Software and updates on Windows¶

Exercise software-and-updates-on-windows-annex.pdf · PDF

Your phone says Update available. You tap Later. Then Later again. What could possibly happen?

On a Friday in May 2017, hospitals in the United Kingdom sent patients home and a big Spanish company told its staff to switch off their computers. The cause was a hole in Windows that had been fixed two months earlier. The machines that got hit were simply the ones that had pressed Later. Today you learn how software arrives on Windows and how to keep three different systems up to date.

A Friday in May 2017¶

Ransomware is a program that locks your files and asks for money to unlock them.

Who was hit? Only the machines that had not installed a two-month-old update. Patched computers were not affected. Nobody had to be clever to be safe from WannaCry. They only had to be up to date.

Three kinds of update¶

Microsoft publishes its monthly security updates on Patch Tuesday, the second Tuesday of each month.

Windows Update¶

Windows Update is the part of Windows that downloads and installs updates for Windows itself and other Microsoft products.

In win11: Start → Settings → Windows Update → Check for updates. A cumulative update for the month appears, with a name that contains a KB number (the code Microsoft gives each update). Let it download in the background.

Then open Update history: it lists Quality updates, Driver updates and Definition updates (the antivirus's list of known threats), each with its date.

winget: a package manager for Windows¶

winget is the package manager of Windows: one command talks to a repository and installs a program.

It arrived in 2020 — more than twenty years after apt — and it is part of Windows 11. Right-click the Start button → Terminal:

winget --version
winget search 7zip

winget search lists Name, Id, Version and Source. The Id is the exact name of the package: 7zip.7zip. The first time, winget asks you to accept the terms of its source: answer Y.

winget show --id 7zip.7zip -e
winget install --id 7zip.7zip -e
winget list

-e means exact: without it winget matches any Id that contains the text and may ask which one. The install downloads the installer, checks its hash against the one in the repository, and installs it. winget list now shows 7-Zip.

A window may dim the screen and ask Do you want to allow this app to make changes? That is User Account Control (UAC): Windows asking for administrator rights, like sudo on Linux. Answer Yes.

winget upgrade
winget uninstall --id 7zip.7zip -e

Three doors into Windows¶

An .msi file is an installer in Windows' own installer format; an .exe is a program that installs.

The classic way, once¶

Open Edge and type the official address of Notepad++: notepad-plus-plus.org. Download the installer and install it, counting every click from the web page to Finish: open the site, find Downloads, download, open the file, accept the UAC window, language, licence, folder, components, Install, Finish. Ten clicks or more — against one line of winget.

Find the file in Downloads → right-click → Properties. The Digital Signatures tab names who signed the installer. If the tab is missing, the file is unsigned, and Windows may warn you.

Uninstall it the graphical way: Settings → Apps → Installed apps → the three dots next to Notepad++ → Uninstall. In the Microsoft Store, the Library (or Downloads) page has a button to get updates for Store apps.

Update, point release, release upgrade¶

Updates come in three sizes:

flowchart LR
    U["<b>Update</b><br>fixes for packages;<br>same version of the system"] --> P["<b>Point release</b><br>the updates, collected<br>Debian 13.0 → 13.7"]
    P --> R["<b>Release upgrade</b><br>a whole new version<br>Debian 12 → 13"]

A release upgrade is a planned job: read the release notes, make a snapshot or a backup first, and expect it to take an hour.

How long am I safe?¶

End of support is the day the maker stops sending security updates for a version. After it, new holes stay open for ever.

Millions of PCs could not move from Windows 10 to Windows 11 because of the TPM 2.0 requirement you met when installing Windows 11.

Bring the Linux machines up to date¶

Shut win11 down; start deb-lab:

cat /etc/debian_version
sudo apt update
sudo apt upgrade
apt list --upgradable

/etc/debian_version shows 13.x, the point release. After the upgrade, apt list --upgradable is empty.

Then ubu-srv:

sudo apt update
sudo apt upgrade
ls /var/run/reboot-required
cat /etc/apt/apt.conf.d/20auto-upgrades
sudo do-release-upgrade -c

The path /etc/apt/apt.conf.d/20auto-upgrades is long: type the start and press Tab to complete it.

Who updates what?¶

Key takeaways¶

• WannaCry (12 May 2017) hit machines missing a security update published on 14 March: being up to date was enough.
• Windows Update updates Windows and Microsoft products; Patch Tuesday is the second Tuesday of each month.
• winget is Windows' package manager: search, install --id … -e, list, upgrade --all, uninstall.
• Software enters Windows through three doors: a downloaded installer, the Microsoft Store, or winget.
• An update fixes the current version; a release upgrade moves to a new one and needs a way back.
• After end of support, a system gets no more security updates.

Quick check¶

Always update — and before a big change, know how you will go back. Next you build that way back, then break your machines on purpose: Snapshots and recovery.