Linked by Thom Holwerda on Thu 19th Nov 2009 23:22 UTC
Windows Earlier this week, a senior National Security Agency official told US Congress that the NSA had worked on Microsoft's latest operating system, Windows 7. This spurred a flurry of rumours about the NSA building backdoors into Windows 7, but Microsoft has today categorically denied these claims.
Thread beginning with comment 395577
To view parent comment, click here.
To read all comments associated with this story, please click here.
umccullough
Member since:
2006-01-26

Anyway, it seems that you choices are: (a) enable a backdoor to your Windows system, or (b) manually check for updates all the time yourself (in which case stealth updates would probably happen anyway once you had manually checked), or (c) don't update.


There's a *huge* difference between setting the automatic updates setting, and disabling the service entirely.

If you're worried about someone slipping an update in that might open a door - then any system you use to install updates that you "trust" is just as fragile...

The only relatively sure way to prevent unwanted backdoors is to review the code and compile your OS yourself.

Reply Parent Score: 3

lemur2 Member since:
2007-02-17

"Anyway, it seems that you choices are: (a) enable a backdoor to your Windows system, or (b) manually check for updates all the time yourself (in which case stealth updates would probably happen anyway once you had manually checked), or (c) don't update.
There's a *huge* difference between setting the automatic updates setting, and disabling the service entirely. "

Not a lot of difference, if you then subsequently run a check for updates manually anyway. The only real difference is that you are not using an automatic scheduled timer to check for updates.

The backdoor mechanism is via the stealth updates. The only thing that you can disable is the automatic updates scheduler.

If you don't periodically manually run a check for updates, your system will not get updated at all. Security risk.

If you do periodically manually run a check for updates, that effectively allows the same stealth backdoor as the automatically scheduled updates. Backdoor.

You can either get owned, or you can get owned.

If you're worried about someone slipping an update in that might open a door - then any system you use to install updates that you "trust" is just as fragile... The only relatively sure way to prevent unwanted backdoors is to review the code and compile your OS yourself.


There is another way.

You could restrict yourself to installing only software which was auditable by people who:

(1) did not write that software, and
(2) are able to read and understand and audit source code, and who
(3) use the same code themselves for their own systems.

Since their interest is your interest, you get the benefit of their audit.

Edited 2009-11-20 03:34 UTC

Reply Parent Score: 2