Newsletter Archives

• Should all BIOS be updated?

  Posted on February 27, 2025 at 03:00 CST by Susan Bradley • Comment in the Forums

  This is a follow-up to my Patch Watch column on Monday. Should you update all computer systems and search out a new BIOS? In a word: No.

  If you are running Windows 10 on an older computer that will not support Windows 11 or you do not plan to upgrade to Windows 11, and your computer is running just fine, I see no reason to upgrade the BIOS.  My advice to seek out and upgrade your BIOS is only for those running Windows 11 23H2 who will be looking to go to 24H2 or are already there.

  Updating your BIOS isn’t quite as scary as it used to be, but when you have a functional system that you do not plan on upgrading, I don’t see a reason to. Do you?

  Windows Patches/Security Patch Lady Posts, Windows 10, Windows 11, Windows 11 24H2, Windows patches

• Wanted: Your views on Windows/Office patching

  Posted on June 22, 2020 at 01:05 CDT by Tracey Capen • Comment in the Forums

  ON SECURITY

  By Susan Bradley

  Recently, it occurred to me that it’s been two years since I posted my survey on consumer- and business-systems updating.

  Given the changes in Windows and Office, a new audit of updating perceptions is clearly overdue. This time around, you’ll find links for two surveys: one for consumer-PC patchers and another directed at businesses.

  Read the full story in AskWoody Plus Newsletter 17.24.0 (2020-06-22).

  On Security AskWoody Plus Newsletter, Patching experience survey, Windows patches

• Google Project Zero: 90-day disclosure is working, with 97.5% of reported vulns being fixed within 90 days

  Posted on August 2, 2019 at 10:12 CDT by woody • Comment in the Forums

  The details are a little more complicated, but not much. Google’s Project Zero has turned up 1,434 security vulnerabilities in the past four and a half years:

  Of these, 1224 were fixed within 90 days, and a further 174 issues were fixed within the 14-day grace period [granted when it looks like the manufacturer is going to release a patch shortly]. That leaves 36 vulnerabilities that were disclosed without a patch being available to users, or in other words 97.5% of our issues are fixed under deadline.

  Realize that Google has a vested interest in saying that their disclosure policy is good for all of us — debatable, but I strongly agree — and they come to the conclusion:

  If most bugs are fixed in a reasonable timeframe (i.e. less than 90 days), then we are only enforcing the deadline on a very small number of unfixed cases. And if disclosing a handful of unfixed vulnerabilities doesn’t substantially help attackers in the short-term, but does lead to the demonstrated long term benefits of shortened patch timelines and more frequent patching cycles, then it would follow that a deadline based disclosure policy is good for user security overall.

  Interesting report. Thank to Catalin Cimpanu, who has additional observations on ZDNet.

  Windows Patches/Security Project Zero, Vulnerability, Windows patches

• MS re-re-..release (again) of KB 2952664 and KB 2976978

  Posted on June 6, 2017 at 16:09 CDT by PKCano • Comment in the Forums

  We’re seeing a recurrence of the two snooping patches KB2952664 for Win7 and KB2976978 for Win8.1. The last time they showed up, was on March 7th, but now they’re back……

  MS re-re-..release of KB2952664 and KB2976978

  Microsoft describes them as a “Compatibility update for keeping Windows up-to-date.”

  This update performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program. The diagnostics evaluate the compatibility status of the Windows ecosystem, and help Microsoft to ensure application and device compatibility for all updates to Windows. There is no GWX or upgrade functionality contained in this update.

  They are appearing as unchecked Optional now, which means they won’t be installed unless you check the corresponding box in Windows Update.
  Their status may change next week to Recommended and, for some, they may show up as checked Important on Patch Tuesday.

  Windows Patches/Security KB 2952664, KB 2976978, snooping, telemetry, Windows patches

• Microsoft releases 13 Optional Windows patches

  Posted on May 20, 2015 at 07:12 CDT by woody • Comment in the Forums

  There’s an obscure Azure-related fix KB 3040272. If anybody can shed light on Microsoft’s explanation, I’d appreciate it!

  InfoWorld Tech Watch

  Windows Patches/Security Windows patches