Applet Mitigations - Updaters

Larry Osterman isn't that into you, either.

Tales from the Crypto — Thu, 23 Aug 2007 07:54:04 GMT

In previous articles, I've pointed out: Programmer Hubris - He's just not that into you Programmer

re: Applet Mitigations - Updaters

Norman Diamond — Wed, 22 Aug 2007 03:35:21 GMT

> two options. The first is that you can assume that the user

> is going to want the update and pre-download it,

DO NOT DO THIS.

Windows Automatic Updates provide correct options for this kind of thing. If the user sets an option to do pre-downloading then you do it. But DO NOT ASSUME IT.

It is really fun (not) to dial up a cell phone, expecting to spend a few seconds downloading or sending e-mail, and finding that some assumer has hijacked your connection. The train is leaving the station in 40 seconds. You want to download updates tonight, not now.

It is really fun (not) to find assumers doing the same thing on a pay-per-packet internet connection.

History question:

> Task Scheduler 1.0 interfaces (which are available on

> Windows platforms going back to Windows ME)

Does that mean 98 had Task Scheduler 0.0 interfaces?

re: Applet Mitigations - Updaters

Mihai — Tue, 21 Aug 2007 20:49:34 GMT

"I'm not sure why WU is a service, I'll see if I can find out."

It is called "Automatic Updates"

re: Applet Mitigations - Updaters

Jerry Pisk — Tue, 21 Aug 2007 20:07:56 GMT

Somehow I think Larry meant that the application that checks for updates and downloads them should not need elevation, not the actual update itself.

re: Applet Mitigations - Updaters

Michael Dunn_ — Tue, 21 Aug 2007 19:14:25 GMT

Shameless plug for an article I wrote that demonstrates how to use BITS to download files:

http://www.codeproject.com/wtl/wtl4mfc9.asp

re: Applet Mitigations - Updaters

Grant — Tue, 21 Aug 2007 17:20:03 GMT

"Maybe this is because it wasn't cool enough to be documented..."

Why do people embarrass themselves like this? A little research shows that there is a large amount of information on the Internet on using BITS, including formal documentation. In addition to the link to the documentation Larry provided, there is:

Write Auto-Updating Apps with .NET and the Background Intelligent Transfer Service API:

http://msdn.microsoft.com/msdnmag/issues/03/02/bits/

Background Intelligent Transfer Service (BITS):

http://download.microsoft.com/download/b/3/d/b3d8e8ea-8c3f-4962-8a01-478b33f44e15/BITS.doc

Using Windows XP Background Intelligent Transfer Service (BITS) with Visual Studio .NET: http://msdn2.microsoft.com/en-us/library/ms997639.aspx

Managed Wrapper for BITS:

http://www.duncanmackenzie.net/blog/Managed-Wrapper-for-BITS/

Maybe some of the above isn't applicable to you, maybe it is. Point being, to claim that Microsoft does not document (and support developers using) it's *public* APIs is an outright lie and does a disservice to the men and women of Microsoft who work very hard to try to make sure the documentation is complete:

http://channel9.msdn.com/Showpost.aspx?postid=331844

re: Applet Mitigations - Updaters

Larry Osterman [MSFT] — Tue, 21 Aug 2007 16:49:54 GMT

davidacoder: I'm not sure why WU is a service, I'll see if I can find out.

re: Applet Mitigations - Updaters

Marc Bernard — Tue, 21 Aug 2007 16:47:37 GMT

>> but I'm not aware of any 3rd party apps that use it

So do we. Our field service folks are mighty happy about it.

http://www.agfa.com/usa/en/he/products_services/all_products/impax_60.jsp

re: Applet Mitigations - Updaters

Leo Davidson — Tue, 21 Aug 2007 16:23:52 GMT

> Uh, this one lost me. I write my installer to install in Program Files. Surely that means my updater must update files (DLLs, EXEs, say) in Program Files?

Your *installer* might write to program files and require elevation but your *updater*, which checks for an update and then downloads it and runs the installer, shouldn't.

I think Larry's point is that you really don't want to be hassled by a UAC prompt when an updater decides to wake up and do an update check. A couple of posts back he mentioned something which did just that.

re: Applet Mitigations - Updaters

AndyC — Tue, 21 Aug 2007 16:03:41 GMT

Tanveer, that's not necessarily true if an Administrator installed the program on behalf of someone else. Using signed v4 MSIs that have been designed for user patching is a really good solution to this. Alternatively, if you are using the Task Scheduler approach, you can arrange for the task to be created in a context which does have the necessary rights.