Examining Microsoft Update

eggsovereasy writes "The Inquirer is reporting that a group in Germany has deciphered the information sent to Microsoft during an update using Windows Update and says that information on all software installed on your computer is sent, even that which is not Microsoft's own software." The original article is, unfortunately, pay-per-view. Update: 02/26 18:19 GMT by T : ionyka points to this "related article from ITWorld that deals with Microsoft's transferring of information through Windows Media Player. When you open up Media Player it sends information back to Microsoft like what movies you play, what songs you listen to and where they come from."

Comments

Surprise, surprise...

[stevenbdjr]

I mean really, did anyone actually think M$ only collected information about patches? It seems like any chance they get to know more about you, or your "computing habits", they're going to take it.

Re:Surprise, surprise...

[wilstephens]

The manufacture's website was in Japanese only, and I had no idea how to navigate let alone install a Japanese application.

And, yes, I am lazy. How did you know?

Re:Surprise, surprise...

[Anonymous Coward]

Microsoft needs to collect this information for driver updates and other *useful* updates.

No they don't. They can just send a list of updates to the client, and the client can display the updates that apply to your computer. This is why Microsoft can claim no information is being sent to their server: because sending information isn't necessary.

This is actually how APT works.

Re:Surprise, surprise...

[Anonymous Coward]

So you have to remember who manufactured all of your hardware, then individually trawl through their sites and hope they keep old drivers on there? Sounds like Linux-style usability to me. I much prefer Microsoft's style of doing it: fast and easy, because I like being lazy.

Re:Surprise, surprise...

[Ian Wolf]

If I tell windows to look for the drivers for a particular device than by all means probe the device for information about it. How does scanning all installed applications aid in this endeavor?

If the reasoning was to better detect and avoid application conflicts I would possibly agree with this method, but the software clearly doesn't do that.

Re:Surprise, surprise...

[Ballsy]

Never confuse "Lazy_ass_user computing" with "computing for people who have better things to do with their time than fuck around searching for drivers on some poorly designed manufacturer website".

Re:Surprise, surprise...

[Anonymous Coward]

The more data that gets sent to microsoft, the harder it becomes to manage. Someone should figure out a way to send them Junk data with wrong version numbers. Windows 3.11 running IE 6.0... that'll leave them scratching there heads.

Re:Surprise, surprise...

[Tellarin]

so this person with a so precious time should think twice before buying products from a company with such a "poorly designed website" or that don't ship a version of the drive with the product

Re:Surprise, surprise...

[Yort]

Fast. Easy computing. That's why I pay for my software..

Riiiiiight. WindowsXP (and maybe Win2000) is the first time Windows FINALLY got some of this stuff working. Have you ever tried to find a driver for your system with Win95/98/ME? Holy crap is it stupid. I mean, come on - Windows couldn't even find the driver that was on THE SAME FREAKING DISC that the OS was installed from?

I'm sorry, but I've worked with Windows too much to buy that it's "fast, easy computing." It's only fast and easy for those who have people like me fix their problems for them...

Troy

Re:Surprise, surprise...

[Xformer]

Even if the poorly designed manufacturer's website is the only one with the working driver?

I had a bad experience along those lines with the Windows Update site, where a particular sound driver (I forget which, at the moment) from them would not work with my hardware, where the one from the manufacturer's website did.

Re:Surprise, surprise...

[japhmi]

But why send a complete list of all of the programs on the computer? Why not send "Windows 98 SE, IE 6.0," and a few things that windows update can actually help with, and not that I am using the WordPerfect suite and not MSOffice (quick, apply the "SlowWordPerfect() operation! and the MakeMozillaCrawl() one two!)

I know it's a bit of paranoia, but I'd rather them not know what I've got running at all, but I'll let them know what MS software I have because that's what I'm getting fixes for.

Re:Surprise, surprise...

[forgetful_ca]

Never confuse "Fast, Easy Computing" with "Lazy_ass_user computing".

Not only that, but using ms update restricts you to using ms signed drivers. I for one don't wish to give ms that particular club to wield over anyone. They've proven to me they aren't responsible enough to be far to anyone, so I don't think they are entitled to be the judge of anything that makes it to my machine.
Secondly, there's no way I can believe that ms would acquire your data and subsequently throw it away. None. They are gathering stats and keeping them.

Re:Surprise, surprise...

[Hal Roberts]

There are still solutions that allow no meaningful information to be sent. For example, why not have the client just ask for new updates since a given date and cache the rest? That took me all of about 15 seconds to think up and would result in far less bandwidth use than sending the user every upgrade applicable to her system every time she connects.

Either 1) privacy is just not a factor for the folks at all or 2) they want the data for other uses. Most likely it's the former, but the fact that the makers of the 95% market share OS don't care enough about privacy to make it even a small concern when designing systems like this is Really Scary, maybe scarier than them purposefully collecting my data, because at least then there's the possibility that they'll be careful with my data once they've got it.

Re:Surprise, surprise...

[1010011010]

Microsoft doesn't offer updates for SQL Server or Office, or Photoshop for that matter, via WindowsUpdate. So why do they need that information to NOT supply updates for those programs?

Re:Surprise, surprise...

[Zeinfeld]

Very profound statement with out any proof or attempt to back it up.

Well heck, the article being pay per view almost nobody in the thread is likely to have read it. Why bother to read the article?

There are a bunch of Win98 programs which are known not to work properly under XP. Every so often Microsoft issues a set of patches that allow these to work properly.

Haha

[mao che minh]

Remember the little "No information is being sent to Microsoft at this time...." message during updates? Wait, why am I laughing?

Re:Haha

[duckpoopy]

Their defense: The information is sent right before this message appears.

Re:Haha

[Ian Wolf]

A cow-orker of mine actually argued with me one day that "No Information" really meant nothing, nada, zilch was sent back to MS.

I should have taken him out back and beaten him with a frozen salmon. Hello!? How do they know what patches you need if they can't look at your system and tell their servers what you've already got.

The fact that the program takes the time to rifle through the system is of no surprise to me. While, I think the practice stinks it hasn't stopped me from using the service though. Given the choice between MS finding my installation of UT2003 or some script kiddie looting my system, I'll choose the former.

Re:Haha

[AyeRoxor!]

"I should have taken him out back and beaten him with a frozen salmon. Hello!? How do they know what patches you need if they can't look at your system and tell their servers what you've already got."

They could send a complete list of available patches to your system and let the client running on your computer pick which ones are neccesary, without microsoft ever knowing what software you have installed. Granted, they could deductively determine what hardware you use based on what patches you then request, but since you can only download patches for microsoft software, the best they could do would be to determine what hardware and microsoft software you currently have installed.

Re:Haha

[squiggleslash]

Hello!? How do they know what patches you need if they can't look at your system and tell their servers what you've already got.

Quite easily, IF they wanted to be bothered. Instead of the server deciding what to download, you have a program on the computer do it.

The process would look something like:

1. Client downloads latest Update Management Software + Config File from server
2. Client runs Update Management Software.
3. UMS determines what patches are needed from inbuilt logic and information in configuration file
4. UMS downloads and applies relevent patches

The system isn't fool proof. It may be possible for someone operating a system this way to determine what software you're running from the nature of the patches downloaded, especially if all patches are downloaded from one source. This can, to some extent, be reduced by bundling patches together so that someone running one of eight different programs or with one of nine different hardware devices attached, downloads a file with the patches for all problems associated with these eight programs or nine devices. But that requires honesty and integrity on the part of the operator of the Update service.

The allegation that Microsoft doesn't do this, and lies to users by claiming it does, is quite damning. There's no need for Microsoft to get this information in order to provide the advertised service, and it should be able to stand by its claim that it does not get that information.

Re:Haha

[Gunzour]

You cow-orker was right. When Microsoft Update said "No information is being sent to Microsoft", no information -- at all -- was being sent to Microsoft. The update server sent your computer a list of available updates, and code ran on your computer which determined which ones were necessary.

Microsoft Update no longer says "No information is being sent...", which is what this article is about.

Re:Haha

[skinfitz]

Remember the little "No information is being sent to Microsoft at this time...."

The more astute amongst you may have noticed that the "No information" message has not been there since Win2kSP3 came out.

Now it says this:

Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you.

Which essentially means that so long as they don't take an email address or phone number they can take what they want.

Re:Haha

[adamfranco]

Well, most of the Linux package/RPM managers allow you to accomplish the same sort of updates without sending out all of your system information. They also seem to work quite well (although I have only used aptget/synaptic and RedCarpet). Just tell the client everything availible. Hell, then we could even CHOOSE what we wanted to update, or just click "everything" to get all new updates.

Re:Haha

[Zocalo]

Frankly, I've always wondered why they didn't adopt this approach in the first place. Not only would it have avoided all the issues with privacy that people get all worked up about, but has the potential to be extended to third party apps too. All you would need is a local database of vendor/server(s) to tell the local client which server to go to for your updates which could be ammended by any software during it's install process. There is an issue with re-pointing a vendor's update server to another offering a trojan disguised as a patch, so you'd need a security mechanism, but apart from that...

Hell, since this is Microsoft we're talking about, they could have even *sold* the back-end update server software to the third parties and made a few more dollars for Bill to roll around in.

Re:Haha

[edsel]

The message reads: "Note Windows Update does not collect any form of personally identifiable information from your computer"

I think that it used to say something like: "No information will be sent to Microsoft"....

Their privacy policy states that they check your system for a valid Windows license.

Re:Haha

[Muddle]

What download?
A download is a file that you have and can keep so you don't have to download it the next time your system crashes.
There is no way to keep the update, patch, or driver now so how is that a download.
Sure one can go to the corporate site and download update's however not all patches and updates are made available there.
One used to be able to go to the Temporary Internet File folder and copy and paste the file to another folder however one cannot even do that now.
It's remote installation but it is not a download in any way shape or form as the files are not saved to disk for future use.
For example the hoops one has had to jump through to install the latest secure version of MSJava left a bad taste in my mouth so I downloaded Sun Java and now use it.
Microsoft stated that one should remove them from trusted sites status due to a problem with COM and certificates which to my knowledge still hasn't been properly fixed. Anyone with Active X enabled in Internet Zone is an Idiot and Microsofts Windows Update does not work without these settings. This lead's me to belive that it was one more attempt to ruin Sun.

Re:Haha

[Malc]

What about IP address? That can be used to identify you. That'll be in the IIS logs for sure.

Re:Haha

[pmz]

The process would look something like:

1. Client downloads latest Update Management Software + Config File from server
2. Client runs Update Management Software.
3. UMS determines what patches are needed from inbuilt logic and information in configuration file
4. UMS downloads and applies relevent patches


XEmacs does exactly this! It works pretty well from what I've seen.

Re:Haha

[sckeener]

None of this configuration information can be used to identify you.

They might not be able to identify you, but they can identify the machine at least for XP. Since XP requires registration, I'd say they know your machine and who paid for XP to go on there.

I wouldn't be surprised if at some later date they claim this is for the catch all 'security reasons.'

Re:Haha

[mobiGeek]

It would be a [] huge file... it would have to send all patches of all time

I strongly suspect that it would be smaller than that of, say, Red Hat's RHN since MS is only worried about the OS and a few of its software titles. RHN on the other hand offers thousands of packages.

And even if the list was quite massive, why would it have to resend everything all the time? Why not send a list of the changes since the last time the user downloaded (the client could say "everything since 2003/01/21 08:45:00" or something similar).

If RHN and other upgrades can download a list of packages, why can't MS? They not smart enough? No, the answer is that they don't get enough "feedback" when they do it that way.

During the beta of Win95 they tried this trick and the press was all over them. They realized they made a mistake introducing such a shocking "big brother" utility at the same time that they were releasing such a major product. Instead, MS is beginning to learn that when it goes to violate people's privacy (and rights), it should do things in small increments:

1. Tightly couple software into the OS
2. Make s/w upgrades hard for the average user
3. Create an "upgrade" system that is "easy" and doesn't infringe on users rights.
4. Release second version of upgrade system (make it mess up less systems)
5. Release third version of upgrade system (people begin to trust it)
6. Release fourth version of upgrade system (invade privacy)
7. Claim piracy is killing jobs in the U.S. (see previous point)
8. ???
9. Eliminate Free software

Re:Haha

[Catbeller]

Solution:

First, user sends the version number of the patch list present on the user's hardware to MS. The version number represents what hardware/MS software is present, and what patches have been previously applied.

A match is found.

A list of patches is generated, and sent to the user.

MS transmits ONLY the patches that the user's version number indicates is necessary.

User patches.

After successful patch, the version number of the patch list is updated on the user's hard drive.
Operation complete.

So, a massive transmittal of a list of ALL patches is not necessary: only the version number of the patch list needs to be communicated.

The "so much data needs to be sent" argument for MS's snooping presupposes their method of applying patches to be the only one. A little thinking comes up with an alternative.

They snoop because they want to snoop.

Re:Haha

[stephanruby]

Their defense: Let's prosecute those german hackers.

Re:Haha

[ArsonSmith]

my debian system does it everyday, sometimes twice a day if I feel like getting something new to play with.

Re:Haha

[egreB]

Well - then I must be allowed to point out the merits of my own particular religion.

$ sudo apt-get update
$ sudo apt-get upgrade
(The last step can replaced with apt-get dist-upgrade if you're doing some serious stuff.)

Da-dum, da-dum and wait a little while the packages download from Your Local Mirror and watch nifty little statistics on how many files you've got installed.. ..and whammmoo! System updated, and there's no need for compiling a single source! There's even nice GUIs with WIMP (Windows, Icons, Menus, Pointers) if you're the kind of type that don't type. Dead easy.

To keep on topic (for a split second), no personal identifiable information is sent to anybody (perhaps except for my IP address and some FTP-commands).

I know, I know, I dont't get any system-specific optimizations. But who can afford the time to compile stuff (other than kernels) these days? This is a 400MHz compter! It can barely compile my kernels (wich, BTW, are nicely fitted as a Debian package to install). Of course, if you've got the spare cycles, there's always source available for you.

But it must be noted that since people's saying so much nice about Gentoo, I've got to try it. I don't doubt it rocks a bit.

Well, wasn't that a rant! (-8

Re:Haha

[aminorex]

> A cow-orker of mine...

> I should have taken him out back and beaten him
> with a frozen salmon.

That will teach him for orking cows.
You know that's just the sort of thing that
brought about the genocide of the Canaanites.

Re:Haha

[zurab]

So, in addition to downloading a list of all possible patches for all possible applications and all possible hardware configurations (pretty big list), it also has to download some sort of ruleset that goes around all of those to actually figure out locally what udpates are available and necessary. That's a lot of bandwidth.

Actually, no need to download all patches and updates, just metadata about them. Client OS then can easily determine what updates it needs and present a choice to the user. It is actually less bandwidth this way because you don't have to transmit the information about your complete system, including 3rd party apps to MS. MS will only provide metadata about *updates*, not a metadata of a complete system.

In any case, this metadata transmission is not substantial, much less so if compression is used.

Complete Breach of Trust

[SUB7IME]

Is this not a complete breach of the TOS that Microsoft offers when you sign up for Windows Update?

If not, it's at least a huge breach of trust, and users should not stand for it.

Re:Complete Breach of Trust

[Sloppy]

Breach of trust? What trust?! Saying Microsoft breached your trust, is like somone who starts smoking this year, saying he didn't know it was bad for him. "The tobacco companies tricked me! Boo hoo!"

This isn't just some random company that nobody has ever heard of, with a clean slate. It's 2003. When people deal with Microsoft they know what they're getting into, regardless of what Microsoft says.

When it comes to Windows users, I really do blame the victim. There's a point where a reputation becomes so soiled, so repeated, and so publically, that it really is either dishonest or stupifyingly negligent for someone to say they didn't know. There just aren't any rocks in the world that are big enough for someone to live under and not hear about Microsoft.

Re:Complete Breach of Trust

[teeker]

This isn't just some random company that nobody has ever heard of, with a clean slate. It's 2003. When people deal with Microsoft they know what they're getting into, regardless of what Microsoft says.

Sorry, I'm gonna call bullshit on this one. While it's true that people involved in the industry generally know what's up, many people outside of it don't. People who have better things to do than read IT-related media get all of their news about MS from totally mainstream sources in the first place, and lot of people could really give a rat's ass about today's MS article on Yahoo's front page. As far as Joe Sixpack is concerned, it's an IT-related story, and he probably doesn't care what it says. If you are not into the theatre scene, do you read reviews for every play in your area? If you are not interested in business, do you read every story in the business section? Probably not, and my mother doesn't read every store about Microsoft.

Saying that the victim is at fault is not a solution to the problem, and is not an excuse for bad behavior on MS's part.

Re:Complete Breach of Trust

[BWJones]

Give me a break. Your acting like windows users should be living with a constant fear that Microsoft "agents" will suddenly appear at their front door to give them a beating.

Ummm, years ago when I was in high school and working for my mother, we had purchased a software package from a company that wrote medical office management software. I had noticed that all of the manuals were photocopied and we had no original disks for Microsoft software that was included in the package. I called Microsoft about this and they had in our office the *next* day two dudes from Microsoft and an FBI agent asking to examine our computers. We ended up getting screwed because the guy whose software we purchased was smacked hard by M$ as the package we bought went unsupported after that.

Of course this guy was absolutely stealing and should have gotten what he deserved, but my point is simply that, yeah, there are Microsoft agents of a sort and they do show up at your door.

Re:Complete Breach of Trust

[ergo98]

How is this insightful? More like "Vehemently anti-Microsoft".

When it comes to Windows users, I really do blame the victim. There's a point where a reputation becomes so soiled, so repeated, and so publically, that it really is either dishonest or stupifyingly negligent for someone to say they didn't know. There just aren't any rocks in the world that are big enough for someone to live under and not hear about Microsoft.

Would you mind pointing out some of those instances where Microsoft abused the privacy of their customers? Given your claims of the prevalence of such information, I'm really eager to listen to the examples you surely will be able to give. Undercutting Netscape and extending Java don't count, by the way, and only the fervently anti-Microsoft can't see the grayness in those areas (i.e. Microsoft is hardly the villain).

For all of the "I told you so!" rhetoric in here (hardly surprizing), I personally find Microsoft to be one of the most trustworthy companies when it comes to privacy: They have gone far above and beyond the call of duty time and time again to put the privacy of their customers ahead of the value of the information. If, indeed, this is sending information on other products installed I would bet a pretty good penny (two pennies in fact!) that it is entirely unintentional.

Re:Complete Breach of Trust

[kevlar]

Microsoft merely states that they do not send any PERSONAL information. As I see it, having them receive an inventory of what is installed on the machines helps greatly with statistical analysis for errata. If they send data about whats installed but you're anonymous, what difference does it make? Its not like they're tracking webclicks or personal information.

Re:Complete Breach of Trust

[hammock]

I don't see why thier jackbooted BSA/Microsoft thugs don't work in the following manner.

BSA/Microsoft accuses you of being a pirate of the high seas, and demands license proof. Microsoft puts up $LARGE_SUM to a trusted authoritive third party. Audit ensues, licensing is verified.

If you are stealing software, BSA/Microsoft gets $LARGE_SUM back, and the entity stealing the software has to pay $FINES, $LICENSES, or $OUT_OF_COURT_SETTLEMENT.

If your licenses are in order, or you are using GNU/Linux, BSA/Microsoft's $LARGE_SUM is awarded to you, covering your work disruptions, legal fees, and more.

This is how it works at the local track if you think one of your competitors has modified thier engine outside of the class specifications. You pony up for the accusation and get rewarded if it's true, and take a loss if it's not.

Re:Complete Breach of Trust

[Twanfox]

Whatever happened to needing a court order in order to search your premisis (or in this case, inventory). Now, I know this is voluntary, but should said company say no, what exactally would Microsoft do? Could they prove sufficient suspicion that there was piracy going on?

Or in simpler terms, do software companies have the right to order you to provide on request an inventory and proof of purchase for their products at any time, without just reason to suspect otherwise, and on their own recognizance?

Re:Complete Breach of Trust

[drxenos]

Got a similar story: A friend of mine works for a small chemical company. One day out of the blue, a MS rep. walked in an flashed his MS ID and demanded (demanded!) to be allowed to inspect all their computers for unauthorized MS software. He acted like he was some sort of offical, or goverment agent or something. The freakin' audacity!

Makes sence

[Anonymous Coward]

Trying to figure what other companies they should push out of business.

Re:Makes sence

[rmadmin]

No no no no.. they are collecting info so they can blackmail other companies out of business, or buy them out. :-d

Re:Makes sence

[ReelOddeeo]

Trying to figure what other companies they should push out of business.

This should not be modded Funny. This is serious.

BillG: Look, everyone has Acrobat Reader, we need to develop XDoc.
Everyone has some SimXXX game, we need to develop Zoo Tychoon.

Business as usual. Take advantage of monopoly position of control. Discover what anyone else might be doing that is popular. Develop a competing product. Give it away, or bundle it into OS.

pay-per-view

[sys49152]

The original article is, unfortunately, pay-per-view.

How can we comment, if we can't read the article?

Oh, wait...

Re:pay-per-view

[AngusSF]

Actually you can only read the first 2-3 pgs of the article. On the third page you see

The following pages are restricted to users of our Premium service. If you are not member you can buy the externer Linkcomplete article as a PDF-file for Euro 1.99. Included you will find a complementary copy of the tools we used to find out what is going on with Windows Update.

Re:pay-per-view

[essdodson]

Welcome to slashdot. You're obviously new here or you've just not been paying attention, would you like a tour?

I wonder what Virtual PC sends ...

[adzoox]

I wonder what Virtual PC sends, whether it sends only the info in the Windows Drive image or everything on the Mac.

This may also be an alterior motive to Microsoft buying Virtual PC from Connectix last week. They want this same data from Mac Users. I imagine if it's not there then it will be added to read all partitions mac/Linux/PC

Knowing what your customers have on their hard drives is sensitive corporate data. Basically, you know the Hot or Not Programs in the industry and then develop programs based on their hard drive residency!

Re:I wonder what Virtual PC sends ...

[stoffel]

I hope M$-connetix keeps developing for Apple. What happened to Bungie.. Bungie was developing great games for Mac. They even showed a previes of Halo on stage during a Steve Keynote.. Now Halo is ony out for Xbox...

M$ keeps buying great mac-software companies to eliminate them.... Is Apple a threat???

Maybe they need a good x86 emulator on windows...

EULA says they can take what they want

[RichMan]

According to the EULA for the latest versions of the OS Microsoft has the right to read any data you have stored on a computer which runs the OS.
Theoretically this includes data dumps of hard drive formats which the OS does not even support.

Re:EULA says they can take what they want

[Nursie]

Well yeah, they're going to make sure they cover their arses.
I thought this sort of outrage was already covered by the change in TOS brought in by WinXP SP1? (i.e. we will take whatever info we want from your machine, and if we don't like it we'll lock you out.)

Re:EULA says they can take what they want

[Ezrem]

And where did you find that piece of info?

Direct from About Windows Update :

Windows Update Privacy Statement (Last Updated 10/15/2002)
Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

* Operating-system version number
* Internet Explorer version number
* Version numbers of other software for which Windows Update provides updates
* Plug and Play ID numbers of hardware devices
* Region and Language setting
The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

Hardly "We can scan your computer for any information we want, and there's not a damned thing you can do about it!" as you've implied.

Re:EULA says they can take what they want

[gmuslera]

The EULA also says that they can delete what they want (at least what they say that violates DRM, and their sofware is not know to be very intelligent), and have others that says something like they own all what you transmit thru they servers...

In fact using their software (and then accepting the EULA) is like simply close your eyes and pray that the big depredator which is in front of you isn't hungry right now, and will not be all the long time you be there.

Re:EULA says they can take what they want

[leviramsey]

Read the parent comment.

This isn't Windows Update he's talking about, it's the EULA for recent versions (XP, IIRC) of Windows.

Re:EULA says they can take what they want

[malfunct]

I'm not defending microsoft here but nothing in the blurb that you posted says that MS won't collect the list of software on the machine. To play devils advocate its pretty easy to say that the installed software is part of the configuration information on the machine. Further it makes some sense how this is useful in picking which patches are presented to you. If there is a patch in windows update that fixes a bug that affects 1 software package in the world that 1% of users use then wouldn't it be useful to scan to see if that is installed and only present the patch to the 1% of users that need it. Especially given that many bug fixes cause bugs in other software that relies on the broken behavior or some kludgy work around.

Re:EULA says they can take what they want

[mrpuffypants]

notice, however, that it says it includes that information...that can very well just be a part of what they are collecting, and the only part they are telling you about.

Re:EULA says they can take what they want

[aug24]

Clearly YANAL (You are not a lawyer)!

Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

If a lawyer writes "this information includes...", then that's exactly what they mean. They don't mean that it is a complete list; there may be other stuff that they're not explicitly telling you about.

Justin.

/Tin Foil Hat Off

[GLX]

The reason why it sends info about other applications (and third party drivers for that matter) is so that they can attempt to be a single-source vendor of patches if needed.

While the intentions may not be all that honest, it's not a horrible idea. I've noticed numerous times when running Windows Update that it's offered to upgrade my Cisco Wireless LAN software as well as my Epson print drivers. Kind of nifty and not all that bad, if you ask me.

Re:/Tin Foil Hat Off

[Atzanteol]

But why must this be done on the server, and collected at Microsoft? Can't the client download a list of what MS has for updates, and decide what the local system has?

Re:/Tin Foil Hat Off

[Com2Kid]

• While the intentions may not be all that honest, it's not a horrible idea. I've noticed numerous times when running Windows Update that it's offered to upgrade my Cisco Wireless LAN software as well as my Epson print drivers. Kind of nifty and not all that bad, if you ask me.

Driver updates? No problem.

SOFTWARE updates? Uh. Problem.

Windows Update is responsible for updating my SYSTEM, thus the term Windows update, not "universal software updator" or some other such silly name.

Besides, last time I let Windows Update update my drivers it replaced my Matrox G400 driver with a French G400 driver that refused to be uninstalled. . . .

Re:/Tin Foil Hat Off

[Fishstick]

I did that once, I was sorry. windowsupdate showed an "updated driver" on for my vid card on my laptop (neomagic, I think). Now, normally I don't go and update device drivers unless there is some specific reason (something not working/ imcompat w some software), but I thought I'd give it a try.

What a mistake. When I rebooted I started getting error messages and it threw me into generic VGA. I had to then dig out the disks that came with the thing and re-install the driver.

Since then, I've avoided this like the plague. Sorry, I'll update any non-ms software myself, thanks. Windowsupdate is convenient given the number of "security updates". It saves me from having to keep track of what I've installed on my machines and it is fairly painless to go out there a couple times a month to see what is available.

But it also encourages the mindset that you should install software updates just because, well, it updates you to the latest version. Updating windows with all the latest security patches, fine. Updating IE or media player just because there is a new version? No thanks.

Same goes for drivers and non-ms software. I'll grant that it would be convenient to see that there are updates and then be able to install right there (remember Oil Change?), but I personally don't need to always need to keep my apps and drivers "up to date", especially if they are working fine otherwise.

Re:/Tin Foil Hat Off

[Zathrus]

The list of patches that Microsoft must have is HUGE

Yes, as it is for any OS vendor. But so what? How much data to you actually have to send? Not a whole lot - just enough to identify what piece of software it's for and what version it is. If you can't store all of that in, oh say, 20 bytes, then you're screwed in oh-so-many ways. Hint - encode the software identifier in a 32-bit or 64-bit number, and the version string in the remaining bytes.

So, let's say you have 1000 patches available for the OS in question -- and, yes, patches are OS specific and MS has that much info from you already. That's a 20,000 byte download. Even at 14.4k it's only 20 seconds. Big deal.

The system then has to process the list and figure out what it may need, then request additional data for each potential patch... but you're going to have to download that information anyway, and there is minimal additional overhead.

It might take slightly longer, particularly over slow links, but it's a hell of a lot more user and security friendly.

but

[mrpuffypants]

i'll bet it totally gets confused if WinXP iteslf is pirated in the first place =]

along with Office and just about everything on the computer..oh well...I guess the police outside are for me

Re:but

[Mitchell Mebane]

I proudly use this version of Windows XP, and I've never had any problems with Windows Update. I even use SP1. Maybe your friend was using the infamous Devil's Own key?

Check out the rest

[joshmathis]

Here is the rest of the article, in PDF format. I'd suggest grabbing it and mirroring as soon as possible... this one won't hold up too long.

http://home.byu.net/~btc25/WindowsUpdate.pdf

One of the more interesting parts deals with how Microsoft can tell the difference between product keys they generated and those done with a keygen.

Re:Check out the rest

[Com2Kid]

The correct link is:

http://home.byu.net/~btc25/windowsupdate.pdf

Aren't caps great? Heh.

Re:Pay per view?

[Call Me Black Cloud]

I made the same mistake...it is ppv...you can read freely until the heart of the article, then it's 1.99 (euro) for the rest.

No verification possible...

[Reinout]

Nice claims, but we the free part of the article doesn't show any actual examples of data that's transmitted. At least not data apart from some generic xml tags.

Any easy way to verify this ourself?

I'm suspecting their claim is true, but I'd like to see the data...

Reinout

And I should be surprised why? Also, a suggestion.

[Jack William Bell]

Although I often semi-sorta-half-hearted-defend Microsoft when people make unsupported categorical statements or otherwise speak mindlessly, I am also willing to speak out against them when they are wrong. As in this instance.

I would have to do some research, but I believe this might violate their own privacy policy. Even if it doesn't, they really have no moral right to send any information about your system without letting you know what it is and giving you a chance to abort the whole thing. Yet I am unsurprised, in fact I expect every big company is doing this kind of thing when they can get away with it.

Not that I am saying "Everyone is doing it, so what is the big deal?" My attitude is more "Let's stop this crap now!"

So I have a suggestion -- someone should start an open source project to create a re-writing proxy for updates that strips out all the stuff Microsoft is sending in the updates, except what is absolutely needed. Make it open enough that we can plug it re-writers for other companies as well.

Is this surprising?

[guacamolefoo]

I am shocked - shocked - by this revelation.

I can see a legitimate purpose for it, from a bug-hunting and trouble-shooting standpoint, but I am highly skeptical that these are the only ways that this information is used. For instance, I expect that if MS sees a high number of installs for a particular app, that it might decide to include that app in the "OS", such as a personal firewall, for instance. Oh, wait...they already did.

An interesting compare/conrast to see is what MS license agreement says about this and what their public statements have been.

Also, is there going to be a DMCA action here? Ugh.

GF.

Predictable

[Rik Sweeney]

Come on, be honest. Who's genuinely suprised by this?

Re:Pay per view?

[illtud]

No it's not. Michael, please do a little thinking before you post... just try it, perhaps?

Yes, it is pay-per-view beyond a certain point, but the meat of the story is in the stuff sent back to MicroSoft, which they've updated to be free at this link here: http://www.tecchannel.de/betriebssysteme/1126/14.h tml. It seems to be information on hardware in the machine. I'd like to see MicroSoft's response to this.

Re:I FAILED IT

[guacamolefoo]

got the new ultra psyware

Great! Where can I get psyware? I've been looking for a way to get rid of my mouse and keyboard. Dos it allow a USB 2.0 connection to my nervous system, or does it use 1394?

GF.

Duh

[IAmRenegadeX]

Assuming "nothing is sent" is about as smart as checking that "trust everything from microsoft.com" checkbox for the activeX control Windows Update downloads. You'd have to be a quart short of an oil change to do either.

big deal - they've confirmed the M$ privacy stmt.

[erik1474]

below from the M$ site... they tell you outright that they are collecting this info. What's the big deal?

Windows Update Privacy Statement (Last Updated 10/15/2002)

Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

Operating-system version number
Internet Explorer version number
Version numbers of other software for which Windows Update provides updates
Plug and Play ID numbers of hardware devices
Region and Language setting

The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

From the Windows Update Privacy Policy

[neile]

Note: Windows Update does not collect any form of personally identifiable information from your computer. Read our privacy statement.

Windows Update Privacy Statement (Last Updated 10/15/2002) Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

• Operating-system version number
• Internet Explorer version number
• Version numbers of other software for which
• Windows Update provides updates
• Plug and Play ID numbers of hardware devices
• Region and Language setting

The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

YES IT DOES! Full example of sent data here:

[illtud]

They've updated the story to give the full info on what gets sent back here: http://www.tecchannel.de/betriebssysteme/1126/14.h tml

Re:I FAILED IT

[jetmarc]

> or does it use 1394?

I think it uses 1984.

XML Schemas available here

[cobyrne]

Client Info Schema and System Info Schema.

They appear to get a copy of your registry, as well as information like processor architecture, manufacturer, printer(s?) etc

Re:XML Schemas available here

[nmtratman]

Ah good. I though I had lost all my registry information when my computer last crashed. I hate having to lookup registry keys and reset settings. Now I know I just need to e-mail Microsoft for them.

Microsoft? I need the registries for someone who is listed as John P. Meezly under Office, Cathy A. Ray, and someone who goes by the handle Scuzzlebug when they write their e-mail. Oh, and someone who had a working copy of Photoshop (versions 6 or 7, don't care). AMD processors on Asus motherboards only, please.

That should do it...

No software collected

[IamTheRealMike]

No, sorry, Microsoft doesn't collect lists of softare, not even the article says that. What it does say is that if they wanted to, they could locate what software you have by looking for registry keys or files specific to that app.

In fact the article says the biggest privacy concern is the hardware list, which doesn't seem that big a deal to me.

Re:No software collected

[Trogre]

No, sorry, Microsoft doesn't collect lists of softare

How do you know this?
I hope you don't mean "because ZoneAlarm hasn't picked up anything weird"

Have you run an external packet sniffer on your net connection?

Please do not think any utility run on Windows cannot be bypassed by a few lines of code in kernelspace.

Another PDF mirror

[wilstephens]

http://clients.fbagroup.co.uk/slashdot/WindowsUpda te.pdf

Who cares about windows update?

[SatanicPuppy]

What I want to know is why fricking Windows Media Player tries to "Phone home" all the time? That thing is harder to get rid of than the clap, and about half as useful. I have my firewall specifically tuned to stomp on it every time it opens its digital mouth.

This is hardly a surprise, and definitely adds a good bit of weight to all those people who call Palladium the death of privacy.

Just my 2.34539 yen worth.

uh-oh.

[war3rd]

You mean they can see my Kenny G. pr0n screensaver?!?!?!?

If you actually *look* at the information sent...

[Anonymous Coward]

... you'll see that - contrary to the Inquirer story - it doesn't include anything about 'installed software', with the exception of device drivers. No applications, no utilities - nothing that MS is likely to want to compete with, and indeed nothing that MS doesn't overtly mention in its own privacy policy.

So what's the problem?

Having read the article...

[cperciva]

I have to say that it's not nearly as scary as advertised. There are two complaints:
1. The Windows Update tool sends to Microsoft a complete list of what hardware you have.
2. If the Windows Update server claims to have an update available for product X, the Windows Update tool will check to see if you have product X installed, and report back to Microsoft.

Well, *duh*. The only way to avoid doing this would involve downloading a complete list of all the updates available for every supported piece of hardware or software. Based on the size of the windows HCL, I'd guess that this would require tens of megabytes of bandwidth -- all so that Windows Update could pick out the half dozen entries which are relevant.

Dear Steven, From Bill Gates

[joelparker]

any chance they get to know more about you.... they're going to take it.

Dear Steven,

Good point. Your previous Slashdot postings are also good, except for that one about Linux.

Sincerely, Bill G.

Re:Tell MS What you think, apparently...

[Landen]

According to a WHOIS, that site is registered to a MarketSmart Technologies in Florida... ...I'd be a bit wary of giving out your info.

Thank You

[mikey504]

Thanks for posting a link to this information. Based on what is here, I see no reason to panic. First, it doesn't appear that any information is sent which would identify the machine the information came from. All they get is, "There is a macine somewhere with a Lite-On CDR in it."

Windows Update has offered me updated device drivers in the past, so I think the inclusion of hardware info could be defended on that basis.

Re:Not news.. but a nice update.

[cperciva]

Personally, I like the way cvsup works. You ask for what you need and a file list. Or so it seems.

cvsup is far more invasive than Windows Update. When you run cvsup, it sends a list of all your files (in the relevant directory, of course) to the server. The server then looks at the list you're sending it and decides what you need to have updated.

Windows Update Privacy Policy

[jamesbulman]

Has anybody actually read the policy? If you read it it doesn't really sound like they've done anything they said they wouldn't.

Open Source solution already in place.

[burnin1965]

Just thought I'd point out that there is already an open source solution you can use to avoid this invasion of privacy, its called linux.

Just had to say that, but on a more serious note, I use Red Hat Network to keep a few Red Hat Linux boxes updated with current patches and it does much the same thing. But there is a big difference.

When you register a box it tells you exactly what information will be sent to RHN about software on your box and allows you to opt out.

The benefit here is two fold in that RHN only sends you updates for the software that is installed on your system and you get updates for any software package that Red Hat supports beyond patches for just the kernel.

What I'm not sure of is if they track all applications you've installed even if they don't support them. Although I still wouldn't be concerned because they tell you up front what information you will be sending to them and you can say NO.

burnin

It's not the personal identification....

[ayeco]

OK, so they don't collect information that can personally identify you as the "owner" of software(s) X. It's all about the fact that they are getting a survey of what's out there. How many users have software x, legally or not.

I don't mind tivo using my info to better programming ala the neilson ratings. BUT I do have a problem with Microsoft using my data (without asking) to adjust their business plans and/or methods of sales, tracking, schemes, etc.

ie "Software maker X has sold 500K copies, BUT our windowsupdate show's that there are 600k copies being use...."

EULA could still be illegal in spite of agreement

[Beetjebrak]

Here in Holland (I don't know the laws in the rest of the world too well) any contract that you sign which contains clauses that are illegal, is null and void. Any statement of MS having the right to download anything off MY computer would seem to me totally illegal and would probably void the whole EULA.
I did read the EULA of the Dutch version of Win2K SP3 completely and never found any clause that would allow them to download anything off my PC without my consent.
Sadly I'm stuck with Windows since I cant (yet) afford a mac to run Adobe apps on. When oh when will Linux/FreeBSD/X get decent colour management and ports of proper graphics apps like Illustrator, Photoshop and InDesign??? The GIMP is a nice toy, but it's hardly of any use for print production work. And KIllustrator and the like are simply a laugh too for any real work.. The Linux/BSD vs. Windows ratio is now 4:1 in the favor of the free, but I'd like to get rid of Windows altogether. Give me my killer graphics apps!! I'll even pay for them! ;-)
Saving up for that Mac in the mean time..

Story is incorrect

[doug363]

According to the (full) article, Windows Update sends a list of hardware installed on your system, but not a list of software. Version numbers for Windows stuff, like IE, are sent, but not any info about other software on your compouter.

From the Windows Update website privacy statement

[greygent]

To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

Yes, we don't not track you.

Tell that to the Melissa author, and some number of other people who's GUID was used to identify them. Even if you aren't a criminal, this could be misused in so many ways.

Despite loving many Microsoft products and the line of NT OS'es, I wouldn't trust Microsoft as far as I could throw them.

Hey now.

[waldoj]

You cow-orker was right.

Now, look here, there's no need to be mean.

-Waldo Jaquith

Re:Tell MS What you think, apparently...

[Mikey-San]

Yeah ... Can you say "spammer troll"?

Bleh. Just contact Microsoft directly at:

http://support.microsoft.com/default.aspx?scid=fh; EN-US;FEEDBACK

-/-
Mikey-San

Easy Solution

[swordboy]

Why doesn't some enterprising individual simply monitor Microsoft's various OS's for updates and then link to the downloadables? Of course, it would be possible for MS to remove downloadables but then this really causes frustration for those who are maintaining systems that cannot access windowsupdate.com. I'm not sure that they could do it - they'd have to install spyware in the actual patches. But then we could configure the firewall to block everything MS.

Or we could all just get Mac's. I'm almost there, unless someone can put together a KDE or Gnome with some usable functionality (like device management and system configuration in ONE GODDAMMED FUCKING LOCATION).

Apple!!!! Bring OSX to X86 and we will make it worth your while!

Re:Easy Solution

[Anonymous Coward]

device management and system configuration in ONE GODDAMMED FUCKING LOCATION

Sorry, that would be too obvious and simple. Everyone is currently far to busy writing biff replacements and theme engines. Anyway, if they made one part easy to use, then they'd have to make something else hard in order to make you feel inferior. Like rotating your screen 90 degrees to the left, or using forcing the use of Elvish fonts.

Re:Easy Solution

[wizarddc]

Apple!!!! Bring OSX to X86 and we will make it worth your while!


The point you are forgetting is that Apple makes and sells hardware, and only makes software so that they can sell that hardware. They'll give you the OS for free, as long as you pony up for the box. They have no interest, financially, to port or sell OS 10 to X86.

Re:Easy Solution

[Zendar]

They'll give you the OS for free, as long as you pony up for the box.

Then why do they charge $120 for existing users (owners) to upgrade to each new point release for OSX?

Re:Easy Solution

[nachoboy]

Because the value of Windows Update doesn't lie in the fact that it gives you the patches. Its value to consumers is that it will automagically detect what kind of system you have and provide a list of the necessary patches. Yes, it also conveniently lets you install all of them with just one more click, but Microsoft already offers all their patches in downloadable .exe form. The problem is that every time a patch comes out, a user must read the accompanying documentation, determine whether their system is vulnerable, and apply the patch. And this is no easy task. There are patches for Windows (no brainer), Office (mostly a no-brainer) [these are usually obtained at Windows Update's little sister site, Office Update], Internet Explorer (easy enough), IIS (do you know whether it's installed?), the Java Virtual Machine (getting a little tricky now), the HTML Help subsystem (woah), the MDAC components that probably got installed when you installed Windows (what luser knows what MDAC is?), and the FrontPage Server Extensions (sounds like Office, no? don't worry, it's conveniently included in Windows). Oh and if that wasn't hard enough, there are patches that supercede patches, late, missing, or broken patches, patches you think you have to apply twice, the list just doesn't end. Windows Update in its current incarnation can get rid of the user hassle for most of that by moving all of the guesswork out of the luser's hands and into Microsoft's engineers' hands.

Personally, I find the whole patch thing ridiculous. I tried to stay abreast of the current security patches by subscribing to the security mailing list and making my own decision about whether a patch applies. It's impossible. Every time you think you've gotten it right, there's another patch to figure into the situation. I use Windows Update to find out what updates I need, but since the home connection is ridiculously slow, I just make a list and download the .exe's from http://download.microsoft.com. (Search by the KB article #). As long as you save them, the syntax for installing them quietly is mostly uniform, and you can apply them with little hassle next time you install.

Re:Easy Solution

[chefren]

A GUI in the Linux kernel tree? That would be like..windows. It's the distros that are the operating systems, Linux is just the kernel. In order to have, say KDE in the kernel tree you would also need to have all libraries and other packages you need to run it in the tree as well, like glibc, X and a big bunch of other things. An entire desktop distro in fact. Bury that idea in your back yard, right next to those irritating ex-neighbors of yours (joke). I give thumbs up for more desktop cooperation between distros, though.

Re:Easy Solution

[Jord]

Forcing one GUI on everyone using Linux is exactly what Linux is against. Linux is about choice. You get to choose which GUI you want to use. If Linux forced you to use one GUI, one email client, one web browser, how would that be any different than Windows or Apple?

Choice is what reigns in Linux. Forcing one GUI on anyone will help nothing.

Re:Easy Solution

[swordboy]

A GUI in the Linux kernel tree? That would be like..windows

We could only hope...

Face it - the desktop needs to get rid of all that cruft and get some standards before it can become mainstream. Although it is a nice thing to have, this variety hinders standards, therby keeping both users and developers away.

YOU INSENSITIVE BASTARD!

[Anonymous Coward]

I am running Win 3.11 with IE 6.0 and what you're suggesting will interfere with my support!

Re:YOU INSENSITIVE BASTARD!

[wo1verin3]

Hah.. I'm running IE 6 on DOS 6. The version numbers are the same, why don't it run well?

Re:Always wondered About That...

[Queuetue]

They could do it all client-side, keeping the data store and package list avaliable locally.

Portage (I assume) doesn't tell gentoo home base what packages I have installed, but it knows which ones I need all the same.

Why "I" think a lot of people are pissed at this..

[Goronmon]

I think a lot of people don't want anyone to know that they use "borrowed" versions of software that they should have payed for. They see that MS might be able to check what they are running and if its being run illegally so instead of thinking I guess the free ride might be over soon. they immediately go into defensive mode, claiming that MS is the devil and that only a "monopoly like them" would ever consider doing this.

You know what? I don't care if they can check to see what I have running on my computer. If I use an updating service made by Microsoft for products made by Microsoft, I almost automatically assume they are getting just about every piece of info off of my computer that they can get. As long as its not anything important (like e-mail, names, credit card numbers, etc) I could care less, I have nothing to hide. If MS wants to see how many people use a certain piece of software, all the power to them.

I guess it all comes down to reading the fine print and knowing that most of the time, the company is looking out for the company, not the customer.

I'm not saying MS should get away with everything it wants to do, but I do think its funny that people are surprised that a service that gets information about your computer actually gets information about your computer.

What, did you miss this?

[sammy baby]

And I quote:

Warby -- who is the chief information officer at Seattle Metropolitan Credit Union -- believes that the terms for the end user license agreement (EULA) for Microsoft's Windows 2000 Service Pack 3 (SP3) and XP Service Pack 1, might well put the credit union in violation of new federal privacy laws... To use the "auto update" feature, according to the Microsoft Windows 2000 SP3 license, "it is necessary to use certain computer system, hardware, and software information..." By using these features, users authorize Microsoft or its designated agent to access and utilize the necessary information for updating purposes."

Full article can be found here.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Inquirer?

[Queuetue]

It's not not THAT enquirer.

Re:The article says MS tells you this beforehand

[Junta]

No, most other platforms do everything client side. The updater says 'give me a list of all available updates', and then the updater does the filtering client side. Only the release number overall of the OS is known.

Sure, updates downloaded from MS sites could be tracked easily anyway, each download request could be associated with IP and such. But if non-MS programs are being probed, then they are wrongly exploiting the updater.

Comment removed

[account_deleted]

Comment removed based on user account deletion

The Devil Came to Redmond...

[ites]

The Devil came to Redmond, looking for some souls to steal,
and there he met with Billy G, who was just about to make a deal.
Said the Devil, "Hey Billy, you look bored, would you care to make a bet?"
And Billy he smiled slyly, and said "Dude, there ain't a deal that I've missed yet."
So the Devil took his keyboard and showed Billy his new game,
Saying "I wrote this quick, in VB6, now see if you can do the same."
Billy G, he just smiled his smile, and took the keyboard away,
and said, "Devil, you're behind the times, and you clicked on the EULA,
"Now you've run Windows Update, and your soul belongs to me."
And the Devil knew he'd met his match, so he turned and tried to flee,
But Billy G was much to fast, and he caught the Devil's long black cape,
Saying, "Devil, stay and play a while, we have a whole wide world to rape."

Don't panic, here's a summary

[unfortunateson]

First of all, the example data sent is available free, as one poster above already listed. There's no software described there other than Windows itself.

Second, the System Info Schema, as posted by another above, is pretty explicit about what registry keys are available to be sent, and it's pretty tame.

Frankly, I have no problem letting them know exactly what hardware I've got running. How can they harm me there? Perhaps a malicious hacker could grab this data and find ways to abuse my network card? Pretty slim.

Call me too open, if you will, but I'd be happy if it would let me know about other MS updates, such as Office, without having to also visit MS' office site. Update those automatically? Never. But it's much less convenient than the Windows Update site.

I greatly doubted that it would be sending large quantities of personal data, because it just doesn't take that long. The ones to worry about are the virus scanners, that take the time to examine every freakin' file.

In summary:

• They're not sending your entire hard drive
• They're not sending your entire registry
• They're not sending a full software inventory
• They're probably gathering a little more than they need
• They're probably not doing anything with it (yet)

Comment removed

[account_deleted]

Comment removed based on user account deletion

WU doesn't send software list

[phasm42]

There are a lot of people in this thread that realize that WU does NOT send a list of all software installed, but they are being drowned out by the highly rated comments about the evils of MS. The "software list" is actually a list of drivers installed, which is fine, because MS will post updated drivers for you to download. It should also be noted that one of the articles posted is from the Inquirer, the same people who predicted hell on earth in y2k, and believe in tinfoil hats.

Great, I've added THIS to my registry then

[MadCow42]

HKEY_LOCAL_MACHINE\Software\IllegalMicrosoftStuff\ BillGatesVISAnumber\8605412399653153

HKEY_LOCAL_MACHINE\Software\MSKillerVirus\Launch Da te\2003.06.21

HKEY_LOCAL_MACHINE\Software\Linux\"format c:\; install Linux" .... hey, why not have some fun with it? q:]

MadCow.

*ahem*

[vmfedor]

Windows Update Privacy Statement
(Last Updated 10/15/2002)
Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

Operating-system version number
Internet Explorer version number
Version numbers of other software for which Windows Update provides updates
Plug and Play ID numbers of hardware devices
Region and Language setting

The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

Maybe you should verify the information before automatically declaring "Microsoft is evil" to any and all anti-Microsoft posts.

Who cares ? I run WinUpdate right after I install

[VaXXi]

Really. Run Windows Update right after a new Windows installation, without other programs installed; therefore, no interesting information for Microsoft (other than Notepad and Paint being installed).

After that, subscribe to one or two good security mailing lists and never use Windows Update again (you will probably find out faster about new vulnerabilities anyway), and download the appropriate patches directly from Microsoft's web site, by following the security advisories.

Agreed, it's a little extra work, but as far as I care, it's worth it.

Re:Am I the only one who is not surprised by this?

[fishbowl]

>This has got to stop.

Why do you say that it has "got to stop?"

Do you thing the DOJ consists of a group of people who took power via a coup d'ètat? Or do you concede that the Department consists of individuals who have been appointed by elected executives and confirmed by an elected Congress?

Whether the current government is a true expression of the will of the American people, or the current government is a result of our apathy (even antipathy) toward the democratic process and the political party structure, it is not reasonable to wait until a crisis at the Federal level to take action.

"Something" can be done. In twelve years or less, the Federal government will be largely composed of individuals who are at this moment seeking State and local office. If you have not developed a relationship with these politicians or their parties NOW, while they are accessible, and if you have not participated in the process of putting them in office by CAMPAIGNING and VOTING, you may find yourself in precisely the same position a decade from now, claiming to be powerless to affect the process, and demanding that "something" be done.

Something *is* done, and the people who make a priority of participation in the political process of this country are the people who shape government. Whether you choose to participate or not, you are still part of the process.

Apathy elects our leaders.

How does this differ from RH Update?

[Canabinol]

I use the Update Agent in RedHat almost on a daily basis - the RH Network knows absolutely everything about my setup (programs, modules, etc.) right down to what version of the Kernel I'm running - that way they can inform me of vulnerabilities and problems that I'm probably susceptible to as soon as there's an update available...it's a "good thing".

Why is it that when Microsoft does this kind of thing, suddenly there's a more sinister motive behind it all?

I don't hear anyone complaining about Redhat's privacy policies...

Re:How does this differ from RH Update?

[gtaluvit]

Because RedHat is free. People need to pay and have a valid license for Windows. Since I'm betting (just an assumption) half the people whining about the update issue have a pirated version of XP or 2K, this poses a threat to them.

On the flip side though, imagine if Redhat's DB was compromised. You'd have an accurate listing of every RedHat box out there, their IP, and what versions of software they were running. Thats a goldmine for a script kiddie.

Re:How does this differ from RH Update?

[Anonymous Coward]

When you sign up for RHN, you're given the option of uploading information about which packages you have installed. You can decline [1]. You won't get email about particular packages you have which need updating, but you can still use the update agent.

The update agent will still work because it polls the servers for which packages are current for your release [2] and compares that list to what you have installed, and the comparison is done locally.

[1] https://rhn.redhat.com/help/basic/register-system- profile.html
[2] https://rhn.redhat.com/help/basic/up2date-setup.ht ml#PACKAGES-TO-UPDATE

Re:How does this differ from RH Update?

[brettlbecker]

Jesus man, how can you compare them? Did you not notice at all that when you registered for RH update you can PICK AND CHOOSE SPECIFICALLY WHICH PACKAGES YOU WANT TO REGISTER? If you don't want them to know which kernel you have, UNCHECK IT.

This is such a ridiculous non-issue that completely misses the point. If what this article says turns out to be true, it means that MS is spying on you and offering you NO CHOICE to avoid that spying. On TOP of charging an arm and a leg for PROPRIETARY, SECURITY-FUCKED software.

Another difference is that if you downloaded Red Hat Linux, you got all the software on there from Red Hat. If you add third-party software, it will only register with Red Hat if Red Hat releases a version of it. This is not the case, if this article is correct, with Microsoft. It will record your software whether it can be updated by MS or not. And that is pointless, unless there is a sinister motive.

B

Re:How does this differ from RH Update?

[StormReaver]

Red Hat's practices are different from Microsoft's practices, even when the components of the practices are identical, because Red Hat does not have a long history of happily abusing its customers.

Microsoft's entire corporate psyche is built around cultivating that abuse. Bill Gates has, on numerous occasions, stated that Microsoft's main competitor is its own customer base. Unless you've been living under a large rock for the last ten years, you're well aware of how Microsoft treats its competitors (and not coincidentally, its "partners").

Microsoft's known street-thug behavioral history should be enough to send shivers down your spine whenever anyone there has network access to your computer in any form whatsoever.

Microsoft profiting from Autoupdate site?

[netr00t]

I wonder, is microsoft using their autoupdate site to spike or sabotage their updates on old products to force the users to purchase newer upgrades? I am an avid (and registered) user of windows 98 2nd ED for 2 of my machines. The others run BSD, RH Linux, and Solaris, it seems like the more i update from the original install the worse it operates, on both machines, new and old. I figured it was my own machine until i reinstalled the entire os and performed an internet upgrade. Now the explorer locks up after upgrading a clean install but not before. The entire pc gets unstable after upgrading and I am concerned that they are sabotaging the upgrades to create instability to force me to buy their new XP. I WILL NOT BUY OR UPGRADE TO XP! This is insane, I wouldn't run Windows at all if all the darn games that I play worked on other OS's. Just my 2 cents. Hey, and let me know if they are sabotaging their upgrades or its just me.

Linkee no workee

[Wee]

Try going to that link with Opera. Even Opera in Windows. You get a nice message needing to install IE "in order to use Windows Update". Can't view their web page or get a list of updates with any other browser apparently. So much for HTML being the lingua franca of the Internet.

Life's far too short to use IE.

-B

Re:Linkee no workee

[xombo]

The reason it requires IE is because windowsupdate.microsoft.com has to use ActiveX to see what packages/updates you have installed, and which ones you don't have installed. Since Mozilla/Opera/etc believe in privacy (and they CANT do activex), they are not going to support activex and let microsoft see all your installed packages.

This is the link

[Wee]

Here's the page which doesn't care about your browser:

http://www.microsoft.com/downloads/search.aspx?dis playlang=en

-B

Now that we know the protocol...

[kaisa_sosey]

Anyone has an idea what could be achieved by sending fake information ?

How the well would it be able to see the Mac?

[Inoshiro]

This is a Virtualized PC -- all it sees are the hardware components emulated by the host operating system.

This is akin to saying that VMWare can somehow tell my that I have an SB Live! -- it can't. All it knows is that it has SB16 emulation inside, and that it writes the output of that to /dev/dsp.

This is pure paranoia talking. Perhaps you should invest in more aluminium for your head.

Re:How the well would it be able to see the Mac?

[Dephex Twin]

It (XP in VPC on a Mac) could EASILY see software on the other partitions.

How would it do this? The "partition" that the Windows OS runs in is a virtual partition, and is really just a disk image. The virtual OS only has knowledge of this partition and up to two other virtual partitions that you set in the preferences of that virtual machine. When you copy something between the Mac side and the Windows side on VPC, a temporary share is created for the duration of the copy.

It is possible to set up VPC to see your entire Mac partition by setting up folder sharing from the Mac's root directory. You'd have to go out of your way to do this, there'd be little to no point, and it would be in no way something MS could count on to happen.

People will believe anything

[EggMan2000]

First of all, nowhere in either article does it say that Windows Update is sent info on what software you have installed. The payper view article mentions that it does send hardware info, though. But we knew that via both the EULA, and the fact that this is the intended purpose, to update drivers for hardware and OS patches.

Don't believe the alarmist titles to articles. Do you all fall into this trap with the evening news as well? "Tune in for the Radon discover that just might save your familyu's life."

I know that you guys are smarter than this. Use your brains.

Windows Update is crap

[McSpew]

As explained by Russ Cooper of NTBugTraq in a lengthy rant on Tax Day of 2002, Windows Update is a horrible piece of crap. He followed it with another lengthy rant about what he thinks Microsoft should be doing instead of Windows Update.

In the meantime, while downloads are large (~1.5MB), the XML package you get for HFNETCHK searches your system for proper file versions and remains the most reliable way to ensure your system is properly patched. Unfortunately, the best tool for checking your patch state (HFNETCHK) doesn't help you download the patches you need. It does identify the MS security alert addressed and even the KB article, but it's not painless. MBSA gets you one step closer by actually having the URL of the KB article, but it's not as painless as downloading updates via Windows Update (when WU properly identifies your patches).

Anybody who's used the atrociously-bad Automatic Update Service will know that it doesn't cover many important software updates and neither does Windows Update. In fact, if you use all three products, you'll frequently find that each product identifies a different set of patches that are required, and usually, none of them list all the patches identified by the others.

What I've found is that HFNETCHK actually identifies truly critical patches, while Windows Update improperly identifies non-critical updates as being critical. For instance, it tells you that installing Internet Explorer 6.0 SP1 is critical (even when you're running a fully-patched IE 5.5SP2) or even worse, it tells you that a patch meant to improve functionality of using a non-IE default browser is critical.

Sorry, but as much as I hate MS and as much as I prefer Mozilla to IE for my own browsing needs (and even though it works better), I don't make it my default browser anywhere, especially on servers, so this update is hardly critical.

In short, while sysadmins at least have a chance to stay fully-patched these days--unlike the days before Code Red--MS still has incredibly shoddy patch management tools, incredibly inconsistent patch installation mechanisms and still takes liberties with customer data it shouldn't need to take.

If Microsoft ever gets serious about patch management, they'll have a common tool that sysadmins can use to patch any and all of their MS software with a common interface and no unnecessary transmission of system-specific data to MS. Is that too much to ask? Apparently.

Keep an archive

[PW2]

Keep an archive of all service packs for your OS

Microsoft can't read all my software......

[olddoc]

I installed all my best software on an ext3 partition!
Ha! Take that Mr. Gates!

Of course now they will probable start including ext3 drivers in the next Windoze.

Re:From the Windows Update website privacy stateme

[fudgefactor7]

"Tell that to the Melissa author, and some number of other people who's GUID was used to identify them. Even if you aren't a criminal, this could be misused in so many ways."

Found on the 'Net: "David L. Smith was not caught on the basis of the GUID, he was caught because the feds were able to trace the point of insertion of the virus into alt.sex from the ISP he used, then from the connection logs down to the phone number used to connect to the service. The GUID had nothing to do with it. There was also no indication that he used pirated software, just that he or someone had used a previously written virus and modified it into Melissa, passing on the unique GUID of the original document/macro author."

Just wanted to set that straight.

BeOS

[Amiasian]

My friend, Virtual PC does run BeOS. However, that said, there is a major bug. I can do everything with it, except type; it hangs on keyboard input. That said, I get a 16 bit 1200 x 1600 display for BeOS with the ability to run any application natively installed on the OS, plus some downloads which I used shared disks to transfer into Be.

This can NOT be so.

[LazloToth]

In case Slashdot readers have not been paying attention, Microsoft now promotes trustworthy computing. Trust is a two-way relationship; therefore, now that we are able to compute with MS products in confidence, it stands to reason that the same level of trust extends from Microsoft to users. The writer of this article evidently has not kept up with recent news.

True?

[siskbc]

Have they actually stated this? I would love to see something in print. Quite deceptive - not surprising to us, but people outside of /. tend to like examples.

A list is a lot of bandwidth?

[siskbc]

So, in addition to downloading a list of all possible patches for all possible applications and all possible hardware configurations (pretty big list), it also has to download some sort of ruleset that goes around all of those to actually figure out locally what udpates are available and necessary. That's a lot of bandwidth.

First, the client would be a one-time install. No biggie there. Next, text is pretty small. I mean, you have to review the patches yourself anyway (please tell me you don't allow MS to decide what gets "updated"...). I can read pretty fast, but not as fast as my modem can d/l text. So I don't think the bandwidth is a problem.

And I would still rather have this client-side. They can deduce all they want, but they won't have things like reg codes, CD keys, etc, which I bet they collect. And I bet they also collect PCI serials. So, if they ever decided to bust you, they'll have all your hardware ID's and software codes. Yay!

Re:Or

[Sj0]

No he couldn't. The chances of getting drivers for any given piece of hardware from windowsupdate.com are incredibly slim. Among all the PCs in my household, only my main computer even has a single component detected by windowsupdate (my nforce sound, oddly enough).

That's why I don't use XP.

[RatBastard]

Windows 2000 SP 2 doesn't have those nasty EULAs in them. And that's what my systems run. I also still run MediaPlayer 6 for the same reasons.

I use Win2K because everything I run needs Windows. I don't use XP because I do not like the invasive EULAs and I think it is a bloated pile of useless eye-candy.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Along those lines...

[ShawnDoc]

As the article states, the DVD's "Unique ID" is sent to MS and looked up in a database of DVD's. This info is then sent to MediaPlayer and stored so the next time the DVD in inserted it will pull up the name and track info.

This is no different than the typical CD player/MP3 ripper which queries the CDDB to find out the title of the CD and the name of the tracks. No big deal.

The original article that started it all

[PhunkySchtuff]

The original "discovery" was made by Louis Solomon of SteelBytes Software
He posted it to ntbugtraq on Monday Feb 24th
Here is the original post, where it describes the issue in a clear fashion, and does point out that Microsoft do tell you exactly what information they gather, however most people are unaware of this as they don't read the EULA - like me

kai

Mr. Jones? Microsoft calling...

[mengel]

We understand you've been considering switching from Microsoft software to an Open Source operating system.

Yes... Before you do that, you might want to consider how embarrasing it might be when people find out you've been watching Debbie Does Dallas on your office PC.

Oh Mr. Jones, blackmail is such an ugly word...

And will you be buying another thousand Office licenses? Wonderful! So nice to do business with you Mr. Jones...

You needed to hack it to know this?

[kap1]

/. paranoia strikes again. All this information is available in the Windows Update Privacy Statement. I guess it's good that someone bothered to verify, but this "scoop" is not much of a shocker.

Windows Update Privacy Statement

[Anonymous Coward]

Taken from XP Pro Automatic Updater, Settings, "Learn more about automatic updating" (help screen), "Windows Update Privacy Statement":

Windows Update Privacy Statement

Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. This information includes:

Operating-system version number and Product Identification number Internet Explorer version number Version numbers of other software Plug and Play ID numbers of hardware devices

The Product Identification number is collected to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information. The configuration information collected is used only for the period of time that you are visiting the site, and is not saved.

To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, Windows generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and information about your operating system version and Internet Explorer version.

Because Windows Update does not collect personally identifiable information, the configuration information and GUID cannot be used to identify you.

Please visit http://windowsupdate.microsoft.com to review any updates to this privacy statement.

Related Topics

Sun has a much better way of doing it...

[illumin8]

I really like the way Sun handles patches, they have a much more intelligent system that doesn't rely on invading your privacy. Here's how it works:

1. You download the patchdiag.xref file from Sunsolve. This file is updated daily and contains a list of all patches available for all versions of Solaris. It's currently about 1.4 megabytes in size. You only need to download this once, throw it up on an NFS server and all of your Solaris hosts can use it.

2. You execute a Perl script called patchk.pl that compares your currently installed patches with what's available for your OS and generates an HTML page that is automatically opened in Netscape. The HTML page simply lists every patch you need and has check-boxes, a lot like Windows Update.

3. Check all the boxes for patches you need and click a button at the bottom of the page and Sunsolve generates a tarball of all your patches for you.

4. Download tarball and install from single user mode.

That is the proper way to do it, and it seems like Windows Update used to do that in previous versions but the xref file got to be too big for every single client to download every time. MS should provide an xref file that Windows administrators can download and run Windows Update across their enterprise using the xref file, not sending any information to Microsoft.

Sun has been selling systems to three letter governement agencies for quite some time that would never even consider purchasing a product that "phoned-home". If Microsoft wants to play in that ball-game they need to pull their head out of their ass and provide real enterprise level patch management.

P.S. The ability to roll-back a failed Windows Update would be nice too...

Spyware

[h-90]

I treid to get Adware to remove Windows but it didn't work.

http://www.lavasoftusa.com/