Re: Microsoft updates Windows without users' consent
Jupiter Jones [MVP] wrote:
> "...should Ford decide to build that clause..."
> Totally irrelevant again as is much of your point.
> Vehicles can have some commonalities and this is not on.
Quite the contrary, Microsoft do write EULA additions that impact the
entire installation, which is fundamentally doubtful since any other
deal you "Sign" is done once signed unless BOTH parties decide on a new
one. However the EULA is far less of an issue than the clearly intended
deception in the dialog...
> "...if Ford did that..."
> then we would need to comply to the point of the law.
> But for now irrelevant.
>
> "NOT an important issue and that it is the users' fault"
> I never said that, ANOTHER assumption on your part.
Certainly sounds like you don't consider it important.
> "...updates can be turned off which they cannot."
> But they can and you know it.
> Your conveniently ignoring that fact does nothing for your point.
> Turn off the service and it is done with the usual note it will need to
> be enabled before Windows Update can function.
That is not what it says on the dialog and YOU KNOW IT. That's the whole
point and is what makes the deception clearly intentional. No amount of
sidestepping is going to change that.
> "Are you saying then that in future..."
> Not at all.
> You should stop such assumptions.
> You have shown yourself to be wrong in the past when making assumptions
> about me.
>
Not really, I assumed you to be a pompous self righteous ass and haven't
yet seen any indication that I got it wrong
People buy an OS for various reasons, Windows has tried to be all
singing all dancing, suitable for entertainment use and for important
business. Microsoft has long led the field in preaching "Trustworthy
Computing", despite the fact that for many years they concentrated on
the usability side rather than on the security side. This is proven time
and again by holes such as those left in IE and OE for years. Then,
suddenly, security became a selling point. A lot of more recent business
has been based around this "Security" model and I have found MS servers
to be as secure as anyone else's, with the condition that they are
patched, W2000 was, one hoped, the end of dubious default settings
leaving only actual flaws to deal with, however the philosophy of
"Integrating" a browser with the OS itself still had some of us doubting.
Of what remained, well, there was and still is ActiveX. This should have
been kept quite separate from the auto update functionality. Sure the
same kind of technology might be used, but frankly being able to "Scan"
my system for updates is, in effect, a vulnerability scan. I trust MS to
fix what they find, not abuse it, otherwise I would not entertain having
their OS in use at all. However if ActiveX can raise privileges to the
extent that it can alter vital OS components there is potential for a
problem. This is of course mitigated by the fact that the user has to
answer the question whether to go ahead or not but to make that judgment
one has to "Trust" Microsoft in the same way one "Trusts" their doctor,
to "Do no harm".
The problem with the lack of separation is that the update method only
raises the same kinds of ActiveX warnings that other things raise, with
the expectation that an ordinary user or a skilled user in a hurry will
correctly interpret what he sees. Why not clarify this by saying
"Microsoft Update needs your permission to..."
That way it's clear what is going on to the less skilled and easy to
read for the hurried. This is the same problem that continues with UAC
and why most, given the chance, will turn it off.
That is not to say other OS are considerably better, only that Windows
"Could" be better in this regard than any. We should be aiming to make
Windows better shouldn't we? Not explaining to people why it isn't but
that's what you get and would know that if you read the manual.
So people have expectations and they expect MS to not pull the kind of
sneaky trick some hacker might pull. True enough in this case no harm
seems to have been done, but were I the kind with ill intent I'd be
disassembling BITS to see how it got that privilege elevation and how it
used it stealthily. UAC for all the crap boasting about it did
absolutely NOTHING to improve security in this case, and there will be
others.