or whenever I see a major round of releases on my laptop. The boss's PC is his to manage (I actually have a technologically savvy boss, a rarity I know).
For Servers, I use Rackspace Managed Hosting and they thoroughly test all updates before hand applying them to my servers. After all, I'm one of two IT guys in our company and we have enough development and other infrastructure work to do. It does mean, however, that we may be a little behind on some updates (still don't have the latest SQL Server 2K5 SP2 on our SQL servers yet).
I hear what everyone is saying about Windows Update. I have an older laptop at home that runs and Athlon XP processor with a VIA chipset. One of the XP service packs made ALL my USB devices stop because it didn't support the VIA chipsets USB 2.0 drivers and VIA didn't have a fix other than to rollback the "upgrade."
|
|
|
|
|
This is all very interesting (and I mean that), but I think I would still advise the 'ordinary' user (if there is such a thing) to install all updates offerred by M$. Better a (temporarily, hopefully) dead machine than giving away your bank account details to some script kiddie. But I respect the views of others in this forum, especially support professionals, who know what they're doing and have a different agenda.
This is probably going to get me flamed I know, but I think M$ are doing a difficult job reasonably well, as far as Windows Update is concerned. Windows is a prime target for hackers, so any tiny loophole is going to be exploited by someone, somewhere. OK, so they screw up occasionally, but given the size of their installed base and the technical naivety of (most of) their users, I think they're doing pretty well.
And some things I don't like about M$? Well, Vista for a start - too big, too slow and not particularly stable or compatible. And why-oh-why don't they supply Windows installation CD's with new PC's anymore? To save money, that's why (as if they needed to...). On the laptop I bought recently, I had to hack around in the partition table to get my missing 20GB back, soaked up by a (to me) useless 'recovery partition'. Ridiculous!
|
|
|
|
|
I use zone alarm and AVG.
AVG is excellent, free, fast and "just works"
Zone alarm is slow, buggy and irritating, but it seems to be the best there is for Windows... unfortunately, the apps on my PC dial home without my permission so I need it
|
|
|
|
|
Pardon me for asking, but why do you use both? I just use ZA and the anti-virus side of it seems fine to me. I do value the ZA popups - what is all this "Internet Explorer is trying to act as a server" all about, for example. No thanks. As for speed, I think that ZA is a memory hog, rather then being slow, but YMMV I guess.
|
|
|
|
|
I gave up on Zone Alarm when their renewal process acted up. I declined to renew, since I was about to switch from Win2K to XP. I was originally intending to buy a new version of ZA after the switch.
After the expiration, Zone Alarm curiously kept issuing false alarm reports. It also forgot settings repeatedly. At one point, it was popping up a couple of times an hour about applications I had already granted access through the firewall.
Frankly, the behavior stank of an attempt to panic me into buying the renewal.
Software Zen: delete this;
|
|
|
|
|
I've been using Zone Alarm (free version) for years. It's never given me any grief that I didn't ask it to (blocking something I shouldn't have, for example). Easily remedied. Maybe the lesson is to only use the free fire-wall aspects?
Like Paul, I value the popups. Besides giving one control, they're rather enlightening as to who's applications are trying to reach out and touch someone.
One could surmise that the reason the market supports various applications that perform the same functionality, rather than one or two best versions, is that both system configurations and user tastes make all of them bad actors at one point or another.
"The difference between genius and stupidity is that genius has its limits." - Albert Einstein
|
|
|
|
|
Kerio was also giving a Personal FireWall for free sometime back. Isn't it?
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
I use a DSL firewall combined with the standard XP/Vista firewall. According to the security experts in my company this is OK. The advantage is that the Mircosoft firewall never bother yo with questions. The disadvantage is that ones someone is inside you computer it does not protect you any more. our experst say that most virussses and trjojans will dsturb you protection anyway once they arein.
Rudolf Heijink
|
|
|
|
|
The XP firewall made itself too annoying to use. It seemed to be making decisions for me (especially for MS products) - and without any easy access to change things. I suppose I could have studied how to use it, but for some reason, I no longer trusted it.
Compared this to ZoneAlarm, which has easy access to a list of all apps that have gotten its attention and the option of checkboxes for essentially always, ask me, and never for access. Very easy to fix a mistake.
Very easy to create addresses, or ranges of network addresses, to allow access to your system.
Microsoft's firewall not bothering you with questions should bother you!
As for the company expert opinions on how a firewall doesn't help once a virus gets in to your system - to a large extent, that's true about any of the protections you may have in your system. It also means either the security applications (or you) failed in keeping the system secure.
"The difference between genius and stupidity is that genius has its limits." - Albert Einstein
|
|
|
|
|
AVG is too annoying, I prefer Avast.
|
|
|
|
|
I've found for technically aware people that keeping your system up to date with OS and app. patches and then using common sense (check your sources, don't install that codec from the porn site etc.) works well. The last time a computer of mine was infected was when I installed Windows XP (without SP 2) and connected to the net. 30 minutes later, while waiting for SP2 to download, my computer was a petri dish.
regards,
Paul Watson
Ireland & South Africa
Andy Brummer wrote: Watson's law:
As an online discussion of cars grows longer, the probability of a comparison involving the Bugatti Veyron approaches one.
|
|
|
|
|
I agree, there should be an option up there for Common Sense.
Also, an option for Keep Patches up-to Date would be good.
Anti-Virus programs are for dumb computer users who don't know how to look after their computers properly (no Common Sense) 
|
|
|
|
|
|
Although not strictly applicable to your situation, downloading to a new system, I always disable my network connection during (for example) a ZoneAlarm upgrade, since it must shut itself down for the update. This, of course, means downloading the update and not installing directly from their server - this latter practice being one I follow for all downloads.
"The difference between genius and stupidity is that genius has its limits." - Albert Einstein
|
|
|
|
|
If you disable networking how does ZoneAlarm get the update?
regards,
Paul Watson
Ireland & South Africa
Andy Brummer wrote: Watson's law:
As an online discussion of cars grows longer, the probability of a comparison involving the Bugatti Veyron approaches one.
|
|
|
|
|
1) Download update
2) Disable Network
3) Install Update
4) Start ZA
5) Reconnect to network.
"The difference between genius and stupidity is that genius has its limits." - Albert Einstein
|
|
|
|
|
Ah right.
Yeah, different to my situation.
regards,
Paul Watson
Ireland & South Africa
Andy Brummer wrote: Watson's law:
As an online discussion of cars grows longer, the probability of a comparison involving the Bugatti Veyron approaches one.
|
|
|
|
|
With the benifit of 20/20 hindsight, you can follow a similar pattern if you downloaded SP2 before you built the system - which you no doubt already figured out.
I tend to think that way from the get-go, having gone through the agony (from DOS days) of needing to install a CDROM driver when my copy of it was on a CDROM. The one on the install-floppy was the generic version and wouldn't work with the installed hardware. It took hours to get it all worked out - and afterwards I alway try to have all available software on-hand from the get-go.
Another lesson it tought me was be more cautious about helping friends with their PC problems. Stories about that, alone, would make a great thread. I think I should have told people I worked as a shoemaker.
Balboos
"No Good Deed Goes Unpunished."
|
|
|
|
|
Balboos wrote: With the benifit of 20/20 hindsight, you can follow a similar pattern if you downloaded SP2 before you built the system - which you no doubt already figured out.
I didn't have a secured box to download SP2 from. I had to:
1. Install Windows XP, network enabled
2. Download SP2
3. Burn SP2 to CD
4. Reinstall Windows XP, network disabled
5. Install SP2 from CD
6. Enable network
7. Switch to Mac OS X 
regards,
Paul Watson
Ireland & South Africa
Andy Brummer wrote: Watson's law:
As an online discussion of cars grows longer, the probability of a comparison involving the Bugatti Veyron approaches one.
|
|
|
|
|
Paul Watson wrote: The last time a computer of mine was infected was when I installed Windows XP (without SP 2) and connected to the net. 30 minutes later, while waiting for SP2 to download, my computer was a petri dish.
I did that once when I was reimaging my laptop (this was in SP1 days) to see how long it took before the system was toasted...8 seconds. 
If that's not a compelling illustration of why firewalls are needed, I don't know what is. 
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
. 
. As a result, our network was crawling with junk. ![Rose | [Rose]](https://www.codeproject.com/script/Forums/Images/rose.gif)
