3rd Party "Microsoft Updates"

[Colonel]

As an network admin, over the last few weeks updates for third party applications have really started to p*** me off. Now, I have SMS on my network, so the actual installs are fine, whats getting under my skin is how every app these days has its own auto-updater. Adobe has one, Sun has one... and they all run as the logged on user.

My clients all run as non-admins, so these auto updates are totally pointless, since they don't have the rights to install the patches. This means they have several totally useless tray icons, they take up resources and bandwidth.

For a single personal computer, these updaters are ok, since you are probably running as an administrator. However, I have several personal machines (as I bet many of the members of this forum do as well) and end up having to install the same updates on each one individually, wasting both my bandwidth and time.

A lot of the software on this form is targeted at simplifying computer deployment and installs, not so much for on-going management.

What I propose is a public version of Microsoft Updates, but for any application. The 'community' maintains the list of programs, and their patches. Eventually, I would like to build in support for one machine to automatically mirror decisions made on a master machine (for home use) and an equivalent to WSUS for a cooperate network. This would of course all be done in a free and secure manner.

I am a skilled programmer, and am willing to do a large part of the work (if not all of it), but I want to know if there is a demand for this type of product or if I am just nuts. Any feedback would be greatly appreciated.

[CoffeeFiend]

I want to know if there is a demand for this type of product or if I am just nuts. Any feedback would be greatly appreciated.

Yes, to both questions?

"Centralized" updaters are certainly a good thing, and you can say there's a demand for them (just look at WSUS, SMS and countless similar deployment/patching programs, Installshield Update Manager, etc).

But as for being nuts, I'm afraid I can't say no. Do you realize everything that would be required for this to happen?

-You need to write a client, that will detect the supported programs (list which must be updated from the web constantly), and then checks for updates/upgrades (must know what to look for - say, in an XML file with the app names/versions and such), download the files from... somewhere? (bandwidth's on you?) in a format that the udater will be able to use (often not in the way they're disrtibuted), then apply them in various ways (have to write a fairly advanced "installer").

-You will need server-side code (don't know what language you had in mind), with various public APIs for the clients to check for updates (personally I'd use web services) and download them. But that must work with one gigantic and complex database: a list of every version of every app supported, a list of every single update ever made for each of the previous table (products*versions), lists of files/patches/updates whatever (likely a very complex format, could be stored as XML), linkto or name of update, etc.

-And as if that wasn't already enough work, you need a community behind it. Lots of volunteers. And you'll need to implement LOTS of stuff for this to work. You will need user accounts. A mechanism for people to submit updates - the info being in a complex format along with all the required files. And of course you can't just expect to let anyone submit anything and not have problems. You would need people to beta-test the updates before they're made public (testing phases). You might need a forum for people to interact (discuss what went wrong with update X for app Y version Z, what do to, or explain how they've done it, etc). And for all this, you'd need to add tons of stuff to the previously mentionned database: lists of users and lists of user groups, plus the relationships (UserID -> GroupID / "group memberships"), and everything needed for a forum and such, and everything required to have some sort of beta testing of updates (a workflow: create new update -> beta testing phase -> problems so back to submitter for fixing, back to beta testing, testing OK -> made public) and all the tables and code to support this (and people to update their submissions), etc.

It would require a large and complex database. A rather large app with fairly complex architecture (even if omitting the forum). And it would have to scale very well if you get a significant amount of users. And it could use lots of bandwidth too. Eventually you'd need funding (perhaps a business model?) to keep this going (hosting/bandwidth costs).

And there could be legal aspects of this, depending on who's hosting the updates (can't distribute anyone's content without approval or such).

And that's assuming a simple server on the internet and clients for single PCs. It would only become more complex if you want people to locally run servers (a bit like WSUS) on their LANs to have people install off that (and have the server sync with your server over the internet).

It's not a bad idea, but I think you don't realize who much work this would require - short and long term. It's not a 1 person project, much less one you can just accomplish in a few spare weekends.

[jcarle]

It's not a bad idea, but I think you don't realize who much work this would require - short and long term. It's not a 1 person project, much less one you can just accomplish in a few spare weekends.

Or without any serious financial backing from some deep pockets.

[Colonel]

I am actually a software engineer by trade, so I do realize exactly how much work this is. The server / client / database is not the problem, as you said, keeping content up to date is.

My plan (assuming I actually start) is to have clients download content directly from the official source, and automate whatever technology they have implemented to install it (ie: client downloads the official path and simply starts it with the required silent switches).

As far as developing a fan base to contribute, look at the communities that have sprung up around unattended installs and switch less installers (here and RyanVM's forums). I am willing to bet updating already installed software is something most people do more often than they format.

[jcarle]

I'm curious to what development languages and/or database systems you work with?

Edited December 10, 2006 by jcarle

[cluberti]

You could probably write an application to do this ala WU, but I'm wondering what types of applications it would support, what versions, how far back in versioning, what database engine to use backing this, and whether or not the BITS engine is used to transmit the updates (ala the WU client).

[CoffeeFiend]

I guess I'm curious about the potential implementation of it too (language, db, everything!) Using BITS would be a good idea for sure (after all, it's not hard to use, there's wrappers for it, articles & sample code and all)

Looks like you know what you're in for though (and starting with something simple-ish)

[Colonel]

The 'plan' is to use C# for the code, and MSSQL2005 as the back end data store, but I will try and keep it compatible with SQL Express with Advanced Services (and therefore free). I do intend to use BITS for file transfers, and I am thinking about Windows Communication Foundation (WCF) for client / server messaging. The only thing making me hesitate about WCF is it means this is going to be XP SP2+.

As for application support, this kind of service is obviously going to scan end user's systems for software and hardware, so I can target applications and drivers that the majority of users have installed.

Of course, this would all be done in a totally anonymous way, nothing like WGA, etc.

Edited December 11, 2006 by Colonel

[CoffeeFiend]

The 'plan' is to use C# for the code, and MSSQL2005 as the back end data store. I do intend to use BITS for file transfers, and I am thinking about Windows Communication Foundation (WCF) for client / server messaging.

Good stuff! If I had a say in it, that's EXACTLY what I would have chosen!

The only thing making me hesitate about WCF is it means this is going to be XP SP2+.

Well, why XP SP2? AFAIK the .NET framework 3 still runs on Win2k. Haven't had time to play with WCF yet (still using the "old" stuff, hoping to make the switch real soon), but it looks VERY, VERY promising!

Either ways, since you're not a n00b, we can expect something decent (good solid n-tier design). Still curious about the DB side of things, are you going to code it all by hand, use an ORM like NHibernate, or codegen tools (codesmith/mygeneration + template), EntLib or something? What about logging? Log4net? Inquisitive and geeky C# types want to know! No such thing as too much details! Unit test wise, I'm personally thinking about switching from NUnit to MbUnit for most stuff (it's quite nice).

One more question: what will be the license? Especially, is there a chance it would be open source at some point? In part or entirely? (Can't blame you either ways as I don't usually release my stuff as open source either, but I'd love to contribute if time permits - anything, from localization code, to Data Access Layers for other DB providers, to bugfixes, feature requests, commenting, unit tests, documentation, anything!).

Honestly, I'd rather have a local server instead of having every client download straight from the source (much like WSUS works), but I do understand developing one more app & "layer" to the system would take more time, effort, and complicate things further. Wish I had time to do something like this from scratch, but I've got just too many pet projects already... Again, ideally there would be a forum or possibly a wiki to go with all this, but eventually it's a LOT of work to make it all happen...

Edit: BTW, personally I wouldn't worry too much about the pre-XP OS'es. Win2k mainstream support is already over, and most businesses that haven't moved to XP yet (we have) are going to do it soon enough. And home users wise, I don't know anyone who still runs Win2k (a few ppl here might, but it's hardly representative of the average home user, whose new PC shipped with XP preinstalled). In a few months, a large percentage of folks will be running Vista anyways. Gotta look forward to the future a bit, even if that means leaving the older OS'es behind sometimes. Personally I don't go out of my way to support old OS'es.

Edited December 11, 2006 by crahak

[Colonel]

Well, why XP SP2? AFAIK the .NET framework 3 still runs on Win2k.

From the Redistributable Package Download Page:

Supported Operating Systems: Longhorn (Windows Code Name) ; Windows Server 2003 Service Pack 1; Windows Vista; Windows XP Service Pack 2

The only problem with saying Win2K is obsolete, is that people still on 2K are the ones that would be most in need of a service like the one we are talking about...

At this point I haven't decided how much I am going to do by hand, and what tools I am going to use, but I do know that for unit tests I would be using the ones that are part of VS Team System (along with the static code analysis and performance profiling).

I don't know about open source, for some parts of it sure. The only thing is it opens the system to attack, otherwise I would be all for it. Either way, it will be free to end users.

When I said clients would download straight from the source, I meant that exactly how WSUS works. Either end clients download from the official source or from a WSUS-Equivalent server that gets them direct from the source.

[jcarle]

I was thinking of reworking WUD into a distributed model. Instead of downloading directly updates directly from Microsoft, I was considering making each WUD client work with an internal bit torrent client.

This could also work with your idea. Each download client is a bittorrent client internally, downloading the updates from all other clients while distributing them simultaneous to all other clients, all via bit torrent protocols.

[CoffeeFiend]

Supported Operating Systems: Longhorn (Windows Code Name) ; Windows Server 2003 Service Pack 1; Windows Vista; Windows XP Service Pack 2

Nevermind what I said... I think I need some sleep (posting at 1am often results in nonsense - for me at least)

The only problem with saying Win2K is obsolete, is that people still on 2K are the ones that would be most in need of a service like the one we are talking about...

I'm not sure I get the reasoning behind this. Why would people running an older OS need more patches for their applications than those running newer OS'es? I don't see how the OS choice changes the problem in any way. The apps, no matter what OS they're installed onto, still need to be updated.

The only thing is it opens the system to attack, otherwise I would be all for it.

I don't think so. If properly designed (using parameterized queries/sprocs and all), it should be very secure. And if I can look at the code, I would likely notice code that's vulnerable (I've secured stuff man times before, and we've never been hacked) and fix it pretty quickly. There seems to be a few other C# folks on the forums too (like jcarle). Alternately, you could do like some projects do, have a gotdotnet workspace or such, and force people to join if they want to have access to the source code (only let people you trust join), or setup a private SCM or something. That way others can help, and not everybody peeks.

When I said clients would download straight from the source, I meant that exactly how WSUS works. Either end clients download from the official source or from a WSUS-Equivalent server that gets them direct from the source.

Great stuff! That was just a misunderstanding.

[jcarle]

Indeed, I'm well versed in C# as well as SQL Server 2005. I'd love to contribute as well if you need the help.

[Colonel]

My point about the older OS's is that people who haven't upgraded to SP2 yet for example, are more likely not to have updates Adobe on their own. I mean me and you want something like this for convenience, but there are people out there still running Adobe Acrobat 5 (I know, I found some at work...). It's the people (like my mother) that don't even realize updates are available that would truly benefit from something like this.

@jcarle: Although that may be a good idea, the idea behind downloading direct from the official source is that we avoid any possible legalities around unauthorized redistribution of ISV's content.

I'll set up a forum / community site some time, what would you guys prefer: SharePoint 3.0 or CommunityServer ?

[Colonel]

Something else I should mention, I was thinking about names, and the best I could do is "Universal Updates".

If someone comes up with something better... well... good for you. Let me know.