MS09-051 needed for XP Pro SP2?

MS09-051 indicates that the patches apply only to XP SP3. There is no
mention of SP2 although all other patches I needed specifically mentioned
SP2 as well as SP3.

So, does XP Pro SP2 need the Windows Media Runtime patches? I assume it
probably does but it would be nice if Microsoft included it in the bulletin
down at the bottom under APPLIES TO section.

Melelina wrote:
> MS09-051 indicates that the patches apply only to XP SP3. There is
> no mention of SP2 although all other patches I needed specifically
> mentioned SP2 as well as SP3.
>
> So, does XP Pro SP2 need the Windows Media Runtime patches? I
> assume it probably does but it would be nice if Microsoft included
> it in the bulletin down at the bottom under APPLIES TO section.

Before you go on - I am actually trying to figure out what you saw/are
seeing that lead you to ask this. I am wondering where your investigation
either fell short or your explanation of what you you are trying to convey
is lacking. I am walking through this methodically and carefully so I can
see where you might have made the mis-interpretation that I see now and
perhaps point out what may have been the real issue. Don't go taking
offense at what I am presenting - for it is a journey for me (typed up as I
take it) as much as it should have been for you and I hoped to discover (on
this journey) what made you make the statement/ask the question you did. I
believe I have found that and explained it as best as any of your peers
(without any more access than you) could. Hopefully you will agree and
maybe, next time, take a similar journey in getting to similar conclusions.


Did you actually look at all the associated web pages for said patch(es)?

For example (given only what you said):
http://www.microsoft.com/technet/sec.../MS09-051.mspx
(That would be the first page I would visit given your information.)

In a nicely laid-out table under the heading, "Affected and Non-Affected
Software", in the column labeled, "Operating System" - the second and third
rows...

Windows XP Service Pack 2
Windows XP Service Pack 3

And gives you links to the necessary patches in the second column for each.

In other words - what were you looking at when you said, "MS09-051 indicates
that the patches apply only to XP SP3. There is no mention of SP2 although
all other patches I needed specifically mentioned SP2 as well as SP3."?

I decided to go deeper - maybe each individual patches download page had no
mention of "Windows XP with SP2" on them.

The first of the three:
http://www.microsoft.com/downloads/d...d-52419537126b
"Supported Operating Systems: Windows 2000 Service Pack 4; Windows Server
2003 Service Pack 2; Windows XP Service Pack 2; Windows XP Service Pack 3"
.... one download for both SP2 and SP3.

The second of the three:
http://www.microsoft.com/downloads/d...b-23dcb8ee49d8
"Supported Operating Systems: Windows XP Service Pack 2"
and
http://www.microsoft.com/downloads/d...6-7b534a1dfe54
"Supported Operating Systems: Windows XP Service Pack 3"
.... two downloads, one for SP2 and one for SP3.

The third of the three:
http://www.microsoft.com/downloads/d...2-8f3536225fb3
"Supported Operating Systems: Windows XP Service Pack 2; Windows XP Service
Pack 3"
.... one download for both SP2 and SP3.

So the actual download pages for the patches seemed to have mention of the
Operating Systems they supported (for each download) - and I guess if you
just happened upon the second of the three patches and only went to the
second (SP3 supported download) link for the download of the patch - you
might think that one was only for SP3 machine (and you would be correct if
you meant that specific version of the download of the KB patch.)

Okay - so I was curious if maybe the individual KB articles maybe did not
have any mention of both service packs, and this is where I see how you
could make your assumption (although if you continued with the research
and/or actually went to the download page(s) for each of them - you would
have seen the stuff I pointed out above.)

http://support.microsoft.com/kb/969878
If you look under "Applies To" at the bottom, it is true, there is no
mention of Windows XP with Service Pack 2. However - if you look more
closely - you will see where the typo was probably made. I say "typo"
because I cannot imagine any other logical reason to list "Windows XP
Professional" and "Windows XP Home Edition" twice under the single heading
"Microsoft Windows XP Service Pack 3, when used with:"... My guess would be
they meant to also have a heading for "Microsoft Windows XP Service Pack 2,
when used with:" in there - as that would make the double-mention of
Home/Professional would make sense.

http://support.microsoft.com/kb/954155
See the explanation for 969878... Same typo in the "Applies To" section at
the bottom? Perhaps an accidental drop of the words, "Microsoft Windows XP
Service Pack 2, when used with:" maybe? Seems to look like it - otherwise
(again) why repeat the same operating systems twice under the single
heading?

http://support.microsoft.com/kb/975025
See the explanation for 969878... Same typo in the "Applies To" section at
the bottom? Perhaps an accidental drop of the words, "Microsoft Windows XP
Service Pack 2, when used with:" maybe? Seems to look like it - otherwise
(again) why repeat the same operating systems twice under the single
heading?

It might not have been a typo - but an automated "Applies To:" text
generation error - coding problem when generating the ticket perhaps. Or
maybe they are just preparing for what I am about to present to you - the
fact that soon enough, updates for SP2 may not be available anyway. ;-)

In any case - by April of this next year (2010) - if you do not have SP3 on
your 32-bit Wndows XP operating system - there *will be* patches released
after that point that may have *no mention* of "Windows XP (32-bit) with
SP2" because "Windows XP with SP2" will no longer be supported - only those
who have "Windows XP with SP3" will definitely have the benefit of
updates/patches from Microsoft through April 2014.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

"Shenan Stanley" <> wrote in message
news:%...
> Melelina wrote:
>> MS09-051 indicates that the patches apply only to XP SP3. There is
>> no mention of SP2 although all other patches I needed specifically
>> mentioned SP2 as well as SP3.
>>
>> So, does XP Pro SP2 need the Windows Media Runtime patches? I
>> assume it probably does but it would be nice if Microsoft included
>> it in the bulletin down at the bottom under APPLIES TO section.
>
> Before you go on - I am actually trying to figure out what you saw/are
> seeing that lead you to ask this. I am wondering where your investigation
> either fell short or your explanation of what you you are trying to convey
> is lacking. I am walking through this methodically and carefully so I can
> see where you might have made the mis-interpretation that I see now and
> perhaps point out what may have been the real issue. Don't go taking
> offense at what I am presenting - for it is a journey for me (typed up as
> I take it) as much as it should have been for you and I hoped to discover
> (on this journey) what made you make the statement/ask the question you
> did. I believe I have found that and explained it as best as any of your
> peers (without any more access than you) could. Hopefully you will agree
> and maybe, next time, take a similar journey in getting to similar
> conclusions.

It wasn't a clear post and I have to apologize for that. I was in the middle
of a discussion about it at dslreports security forum in the monthly
Microsoft patches thread and I should have posted here with a clearer
explanation like I did at dslr.
>
>
> Did you actually look at all the associated web pages for said patch(es)?
>
> For example (given only what you said):
> http://www.microsoft.com/technet/sec.../MS09-051.mspx
> (That would be the first page I would visit given your information.)
>
> In a nicely laid-out table under the heading, "Affected and Non-Affected
> Software", in the column labeled, "Operating System" - the second and
> third rows...
>
> Windows XP Service Pack 2
> Windows XP Service Pack 3
>
> And gives you links to the necessary patches in the second column for
> each.
>
> In other words - what were you looking at when you said, "MS09-051
> indicates that the patches apply only to XP SP3. There is no mention of
> SP2 although all other patches I needed specifically mentioned SP2 as well
> as SP3."?

I was not clear about it. I was in the dslr thread but, yes, my post here
was confusing and too brief. Sorry.
>
> I decided to go deeper - maybe each individual patches download page had
> no mention of "Windows XP with SP2" on them.
>
> The first of the three:
> http://www.microsoft.com/downloads/d...d-52419537126b
> "Supported Operating Systems: Windows 2000 Service Pack 4; Windows Server
> 2003 Service Pack 2; Windows XP Service Pack 2; Windows XP Service Pack 3"
> ... one download for both SP2 and SP3.
>
> The second of the three:
> http://www.microsoft.com/downloads/d...b-23dcb8ee49d8
> "Supported Operating Systems: Windows XP Service Pack 2"
> and
> http://www.microsoft.com/downloads/d...6-7b534a1dfe54
> "Supported Operating Systems: Windows XP Service Pack 3"
> ... two downloads, one for SP2 and one for SP3.
>
> The third of the three:
> http://www.microsoft.com/downloads/d...2-8f3536225fb3
> "Supported Operating Systems: Windows XP Service Pack 2; Windows XP
> Service Pack 3"
> ... one download for both SP2 and SP3.
>
> So the actual download pages for the patches seemed to have mention of the
> Operating Systems they supported (for each download) - and I guess if you
> just happened upon the second of the three patches and only went to the
> second (SP3 supported download) link for the download of the patch - you
> might think that one was only for SP3 machine (and you would be correct if
> you meant that specific version of the download of the KB patch.)
>
> Okay - so I was curious if maybe the individual KB articles maybe did not
> have any mention of both service packs, and this is where I see how you
> could make your assumption (although if you continued with the research
> and/or actually went to the download page(s) for each of them - you would
> have seen the stuff I pointed out above.)

I read both the bulletin and KB articles and saw the download pages for
each. I was looking for the file attributes and that is why I was on the KB
page that was confusing for two of the patches. I knew my file attributes
were older than what was shown but that still didn't fully convince me that
I needed the patches. As for the third patch that had the separate SP2
update, I am not positive I looked at it. That was the middle one in the
list from the security bulletin and I know I clicked on the first patch and
think I then may have clicked on the third one and then didn't try the
middle one once I was confused by the other two and probably figured the
third one was also confusing, plus, there were so many to check this month!
That will teach me to skip one. I may have clicked on the SP3 update for
the second one by mistake, but I suspect I didn't click on that one at all
and, if I had, and I had seen the SP2 update then I would have been far more
likely to think that the typos in the first and second patches "applies to"
meant that SP2 heading simply got left out. I would have just gone ahead
installed all three.

>
> http://support.microsoft.com/kb/969878
> If you look under "Applies To" at the bottom, it is true, there is no
> mention of Windows XP with Service Pack 2. However - if you look more
> closely - you will see where the typo was probably made. I say "typo"
> because I cannot imagine any other logical reason to list "Windows XP
> Professional" and "Windows XP Home Edition" twice under the single heading
> "Microsoft Windows XP Service Pack 3, when used with:"... My guess would
> be they meant to also have a heading for "Microsoft Windows XP Service
> Pack 2, when used with:" in there - as that would make the double-mention
> of Home/Professional would make sense.

I just thought the double text was a typo and didn't jump to the conclusion
it was typo because they meant to have a heading for XP SP2 also and somehow
didn't. To me, it could be read either way.
>
> http://support.microsoft.com/kb/954155
> See the explanation for 969878... Same typo in the "Applies To" section at
> the bottom? Perhaps an accidental drop of the words, "Microsoft Windows
> XP Service Pack 2, when used with:" maybe? Seems to look like it -
> otherwise (again) why repeat the same operating systems twice under the
> single heading?
>
> http://support.microsoft.com/kb/975025
> See the explanation for 969878... Same typo in the "Applies To" section at
> the bottom? Perhaps an accidental drop of the words, "Microsoft Windows
> XP Service Pack 2, when used with:" maybe? Seems to look like it -
> otherwise (again) why repeat the same operating systems twice under the
> single heading?

I don't know why they repeated the same operating systems twice under the
single heading and that is why I asked both in the dslr thread and here. I
also sent feedback on those pages to Microsoft.
>
> It might not have been a typo - but an automated "Applies To:" text
> generation error - coding problem when generating the ticket perhaps. Or
> maybe they are just preparing for what I am about to present to you - the
> fact that soon enough, updates for SP2 may not be available anyway. ;-)

Yeah, I wondered if the upcoming end of support SP2 was at the bottom of
this.
>
> In any case - by April of this next year (2010) - if you do not have SP3
> on your 32-bit Wndows XP operating system - there *will be* patches
> released after that point that may have *no mention* of "Windows XP
> (32-bit) with SP2" because "Windows XP with SP2" will no longer be
> supported - only those who have "Windows XP with SP3" will definitely have
> the benefit of updates/patches from Microsoft through April 2014.

Yes, I know this. We have speculated at dslreports security forum several
times about whether or not Microsoft is gong to allow SP2 users, after that
date, to install SP3 critical patches (at their own "risk" since the patches
will be labeled for SP 3 only and tested only for SP3). I recall for earlier
Windows service packs that I could install the patches after the expiration
of the Service Pack (probably not from WU/MU but I haven't used either since
2004). Some folks are saying that this time Microsoft is going to cut off
any attempts by SP2 users to install the SP3 patches after next April and
that this will be done via the installer because how the installation is
handled has changed significantly since XP SP1 end of support and it is now
easy for Microsoft to cut us off where that was not the case when support
ended for SP1. So, I and many others using SP2 are waiting to see what
happens next April.

I am impressed by your dilgence in figuring out what I meant given the
vagueness of my post. Thank you!


> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>

<snipped>

Melelina wrote:
<snipped>
> Yes, I know this. We have speculated at dslreports security forum
> several times about whether or not Microsoft is gong to allow SP2
> users, after that date, to install SP3 critical patches (at their
> own "risk" since the patches will be labeled for SP 3 only and
> tested only for SP3). I recall for earlier Windows service packs
> that I could install the patches after the expiration of the
> Service Pack (probably not from WU/MU but I haven't used either
> since 2004). Some folks are saying that this time Microsoft is
> going to cut off any attempts by SP2 users to install the SP3
> patches after next April and that this will be done via the
> installer because how the installation is handled has changed
> significantly since XP SP1 end of support and it is now easy for
> Microsoft to cut us off where that was not the case when support
> ended for SP1. So, I and many others using SP2 are waiting to see
> what happens next April.

There will be some updates that you will likely be able to install after
that date. However - just like with previous SP updates, etc - there will
be some (many) that will check for certain things and if those things are
not there (won't be if you do not have the latest service pack available)
then they will not install - because to do so could be dangerous. You
wouldn't - perhaps - have necessary pre-requisites.

SP2 was really the 'dangerous' one of the Windows XP service packs - as it
changed the most. SP3 really does not change all that much about the
underlying OS. Most SP3 installation issues center around existing (but
often unseen) issues that should be fixed anyway. Very few *actual*
incompatibilities exists when going from SP2 to SP3. And yes - if you get
SP3 - you are getting hundreds of patches you would not likely have any
other way. ;-)

My suggestion to anyone is to install Windows XP SP3. I always ask for
someone to come up with a good reason not to - and no one has actually come
up with one that has prevented it, yet. There's always that possibility it
will happen. IN the end - no one is forcing anything on you, though. If
you want to stay SP2 - okay. There are still people touting the greatness
of Windows 98 and using it. If it works for them - good enough. It's when
they start wanting to do something new, use a new piece of hardware, a new
software package, etc - that they start having issues. ;-)

If you decide you want to install SP3 - come back - I have a set of
instructions that would more than likely get your through it unscathed and
with a better running/cleaner system in the end too. *grin*

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Speculate about what?

Fact: WinXP entered Extended Support on 12 April 2009.

Fact: Per Windows Life Cycle policies, computers running WinXP SP2 will NOT
be offered any further critical security updates, Automatic Updates will
cease to function, and Windows Update website will not be available after 12
April 2010 until SP3 is installed.

Fact: Security updates (only) will be available to computers running WinXP
SP3 through 12 April 2014.

Fact: Anyone running WinXP Gold or WinXP SP1 has not been able to reach
Windows Update or update via Automatic Updates since October 2006.

> Melelina wrote:
> <snipped>
>> Yes, I know this. We have speculated at dslreports security forum
>> several times about whether or not Microsoft is gong to allow SP2
>> users, after that date, to install SP3 critical patches (at their
>> own "risk" since the patches will be labeled for SP 3 only and
>> tested only for SP3).

Who said anything about Windows Updates site? Most of us haven't used that
for four or five years. I stopped using it in 2004. I am not allowing WGA
(much less WGAN) on this computer which is a Dell XPS 600 with a valid
Windows license. Somehow, Microsoft calling me a thief constantly just
doesn't agree with me. It is ridiculous to think that I would suddenly
decide to uninstall my legal copy of XP Pro SP2 and install a pirated one.
That would make me insane and I fail to understand why Microsoft thinks I
must do this constantly and thus Microsoft must force WGA (and better yet if
I am stupid WGAN).

I only get security patches that do not require WGA. I get each patch from
reading the Microsoft monthly security bulletin and then I manually download
to disk (why anyone would do autoupdating besides the WGA thing is beyond me
because then they don't have all the patches on disk)! I install each patch
one at a time and use the computer for awhile before installing the next
one. I don't install all security patches either. I am like most at
dslreports security forum in that respect.

So, I have not the vaguest interest in WU site. The first thing I do with a
new computer is disable automatic updates. We are speculating about the
ability to seek out the security patches after next April and manually
install them on SP2. I did that on SP1. This is a newer computer. I never
install Service Packs on a current computer. That is asking for trouble. I
would still be on SP1 if that computer had not practically exploded at 18
months of age and Dell eventually (after five months of trying to fix the
old computer) gave me a brand new, much better one that came with SP2
installed. This is the only reason I have SP2. I still use a virtual machine
with SP1 and it is faster than SP2 and I see very little difference other
than I had to install a patch on SP2 to get the necessary half open
connections for tcp/ip back that were in SP1. That alone makes SP1 superior
to SP2. Microsoft realized it too because Vista SP2 and Windows 7 don't need
the patch.


"PA Bear [MS MVP]" <> wrote in message
news:...
> Speculate about what?
>
> Fact: WinXP entered Extended Support on 12 April 2009.
>
> Fact: Per Windows Life Cycle policies, computers running WinXP SP2 will
> NOT be offered any further critical security updates, Automatic Updates
> will cease to function, and Windows Update website will not be available
> after 12 April 2010 until SP3 is installed.
>
> Fact: Security updates (only) will be available to computers running WinXP
> SP3 through 12 April 2014.
>
> Fact: Anyone running WinXP Gold or WinXP SP1 has not been able to reach
> Windows Update or update via Automatic Updates since October 2006.
>
> > Melelina wrote:
>> <snipped>
>>> Yes, I know this. We have speculated at dslreports security forum
>>> several times about whether or not Microsoft is gong to allow SP2
>>> users, after that date, to install SP3 critical patches (at their
>>> own "risk" since the patches will be labeled for SP 3 only and
>>> tested only for SP3).
>

"Shenan Stanley" <> wrote in message
news:...
> <snipped>
>
> Melelina wrote:
> <snipped>
>> Yes, I know this. We have speculated at dslreports security forum
>> several times about whether or not Microsoft is gong to allow SP2
>> users, after that date, to install SP3 critical patches (at their
>> own "risk" since the patches will be labeled for SP 3 only and
>> tested only for SP3). I recall for earlier Windows service packs
>> that I could install the patches after the expiration of the
>> Service Pack (probably not from WU/MU but I haven't used either
>> since 2004). Some folks are saying that this time Microsoft is
>> going to cut off any attempts by SP2 users to install the SP3
>> patches after next April and that this will be done via the
>> installer because how the installation is handled has changed
>> significantly since XP SP1 end of support and it is now easy for
>> Microsoft to cut us off where that was not the case when support
>> ended for SP1. So, I and many others using SP2 are waiting to see
>> what happens next April.
>
> There will be some updates that you will likely be able to install after
> that date. However - just like with previous SP updates, etc - there will
> be some (many) that will check for certain things and if those things are
> not there (won't be if you do not have the latest service pack available)
> then they will not install - because to do so could be dangerous. You
> wouldn't - perhaps - have necessary pre-requisites.

The only updates I would want are security patches. I don't install any
updates or programs from Microsoft that require WGA and I do have a valid XP
Pro OEM license for this Dell computer. I just resent Microsoft assuming I
am a pirate. They need to get over that as why would anyone suddenly decide
to uninstall their legal copy of Windows and go out and obtain a pirated
version (with who knows what nasties included) and install that instead?
Once Windows validates once that should be it. My Ford dealer doesn't
require that I come in every six months to assure them I really did buy my
Ford.
>
> SP2 was really the 'dangerous' one of the Windows XP service packs - as it
> changed the most. SP3 really does not change all that much about the
> underlying OS. Most SP3 installation issues center around existing (but
> often unseen) issues that should be fixed anyway. Very few *actual*
> incompatibilities exists when going from SP2 to SP3. And yes - if you get
> SP3 - you are getting hundreds of patches you would not likely have any
> other way. ;-)

I realize this. I recall myriads of threads in both the Microsoft Help forum
and Security forum at dslreports before SP2 was released, and after the
release, and the same for SP3. I saw a lot more problems with those going to
SP2 than those going to SP3. I might upgrade if this computer was newer and
not so very heavily used. But this computer will be four years old on Feb 1
2010. It has four virtual machines installed, and used a great deal, as well
as a ton of programs. It is highly customized and I simply cannot imagine
having no serious problems upgrading it at that age and customization level.
>
> My suggestion to anyone is to install Windows XP SP3. I always ask for
> someone to come up with a good reason not to - and no one has actually
> come up with one that has prevented it, yet. There's always that
> possibility it will happen. IN the end - no one is forcing anything on
> you, though. If you want to stay SP2 - okay. There are still people
> touting the greatness of Windows 98 and using it. If it works for them -
> good enough. It's when they start wanting to do something new, use a new
> piece of hardware, a new software package, etc - that they start having
> issues. ;-)

That is something else I don't do. I don't upgrade any hardware on a current
computer. I wait until I get a new computer for that. I think it foolish to
spend money that way. Computers become obsolete fast anyway so just wait
until you buy your next computer for whatever is. I'd like hardware
virtualization very much but I am not upgrading a CPU (that was supposed to
have it so Dell told me (it's a Pentium IV 670 hyperthreading at 3.8GhZ and
the 671 has hardware virtualization) just to get that. My next computer will
have it as I will make absolutely positive of that before I purchase it.

I have a Dell that is now 10.5 years old with 98SE. I used it a fair amount
until about six months ago when it stopped accessing the internet at
anything above dialup speed on cable modem. I think it is the network card
but it is so old now and rusty that I see no point in trying to fix it. I
still can access the files from my XP computer or my virtual computers.
Yeah, I really liked 98SE.
>
> If you decide you want to install SP3 - come back - I have a set of
> instructions that would more than likely get your through it unscathed and
> with a better running/cleaner system in the end too. *grin*

We'll see. With virtual machines it makes upgrading the host not that
important (except if I could get hardware virtualization with a Service Pack
upgrade I'd do it)!

> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>

Melelina wrote:

> I only get security patches that do not require WGA. I get each patch from
> reading the Microsoft monthly security bulletin and then I manually download
> to disk (why anyone would do autoupdating besides the WGA thing is beyond me
> because then they don't have all the patches on disk)!

I fail to see why you would want to keep copies of all the updates in a home
machine scenario. Heck, now that we've got WSUS I don't even keep copies of all
the updates at work. (Well, I suppose WSUS keeps them for me, in a sense.)

In the unlikely event that I need them again, I'll download them again. Most
likely by the next time I reinstall half of them will be superseded, even if
there isn't a more recent service pack.

> I don't install all security patches either.

The disadvantage of this approach is that it means your system does not match
any of the majority user groups, hence is more likely to experience problems
that are rare (and hence less likely to be already fixed). However, this is a
fairly low risk. (Probably the greater risk is that you'll overlook a security
update that you really do need.)

> So, I have not the vaguest interest in WU site. The first thing I do with a
> new computer is disable automatic updates. We are speculating about the
> ability to seek out the security patches after next April and manually
> install them on SP2.

I'd be surprised if that works. But ...

> I did that on SP1.

Huh. Of course, if I remember correctly, the pre-SP2 update.exe was
considerably less intelligent about code branches. I didn't move from Windows
2000 until after SP2 so I'm not very familiar with it, but I seem to recall
reading that the post-SP2 version was a significant upgrade.

In any case, I think this is missing the point. Even if you can install SP3
patches on SP2, there are likely to be faults and vulnerabilities in SP2 that
never get patched because they don't apply to SP3.

> This is a newer computer. I never
> install Service Packs on a current computer. That is asking for trouble.

Seems to me *not* installing service packs, after a reasonable waiting period of
course, is asking for trouble. Still, whatever works for you.

Have you considered moving to a more version-control friendly OS such as Debian?
With that as your primary OS you could run Windows inside a VM and possibly
never need to update it at all.

Harry.



I
> would still be on SP1 if that computer had not practically exploded at 18
> months of age and Dell eventually (after five months of trying to fix the
> old computer) gave me a brand new, much better one that came with SP2
> installed. This is the only reason I have SP2. I still use a virtual machine
> with SP1 and it is faster than SP2 and I see very little difference other
> than I had to install a patch on SP2 to get the necessary half open
> connections for tcp/ip back that were in SP1. That alone makes SP1 superior
> to SP2. Microsoft realized it too because Vista SP2 and Windows 7 don't need
> the patch.
>
>
> "PA Bear [MS MVP]" <> wrote in message
> news:...
>> Speculate about what?
>>
>> Fact: WinXP entered Extended Support on 12 April 2009.
>>
>> Fact: Per Windows Life Cycle policies, computers running WinXP SP2 will
>> NOT be offered any further critical security updates, Automatic Updates
>> will cease to function, and Windows Update website will not be available
>> after 12 April 2010 until SP3 is installed.
>>
>> Fact: Security updates (only) will be available to computers running WinXP
>> SP3 through 12 April 2014.
>>
>> Fact: Anyone running WinXP Gold or WinXP SP1 has not been able to reach
>> Windows Update or update via Automatic Updates since October 2006.
>>
>>> Melelina wrote:
>>> <snipped>
>>>> Yes, I know this. We have speculated at dslreports security forum
>>>> several times about whether or not Microsoft is gong to allow SP2
>>>> users, after that date, to install SP3 critical patches (at their
>>>> own "risk" since the patches will be labeled for SP 3 only and
>>>> tested only for SP3).
>
>

[I want some of what she's smoking!]

Harry Johnston [MVP] wrote:
> Melelina wrote:
>
>> I only get security patches that do not require WGA. I get each patch
>> from
>> reading the Microsoft monthly security bulletin and then I manually
>> download to disk (why anyone would do autoupdating besides the WGA thing
>> is beyond me because then they don't have all the patches on disk)!
>
> I fail to see why you would want to keep copies of all the updates in a
> home
> machine scenario. Heck, now that we've got WSUS I don't even keep copies
> of all the updates at work. (Well, I suppose WSUS keeps them for me, in a
> sense.)
> In the unlikely event that I need them again, I'll download them again.
> Most likely by the next time I reinstall half of them will be superseded,
> even if there isn't a more recent service pack.
>
>> I don't install all security patches either.
>
> The disadvantage of this approach is that it means your system does not
> match any of the majority user groups, hence is more likely to experience
> problems that are rare (and hence less likely to be already fixed).
> However, this is a fairly low risk. (Probably the greater risk is that
> you'll overlook a security update that you really do need.)
>
>> So, I have not the vaguest interest in WU site. The first thing I do with
>> a
>> new computer is disable automatic updates. We are speculating about the
>> ability to seek out the security patches after next April and manually
>> install them on SP2.
>
> I'd be surprised if that works. But ...
>
>> I did that on SP1.
>
> Huh. Of course, if I remember correctly, the pre-SP2 update.exe was
> considerably less intelligent about code branches. I didn't move from
> Windows 2000 until after SP2 so I'm not very familiar with it, but I seem
> to recall reading that the post-SP2 version was a significant upgrade.
>
> In any case, I think this is missing the point. Even if you can install
> SP3
> patches on SP2, there are likely to be faults and vulnerabilities in SP2
> that never get patched because they don't apply to SP3.
>
>> This is a newer computer. I never
>> install Service Packs on a current computer. That is asking for trouble.
>
> Seems to me *not* installing service packs, after a reasonable waiting
> period of course, is asking for trouble. Still, whatever works for you.
>
> Have you considered moving to a more version-control friendly OS such as
> Debian? With that as your primary OS you could run Windows inside a VM
> and
> possibly never need to update it at all.
>
> Harry.
>
>
>
> I
>> would still be on SP1 if that computer had not practically exploded at 18
>> months of age and Dell eventually (after five months of trying to fix the
>> old computer) gave me a brand new, much better one that came with SP2
>> installed. This is the only reason I have SP2. I still use a virtual
>> machine with SP1 and it is faster than SP2 and I see very little
>> difference other than I had to install a patch on SP2 to get the
>> necessary
>> half open connections for tcp/ip back that were in SP1. That alone makes
>> SP1 superior to SP2. Microsoft realized it too because Vista SP2 and
>> Windows 7 don't need the patch.
>>
>>
>> "PA Bear [MS MVP]" <> wrote in message
>> news:...
>>> Speculate about what?
>>>
>>> Fact: WinXP entered Extended Support on 12 April 2009.
>>>
>>> Fact: Per Windows Life Cycle policies, computers running WinXP SP2 will
>>> NOT be offered any further critical security updates, Automatic Updates
>>> will cease to function, and Windows Update website will not be available
>>> after 12 April 2010 until SP3 is installed.
>>>
>>> Fact: Security updates (only) will be available to computers running
>>> WinXP
>>> SP3 through 12 April 2014.
>>>
>>> Fact: Anyone running WinXP Gold or WinXP SP1 has not been able to reach
>>> Windows Update or update via Automatic Updates since October 2006.
>>>
>>>> Melelina wrote:
>>>> <snipped>
>>>>> Yes, I know this. We have speculated at dslreports security forum
>>>>> several times about whether or not Microsoft is gong to allow SP2
>>>>> users, after that date, to install SP3 critical patches (at their
>>>>> own "risk" since the patches will be labeled for SP 3 only and
>>>>> tested only for SP3).

"Harry Johnston [MVP]" <> wrote in message
news:...
> Melelina wrote:
>
>> I only get security patches that do not require WGA. I get each patch
>> from reading the Microsoft monthly security bulletin and then I manually
>> download to disk (why anyone would do autoupdating besides the WGA thing
>> is beyond me because then they don't have all the patches on disk)!
>
> I fail to see why you would want to keep copies of all the updates in a
> home machine scenario. Heck, now that we've got WSUS I don't even keep
> copies of all the updates at work. (Well, I suppose WSUS keeps them for
> me, in a sense.)

You have never had patches have to be reinstalled after failing at some
point? I have.
>
> In the unlikely event that I need them again, I'll download them again.
> Most likely by the next time I reinstall half of them will be superseded,
> even if there isn't a more recent service pack.

I download everything to disk including Firefox extensions. I don't just
install them. Why would I want the hassle of having to go download them
again if I have to create a new Profile, etc? But then I never read a PDF in
my browser either. I download to disk and scan for viruses first. That way I
avoid all the nasties that so many lazy users are prone to get and I have
the PDF on disk for whenever I want to read it again. I don't have to hunt
for it on the net again.
>
>> I don't install all security patches either.
>
> The disadvantage of this approach is that it means your system does not
> match any of the majority user groups, hence is more likely to experience
> problems that are rare (and hence less likely to be already fixed).
> However, this is a fairly low risk. (Probably the greater risk is that
> you'll overlook a security update that you really do need.)

Yes, true I might overload an important patch. I try hard to not let that
happen and I do read the thread at dslreports Security forum each month on
the Security Bulletin for that patch Tuesday and I read any other threads
started about questions/problems with any patch. I also use QFECheck (I got
that somehow without allowing WGA like Microsoft insists) and Belarc Advisor
for many years.
>
>> So, I have not the vaguest interest in WU site. The first thing I do with
>> a new computer is disable automatic updates. We are speculating about the
>> ability to seek out the security patches after next April and manually
>> install them on SP2.
>
> I'd be surprised if that works. But ...
>
>> I did that on SP1.
>
> Huh. Of course, if I remember correctly, the pre-SP2 update.exe was
> considerably less intelligent about code branches. I didn't move from
> Windows 2000 until after SP2 so I'm not very familiar with it, but I seem
> to recall reading that the post-SP2 version was a significant upgrade.
>
> In any case, I think this is missing the point. Even if you can install
> SP3 patches on SP2, there are likely to be faults and vulnerabilities in
> SP2 that never get patched because they don't apply to SP3.
>
>> This is a newer computer. I never install Service Packs on a current
>> computer. That is asking for trouble.
>
> Seems to me *not* installing service packs, after a reasonable waiting
> period of course, is asking for trouble. Still, whatever works for you.
We'll see. I could change my mind. I think if I decide to buy a new computer
early next year I will not upgrade the Service Pack on this one as it will
become my secondary computer. If I decide to wait until this computer is a
little older (say this time next year) then I may decide to install the SP
as this would still be my main computer.
>
> Have you considered moving to a more version-control friendly OS such as
> Debian? With that as your primary OS you could run Windows inside a VM and
> possibly never need to update it at all.

I've tried Ubuntu awhile back but know nothing about Debian.

>
> Harry.
>
>
>
> I
>> would still be on SP1 if that computer had not practically exploded at 18
>> months of age and Dell eventually (after five months of trying to fix the
>> old computer) gave me a brand new, much better one that came with SP2
>> installed. This is the only reason I have SP2. I still use a virtual
>> machine with SP1 and it is faster than SP2 and I see very little
>> difference other than I had to install a patch on SP2 to get the
>> necessary half open connections for tcp/ip back that were in SP1. That
>> alone makes SP1 superior to SP2. Microsoft realized it too because Vista
>> SP2 and Windows 7 don't need the patch.
>>
>>
>> "PA Bear [MS MVP]" <> wrote in message
>> news:...
>>> Speculate about what?
>>>
>>> Fact: WinXP entered Extended Support on 12 April 2009.
>>>
>>> Fact: Per Windows Life Cycle policies, computers running WinXP SP2 will
>>> NOT be offered any further critical security updates, Automatic Updates
>>> will cease to function, and Windows Update website will not be available
>>> after 12 April 2010 until SP3 is installed.
>>>
>>> Fact: Security updates (only) will be available to computers running
>>> WinXP SP3 through 12 April 2014.
>>>
>>> Fact: Anyone running WinXP Gold or WinXP SP1 has not been able to reach
>>> Windows Update or update via Automatic Updates since October 2006.
>>>
>>>> Melelina wrote:
>>>> <snipped>
>>>>> Yes, I know this. We have speculated at dslreports security forum
>>>>> several times about whether or not Microsoft is gong to allow SP2
>>>>> users, after that date, to install SP3 critical patches (at their
>>>>> own "risk" since the patches will be labeled for SP 3 only and
>>>>> tested only for SP3).
>>