Software update - Wikiwand

Software update is the process of changing installed software with the intent to make it more modern. It also refers to the stored data used to update software. When storage was significantly more expensive, patching files was the dominant form of update. With the advent of larger distribution storage media and higher Internet bandwidth, it became common to replace entire files instead of patching.

An update may require prior application of other updates, or may require prior or concurrent updates to multiple components. To facilitate updates, operating systems often provide automatic or semi-automatic updating facilities. Package management systems offer update automation.

An update can be any size. An update can be relatively large when the changes add or replace data such as graphics and sound files; for example for a game update. An update usually takes less time to run than an initial installation of the software.

Although often intended to fix problems, an update can introduce new problems. In some cases, an update intentionally disables functionality, for instance, by removing aspects for which the consumer is no longer licensed.

Remove ads

Management

Summarize

Perspective

Software update systems allow for updates to be managed by users and software developers. In the 2017 Petya cyberpandemic, the financial software "MeDoc"'s update system is said to have been compromised to spread malware via its updates.^[1]^[2] On the Tor Blog, cybersecurity expert Mike Perry states that deterministic, distributed builds are likely the only way to defend against malware that attacks the software development and build processes to infect millions of machines in a single, officially signed, instantaneous update.^[3] Update managers also allow for security updates to be applied quickly and widely. Update managers of Linux such as Synaptic allow users to update all software installed on their machine. Applications like Synaptic use cryptographic checksums to verify source/local files before they are applied to ensure fidelity against malware.^[4]^[5]

Automatic updating has become more widespread over time. Some cite a cause of its prevalence to be due to Windows support in early 2000s. Service Pack 2 of Windows XP (available in 2004) enabled it by default.

Remove ads

Classification

Summarize

Perspective

Updates are classified many ways. Notable classifications in alphabetical order follow.

Hotfix

A hotfix is a software update that is released outside the normal update cycle or intended to be applied to a live system; often to fix a bug.^[6]

Originally, hotfix referred to patching a hot system – a production server that is actively serving clients. For development, such a change usually must be designed quickly and outside normal development processes; at relatively high cost and disrupting other development effort. For the user, a hotfix is relatively risky since it is applied to a server without time for testing it. The risk of applying the hotfix must be weighed against the risk of not applying it. The problem to be fixed might be so critical that inaction is riskier than the potential loss of service.

Over time, the meaning has shifted to an update that is created with urgency or released outside the normal update cycle for the software.

Applying (installing) a hotfix generally involves the same process as any software update. Most modern operating systems and desktop applications can download and apply updates automatically. Network administrators may use software programs to automate and simplify applying updates to the machines they manage.

Malicious update

Some hacker may compromise legitimate software update channel and inject malicious code.^[7]

Monkey patch

In computer programming, monkey patching is a technique used to dynamically update the behavior of a piece of code at run-time. It is used to extend or modify the runtime code of dynamic languages such as Smalltalk, JavaScript, Objective-C, Ruby, Perl, Python, Groovy, Lisp, and Lua without altering the original source code.

Patch

A patch is a form of software update that consists of data for modifying an existing software resource such as a program or a file, often to fix bugs and security vulnerabilities.^[8]^[9] A patch may be created to improve functionality, usability, or performance. A patch is typically provided by a vendor for updating their software. A patch may be created manually, but commonly it is created via a tool that compares two versions of the resource and generates data that can be used to transform one to the other.

Typically, a patch needs to be applied to the specific version of the resource it is intended to modify, although there are exceptions. Some patching tools can detect the version of the existing resource and apply the appropriate patch, even if it supports multiple versions. As more patches are released, their cumulative size can grow significantly, sometimes exceeding the size of the resource itself. To manage this, the number of supported versions may be limited, or a complete copy of the resource might be provided instead.

Patching allows for modifying a binary executable. Although this can be technically challenging (requires a thorough understanding of the workings of the executable), it may be feasible when the source code is unavailable to build a full executable, and it allows for a smaller distribution which can be more economical than distributing full files.

Although often intended to fix problems, a patch can introduce new problems. In some cases, an update intentionally disables functionality, for instance, by removing aspects for which the consumer is no longer licensed. Patch management is a part of lifecycle management, and involves a strategy and planning of what patches should be applied to which systems and at what times. Typically, a patch is applied in a permanent way (i.e. to storage), but in some cases, a patch is applied to memory (i.e. via a tool such as a debugger) in which case the change is lost when the resource is reloaded from storage.

Patch release

A patch release (often colloquially also known as a point release, dot release, or bugfix release) is a software release of a product or other project, especially one intended to fix bugs or do small cleanups rather than add significant features. Often, there are too many bugs to be fixed in a single major or minor release, creating a need for a point release.

Program temporary fix

In IBM terminology, a Program temporary fix or Product temporary fix (PTF), sometimes depending on date,^[10]^[11] is a single bug fix, or group of fixes, distributed in a form ready to install for customers.

A PTF normally follows an APAR (Authorized Program Analysis Report^[12]), and where an "APAR fix" was issued, the PTF "is a tested APAR"^[13] or set of APAR fixes. However, if an APAR is resolved as "Fixed If Next" or "Permanent Restriction" then there may be no PTF fixing it, only a subsequent release.

Security patch

A security patch is a change to correct the weakness described by a vulnerability. The corrective action prevents successful exploitation and removes or mitigates a threat's capability to exploit a specific vulnerability. Patch management is a part of vulnerability management – the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities.

Security patches are the primary method of fixing security vulnerabilities in software. Currently Microsoft releases its security patches once a month ("patch Tuesday"), and other operating systems and software projects have security teams dedicated to releasing the most reliable software patches as soon after a vulnerability announcement as possible. Security patches are closely tied to responsible disclosure.

These security patches are critical to ensure that business process does not get affected. In 2017, companies were struck by a ransomware called WannaCry which encrypts files in certain versions of Microsoft Windows and demands a ransom via BitCoin. In response to this, Microsoft released a patch which stops the ransomware from running.

Service pack

In computing, a service pack comprises a collection of updates, fixes, or enhancements to a software program delivered in the form of a single installable package. Companies often release a service pack when the number of individual patches to a given program reaches a certain (arbitrary) limit, or the software release has shown to be stabilized with a limited number of remaining issues based on users' feedback and bug reports. In large software applications such as office suites, operating systems, database software, or network management, it is not uncommon to have a service pack issued within the first year or two of a product's release. Installing a service pack is easier and less error-prone than installing many individual patches, even more so when updating multiple computers over a network, where service packs are common.

Service packs are usually numbered, and thus shortly referred to as SP1, SP2, SP3 etc.^[14] They may also bring, besides bug fixes,^[15] entirely new features, as is the case of SP2 of Windows XP (e.g. Windows Security Center), or SP3 and SP4 of the heavily database dependent Trainz 2009: World Builder Edition.^[16]

Unofficial patch

An unofficial patch, sometimes alternatively called a community patch, is a patch for a piece of software, created by a third party such as a user community without the involvement of the original developer. Similar to an ordinary patch, it alleviates bugs or shortcomings. Unofficial patches do not usually change the intended usage of the software, in contrast to other third-party software adaptions such as mods or cracks.

Remove ads

Process

Summarize

Perspective

Software update processes vary dramatically. Some notable processes are described here.

Firmware update

Updating firmware (i.e. motherboard BIOS) can be challenging when it involves replacing the entire image on the hardware. As such, an error or interruption during the update process, such as loss of power, may render the hardware unusable.

An update, a binary image, is often installed via a supplier-provided program that overwrite the existing image with another. This program may safeguard against serious damage. For example, the update procedure could make and keep a backup of the firmware in case it determines that the primary copy is corrupt (i.e. via a checksum).

Limited release

In the cases of large updates or of significant changes, distributors often limit availability of updates to qualified developers as a beta test.

Hot patching

Hot patching, also known as live patching or dynamic software updating, is the application of patches without shutting down and restarting the system or the program concerned. This addresses problems related to unavailability of service provided by the system or the program.^[17] Method can be used to update Linux kernel without stopping the system.^[18]^[19] A patch that can be applied in this way is called a hot patch or a live patch. This is becoming a common practice in the mobile app space.^[20] Companies like Rollout.io use method swizzling to deliver hot patches to the iOS ecosystem.^[21] Another method for hot-patching iOS apps is JSPatch.^[22]

Cloud providers often use hot patching to avoid downtime for customers when updating underlying infrastructure.^[23]

Slipstreaming

Slipstreaming is the act of integrating updates into the installation files of their original app, so that the result allows a direct installation of the updated app.^[24]^[25]

The nature of slipstreaming means that it involves an initial outlay of time and work, but can save a lot of time (and, by extension, money) in the long term. This is especially significant for administrators that are tasked with managing a large number of computers, where typical practice for installing an operating system on each computer would be to use the original media and then update each computer after the installation was complete. This would take a lot more time than starting with a more up-to-date (slipstreamed) source, and needing to download and install the few updates not included in the slipstreamed source.

However, not all updates can be applied in this fashion and one disadvantage is that if it is discovered that a certain update is responsible for later problems, that update cannot be removed without using an original, non-slipstreamed installation source.

Remove ads

References

Loading content...

Loading related searches...

Wikiwand - on

Seamless Wikipedia browsing. On steroids.

Remove ads

Management

Classification

Hotfix

Malicious update

Monkey patch

Patch

Patch release

Program temporary fix

Security patch

Service pack

Unofficial patch

Process

Firmware update

Limited release

Hot patching

Slipstreaming

See also

References