Slashdot Mirror

← Back to Stories (view on slashdot.org)

Examining Microsoft Update

Posted by michael on from the policy-of-no-privacy dept.

eggsovereasy writes "The Inquirer is reporting that a group in Germany has deciphered the information sent to Microsoft during an update using Windows Update and says that information on all software installed on your computer is sent, even that which is not Microsoft's own software." The original article is, unfortunately, pay-per-view. Update: 02/26 18:19 GMT by T : ionyka points to this "related article from ITWorld that deals with Microsoft's transferring of information through Windows Media Player. When you open up Media Player it sends information back to Microsoft like what movies you play, what songs you listen to and where they come from."

79 of 773 comments (clear)

  1. Haha by mao+che+minh · · Score: 5, Interesting

    Remember the little "No information is being sent to Microsoft at this time...." message during updates? Wait, why am I laughing?

    1. Re:Haha by duckpoopy · · Score: 5, Funny

      Their defense: The information is sent right before this message appears.

      --
      word.
    2. Re:Haha by Ian+Wolf · · Score: 4, Insightful

      A cow-orker of mine actually argued with me one day that "No Information" really meant nothing, nada, zilch was sent back to MS.

      I should have taken him out back and beaten him with a frozen salmon. Hello!? How do they know what patches you need if they can't look at your system and tell their servers what you've already got.

      The fact that the program takes the time to rifle through the system is of no surprise to me. While, I think the practice stinks it hasn't stopped me from using the service though. Given the choice between MS finding my installation of UT2003 or some script kiddie looting my system, I'll choose the former.

      --
      "The words of the prophets are written on the Slashdot walls."
    3. Re:Haha by AyeRoxor! · · Score: 4, Insightful

      "I should have taken him out back and beaten him with a frozen salmon. Hello!? How do they know what patches you need if they can't look at your system and tell their servers what you've already got."

      They could send a complete list of available patches to your system and let the client running on your computer pick which ones are neccesary, without microsoft ever knowing what software you have installed. Granted, they could deductively determine what hardware you use based on what patches you then request, but since you can only download patches for microsoft software, the best they could do would be to determine what hardware and microsoft software you currently have installed.

    4. Re:Haha by squiggleslash · · Score: 3, Redundant
      Hello!? How do they know what patches you need if they can't look at your system and tell their servers what you've already got.
      Quite easily, IF they wanted to be bothered. Instead of the server deciding what to download, you have a program on the computer do it.

      The process would look something like:

      1. Client downloads latest Update Management Software + Config File from server
      2. Client runs Update Management Software.
      3. UMS determines what patches are needed from inbuilt logic and information in configuration file
      4. UMS downloads and applies relevent patches
      The system isn't fool proof. It may be possible for someone operating a system this way to determine what software you're running from the nature of the patches downloaded, especially if all patches are downloaded from one source. This can, to some extent, be reduced by bundling patches together so that someone running one of eight different programs or with one of nine different hardware devices attached, downloads a file with the patches for all problems associated with these eight programs or nine devices. But that requires honesty and integrity on the part of the operator of the Update service.

      The allegation that Microsoft doesn't do this, and lies to users by claiming it does, is quite damning. There's no need for Microsoft to get this information in order to provide the advertised service, and it should be able to stand by its claim that it does not get that information.

      --
      You are not alone. This is not normal. None of this is normal.
    5. Re:Haha by Gunzour · · Score: 5, Informative

      You cow-orker was right. When Microsoft Update said "No information is being sent to Microsoft", no information -- at all -- was being sent to Microsoft. The update server sent your computer a list of available updates, and code ran on your computer which determined which ones were necessary.

      Microsoft Update no longer says "No information is being sent...", which is what this article is about.

    6. Re:Haha by skinfitz · · Score: 5, Informative

      Remember the little "No information is being sent to Microsoft at this time...."

      The more astute amongst you may have noticed that the "No information" message has not been there since Win2kSP3 came out.

      Now it says this:

      Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you.

      Which essentially means that so long as they don't take an email address or phone number they can take what they want.

    7. Re:Haha by ArsonSmith · · Score: 3, Informative

      my debian system does it everyday, sometimes twice a day if I feel like getting something new to play with.

      --
      Paying taxes to buy civilization is like paying a hooker to buy love.
  2. Complete Breach of Trust by SUB7IME · · Score: 3, Insightful

    Is this not a complete breach of the TOS that Microsoft offers when you sign up for Windows Update?

    If not, it's at least a huge breach of trust, and users should not stand for it.

    1. Re:Complete Breach of Trust by teeker · · Score: 5, Insightful

      This isn't just some random company that nobody has ever heard of, with a clean slate. It's 2003. When people deal with Microsoft they know what they're getting into, regardless of what Microsoft says.

      Sorry, I'm gonna call bullshit on this one. While it's true that people involved in the industry generally know what's up, many people outside of it don't. People who have better things to do than read IT-related media get all of their news about MS from totally mainstream sources in the first place, and lot of people could really give a rat's ass about today's MS article on Yahoo's front page. As far as Joe Sixpack is concerned, it's an IT-related story, and he probably doesn't care what it says. If you are not into the theatre scene, do you read reviews for every play in your area? If you are not interested in business, do you read every story in the business section? Probably not, and my mother doesn't read every store about Microsoft.

      Saying that the victim is at fault is not a solution to the problem, and is not an excuse for bad behavior on MS's part.

      --
      teeker
    2. Re:Complete Breach of Trust by BWJones · · Score: 4, Interesting

      Give me a break. Your acting like windows users should be living with a constant fear that Microsoft "agents" will suddenly appear at their front door to give them a beating.

      Ummm, years ago when I was in high school and working for my mother, we had purchased a software package from a company that wrote medical office management software. I had noticed that all of the manuals were photocopied and we had no original disks for Microsoft software that was included in the package. I called Microsoft about this and they had in our office the *next* day two dudes from Microsoft and an FBI agent asking to examine our computers. We ended up getting screwed because the guy whose software we purchased was smacked hard by M$ as the package we bought went unsupported after that.

      Of course this guy was absolutely stealing and should have gotten what he deserved, but my point is simply that, yeah, there are Microsoft agents of a sort and they do show up at your door.

      --
      Visit Jonesblog and say hello.
  3. Makes sence by Anonymous Coward · · Score: 5, Funny

    Trying to figure what other companies they should push out of business.

  4. pay-per-view by sys49152 · · Score: 5, Funny
    The original article is, unfortunately, pay-per-view.

    How can we comment, if we can't read the article?

    Oh, wait...

    1. Re:pay-per-view by essdodson · · Score: 4, Funny

      Welcome to slashdot. You're obviously new here or you've just not been paying attention, would you like a tour?

      --
      scott
  5. I wonder what Virtual PC sends ... by adzoox · · Score: 4, Insightful
    I wonder what Virtual PC sends, whether it sends only the info in the Windows Drive image or everything on the Mac.

    This may also be an alterior motive to Microsoft buying Virtual PC from Connectix last week. They want this same data from Mac Users. I imagine if it's not there then it will be added to read all partitions mac/Linux/PC

    Knowing what your customers have on their hard drives is sensitive corporate data. Basically, you know the Hot or Not Programs in the industry and then develop programs based on their hard drive residency!

    --
    Yell & scream & rant & rave... it's no use... you need a shaaaave ~ Bugs Bunny
  6. EULA says they can take what they want by RichMan · · Score: 3, Insightful

    According to the EULA for the latest versions of the OS Microsoft has the right to read any data you have stored on a computer which runs the OS.
    Theoretically this includes data dumps of hard drive formats which the OS does not even support.

    1. Re:EULA says they can take what they want by Nursie · · Score: 3, Insightful

      Well yeah, they're going to make sure they cover their arses.
      I thought this sort of outrage was already covered by the change in TOS brought in by WinXP SP1? (i.e. we will take whatever info we want from your machine, and if we don't like it we'll lock you out.)

    2. Re:EULA says they can take what they want by Ezrem · · Score: 4, Informative

      And where did you find that piece of info?

      Direct from About Windows Update :

      Windows Update Privacy Statement (Last Updated 10/15/2002)
      Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

      * Operating-system version number
      * Internet Explorer version number
      * Version numbers of other software for which Windows Update provides updates
      * Plug and Play ID numbers of hardware devices
      * Region and Language setting
      The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

      Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

      To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

      Hardly "We can scan your computer for any information we want, and there's not a damned thing you can do about it!" as you've implied.

    3. Re:EULA says they can take what they want by gmuslera · · Score: 4, Interesting

      The EULA also says that they can delete what they want (at least what they say that violates DRM, and their sofware is not know to be very intelligent), and have others that says something like they own all what you transmit thru they servers...

      In fact using their software (and then accepting the EULA) is like simply close your eyes and pray that the big depredator which is in front of you isn't hungry right now, and will not be all the long time you be there.

    4. Re:EULA says they can take what they want by leviramsey · · Score: 5, Informative

      Read the parent comment.

      This isn't Windows Update he's talking about, it's the EULA for recent versions (XP, IIRC) of Windows.

    5. Re:EULA says they can take what they want by malfunct · · Score: 5, Insightful

      I'm not defending microsoft here but nothing in the blurb that you posted says that MS won't collect the list of software on the machine. To play devils advocate its pretty easy to say that the installed software is part of the configuration information on the machine. Further it makes some sense how this is useful in picking which patches are presented to you. If there is a patch in windows update that fixes a bug that affects 1 software package in the world that 1% of users use then wouldn't it be useful to scan to see if that is installed and only present the patch to the 1% of users that need it. Especially given that many bug fixes cause bugs in other software that relies on the broken behavior or some kludgy work around.

      --

      "You can now flame me, I am full of love,"

    6. Re:EULA says they can take what they want by mrpuffypants · · Score: 3, Insightful

      notice, however, that it says it includes that information...that can very well just be a part of what they are collecting, and the only part they are telling you about.

    7. Re:EULA says they can take what they want by aug24 · · Score: 4, Insightful
      Clearly YANAL (You are not a lawyer)!

      Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

      If a lawyer writes "this information includes...", then that's exactly what they mean. They don't mean that it is a complete list; there may be other stuff that they're not explicitly telling you about.

      Justin.

      --
      You're only jealous cos the little penguins are talking to me.
  7. /Tin Foil Hat Off by GLX · · Score: 5, Insightful

    The reason why it sends info about other applications (and third party drivers for that matter) is so that they can attempt to be a single-source vendor of patches if needed.

    While the intentions may not be all that honest, it's not a horrible idea. I've noticed numerous times when running Windows Update that it's offered to upgrade my Cisco Wireless LAN software as well as my Epson print drivers. Kind of nifty and not all that bad, if you ask me.

    --
    Sig (appended to the end of comments you post, 120 chars)
    1. Re:/Tin Foil Hat Off by Atzanteol · · Score: 4, Insightful

      But why must this be done on the server, and collected at Microsoft? Can't the client download a list of what MS has for updates, and decide what the local system has?

      --
      "Ignorance more frequently begets confidence than does knowledge"

      - Charles Darwin
    2. Re:/Tin Foil Hat Off by Com2Kid · · Score: 3, Insightful
      • While the intentions may not be all that honest, it's not a horrible idea. I've noticed numerous times when running Windows Update that it's offered to upgrade my Cisco Wireless LAN software as well as my Epson print drivers. Kind of nifty and not all that bad, if you ask me.


      Driver updates? No problem.

      SOFTWARE updates? Uh. Problem.

      Windows Update is responsible for updating my SYSTEM, thus the term Windows update, not "universal software updator" or some other such silly name.

      Besides, last time I let Windows Update update my drivers it replaced my Matrox G400 driver with a French G400 driver that refused to be uninstalled. . . .
      --
      Need help treating your acne? Come here!
    3. Re:/Tin Foil Hat Off by Zathrus · · Score: 5, Interesting

      The list of patches that Microsoft must have is HUGE

      Yes, as it is for any OS vendor. But so what? How much data to you actually have to send? Not a whole lot - just enough to identify what piece of software it's for and what version it is. If you can't store all of that in, oh say, 20 bytes, then you're screwed in oh-so-many ways. Hint - encode the software identifier in a 32-bit or 64-bit number, and the version string in the remaining bytes.

      So, let's say you have 1000 patches available for the OS in question -- and, yes, patches are OS specific and MS has that much info from you already. That's a 20,000 byte download. Even at 14.4k it's only 20 seconds. Big deal.

      The system then has to process the list and figure out what it may need, then request additional data for each potential patch... but you're going to have to download that information anyway, and there is minimal additional overhead.

      It might take slightly longer, particularly over slow links, but it's a hell of a lot more user and security friendly.

  8. Check out the rest by joshmathis · · Score: 5, Informative

    Here is the rest of the article, in PDF format. I'd suggest grabbing it and mirroring as soon as possible... this one won't hold up too long.

    http://home.byu.net/~btc25/WindowsUpdate.pdf

    One of the more interesting parts deals with how Microsoft can tell the difference between product keys they generated and those done with a keygen.

    1. Re:Check out the rest by Com2Kid · · Score: 5, Informative

      The correct link is:

      http://home.byu.net/~btc25/windowsupdate.pdf

      Aren't caps great? Heh.

      --
      Need help treating your acne? Come here!
  9. Re:Pay per view? by Call+Me+Black+Cloud · · Score: 5, Informative

    I made the same mistake...it is ppv...you can read freely until the heart of the article, then it's 1.99 (euro) for the rest.

  10. No verification possible... by Reinout · · Score: 4, Insightful

    Nice claims, but we the free part of the article doesn't show any actual examples of data that's transmitted. At least not data apart from some generic xml tags.

    Any easy way to verify this ourself?

    I'm suspecting their claim is true, but I'd like to see the data...

    Reinout

    --
    Reinout van Rees
  11. And I should be surprised why? Also, a suggestion. by Jack+William+Bell · · Score: 4, Insightful

    Although I often semi-sorta-half-hearted-defend Microsoft when people make unsupported categorical statements or otherwise speak mindlessly, I am also willing to speak out against them when they are wrong. As in this instance.

    I would have to do some research, but I believe this might violate their own privacy policy. Even if it doesn't, they really have no moral right to send any information about your system without letting you know what it is and giving you a chance to abort the whole thing. Yet I am unsurprised, in fact I expect every big company is doing this kind of thing when they can get away with it.

    Not that I am saying "Everyone is doing it, so what is the big deal?" My attitude is more "Let's stop this crap now!"

    So I have a suggestion -- someone should start an open source project to create a re-writing proxy for updates that strips out all the stuff Microsoft is sending in the updates, except what is absolutely needed. Make it open enough that we can plug it re-writers for other companies as well.

    --
    - -
    Are you an SF Fan? Are you a Tru-Fan?
  12. Re:I FAILED IT by guacamolefoo · · Score: 3, Funny

    got the new ultra psyware

    Great! Where can I get psyware? I've been looking for a way to get rid of my mouse and keyboard. Dos it allow a USB 2.0 connection to my nervous system, or does it use 1394?

    GF.

    --
    Lots of petrified grits
  13. big deal - they've confirmed the M$ privacy stmt. by erik1474 · · Score: 4, Informative

    below from the M$ site... they tell you outright that they are collecting this info. What's the big deal?

    Windows Update Privacy Statement (Last Updated 10/15/2002)

    Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

    Operating-system version number
    Internet Explorer version number
    Version numbers of other software for which Windows Update provides updates
    Plug and Play ID numbers of hardware devices
    Region and Language setting

    The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

  14. From the Windows Update Privacy Policy by neile · · Score: 3, Redundant

    Note: Windows Update does not collect any form of personally identifiable information from your computer. Read our privacy statement.

    Windows Update Privacy Statement (Last Updated 10/15/2002) Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

    • Operating-system version number
    • Internet Explorer version number
    • Version numbers of other software for which
    • Windows Update provides updates
    • Plug and Play ID numbers of hardware devices
    • Region and Language setting

    The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

    Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

    To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

  15. YES IT DOES! Full example of sent data here: by illtud · · Score: 5, Informative

    They've updated the story to give the full info on what gets sent back here: http://www.tecchannel.de/betriebssysteme/1126/14.h tml

  16. Re:I FAILED IT by jetmarc · · Score: 5, Funny

    > or does it use 1394?

    I think it uses 1984.

  17. XML Schemas available here by cobyrne · · Score: 4, Informative

    Client Info Schema and System Info Schema.

    They appear to get a copy of your registry, as well as information like processor architecture, manufacturer, printer(s?) etc

  18. Another PDF mirror by wilstephens · · Score: 3, Informative


    http://clients.fbagroup.co.uk/slashdot/WindowsUpda te.pdf

  19. Who cares about windows update? by SatanicPuppy · · Score: 4, Funny

    What I want to know is why fricking Windows Media Player tries to "Phone home" all the time? That thing is harder to get rid of than the clap, and about half as useful. I have my firewall specifically tuned to stomp on it every time it opens its digital mouth.

    This is hardly a surprise, and definitely adds a good bit of weight to all those people who call Palladium the death of privacy.

    Just my 2.34539 yen worth.

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  20. uh-oh. by war3rd · · Score: 5, Funny

    You mean they can see my Kenny G. pr0n screensaver?!?!?!?

    --
    Got sushi? The Sushi FAQ
  21. Re:Surprise, surprise... by wilstephens · · Score: 3, Insightful

    The manufacture's website was in Japanese only, and I had no idea how to navigate let alone install a Japanese application.

    And, yes, I am lazy. How did you know?

  22. If you actually *look* at the information sent... by Anonymous Coward · · Score: 3, Interesting

    ... you'll see that - contrary to the Inquirer story - it doesn't include anything about 'installed software', with the exception of device drivers. No applications, no utilities - nothing that MS is likely to want to compete with, and indeed nothing that MS doesn't overtly mention in its own privacy policy.

    So what's the problem?

  23. Having read the article... by cperciva · · Score: 5, Informative

    I have to say that it's not nearly as scary as advertised. There are two complaints:
    1. The Windows Update tool sends to Microsoft a complete list of what hardware you have.
    2. If the Windows Update server claims to have an update available for product X, the Windows Update tool will check to see if you have product X installed, and report back to Microsoft.

    Well, *duh*. The only way to avoid doing this would involve downloading a complete list of all the updates available for every supported piece of hardware or software. Based on the size of the windows HCL, I'd guess that this would require tens of megabytes of bandwidth -- all so that Windows Update could pick out the half dozen entries which are relevant.

    --
    Tarsnap: Online backups for the truly paranoid
  24. Re:Surprise, surprise... by Anonymous Coward · · Score: 5, Insightful

    Microsoft needs to collect this information for driver updates and other *useful* updates.

    No they don't. They can just send a list of updates to the client, and the client can display the updates that apply to your computer. This is why Microsoft can claim no information is being sent to their server: because sending information isn't necessary.

    This is actually how APT works.

  25. Re:Surprise, surprise... by Anonymous Coward · · Score: 3, Informative

    So you have to remember who manufactured all of your hardware, then individually trawl through their sites and hope they keep old drivers on there? Sounds like Linux-style usability to me. I much prefer Microsoft's style of doing it: fast and easy, because I like being lazy.

  26. Re:Surprise, surprise... by Ian+Wolf · · Score: 5, Insightful

    If I tell windows to look for the drivers for a particular device than by all means probe the device for information about it. How does scanning all installed applications aid in this endeavor?

    If the reasoning was to better detect and avoid application conflicts I would possibly agree with this method, but the software clearly doesn't do that.

    --
    "The words of the prophets are written on the Slashdot walls."
  27. Dear Steven, From Bill Gates by joelparker · · Score: 5, Funny
    any chance they get to know more about you.... they're going to take it.

    Dear Steven,

    Good point. Your previous Slashdot postings are also good, except for that one about Linux.

    Sincerely, Bill G.

  28. Re:Surprise, surprise... by Ballsy · · Score: 5, Insightful

    Never confuse "Lazy_ass_user computing" with "computing for people who have better things to do with their time than fuck around searching for drivers on some poorly designed manufacturer website".

  29. Re:Surprise, surprise... by Anonymous Coward · · Score: 5, Funny

    The more data that gets sent to microsoft, the harder it becomes to manage. Someone should figure out a way to send them Junk data with wrong version numbers. Windows 3.11 running IE 6.0... that'll leave them scratching there heads.

  30. Windows Update Privacy Policy by jamesbulman · · Score: 3, Insightful

    Has anybody actually read the policy? If you read it it doesn't really sound like they've done anything they said they wouldn't.

  31. EULA could still be illegal in spite of agreement by Beetjebrak · · Score: 5, Informative

    Here in Holland (I don't know the laws in the rest of the world too well) any contract that you sign which contains clauses that are illegal, is null and void. Any statement of MS having the right to download anything off MY computer would seem to me totally illegal and would probably void the whole EULA.
    I did read the EULA of the Dutch version of Win2K SP3 completely and never found any clause that would allow them to download anything off my PC without my consent.
    Sadly I'm stuck with Windows since I cant (yet) afford a mac to run Adobe apps on. When oh when will Linux/FreeBSD/X get decent colour management and ports of proper graphics apps like Illustrator, Photoshop and InDesign??? The GIMP is a nice toy, but it's hardly of any use for print production work. And KIllustrator and the like are simply a laugh too for any real work.. The Linux/BSD vs. Windows ratio is now 4:1 in the favor of the free, but I'd like to get rid of Windows altogether. Give me my killer graphics apps!! I'll even pay for them! ;-)
    Saving up for that Mac in the mean time..

    --
    Learn from the mistakes of others. There isn't enough time to make them all yourself.
  32. Re:Surprise, surprise... by Tellarin · · Score: 5, Insightful


    so this person with a so precious time should think twice before buying products from a company with such a "poorly designed website" or that don't ship a version of the drive with the product

    --
    -- SouNerd.com
  33. Story is incorrect by doug363 · · Score: 4, Informative

    According to the (full) article, Windows Update sends a list of hardware installed on your system, but not a list of software. Version numbers for Windows stuff, like IE, are sent, but not any info about other software on your compouter.

  34. From the Windows Update website privacy statement by greygent · · Score: 4, Informative

    To provide you with the best possible service, Windows Update also tracks and records how many unique machines visit its site and whether the download and installation of specific updates succeeded or failed. In order to do this, the Windows operating system generates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any personally identifiable information and cannot be used to identify you. Windows Update records the GUID of the computer that attempted the download, the ID of the item that you attempted to download and install, and the configuration information listed above.

    Yes, we don't not track you.

    Tell that to the Melissa author, and some number of other people who's GUID was used to identify them. Even if you aren't a criminal, this could be misused in so many ways.

    Despite loving many Microsoft products and the line of NT OS'es, I wouldn't trust Microsoft as far as I could throw them.

  35. Hey now. by waldoj · · Score: 5, Funny

    You cow-orker was right.

    Now, look here, there's no need to be mean.

    -Waldo Jaquith

  36. Easy Solution by swordboy · · Score: 3, Interesting

    Why doesn't some enterprising individual simply monitor Microsoft's various OS's for updates and then link to the downloadables? Of course, it would be possible for MS to remove downloadables but then this really causes frustration for those who are maintaining systems that cannot access windowsupdate.com. I'm not sure that they could do it - they'd have to install spyware in the actual patches. But then we could configure the firewall to block everything MS.

    Or we could all just get Mac's. I'm almost there, unless someone can put together a KDE or Gnome with some usable functionality (like device management and system configuration in ONE GODDAMMED FUCKING LOCATION).

    Apple!!!! Bring OSX to X86 and we will make it worth your while!

    --

    Life is the leading cause of death in America.
    1. Re:Easy Solution by Zendar · · Score: 3, Informative
      They'll give you the OS for free, as long as you pony up for the box.

      Then why do they charge $120 for existing users (owners) to upgrade to each new point release for OSX?

    2. Re:Easy Solution by nachoboy · · Score: 3, Informative

      Because the value of Windows Update doesn't lie in the fact that it gives you the patches. Its value to consumers is that it will automagically detect what kind of system you have and provide a list of the necessary patches. Yes, it also conveniently lets you install all of them with just one more click, but Microsoft already offers all their patches in downloadable .exe form. The problem is that every time a patch comes out, a user must read the accompanying documentation, determine whether their system is vulnerable, and apply the patch. And this is no easy task. There are patches for Windows (no brainer), Office (mostly a no-brainer) [these are usually obtained at Windows Update's little sister site, Office Update], Internet Explorer (easy enough), IIS (do you know whether it's installed?), the Java Virtual Machine (getting a little tricky now), the HTML Help subsystem (woah), the MDAC components that probably got installed when you installed Windows (what luser knows what MDAC is?), and the FrontPage Server Extensions (sounds like Office, no? don't worry, it's conveniently included in Windows). Oh and if that wasn't hard enough, there are patches that supercede patches, late, missing, or broken patches, patches you think you have to apply twice, the list just doesn't end. Windows Update in its current incarnation can get rid of the user hassle for most of that by moving all of the guesswork out of the luser's hands and into Microsoft's engineers' hands.

      Personally, I find the whole patch thing ridiculous. I tried to stay abreast of the current security patches by subscribing to the security mailing list and making my own decision about whether a patch applies. It's impossible. Every time you think you've gotten it right, there's another patch to figure into the situation. I use Windows Update to find out what updates I need, but since the home connection is ridiculously slow, I just make a list and download the .exe's from http://download.microsoft.com. (Search by the KB article #). As long as you save them, the syntax for installing them quietly is mostly uniform, and you can apply them with little hassle next time you install.

  37. Re:Surprise, surprise... by Xformer · · Score: 4, Interesting

    Even if the poorly designed manufacturer's website is the only one with the working driver?

    I had a bad experience along those lines with the Windows Update site, where a particular sound driver (I forget which, at the moment) from them would not work with my hardware, where the one from the manufacturer's website did.

    --
    All I want is a kind word, a warm bed and unlimited power.
  38. YOU INSENSITIVE BASTARD! by Anonymous Coward · · Score: 5, Funny

    I am running Win 3.11 with IE 6.0 and what you're suggesting will interfere with my support!

  39. What, did you miss this? by sammy+baby · · Score: 3, Informative

    And I quote:

    Warby -- who is the chief information officer at Seattle Metropolitan Credit Union -- believes that the terms for the end user license agreement (EULA) for Microsoft's Windows 2000 Service Pack 3 (SP3) and XP Service Pack 1, might well put the credit union in violation of new federal privacy laws... To use the "auto update" feature, according to the Microsoft Windows 2000 SP3 license, "it is necessary to use certain computer system, hardware, and software information..." By using these features, users authorize Microsoft or its designated agent to access and utilize the necessary information for updating purposes."

    Full article can be found here.

  40. Comment removed by account_deleted · · Score: 5, Insightful

    Comment removed based on user account deletion

  41. Comment removed by account_deleted · · Score: 5, Informative

    Comment removed based on user account deletion

  42. The Devil Came to Redmond... by ites · · Score: 5, Funny

    The Devil came to Redmond, looking for some souls to steal,
    and there he met with Billy G, who was just about to make a deal.
    Said the Devil, "Hey Billy, you look bored, would you care to make a bet?"
    And Billy he smiled slyly, and said "Dude, there ain't a deal that I've missed yet."
    So the Devil took his keyboard and showed Billy his new game,
    Saying "I wrote this quick, in VB6, now see if you can do the same."
    Billy G, he just smiled his smile, and took the keyboard away,
    and said, "Devil, you're behind the times, and you clicked on the EULA,
    "Now you've run Windows Update, and your soul belongs to me."
    And the Devil knew he'd met his match, so he turned and tried to flee,
    But Billy G was much to fast, and he caught the Devil's long black cape,
    Saying, "Devil, stay and play a while, we have a whole wide world to rape."

    --
    Sig for sale or rent. One previous user. Inquire within.
  43. Don't panic, here's a summary by unfortunateson · · Score: 4, Informative

    First of all, the example data sent is available free, as one poster above already listed. There's no software described there other than Windows itself.

    Second, the System Info Schema, as posted by another above, is pretty explicit about what registry keys are available to be sent, and it's pretty tame.

    Frankly, I have no problem letting them know exactly what hardware I've got running. How can they harm me there? Perhaps a malicious hacker could grab this data and find ways to abuse my network card? Pretty slim.

    Call me too open, if you will, but I'd be happy if it would let me know about other MS updates, such as Office, without having to also visit MS' office site. Update those automatically? Never. But it's much less convenient than the Windows Update site.

    I greatly doubted that it would be sending large quantities of personal data, because it just doesn't take that long. The ones to worry about are the virus scanners, that take the time to examine every freakin' file.

    In summary:

    • They're not sending your entire hard drive
    • They're not sending your entire registry
    • They're not sending a full software inventory
    • They're probably gathering a little more than they need
    • They're probably not doing anything with it (yet)
    --
    Design for Use, not Construction!
  44. Re:Surprise, surprise... by japhmi · · Score: 3, Insightful

    But why send a complete list of all of the programs on the computer? Why not send "Windows 98 SE, IE 6.0," and a few things that windows update can actually help with, and not that I am using the WordPerfect suite and not MSOffice (quick, apply the "SlowWordPerfect() operation! and the MakeMozillaCrawl() one two!)

    I know it's a bit of paranoia, but I'd rather them not know what I've got running at all, but I'll let them know what MS software I have because that's what I'm getting fixes for.

    --
    "Giving money and power to government is like giving whiskey and car keys to teenage boys" P. J. O'Rourke
  45. WU doesn't send software list by phasm42 · · Score: 3, Insightful

    There are a lot of people in this thread that realize that WU does NOT send a list of all software installed, but they are being drowned out by the highly rated comments about the evils of MS. The "software list" is actually a list of drivers installed, which is fine, because MS will post updated drivers for you to download. It should also be noted that one of the articles posted is from the Inquirer, the same people who predicted hell on earth in y2k, and believe in tinfoil hats.

    --
    "No one likes working in a hamster wheel, and your shop smells of cedar shavings from here." - TaleSpinner
  46. Great, I've added THIS to my registry then by MadCow42 · · Score: 5, Funny

    HKEY_LOCAL_MACHINE\Software\IllegalMicrosoftStuff\ BillGatesVISAnumber\8605412399653153

    HKEY_LOCAL_MACHINE\Software\MSKillerVirus\Launch Da te\2003.06.21

    HKEY_LOCAL_MACHINE\Software\Linux\"format c:\; install Linux" .... hey, why not have some fun with it? q:]

    MadCow.

    --
    I used to have a sig, but I set it free and it never came back.
  47. *ahem* by vmfedor · · Score: 5, Interesting
    Windows Update Privacy Statement
    (Last Updated 10/15/2002)
    Windows Update is committed to protecting your privacy. To provide you with the appropriate list of updates, Windows Update must collect a certain amount of configuration information from your computer. None of this configuration information can be used to identify you. This information includes:

    Operating-system version number
    Internet Explorer version number
    Version numbers of other software for which Windows Update provides updates
    Plug and Play ID numbers of hardware devices
    Region and Language setting

    The configuration information collected is used only to determine the appropriate updates and to generate aggregate statistics. Windows Update does not collect your name, address, e-mail address, or any other form of personally identifiable information.

    Windows Update also collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. A validly licensed copy of Windows ensures that you will receive on-going updates from Windows Update. The Product ID and Product Key are not retained beyond the end of the Windows Update session.

    Maybe you should verify the information before automatically declaring "Microsoft is evil" to any and all anti-Microsoft posts.

    --

    I like my women how I like my sugar.. granulated.

  48. Re:Surprise, surprise... by forgetful_ca · · Score: 3, Interesting
    Never confuse "Fast, Easy Computing" with "Lazy_ass_user computing".
    Not only that, but using ms update restricts you to using ms signed drivers. I for one don't wish to give ms that particular club to wield over anyone. They've proven to me they aren't responsible enough to be far to anyone, so I don't think they are entitled to be the judge of anything that makes it to my machine.
    Secondly, there's no way I can believe that ms would acquire your data and subsequently throw it away. None. They are gathering stats and keeping them.
  49. How does this differ from RH Update? by Canabinol · · Score: 5, Insightful

    I use the Update Agent in RedHat almost on a daily basis - the RH Network knows absolutely everything about my setup (programs, modules, etc.) right down to what version of the Kernel I'm running - that way they can inform me of vulnerabilities and problems that I'm probably susceptible to as soon as there's an update available...it's a "good thing".

    Why is it that when Microsoft does this kind of thing, suddenly there's a more sinister motive behind it all?

    I don't hear anyone complaining about Redhat's privacy policies...

    1. Re:How does this differ from RH Update? by Anonymous Coward · · Score: 5, Informative

      When you sign up for RHN, you're given the option of uploading information about which packages you have installed. You can decline [1]. You won't get email about particular packages you have which need updating, but you can still use the update agent.

      The update agent will still work because it polls the servers for which packages are current for your release [2] and compares that list to what you have installed, and the comparison is done locally.

      [1] https://rhn.redhat.com/help/basic/register-system- profile.html
      [2] https://rhn.redhat.com/help/basic/up2date-setup.ht ml#PACKAGES-TO-UPDATE

    2. Re:How does this differ from RH Update? by brettlbecker · · Score: 3, Insightful
      Jesus man, how can you compare them? Did you not notice at all that when you registered for RH update you can PICK AND CHOOSE SPECIFICALLY WHICH PACKAGES YOU WANT TO REGISTER? If you don't want them to know which kernel you have, UNCHECK IT.

      This is such a ridiculous non-issue that completely misses the point. If what this article says turns out to be true, it means that MS is spying on you and offering you NO CHOICE to avoid that spying. On TOP of charging an arm and a leg for PROPRIETARY, SECURITY-FUCKED software.

      Another difference is that if you downloaded Red Hat Linux, you got all the software on there from Red Hat. If you add third-party software, it will only register with Red Hat if Red Hat releases a version of it. This is not the case, if this article is correct, with Microsoft. It will record your software whether it can be updated by MS or not. And that is pointless, unless there is a sinister motive.

      B

      --
      "We must still have chaos within in order to be able to give birth to a dancing star." --Friedrich Nietzsche
  50. Re:Surprise, surprise... by Hal+Roberts · · Score: 3, Insightful

    There are still solutions that allow no meaningful information to be sent. For example, why not have the client just ask for new updates since a given date and cache the rest? That took me all of about 15 seconds to think up and would result in far less bandwidth use than sending the user every upgrade applicable to her system every time she connects.

    Either 1) privacy is just not a factor for the folks at all or 2) they want the data for other uses. Most likely it's the former, but the fact that the makers of the 95% market share OS don't care enough about privacy to make it even a small concern when designing systems like this is Really Scary, maybe scarier than them purposefully collecting my data, because at least then there's the possibility that they'll be careful with my data once they've got it.

  51. Linkee no workee by Wee · · Score: 4, Insightful
    Try going to that link with Opera. Even Opera in Windows. You get a nice message needing to install IE "in order to use Windows Update". Can't view their web page or get a list of updates with any other browser apparently. So much for HTML being the lingua franca of the Internet.

    Life's far too short to use IE.

    -B

    --

    Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.

  52. This is the link by Wee · · Score: 5, Informative
    Here's the page which doesn't care about your browser:

    http://www.microsoft.com/downloads/search.aspx?dis playlang=en

    -B

    --

    Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.

  53. People will believe anything by EggMan2000 · · Score: 4, Interesting

    First of all, nowhere in either article does it say that Windows Update is sent info on what software you have installed. The payper view article mentions that it does send hardware info, though. But we knew that via both the EULA, and the fact that this is the intended purpose, to update drivers for hardware and OS patches.

    Don't believe the alarmist titles to articles. Do you all fall into this trap with the evening news as well? "Tune in for the Radon discover that just might save your familyu's life."

    I know that you guys are smarter than this. Use your brains.

    --
    what? what I thought we were in the trust tree in the nest, were we not?
  54. Windows Update is crap by McSpew · · Score: 5, Informative

    As explained by Russ Cooper of NTBugTraq in a lengthy rant on Tax Day of 2002, Windows Update is a horrible piece of crap. He followed it with another lengthy rant about what he thinks Microsoft should be doing instead of Windows Update.

    In the meantime, while downloads are large (~1.5MB), the XML package you get for HFNETCHK searches your system for proper file versions and remains the most reliable way to ensure your system is properly patched. Unfortunately, the best tool for checking your patch state (HFNETCHK) doesn't help you download the patches you need. It does identify the MS security alert addressed and even the KB article, but it's not painless. MBSA gets you one step closer by actually having the URL of the KB article, but it's not as painless as downloading updates via Windows Update (when WU properly identifies your patches).

    Anybody who's used the atrociously-bad Automatic Update Service will know that it doesn't cover many important software updates and neither does Windows Update. In fact, if you use all three products, you'll frequently find that each product identifies a different set of patches that are required, and usually, none of them list all the patches identified by the others.

    What I've found is that HFNETCHK actually identifies truly critical patches, while Windows Update improperly identifies non-critical updates as being critical. For instance, it tells you that installing Internet Explorer 6.0 SP1 is critical (even when you're running a fully-patched IE 5.5SP2) or even worse, it tells you that a patch meant to improve functionality of using a non-IE default browser is critical.

    Sorry, but as much as I hate MS and as much as I prefer Mozilla to IE for my own browsing needs (and even though it works better), I don't make it my default browser anywhere, especially on servers, so this update is hardly critical.

    In short, while sysadmins at least have a chance to stay fully-patched these days--unlike the days before Code Red--MS still has incredibly shoddy patch management tools, incredibly inconsistent patch installation mechanisms and still takes liberties with customer data it shouldn't need to take.

    If Microsoft ever gets serious about patch management, they'll have a common tool that sysadmins can use to patch any and all of their MS software with a common interface and no unnecessary transmission of system-specific data to MS. Is that too much to ask? Apparently.