The fact that Office won't install patches without the original media or the
source files has, of course, been around since Office 2000.
This behaviour originates from the design of Windows Installer, and was so
badly botched in the case of Office 2000 that Microsoft Australia were given to
replacing Office 2000 disks with Office 2000 SR-1 disks because it become
impossible to patch certain versions of Office 2000 RTM.
Of course now we know Microsoft themselves consider this Windows Installer
behaviour to be a huge failure because Office 2003 will offer to cache the
setup files! So presumably the Office team haven't been able to request any
design changes of the Windows Installer team so they've given up and worked
around it.
But the need to cache 500Mb of setup files just so you can update half-a-dozen
files in the future is a pretty lame scheme and the fact that such a rigmarole
is required to do this is an immense cock-up, IMHO.
Fortunately Office has not been the attack surface for as many serious exploits
as the number of patches would suggest, so Microsoft has not needed to make any
serious changes to this architecture. Perhaps we need a really serious outbreak
to force some changes and make it simpler to keep Office updated, cf. where the
Slammer worm forced a reworking of the SQL Server patch installer. Seriously,
it should be possible to update Office with a flat directory of updated
binaries and a batch file. MS need to stop dreaming up reasons why things are
impossible. It's only software -- you can do anything with it you want!
It's funny that in the case of .NET and now SQL Server 2005 Express they make a
big fuss over so-called XCOPY deployment in recognition of the fact that
dropping updated files without a complicated local registration process is a
much better way to get something done. Yet you can't drop an updated
WINWORD.EXE in the Office directory.
Geoff Vass
-----Original Message-----
From: Windows NTBugtraq Mailing List
[mailto:NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM]On Behalf Of Fish
Sent: Saturday, 18 September 2004 11:52
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Windows Update / Office Update again!
-----
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such
that just hitting reply is going to result in the message coming to the list,
not to the individual who sent the message. This was done to help reduce the
number of Out of Office messages posters received. So if you want to send a
reply just to the poster, you'll have to copy their email address out of the
message and place it in your TO: field.
-----
