Re: Windows Update / Office Update again!

From: Geoff Vass (geoff_at_CADZOW.COM.AU)
Date: 09/28/04

  • Next message: Jim Garrison: "WindowsUpdate V5 on XPSP1 broken" 
    Date:         Tue, 28 Sep 2004 07:36:48 +0930
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    The fact that Office won't install patches without the original media or the source files has, of course, been around since Office 2000.

    This behaviour originates from the design of Windows Installer, and was so badly botched in the case of Office 2000 that Microsoft Australia were given to replacing Office 2000 disks with Office 2000 SR-1 disks because it become impossible to patch certain versions of Office 2000 RTM.

    Of course now we know Microsoft themselves consider this Windows Installer behaviour to be a huge failure because Office 2003 will offer to cache the setup files! So presumably the Office team haven't been able to request any design changes of the Windows Installer team so they've given up and worked around it.

    But the need to cache 500Mb of setup files just so you can update half-a-dozen files in the future is a pretty lame scheme and the fact that such a rigmarole is required to do this is an immense ***-up, IMHO.

    Fortunately Office has not been the attack surface for as many serious exploits as the number of patches would suggest, so Microsoft has not needed to make any serious changes to this architecture. Perhaps we need a really serious outbreak to force some changes and make it simpler to keep Office updated, cf. where the Slammer worm forced a reworking of the SQL Server patch installer. Seriously, it should be possible to update Office with a flat directory of updated binaries and a batch file. MS need to stop dreaming up reasons why things are impossible. It's only software -- you can do anything with it you want!

    It's funny that in the case of .NET and now SQL Server 2005 Express they make a big fuss over so-called XCOPY deployment in recognition of the fact that dropping updated files without a complicated local registration process is a much better way to get something done. Yet you can't drop an updated WINWORD.EXE in the Office directory.

    Geoff Vass

    -----Original Message-----
    From: Windows NTBugtraq Mailing List
    [mailto:NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM]On Behalf Of Fish
    Sent: Saturday, 18 September 2004 11:52
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    Subject: Windows Update / Office Update again!

    -----
    NTBugtraq Editor's Note:

    Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
    -----

  • Next message: Jim Garrison: "WindowsUpdate V5 on XPSP1 broken"