Linked by Thom Holwerda on Fri 14th Sep 2007 14:02 UTC, submitted by tux68
Windows Microsoft has begun patching files on Windows XP and Vista without users' knowledge, even when the users have turned off auto-updates. Many companies require testing of patches before they are widely installed, and businesses in this situation are objecting to the stealth patching. "Normal behaviour," according to Microsoft.
Thread beginning with comment 271248
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: :-/
by dylansmrjones on Fri 14th Sep 2007 14:28 UTC in reply to ":-/"
dylansmrjones
Member since:
2005-10-02

Well, from a security-POV Microsoft could hardly do it much different.

MS of course has the following options:

1) Install updates to WU automatically if WU is set to "automatic updates"

2) Download updates to WU automatically if WU is set to "automatic downloads" and notify the user that the updates are ready to be installed. However! The user must be notified that WU will not work if the updates are not installed.

3) Nofify the user of updates to WU if WU is set to "Notify only". However! The user must be notified that WU will not to work if the updates are not installed.

The downside of doing 2) and 3) is that the user will not know about important updates until the user has updated the Updater (which is difficult to formulate properly, as Kroc proved with his earlier post.. heehee).

From a security-oriented POV Microsoft has not been unethical. From a privacy-oriented and technological POV Microsoft has handled in part unethical and in part incompetent.

But it doesn't mean that MS is trying to take over your computer (they may be doing that, but not through WU).

Reply Parent Score: 5

RE[2]: :-/
by mcduck on Fri 14th Sep 2007 14:33 in reply to "RE: :-/"
mcduck Member since:
2005-11-23

What Microsoft should have done is to inform of this in WU. No part of a operating system should be self-updating without written notice of what parts gets self-updated, and why.

Also, from a security standpoint, i think this is bad.

WU is propriary. We dont know how it validates new self-updates. What if Microsoft WU servers get hacked, and millions of Windows machines starts to automaticlly download compromised code?

Edited 2007-09-14 14:34

Reply Parent Score: 9

RE[3]: :-/
by dylansmrjones on Fri 14th Sep 2007 14:48 in reply to "RE[2]: :-/"
dylansmrjones Member since:
2005-10-02

Well for me it ain't a risk, since my firewall blocks Windows Update unless I specifically allow WU to contact the servers ;)

Remember, the Windows Update servers do not contact your machine. It is your machine that contact the Windows Update servers.

If the servers are compromised people using automatic download/installation/notification are in (a rather hypothetical) risk. It's however only a matter of having a properly configured firewall - and not the built-in btw.

Reply Parent Score: 3

RE[3]: :-/
by sappyvcv on Fri 14th Sep 2007 15:11 in reply to "RE[2]: :-/"
sappyvcv Member since:
2005-07-06

What happens if ANY update servers (including those hosted by debian, redhat, apple, etc) get hacked? A lot of people are screwed.

Reply Parent Score: 1

RE[3]: :-/
by kaiwai on Sat 15th Sep 2007 04:31 in reply to "RE[2]: :-/"
kaiwai Member since:
2005-07-06

Also, from a security standpoint, i think this is bad.


True; this was raised from another point of view; what happens if someone can find how it works and attract the end users machine from that vector - using an apparent 'legitimate' open door where by the WU can be updated to point to an illegitimate source and thus, ability to deploy false updates which are actually anything ranging from adware to spyware to virus's.

The issue I think which people forget, and you have raised in your post is this; the issue isn't necessarily privacy per say but how this 'technology' can be exploited.

Reply Parent Score: 3

RE[2]: :-/
by looncraz on Fri 14th Sep 2007 19:08 in reply to "RE: :-/"
looncraz Member since:
2005-07-24

It is very easy to remedy. You simply have the updater update itself when you check for updates.

The updater informs the user about the need for the update every time a manual update check is attempted, they have to do it to use the current update system.

Simple. Very simple. No need to do anything automatically.

Of course, I think automatic updates ( auto-download-install ) is The Dumbest Idea Ever(R).

--The loon

Reply Parent Score: 2

RE[3]: :-/
by sappyvcv on Fri 14th Sep 2007 19:53 in reply to "RE[2]: :-/"
sappyvcv Member since:
2005-07-06

But it can't check for updates without the updater update. In 3 of the 4 settings, the updater automatically checks for updates, which is when you say its ok for it to update itself.

The 4th setting, according to some people, doesn't automatically update the updater anyway.

Reply Parent Score: 2