Online Patching Systems?

Master_Flash asks: "My company is preparing to distribute an online Windows application that will change over time (don't they all?). We been evaluating online patch systems. There are a number of commercial applications out there. Some look good: RTPatch from PocketSoft, ASTA Binary Patcher, and Necromancer's FlashUpdate. Has anyone had a positive experience with these or other applications? One other idea we had was to use CVS as a patching system. While CVS isn't technically a binary patch it does a great job at checking on which files need to be updated. Most of the files we have are small and change infrequently, so CVS could work. Opinions and guidance are welcome."

Mod parent up!

[xilmaril]

it's cryptic, confusing, and apparently making a stab in the dark at witty and insightful! it's everything slashdot has been aspiring for over the years!

(p.s. -- huh? does this make as much sense to everyone else, or am I just a nitwit?)

Not CVS!

[moosesocks]

CVS is overly bandwidth and cpu-intensive both client-side and server side. I believe that there are various forks of it which are more efficent.

But, I digress. CVS was not designed for this. Rsync was designed almost percisely for something like this. It only transferres the parts of the file which have been modified, and compresses it as well.

But, why not simply use installshield or a similar tool like all other windows developers and just release periodic updates (which fits the model for windows software, which, IMO is quite diferent than the linux model (make many releases and many patches, while windows and MAC lean twoard making a few periodic releases, only patching where there is a severe flaw).

I'm not saying that one model is any better, i'm just saying that you need to keep consistancy.

Hmm... BITS?

[Leffe]

An article on the MSDN [microsoft.com] that might be helpful, it details BITS, a part of the .NET Framework.

I'm not erally sure if it's helpful or not as I haven't read much of it, but I'll post a quote out of it ;)

[I] have to admit, I love the Windows(R) Update feature. My computer is connected to the Internet about 85 percent of the time that it is turned on and yet, like most people, I certainly don't use the network that much. Windows XP takes advantage of this unused bandwidth by comparing the most recent service p

Patchlink

[teridon]

The government installation at which I work will soon deploy Patchlink [patchlink.com], mainly for security updates. However, since it hasn't happened yet, I can't offer you any feedback. There are links to some ROI studies on their website.

No patch manager. But....

[FreeLinux]

My company is preparing to distribute an online Windows application that will change over time (don't they all?).

First question is; What is an online Windows application? Is this a web application or a Windows application? Or is it some totally new type of application?

The second thing is that, while bugs are inevitable and patches will almost certainly be a fact of life, are you sure that this appication is really as ready and as thoroughly tested as it could be? Or is this another rush to market job tha

Re:No patch manager. But....

[Mage Powers]

A guess:
An online windows application is a program that depends on an internet server to be useful, MMORPG, stock market, instant messenger kinda fall under this category

Re:No patch manager. But....

[SirTalon42]

like spamware and adware...

MSI and MSP

[stonebeat.org]

For windows env I would use MSI technology. MSP can be used to deply patches. Wise [wise.com] has lot of good easy to use applications designed for deployment of MSIs and MSPs.

this is a subject

[Deternal]

If it's online, wouldn't java webstart do the trick? :D

Anyway another obvious way is for the server to push updates to the client when the admin approves it (like Domino/notes does).

Or have a central ressource and the client checks for updates (like Azureus).

Basically the best way is making it easy on bandwith, for admins and for users - the domino/notes approach does this (set up on server, approve, client gets notify to update - a few tricks are pushed to the client, client restarts and voila new version).

Anyway, the 'thing' you are building will dictate what kind of system you should use. Just don't expect a corporate admin to go around 200 machines on foot because you made some kind of lame updater which only works with admin privs, because they simply wont, instead they'll push for "the better version from company Y".

Heh...

[GiveMeLinux]

Just do it the best way history has shown how: send out "Critical Windows Update Patch" emails...

RTPatch

[EvlG]

I've used it before, it works really well.

It can be a little slow to generate the patches (I found that having 2 physical hard disks helped, 1 for input and 1 for output) but the resultant patch is quite optimized.

The tools are perhaps a little old feeling, with scripts and command line compilation tools, but on the whole the product works really well.

I call "Bullshit".

[adjuster]

Forgive me-- if the audience for your application is strictly home users, then disregard everything I say below. If, however, your audience includes corporate LAN's, listen the fuck up.

I shudder every time I hear an app. manufacturer talking about their "innovative" online patch delivery systems. Frequently, "innovative" online patch delivery systems cover up for shitty software QA.

I am a network administsrator. I have to keep PC's, servers, and the applications running therein working properly. I have a lab. I test patches in that lab. I make sure that things continue to work. I don't want you to patch your fucking app without going thru me.

It's a 'doze application. Package the application as an MSI. Expect that it will be deployed with IntelliMirror. Issue MSP's when you need to patch the application. Problem solved.

Re:I call "Bullshit".

[emf]

Looks like you picked the wrong week to quit drinking coffee eh? :)

Re:I call "Bullshit".

[innosent]

Yeah, grab some coffee and a cigarette, but I hear you. Don't automatically patch systems that you don't manage. For in-house software that's been tested, let the clients pull updates automatically (once approved and made available), but for software distributed to other companies, let the user/administrator choose whether or not to pull updates, ideally so that a few machines can test your patches first.

Also, don't be like Microsoft. If you're going to have updates, make sure that every machine that is

Roll Your Own!

[billcopc]

I made a very simple live update system way back. It involved having all the latest files on a network share. Quite simply, every time the application was launched it would check that share for any files newer than its own and copy them over (thanks to a 30kbyte stub loader). Result: anyone who used my software was assured to have the latest version, and as a bonus if they were using it and it crashed, chances are they'd get a fix when they tried to reload it :)

I later used a variation on that scheme that involved a cron job on the server, checking regularly for new commits to the shared folder. It would then calculate windowed hashes of each file and the client update app would simply compare the server's hashes with its own (cached) hashes. This enabled me to minimize download times since it would only download the chunks that had been changed (in the case of large data heaps). It's not foolproof since I didn't do any insert/delete logic (add 1 byte to the beginning of the file and the rest is immediately invalidated)... but it was simple enough to justify the occasional forethought when releasing updates. It's like a castrated embedded version of rsync :) Damned easy to code too.

Considering the hell I've been thorugh with RTPatch and its ever-flaky software, it would be well worth writing my own smart binary diff (with proper shuffling detection and compression). These things really aren't that complicated to implement and the advantage of rolling your own is that you can include extra logic tailored for your application (or for that particular client).

InstallShield

[Mark Pitman]

We use InstallShield at the company I work for. Just build your initial installation as an MSI (Windows Installer) package and either release subsequent MSI's to either install or upgrade or release a MSP which will patch the software that is already installed. You can try to figure out a "better" way, but really, Windows Installer is what pretty much every Windows user is used to.

Re:InstallShield

[engeeke]

I agree that InstallShield is a pretty good solution, but keep in mind that you've got to author your initial MSI properly or upgrades and patching will be very difficult. I've had to upgrade MSIs that weren't build properly initially (lots of "AllOtherFiles###" components, dynamically linked components, missing upgrade table, etc.), and if you don't build that first MSI properly then you're piling hacks on top of hacks. Spend a few bucks on a consultant [exotribe.com] or ask an expert for some free advice [mailto] if you need

Several Options

[justanyone]

1. Marimba [marimba.com] Castanet (I know, I love to hate them, too) has a technology that provides auto-updates to files on a box, and can even be scripted to stop and restart the process. I have used this and while it is expensive, somewhat complex internally, and a bit slow, it does work, and is highly scalable to 10,000+ boxes quite easily.

2. Rsync (a very common open-source Samba project) [samba.org] will synchronize files across a network, sending only the file differences, handling file deletion if so requested, etc. Ver

port blocking

[iamcadaver]

Port blocking is RAMPANT now.

It *has* to work over either port 80 or 443, or it is a non-viable option. Period.

I'd go with xdelta or rsync, compiled/configured for port 443, and a good web frontend.