Microsoft updates Windows without users' consent

It is not what I would expect but that is not the same as what is legal.
Do not confuse what we want or expect with what is legal because quite often
they are not the same.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Services
http://www3.telus.net/dandemar


"FIsc" wrote in message
oups.com...
On 13 sep, 18:05, Bruce Chambers wrote:
Silicon neuron wrote:

Microsoft has begun patching files on Windows XP and Vista without
users'
knowledge, even when the users have turned off auto-updates.

Actually, this is *not* being done _without_ user consent. Just
the
opposite. Every user of each operating systems has been given advance
notice that such things could happen, and has consented to it.

Read the Vista EULA. Section 7 makes it clear that this could happen:

================================================== ======================

You may switch off these features or not use them.

And what about this part? If it was done without user consent even
when automatic updates were not accepted, isn't this in breach with
their own rules?

Jupiter Jones [MVP] wrote:
It is not what I would expect but that is not the same as what is legal.
Do not confuse what we want or expect with what is legal because quite
often they are not the same.



You would not take that attitude if a car manufacturer made a misleading
statement about their products. You might accept a recall notice and
comply with it, but if Ford turned up at midnight and started towing
your car away to repair it I doubt you would be quite so happy with the
deceptive language.

Ford can't.
There is NOTHING in any agreement that even vaguely gives Ford that right
assuming I and not Ford own the vehicle.
If Ford did, I would seek a competent attorney.

You already know that but see it convenient to ignore that fact in a vain
attempt with this irrelevant comparison.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Services
http://www3.telus.net/dandemar


"Charlie Tame" wrote in message
...
You would not take that attitude if a car manufacturer made a misleading
statement about their products. You might accept a recall notice and
comply with it, but if Ford turned up at midnight and started towing your
car away to repair it I doubt you would be quite so happy with the
deceptive language.

On 16 sep, 20:43, "Jupiter Jones [MVP]"
wrote:
It is not what I would expect but that is not the same as what is legal.
Do not confuse what we want or expect with what is legal because quite often
they are not the same.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Serviceshttp://www3.telus.net/dandemar


Microsoft indicates themselves a user can refuse to have automatic
updates installed.

When a computer is accessed without the proper consent of the user
isn't this what hackers do and isn't this considered to be illegal?

You have been notified in the license.

"...isn't this considered to be illegal?"
If you want an actual legal opinion, as has been stated many times before,
you need to consult a lawyer specializing in licensing law.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Services
http://www3.telus.net/dandemar


"FIsc" wrote in message
ps.com...
When a computer is accessed without the proper consent of the user
isn't this what hackers do and isn't this considered to be illegal?

On Sun, 16 Sep 2007 12:42:21 -0700, "Jupiter Jones [MVP]"
wrote:

Ford can't.
There is NOTHING in any agreement that even vaguely gives Ford that right
assuming I and not Ford own the vehicle.
If Ford did, I would seek a competent attorney.

Yet your being some unabashed fanboy and Microsoft apologist you
willing give them rights to your first born or whatever else they
want. If you only had the intelligence to understand how stupid that
is, but we both know you don't.

Jupiter Jones [MVP] wrote:
Ford can't.
There is NOTHING in any agreement that even vaguely gives Ford that
right assuming I and not Ford own the vehicle.
If Ford did, I would seek a competent attorney.

You already know that but see it convenient to ignore that fact in a
vain attempt with this irrelevant comparison.


Wasn't exactly in vain, you answered it, and you are correct of course,
however one could argue, as you are doing for Microsoft, that Ford took
that measure "For your own good" since an accident might have occurred
had they not done so, and should Ford decide to build that clause into
future sales we therefore conclude that you'd have no problem with it.

Remember MS add bits to their EULAs all the time so if Ford did that and
included "The buyer agrees that in the event of an alternator failure
the entire vehicle becomes subject to this agreement" for their
replacement alternators some 5 years after you bought the car you would
consider the original sale "Deception".

The real problem is that Microsoft, in the settings dialogue do not say
"You can pretend to turn this off but not really", they clearly imply
that updates can be turned off which they cannot.

Any security minded professional would consider unannounced "Back doors"
into an OS to be a concern, simply because they are there, so frankly
your insistence that this is NOT an important issue and that it is the
users' fault for not reading deceptive language in such a frame of mind
as to "Expect" Microsoft to be dishonest goes against your own claim,
that we should believe Microsoft IS honest.

Are you saying then that in future we should "Expect" Microsoft to
mislead users with legal agreements, it sure seems like you are, and
that being the case the aforementioned professional with security in
mind has only one choice...

Adam Albright wrote:
On Sun, 16 Sep 2007 09:59:07 -0700, FIsc
wrote:

On 13 sep, 18:05, Bruce Chambers wrote:
Silicon neuron wrote:

Microsoft has begun patching files on Windows XP and Vista without users'
knowledge, even when the users have turned off auto-updates.
Actually, this is *not* being done _without_ user consent. Just the
opposite. Every user of each operating systems has been given advance
notice that such things could happen, and has consented to it.

Read the Vista EULA. Section 7 makes it clear that this could happen:

================================================== ======================

You may switch off these features or not use them.
And what about this part? If it was done without user consent even
when automatic updates were not accepted, isn't this in breach with
their own rules?


Microsoft is infamous for proclaiming "rules" only to break the rules
themselves. Classic example and what's getting a lot of noise now is
UAC and standard user. For YEARS Windows and every Microsoft product
was by DESIGN written to run as administrator. Until Vista, Windows
installed itself with one user, will full administrative rights unless
you changed it. Now the boys of Redmond bellow loudly that's not a
good idea, yet it was Microsoft that not only started the practice but
encouraged it. The biggest hypocrites of all are found at Microsoft!


You should be worrying about Identity Theft (some real damage) running
around out here on the Internet, instead of the BS.

FIsc wrote:
On 16 sep, 20:43, "Jupiter Jones [MVP]"
wrote:
It is not what I would expect but that is not the same as what is legal.
Do not confuse what we want or expect with what is legal because quite often
they are not the same.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Serviceshttp://www3.telus.net/dandemar


Microsoft indicates themselves a user can refuse to have automatic
updates installed.

When a computer is accessed without the proper consent of the user
isn't this what hackers do and isn't this considered to be illegal?




It's deception, plain and simple, no matter how much Jones cares to
pontificate about it.

The fact is that nobody has yet proven that this behavior is necessary.
Past behavior has been that Windows / Microsoft update will tell you
that your updating mechanism is out of date when you first check, no
reason has yet been given why that is no longer viable.

"...should Ford decide to build that clause..."
Totally irrelevant again as is much of your point.
Vehicles can have some commonalities and this is not on.

"...if Ford did that..."
then we would need to comply to the point of the law.
But for now irrelevant.

"NOT an important issue and that it is the users' fault"
I never said that, ANOTHER assumption on your part.

"...updates can be turned off which they cannot."
But they can and you know it.
Your conveniently ignoring that fact does nothing for your point.
Turn off the service and it is done with the usual note it will need to be
enabled before Windows Update can function.

"Are you saying then that in future..."
Not at all.
You should stop such assumptions.
You have shown yourself to be wrong in the past when making assumptions
about me.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Services
http://www3.telus.net/dandemar


"Charlie Tame" wrote in message
...
Wasn't exactly in vain, you answered it, and you are correct of course,
however one could argue, as you are doing for Microsoft, that Ford took
that measure "For your own good" since an accident might have occurred had
they not done so, and should Ford decide to build that clause into future
sales we therefore conclude that you'd have no problem with it.

Remember MS add bits to their EULAs all the time so if Ford did that and
included "The buyer agrees that in the event of an alternator failure the
entire vehicle becomes subject to this agreement" for their replacement
alternators some 5 years after you bought the car you would consider the
original sale "Deception".

The real problem is that Microsoft, in the settings dialogue do not say
"You can pretend to turn this off but not really", they clearly imply that
updates can be turned off which they cannot.

Any security minded professional would consider unannounced "Back doors"
into an OS to be a concern, simply because they are there, so frankly your
insistence that this is NOT an important issue and that it is the users'
fault for not reading deceptive language in such a frame of mind as to
"Expect" Microsoft to be dishonest goes against your own claim, that we
should believe Microsoft IS honest.

Are you saying then that in future we should "Expect" Microsoft to mislead
users with legal agreements, it sure seems like you are, and that being
the case the aforementioned professional with security in mind has only
one choice...

On Sun, 16 Sep 2007 15:44:17 -0500, Charlie Tame
wrote:

Jupiter Jones [MVP] wrote:
Ford can't.
There is NOTHING in any agreement that even vaguely gives Ford that
right assuming I and not Ford own the vehicle.
If Ford did, I would seek a competent attorney.

You already know that but see it convenient to ignore that fact in a
vain attempt with this irrelevant comparison.


Wasn't exactly in vain, you answered it, and you are correct of course,
however one could argue, as you are doing for Microsoft, that Ford took
that measure "For your own good" since an accident might have occurred
had they not done so, and should Ford decide to build that clause into
future sales we therefore conclude that you'd have no problem with it.

Remember MS add bits to their EULAs all the time so if Ford did that and
included "The buyer agrees that in the event of an alternator failure
the entire vehicle becomes subject to this agreement" for their
replacement alternators some 5 years after you bought the car you would
consider the original sale "Deception".

It seems the fanboy crowd is hung up on the principle involved. They
foolishly think Microsoft can do whatever it wants, much like George
Bush just ignores Congress or fires generals that don't do what he
wants. Relationships are built on TRUST. Two times now in recent
memory Microsoft has betrayed that trust. A couple weeks ago in
sheepishly admitted they 'my mistake, oh it was just human error'
marked perfectly legal copies of Vista as counterfeit and now
admitting they may on the sneak update your computer even when they've
told you that you have the option to turn off automatic updates. If or
not it is a good idea is totally irrelevant. It's the sneakiness of
what Microsoft always seems to get caught doing that ****es off
customers. Except of course for the moronic fanboy crowd that seems
too stupid to known or understand the consequences. The EULA is not a
one sided agreement. All contracts have rights for both parties.
Microsoft keeps ****ing on customer rights. THAT is what should and
does **** off smarter customers. Dummies will of course remain dummies
because they are dummies.

On Sun, 16 Sep 2007 14:13:20 -0700, "Jupiter Jones [MVP]"
wrote:


You should stop such assumptions.

You should put in a voucher for being a Microsoft apologist. You know
lobbyists working on behave of some other government need to register
as foreign agents. MVPs with their heads stuck up their ass should be
forced to register as Microsoft agents.

You have shown yourself to be wrong in the past when making assumptions
about me.

You are judged by what you post. Damn man, I've rarely see anybody get
off on pontificating and trying to hold court more then you obviously
do.

A great deal changed when Bush signed the recent security amendment Bill for
the NSA--at his request. Nothing is confidential any more. Use hushmail.com
if you want but you're still on an open system--we can still dream, though.

"Adam Albright" wrote in message
...
On Sun, 16 Sep 2007 15:44:17 -0500, Charlie Tame
wrote:

Jupiter Jones [MVP] wrote:
Ford can't.
There is NOTHING in any agreement that even vaguely gives Ford that
right assuming I and not Ford own the vehicle.
If Ford did, I would seek a competent attorney.

You already know that but see it convenient to ignore that fact in a
vain attempt with this irrelevant comparison.


Wasn't exactly in vain, you answered it, and you are correct of course,
however one could argue, as you are doing for Microsoft, that Ford took
that measure "For your own good" since an accident might have occurred
had they not done so, and should Ford decide to build that clause into
future sales we therefore conclude that you'd have no problem with it.

Remember MS add bits to their EULAs all the time so if Ford did that and
included "The buyer agrees that in the event of an alternator failure
the entire vehicle becomes subject to this agreement" for their
replacement alternators some 5 years after you bought the car you would
consider the original sale "Deception".

It seems the fanboy crowd is hung up on the principle involved. They
foolishly think Microsoft can do whatever it wants, much like George
Bush just ignores Congress or fires generals that don't do what he
wants. Relationships are built on TRUST. Two times now in recent
memory Microsoft has betrayed that trust. A couple weeks ago in
sheepishly admitted they 'my mistake, oh it was just human error'
marked perfectly legal copies of Vista as counterfeit and now
admitting they may on the sneak update your computer even when they've
told you that you have the option to turn off automatic updates. If or
not it is a good idea is totally irrelevant. It's the sneakiness of
what Microsoft always seems to get caught doing that ****es off
customers. Except of course for the moronic fanboy crowd that seems
too stupid to known or understand the consequences. The EULA is not a
one sided agreement. All contracts have rights for both parties.
Microsoft keeps ****ing on customer rights. THAT is what should and
does **** off smarter customers. Dummies will of course remain dummies
because they are dummies.

Jupiter Jones [MVP] wrote:
"...should Ford decide to build that clause..."
Totally irrelevant again as is much of your point.
Vehicles can have some commonalities and this is not on.



Quite the contrary, Microsoft do write EULA additions that impact the
entire installation, which is fundamentally doubtful since any other
deal you "Sign" is done once signed unless BOTH parties decide on a new
one. However the EULA is far less of an issue than the clearly intended
deception in the dialog...




"...if Ford did that..."
then we would need to comply to the point of the law.
But for now irrelevant.

"NOT an important issue and that it is the users' fault"
I never said that, ANOTHER assumption on your part.



Certainly sounds like you don't consider it important.





"...updates can be turned off which they cannot."
But they can and you know it.
Your conveniently ignoring that fact does nothing for your point.
Turn off the service and it is done with the usual note it will need to
be enabled before Windows Update can function.



That is not what it says on the dialog and YOU KNOW IT. That's the whole
point and is what makes the deception clearly intentional. No amount of
sidestepping is going to change that.




"Are you saying then that in future..."
Not at all.
You should stop such assumptions.
You have shown yourself to be wrong in the past when making assumptions
about me.


Not really, I assumed you to be a pompous self righteous ass and haven't
yet seen any indication that I got it wrong


People buy an OS for various reasons, Windows has tried to be all
singing all dancing, suitable for entertainment use and for important
business. Microsoft has long led the field in preaching "Trustworthy
Computing", despite the fact that for many years they concentrated on
the usability side rather than on the security side. This is proven time
and again by holes such as those left in IE and OE for years. Then,
suddenly, security became a selling point. A lot of more recent business
has been based around this "Security" model and I have found MS servers
to be as secure as anyone else's, with the condition that they are
patched, W2000 was, one hoped, the end of dubious default settings
leaving only actual flaws to deal with, however the philosophy of
"Integrating" a browser with the OS itself still had some of us doubting.

Of what remained, well, there was and still is ActiveX. This should have
been kept quite separate from the auto update functionality. Sure the
same kind of technology might be used, but frankly being able to "Scan"
my system for updates is, in effect, a vulnerability scan. I trust MS to
fix what they find, not abuse it, otherwise I would not entertain having
their OS in use at all. However if ActiveX can raise privileges to the
extent that it can alter vital OS components there is potential for a
problem. This is of course mitigated by the fact that the user has to
answer the question whether to go ahead or not but to make that judgment
one has to "Trust" Microsoft in the same way one "Trusts" their doctor,
to "Do no harm".

The problem with the lack of separation is that the update method only
raises the same kinds of ActiveX warnings that other things raise, with
the expectation that an ordinary user or a skilled user in a hurry will
correctly interpret what he sees. Why not clarify this by saying
"Microsoft Update needs your permission to..."

That way it's clear what is going on to the less skilled and easy to
read for the hurried. This is the same problem that continues with UAC
and why most, given the chance, will turn it off.

That is not to say other OS are considerably better, only that Windows
"Could" be better in this regard than any. We should be aiming to make
Windows better shouldn't we? Not explaining to people why it isn't but
that's what you get and would know that if you read the manual.

So people have expectations and they expect MS to not pull the kind of
sneaky trick some hacker might pull. True enough in this case no harm
seems to have been done, but were I the kind with ill intent I'd be
disassembling BITS to see how it got that privilege elevation and how it
used it stealthily. UAC for all the crap boasting about it did
absolutely NOTHING to improve security in this case, and there will be
others.

"Certainly sounds like you don't consider it important."
Your selective reading has led you to false assumptions before.

"Quite the contrary"
Not at all, your comparison with Ford was irrelevant.

--
Jupiter Jones [MVP]
Windows Server System - Microsoft Update Services
http://www3.telus.net/dandemar


"Charlie Tame" wrote in message
...

Quite the contrary, Microsoft do write EULA additions that impact the
entire installation, which is fundamentally doubtful since any other deal
you "Sign" is done once signed unless BOTH parties decide on a new one.
However the EULA is far less of an issue than the clearly intended
deception in the dialog...




"...if Ford did that..."
then we would need to comply to the point of the law.
But for now irrelevant.

"NOT an important issue and that it is the users' fault"
I never said that, ANOTHER assumption on your part.



Certainly sounds like you don't consider it important.





"...updates can be turned off which they cannot."
But they can and you know it.
Your conveniently ignoring that fact does nothing for your point.
Turn off the service and it is done with the usual note it will need to
be enabled before Windows Update can function.



That is not what it says on the dialog and YOU KNOW IT. That's the whole
point and is what makes the deception clearly intentional. No amount of
sidestepping is going to change that.




"Are you saying then that in future..."
Not at all.
You should stop such assumptions.
You have shown yourself to be wrong in the past when making assumptions
about me.


Not really, I assumed you to be a pompous self righteous ass and haven't
yet seen any indication that I got it wrong


People buy an OS for various reasons, Windows has tried to be all singing
all dancing, suitable for entertainment use and for important business.
Microsoft has long led the field in preaching "Trustworthy Computing",
despite the fact that for many years they concentrated on the usability
side rather than on the security side. This is proven time and again by
holes such as those left in IE and OE for years. Then, suddenly, security
became a selling point. A lot of more recent business has been based
around this "Security" model and I have found MS servers to be as secure
as anyone else's, with the condition that they are patched, W2000 was, one
hoped, the end of dubious default settings leaving only actual flaws to
deal with, however the philosophy of "Integrating" a browser with the OS
itself still had some of us doubting.

Of what remained, well, there was and still is ActiveX. This should have
been kept quite separate from the auto update functionality. Sure the same
kind of technology might be used, but frankly being able to "Scan" my
system for updates is, in effect, a vulnerability scan. I trust MS to fix
what they find, not abuse it, otherwise I would not entertain having their
OS in use at all. However if ActiveX can raise privileges to the extent
that it can alter vital OS components there is potential for a problem.
This is of course mitigated by the fact that the user has to answer the
question whether to go ahead or not but to make that judgment one has to
"Trust" Microsoft in the same way one "Trusts" their doctor, to "Do no
harm".

The problem with the lack of separation is that the update method only
raises the same kinds of ActiveX warnings that other things raise, with
the expectation that an ordinary user or a skilled user in a hurry will
correctly interpret what he sees. Why not clarify this by saying
"Microsoft Update needs your permission to..."

That way it's clear what is going on to the less skilled and easy to read
for the hurried. This is the same problem that continues with UAC and why
most, given the chance, will turn it off.

That is not to say other OS are considerably better, only that Windows
"Could" be better in this regard than any. We should be aiming to make
Windows better shouldn't we? Not explaining to people why it isn't but
that's what you get and would know that if you read the manual.

So people have expectations and they expect MS to not pull the kind of
sneaky trick some hacker might pull. True enough in this case no harm
seems to have been done, but were I the kind with ill intent I'd be
disassembling BITS to see how it got that privilege elevation and how it
used it stealthily. UAC for all the crap boasting about it did absolutely
NOTHING to improve security in this case, and there will be others.