Slashdot Mirror
Microsoft Sued Over WGA
Hope Thelps writes "The Seattle PI is reporting on a lawsuit being brought against Microsoft in response to their WGA spyware. Groklaw is also covering the story. Although there are a lot of similarities to Sony's rootkit, the actual harm done is less concrete. It'll be interesting to see how this turns out."
Sued by the same moneymonger who sued Sony.
whoopie, M$ loses and donates another $1,000,000.00 worth of software to some high school system or third world country as retribution (at a cost of about 35 cents to the evil empire).
win or lose this will deter Microsoft from using wga to shut down any unlicensed (or otherwise) computers...for a while at least.
In the case of Windows Updates, I would argue that it is even more out of the user's control. For alot of malware, you have to click "yes install" at some point. For Windows Updates, the recommended state is to "automatically download and install in the background." In theory a user could examine each and every update to figure out what they all do, but in practise the actual purpose of each update is heavily obfuscated. Worse yet, in the case of WGA, once you allow it to install (it seems innocent enough at first), it is used against you to force further installations.
Frankly the tactic Microsoft is using in their updates is not ethical. Everyone is told to do their Windows Updates (for security reasons), and Microsoft is exploiting this to slip in some other software that the user does not necessarily need. Worse yet, this software sends back information to Microsoft HQ without user permission. If this does not count as spyware, I don't know what does.
I hope this lawsuit makes Microsoft wake up to the illegitimacy of their tactics.
1. WGA communicates with Microsoft HQ. The information transferred may or may not be 'sensitive' but this could be considered an invasion of privacy.
2. Any program that uses up system ressources without performing a task explicitly requested by the user is harmful in the sense that it slows down the computer. This is one of the main complaints with spyware/adware: they slow down your computer for no purpose (or at least no purpose that you, the user, are interested in).
3. WGA appears to effectively give someone else (specifically Microsoft) control over your machine (for instance the recently announced "remote shutoff" function). To the user, a program that limits their control of the computer (and gives someone else more control) is harmful. Note that the argument "but Microsoft would only shut off illegitimate versions of Windows" doesn't make any difference. Even if that's true, there is still a loss of control for the user. This is harmful to the user.
To the same extent that any other piece of so-called "spyware" is harmful (installed in a tricky way; sends info back to some company; wastes CPU cycles and disk space; etc.), WGA should also be considered "harmful."
The problem with WGA is that is not an update, security-patch, or feature upgrade. It does *nothing* for the user, and only installs in order to give Microsoft more control/leverage over your machine. From the user perspective, it is a net negative, hence harmful.
What peeves people so much about WGA is that MS pushed it out as a Critical Update, meaning that all machines with Auto Update install it without prompting. It is undeniably not a critical security update and to make matters worse it phones home. After taking some heat, MS then conceded that the installation of WGA will be optional (if by optional you mean selectively blocking some non-critical updates). It's still being pushed, but you don't have to install it. For those of you with your less than legit copies worried about not receiving updates, you can always download third-party update packs if you don't mind a bit of a delay. Not necessarily a bad thing considering that MS has been known for having to patch their patches. I'm not an MS fan, but not a huge hater. Just a strategically stupid time to ramp up WGA after the whole rootkit fiasco. I'm not an MS fan, but not a huge hater. Just a strategicly stupid time to ramp up WGA after the whole rootkit fiasco.
In other words, false positives. Also, doesn't it phone home every day or something? You'd think you'd only need to check once.
Want a high quality FOSS RTS game? Try Warzone 2100!
No... you can not change from a Corporate key to a consumer XP key without reinstalling the OS. We installed XP Professional (Corporate version) whenever we had a hard drive crash or virus infection on our office PCs, and frankly (and quite stupidly), did not even hold onto our original installation media or CD Keys for XP Professional ("consumer"). Now, Microsoft is forcing us to purchase Windows XP a second time for all of these workstations through WGA, which *does* make Windows take longer every day to log on, while it displays nagware. Frankly, I am in 100% agreement with the lawsuit. Microsoft didn't disclose squat, and left everyone to believe that this was a "critical update". If downloading a patch from MS website, they did post a link to some "independent" german company certifying that WGA doesn't disclose personally identifying information. It is not too difficult task to identify workstations from their IP address, especially when static. Microsoft must not have heard of Traceroute. So, this is just another crock. Anyhow, we are now just paying Microsoft twice for about 18 of our XP installations. We just can't have our stations slowing down, and telling our users they are running pirated software. Without the original CDs and Keys, we can't prove that we purchased the software already. And unremovable software that takes over your computer places the onus directly on the consumer. It was a remarkably clever way to double-charge us.
BUT... step back for a second. Forget the fact that they're a mega-conglomerate. Forget the fact that it's some giant company who you think might be out for world domination, one PC at a time.
Instead, I think of it like this:
You create a piece of software (Those of you who say what about "Sourceforge" or "freshmeat", back off for a few minutes... we're not talking OSS right now, we're talking commercial). You want some level of appreciation. You want to make sure that when people pay the $XXX for the software you made (And let's face it, we're talking a BUSINESS here, not a charity - you'll charge however much is possible, to keep it selling and get as much profit as possible).
You also are not a bumbling idiot, you've used emule, bittorrent, google, and astalavista. You are, or know, that "Guy who has everything" for software. You've needed some minor piece of software, and could find / engineer a crack / keygen for it. You get it for free. If you DO have scruples, you know too many who don't.
So you want to protect your software from the evils of "Oh, I can get it for free". Without protection, a couple days and it's spread around the net. You protect it, congratulations, you've bought yourself a week before a serial / crack is released. SO you lock it down good and tight. And hey, if there's something people without scruples love, it's the idea that "They say we can't, so we'll prove them wrong!". Besides, according to crackers / OSS fanatics / the immoral, ALL software should be free, you should be doing this in your spare time, and hoping that you'll get enough donations to live off of if we don't pay for it! (Wait.... they stole the software, but expect the owner to live off of donations, while they're not paying for it anyways?!).
Solution: You use pre-packaged solutions to lock down your software, good and tight. It runs various checks against files for alteration. It might even dial home when run to make sure it's legit, disabling if not. Hell, I'd do it if I wrote still. Does that make you evil? NO! It means you want to protect your investment (Time, effort, energy, money, employees). But somewhere, somebody out there will find a way to defeat it. You've not bought "infinite protection", instead you've bought another month to come up with a better way of protecting your money (Goal here is to delay it as long as possible. Outright prevention is impossible, but delaying is entirely doable).
So you use software to dial home and verify authenticity, check itself and other files to make sure that they're running and not tampered with, restore each other if necessary, and quite possibly re-confirm that they're authentic from the dial home. Does that make you an evil beast who deserves to die? Hell no.
But wait, it's Microsoft. Oh, SCREW THIS! They're too big, make too much money, they're evil! Need to die. Who the hell do they think they are, trying to protect their stuff? They don't need the extra money, I feel good sticking it to them! Imagine, trying to make people pay for their stuff or make people feel bad for having stolen it.
THE NERVE.
the actual harm done is less concrete
Oh yes it is. I don't understand this thinking. Why, "harm" has to mean something really tangible, like breaking a leg or something ? I think not. The harm here does not cause some physically concievable defect - yet. But thing is, they did not tell the people what this WGA does (i.e. calling home every so often), they just told it when some people have found it out. Ok, I know how EULAs work, and how they probably could prove in court that they have every right to change their software as they see fit, still, when it is about using our computers to send _any_ information to _anyplace_ without asking us first, or if not asking then at least telling us about it, is just outrageous. I don't care what they send, I don't care how much or how small amount of information is in it, I don't care who they send it to, it just should not happen without asking us and letting us approve of disapprove the action.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.