The Register

30 June 2002 Updated: 09:50 GMT

Biting the hand that feeds  IT


MS security patch EULA gives Billg admin privileges on your box

By Thomas  C Greene in Washington

Posted: 30/06/2002 at 05:56 GMT

If you caught our recent coverage of the Windows Media Player trio of
security holes you may have followed a link to the TechNet download site
for a patch, or you might have activated Windows Update. If you did the
former (though, oddly, not if you did the latter), you would have been
confronted with an End User License Agreement (EULA) stating, most
ominously, that:

"You agree that in order to protect the integrity of content and software
protected by digital rights management ('Secure Content'), Microsoft may
provide security related updates to the OS Components that will be
automatically downloaded onto your computer. These security related
updates may disable your ability to copy and/or play Secure Content and
use other software on your computer. If we provide such a security
update, we will use reasonable efforts to post notices on a web site
explaining the update."

"Reasonable efforts to post notices" somewhere on the Web. I think it's
clear from the wording that MS has absolutely no intention of bringing
this behavior to our attention.

Instead, Microsoft has just assumed the right to attack your computer and
surreptitiously install code of its choosing. You will not be warned; you
will not be offered an opportunity examine the download or refuse it. MS
will simply connect remotely and install what it will, or install it
secretly when you contact them.

This means MS will have administrator privileges on your personal
computer. What they feed you may be infected with viruses; it may break
your applications, corrupt data files, destroy weeks or months or even
years of work, but you'll have no recourse if it does. By downloading
this WMP critical security patch, which you must do to operate WMP
safely, you'll agree to give Billg deed and title to your personal
property and to leave Microsoft immune from legal retaliation if they
damage your machine.

The pusillanimity of wrapping what amounts to a digital land-grant into a
needed, critical security patch is matched only by the arrogance of
assuming that Windows is now such a fundamental linchpin of a human life
worth living that no retaliation in the courts or at the retail counters
is conceivable. (And that's not to mention 'informal' retaliation by
outraged IP warriors, which we fully expect to see.)

We've heard the Billg rubbish about Trustworthy Computing until we're
sick to death of the trivial incantation. Ironically, Microsoft has just
taken steps to make the Internet immensely more untrustworthy than it
already is. When we know that arbitrary code will be secretely installed
on our connected boxes by software vendors who are not accountable for
the damage they may do, any issue of trust is obliterated.

May I suggest my (personally) favorite solution to that problem?

Linux.

http://www.suse.com/index_us.html


VICUG-L is the Visually Impaired Computer User Group List.
To join or leave the list, send a message to
[log in to unmask]  In the body of the message, simply type
"subscribe vicug-l" or "unsubscribe vicug-l" without the quotations.
 VICUG-L is archived on the World Wide Web at
http://maelstrom.stjohns.edu/archives/vicug-l.html