Slashdot Mirror
Microsoft Sued Over WGA
Hope Thelps writes "The Seattle PI is reporting on a lawsuit being brought against Microsoft in response to their WGA spyware. Groklaw is also covering the story. Although there are a lot of similarities to Sony's rootkit, the actual harm done is less concrete. It'll be interesting to see how this turns out."
Sued by the same moneymonger who sued Sony.
Amen to that! Maybe someday Microsoft will realize that WGA doesn't prevent piracy; it's just another thing to annoy legitimate users.
OK, I guess that's not going to happen anytime soon. Oh well, I can dream, right?
whoopie, M$ loses and donates another $1,000,000.00 worth of software to some high school system or third world country as retribution (at a cost of about 35 cents to the evil empire).
It came as a Windows Update, if you wanted to protect yourself you should have turned automatic updates off...
win or lose this will deter Microsoft from using wga to shut down any unlicensed (or otherwise) computers...for a while at least.
"I just only wish there was an alternative..." typed the man in his slashdot repsonse on his Linux workstation.
FLR
So what exactly are they going to sue for, like 1/30000th of Microsoft's money? This is why no one can ever successfully sue Microsoft.
http:///..org...pure genius, yet absolutely impossible to explain to the uninformed.
How can an official component of Windows be spyware? It's their operating system, they allready own you if you use it. Pull down your pants and get it over with allready.
"If you don't have eyes you shouldn't have wings" -- Carl Pilkington
A Microsoft spokesman, Jim Desler, agreed with the allegations. "Spyware is deceptive software that is installed on a user's computer without the user's consent and has some malicious purpose," Desler said.
Well, actually he claims to have disputed the allegations, but then he said what's quoted above, and finally (to the press corp's horror and astonishment), proceeded to shove his entire foot, ankle, and leg (up to his knee), firmly down his own throat.
Let's break this down:
[x] Deceptive software...check!
[x] Installed without user's consent...check! (Well, basically with as much consent as any other spyware package, so I think there's a good case to be made for this point.)
[x] Malicious purpose...check! It beams data back to the mothership every day and can be used to remotely break the computer. I think that qualifies as "malicious."
So apparently by Microsoft's own admission, WGA is spyware.
I'd personally argue for a more expansive definition of spyware (or malware, or scumware, etc...), but even given the relatively constrained definition proposed by Microsoft itself, WGA seems to qualify.
A: On a pile of money.
Is '... in response to their WGA spyware' really necessary? Provide the information and let the readers make up their minds.
Clear notice that this was an optional install. I could have elected not to install it and had my machine function as before. I had to read a statement and check a box saying I understood and agreed.
We can argue the merits of the actual software that is installed.
Hey, at least the Sony rootkit comes with music!... this thing comes with worse: Windows!
A computer once beat me at chess, but it was no match for me at kick boxing.
DOH!
Oh... was I supposed RTFA? But wait... this is slashdot.
File under 'M' for 'Manic ranting'
1. WGA communicates with Microsoft HQ. The information transferred may or may not be 'sensitive' but this could be considered an invasion of privacy.
2. Any program that uses up system ressources without performing a task explicitly requested by the user is harmful in the sense that it slows down the computer. This is one of the main complaints with spyware/adware: they slow down your computer for no purpose (or at least no purpose that you, the user, are interested in).
3. WGA appears to effectively give someone else (specifically Microsoft) control over your machine (for instance the recently announced "remote shutoff" function). To the user, a program that limits their control of the computer (and gives someone else more control) is harmful. Note that the argument "but Microsoft would only shut off illegitimate versions of Windows" doesn't make any difference. Even if that's true, there is still a loss of control for the user. This is harmful to the user.
To the same extent that any other piece of so-called "spyware" is harmful (installed in a tricky way; sends info back to some company; wastes CPU cycles and disk space; etc.), WGA should also be considered "harmful."
The problem with WGA is that is not an update, security-patch, or feature upgrade. It does *nothing* for the user, and only installs in order to give Microsoft more control/leverage over your machine. From the user perspective, it is a net negative, hence harmful.
I'm sure that I'm not the only one who hates all of the BS you get when you buy a new laptop/desktop. First thing I've always done with my Dell laptops/desktops is format, reinstall xp + linux. However, I got frustrated with the activation when I didn't always internet or the activation insisted i make a 30 minute call to MSFT to get a rediculously long key. Long story short, I used the ever-so-famous corporate copy + key (generated with keygen) even though I have XP Pro COAs on the systems. Now, a few years down the road WGA is going to force me to reinstall--now that I have many important business apps installed. How many others are in the situation of "invalid keys" with legit COA licenses?
Just thought that you guys might wanna know that Microsoft has came up with an article on removing WGA.
w00t
I mean, I'd be just a little less bad (WGA) if it worked properly. I've seen most of my old HS's comps get the "not genuine" notice, and it takes a while to fix.
By reading this, you have given me brief control of your mind.
I make websites and stuff. Buy one.
What peeves people so much about WGA is that MS pushed it out as a Critical Update, meaning that all machines with Auto Update install it without prompting. It is undeniably not a critical security update and to make matters worse it phones home. After taking some heat, MS then conceded that the installation of WGA will be optional (if by optional you mean selectively blocking some non-critical updates). It's still being pushed, but you don't have to install it. For those of you with your less than legit copies worried about not receiving updates, you can always download third-party update packs if you don't mind a bit of a delay. Not necessarily a bad thing considering that MS has been known for having to patch their patches. I'm not an MS fan, but not a huge hater. Just a strategically stupid time to ramp up WGA after the whole rootkit fiasco. I'm not an MS fan, but not a huge hater. Just a strategicly stupid time to ramp up WGA after the whole rootkit fiasco.
http://news.com.com/5208-1029-0.html?forumID=1&thr eadID=18274&messageID=157697&start=-16
With the possibility of barring access to Windows...
http://it.slashdot.org/article.pl?sid=06/06/29/165 7241
... then how much of downtime must a user suffer from this?
Look everybody wga is NOT SPYWARE. I ran Microsoft Windows AntiSpyware Beta on WGA and it came up CLEAN. So drop it okay?
http://www.firewallleaktester.com/removewga.htm
I CANNOT vouch for the legitimacy of that utility (so scan it first, try it on a staging machine, etc., YMMV, Batteries not included, and all that jazz). I just did a quick search for utilities for removing WGA, but being a Linux user I don't have much use for it myself. There are reviews of it on legitimate sites (for example, PC World) but then they've also unknowingly recommended scumware in the past as well.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
In other news, Jack Kevorkian sued the developers of the POSIX-compliant 'NUX commandline program "killall", citing that the application didn't really kill "all" the programs on the computer but instead should be renamed to "killnothingbut". This intellectual Advantage(TM) of Kevorkian stemmed from his introduction of the oft'quoted uber-leet commandline tool "kevork" which injects null pointers into the code and data segments of all programs that are non-responsive to the "TERM" and "KILL" flags. Kevorkian was unable for comment on whether this is a closed or open-source application, though it was rumoured by his assistant that it is a simple library replacement with a namely-fassioned symlink to killall that the library determines based at runtime with argv.
Sincerily,
John "kill'em'all" Dahmer
The thing is my hijacked copy of Windows XP won't even download updates because it has an 'invalid key', so how are they going to deliver the WGA?
It has been eons since I read the EULA, but it basically says that MS owns the systems. That means that they can do whatever they want. OTH, sony or any 3rd party who does not have explicit permission from MS can then be sued. Oddly enough, if MS and Sony had not been fighting over playstation/xbox, MS probably would have given permission.
I prefer the "u" in honour as it seems to be missing these days.
I am confused (a dangerous thing to admit openly on slashdot, I know). It is said that the WGA is what audits a system to determine authenticity. For now installing WGA is voluntary (or installed by user permission...informed consent, I think it is called) However, it's later stated that WGA will become mandatory at some point, and possibility that Windows will be disabled (killed, turned off, etc.) eventually, if WGA is NOT installed. So, if WGA is not installed, what other mechanism is in place within Windows that could allow MS to remotely shut down a computer system? What am I missing?
They might mod me down troll/redundant, etc, but what the hell!
I ran a Windows/Linux machine and switched to Mac a year and a half ago. Since then, I've never looked back. Specifically, I don't have to deal with a company that has contempt for me and treats me like a criminal. Since OS X will only run on Macs, Apple doesn't have to worry about piracy, license keys, etc. What's more, I can run several Linux distros within the Parallels emulation software.
The only thing that sucks is I'd like to run my old games, but that would require Boot Camp, and with XP I need to register online. If I run Windows, I want to do so offline, full stop.
This space left intentionally blank.
If you buy a machine with an OEM copy of XP Pro on it, and then re-install with a corporate XP Pro cdrom, you've technically committed a software license violation unless you also bought a corporate "volume license" to cover it (yep, you actually have to pay for XP Pro twice in this scenario to stay legal) plus used your specific corporate installation key code that was assigned to your company when you bought the volume license. Otherwise you must use your original OEM licensed copy of XP install (or recovery) media and your original installation code from the sticker on the machine plus go thru all the hassles of product re-activation to remain legal. Yes this is a load of crap to have to go thru, but when you clicked thru that OEM Windows EULA, you voluntarily agreed to be bound under such nefarious terms.
There will be many arguments presented in court to validate both sides to this, but there is an aspect of this that the Microsoft loving trolls here will never admit. This WGA is doing just what a ton of malware/spyware/crapware is doing, which is exactly why Windows can never be secure.
I would be curious to know how many Windows XP users are no longer able to validate their OS. I bought Windows XP Pro OEM when it first came out. 3 motherboards, 3 video cards, 4 harddrives, I forget how many CD/DVD-RW's, and 3 slipstreams, my Windows has been apparently installed on too many computers(?). I am told that this cannot happen, but oh well. I now use Mac and Slackware Linux.
............You own Windows
I really don't see what all the fuss is about, if MS want to make sure your copy of windows is legit, then fine, after all, you bought into their crap. And for all of those people who actually did buy into it, getting rid of the illegal copies makes forking out the money seem a lot less painful, for those who didn't, how can you expect it to work, you stole it. Nobody would mind if Ford introduced some tracking gadget to help stop car theft... ...well, maybe they would, but I'm sure not so many would.
I hate MS as much as the next slashdotter, but the endless moaning about WGA is really starting to get to me.
Anyways, good for whoever's launching the suit. They have no right to add in spyware to their OS. IANAL, but it seems to me that they can't modify the EULA for Windows and have the changes retroactively effect existing users. Naturally the WGA stuff has it's own EULA (as do several other updates), but when it's put in as a forced update, you really don't have much of a choice. I'd assume that would render the contents null and void. It's like someone having you sign a waiver after the work has been done - you weren't presented with the terms prior to the transaction (or installation, as it would be in this case), thus it's really no more than a vague scare tactic to try and prevent outcries and lawsuits like this.
How are sites slashdotted when nobody reads TFAs?
BUT... step back for a second. Forget the fact that they're a mega-conglomerate. Forget the fact that it's some giant company who you think might be out for world domination, one PC at a time.
Instead, I think of it like this:
You create a piece of software (Those of you who say what about "Sourceforge" or "freshmeat", back off for a few minutes... we're not talking OSS right now, we're talking commercial). You want some level of appreciation. You want to make sure that when people pay the $XXX for the software you made (And let's face it, we're talking a BUSINESS here, not a charity - you'll charge however much is possible, to keep it selling and get as much profit as possible).
You also are not a bumbling idiot, you've used emule, bittorrent, google, and astalavista. You are, or know, that "Guy who has everything" for software. You've needed some minor piece of software, and could find / engineer a crack / keygen for it. You get it for free. If you DO have scruples, you know too many who don't.
So you want to protect your software from the evils of "Oh, I can get it for free". Without protection, a couple days and it's spread around the net. You protect it, congratulations, you've bought yourself a week before a serial / crack is released. SO you lock it down good and tight. And hey, if there's something people without scruples love, it's the idea that "They say we can't, so we'll prove them wrong!". Besides, according to crackers / OSS fanatics / the immoral, ALL software should be free, you should be doing this in your spare time, and hoping that you'll get enough donations to live off of if we don't pay for it! (Wait.... they stole the software, but expect the owner to live off of donations, while they're not paying for it anyways?!).
Solution: You use pre-packaged solutions to lock down your software, good and tight. It runs various checks against files for alteration. It might even dial home when run to make sure it's legit, disabling if not. Hell, I'd do it if I wrote still. Does that make you evil? NO! It means you want to protect your investment (Time, effort, energy, money, employees). But somewhere, somebody out there will find a way to defeat it. You've not bought "infinite protection", instead you've bought another month to come up with a better way of protecting your money (Goal here is to delay it as long as possible. Outright prevention is impossible, but delaying is entirely doable).
So you use software to dial home and verify authenticity, check itself and other files to make sure that they're running and not tampered with, restore each other if necessary, and quite possibly re-confirm that they're authentic from the dial home. Does that make you an evil beast who deserves to die? Hell no.
But wait, it's Microsoft. Oh, SCREW THIS! They're too big, make too much money, they're evil! Need to die. Who the hell do they think they are, trying to protect their stuff? They don't need the extra money, I feel good sticking it to them! Imagine, trying to make people pay for their stuff or make people feel bad for having stolen it.
THE NERVE.
WGA and a ROOTKIT are NOT similar. The Sony RootKit was also exploitable, so that other malware could hide themselves. The only similarity is they both called home.
... it's not even funny anymore (and I guess that's why there is a lawsuite). Yes, there have been false positives but I don't think that's the real issue. Especially the new WGA Tray notification is tremendously flawed: - It claims to be an important security update, while it really isn't - Hiding it on Windowsupdate is just a temporary workaround it reappears and claims to be an important update with each and every single of it frequent updates - Once installed it cannot be uninstalled (only manually, you need quite some computer-skills for that) - If you DO install it, the current versions phoned home daily, newer versions will 'only' phone home every day. Why do I have to proove to Microsoft this often, that my legally optained copy of Windows is still legal? I don't remeber agreeing to that when I bought my copy of Windows. - WGATray.exe actually uses quite a lot of ressources and did slow down my system's boot-up time. On every single startup it uses quite some CPU-time to performe its WGA check. - It behaves like spyware! Microsoft doesn't clearly tell it's users on Windowsupdate that this will steal system ressources from them and that it will phone home to Microsoft constantly. Microsoft even calls it an important security update which it clearly is not, pretty much like a lot of other rouge software out there. And Microsoft already plans to make WGA Tray Notifications even more mandatory than they already are (current plans involve that all other WGA-checks will automatically assume your copy of Windows is not genuine if you refuse to install the tray notifications and waste your ressources on that).
Maybe Microsoft is secretly paying this lawfirm as way to combat these damn software companies who think they can install whatever they damn well please on peoples machines.
*coughs* AOL *coughs*
So why not, maybe it would cost them less money then to hire this firm and pay them off then create 10 new patchs because of a expliots. Now we could say PI v Microsoft basically making it illegal to not show you software package ingredients. There are laws created all the time by way of the judicial system and I hope this goes all the way to the US Supreme court and becomes federal law.
To me this is a major violation of privacy which is already being deminished away by big brother.
the actual harm done is less concrete
Oh yes it is. I don't understand this thinking. Why, "harm" has to mean something really tangible, like breaking a leg or something ? I think not. The harm here does not cause some physically concievable defect - yet. But thing is, they did not tell the people what this WGA does (i.e. calling home every so often), they just told it when some people have found it out. Ok, I know how EULAs work, and how they probably could prove in court that they have every right to change their software as they see fit, still, when it is about using our computers to send _any_ information to _anyplace_ without asking us first, or if not asking then at least telling us about it, is just outrageous. I don't care what they send, I don't care how much or how small amount of information is in it, I don't care who they send it to, it just should not happen without asking us and letting us approve of disapprove the action.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Obviously you've never used Solaris.
When they say killall, they _mean_ killall.
ND
This statement is forty-five characters long.
So what will be the outcome of such a lawsuit? Perhaps MS will pay a fine, the sueing parties will be happy. But if you want to keep using windows, you'll still need the WGA 'critical update'. Worse, I don't think the lawsuit is going to prevent future WGA implementations. Regargdless of the outcome, the next version of windows will have something similar to WGA installed from the start. There will be a parargraph in the licence agreement when you install your (legal or illegal) copy of Vista that the software may be contacting other computers etc etc without explicit user consent etc etc and you hereby agree etc etc. People aren't going to read it, but they'll hit the "I Agree" button. No grounds for a new lawsuit. With windows, you're stuck with WGA. Take it or leave it.
assignment != equality != identity
This is what will be used against this case. If this case continues and the court allows it in, then it will quickly change from illegal program to one of validity over the EULA.
I prefer the "u" in honour as it seems to be missing these days.
Actually, he said he put it on 5 machines. So it's $1,500 worth of time. Considering the fact that a Google search and applied solution takes about 10 minutes, maximum... His time must be worth a lot!
True story:
I sometimes use my university's wireless network (whenever I bring my laptop). Since the university's IT lab has no way of knowing who is using what laptop[1], they redirect all initial traffic to a portal where you must log in (using the username + password you use on all other university computer systems). Point being, you get a network connection, but must log in to actually get where you want.
Since I installed WGA[2] (at the point I was rather indifferent to it), every time I use the university's network I get 50 entries in the Application Log (error source: crypt32; description: "Failed auto update retrieval of third-party root list sequence number from: with error: [timeout/server cannot perform operation/error code]"). This happens before I have a chance to log in on the university network, which of course means that my laptop can't yet access said site. More annoying, though, is that svchost -k netsvcs starts eating memory like crazy; peaking at over 90 MBs and then falling down to 70-80 (used to stay at 20-30). This only happens when I use the laptop at the university; at home (where obviously no login is required) the process stays at 20-30 MB.
I personally think that some "advantage" component that, when unable to access some site, causes a process to eat up 3-4 times the memory it usually does, taking up an extra 10% of the computer's physical memory in the process, is rather a DISADVANTAGE. I don't know how much memory spyware typically consumes, so I can't reflect on the comparison between WGA and spyware. 50 MB seems a rather hefty price for failing to communicate with some server, though.
Maybe they should rename it WGD?
[1] I guess a) setting up individual users' connections, including keys, is too much work, b1) collecting MAC addresses is too much work, b2) Joe Average won't be able to figure out his computer's wireless' MAC anyway, and c) there are potential security leaks if wireless cards, or laptops, are stolen/sold to non-university users (both a and b1).
[2] Troubles started at that point. Could be something else, I SUPPOSE, but I think it is unlikely.
Perhaps samba has gotten much better since I last used it, but setting connecting to or creating Windows shares was far easier with Windows than with Linux.
Well, on my computer at home with GNOME 2.14 I seem to recall Right click folder -> Sharing and the Sharing admin panel, which sets up Samba appropriately. Browsing network shares was simply a matter of clicking the network bit in Nautilus (and it actually didn't keep hanging like explorer, but YMMV -- some Windows networks I tried worked horribly)
try and find an a good open source alternative to something like Soundforge, Cubase or Protools
It is a bit of a problem but progress is being made (see the ANGULA project). If you're willing to mess about at the command line a bit you can get quite a nice setup with JACK and DSSI/VST/LADSPA/LADCCA stuff and using rosegarden as a sequencer, linuxsampler and others for sampling, ardour for recording. Most audio people I've known haven't been afraid to get down to the ugly parts of their Windows systems to improve performance, though.
Some integration needs to be made, and the frontend stuff is inferior to their Windows counterparts currently. The backends still need some work but IMO they're better than the mess on Windows, though in Windows that is hidden by the UI. Plus another advantage is that you can strip the system down to bare minimals with a custom kernel for audio work (low latency, realtime optimisations with ALSA can get extremely low latency of less than 2ms consistently and no stuttering on my low end system but again YMMV).
said that Windows does them perfectly well.
I have to disagree here though. It's not so much that Windows struggles with the tasks themselves, but the OS can end up a bit of a mess when you leave it in the hands of a typical non-geek user for long. I tried my best with my family's laptop, created them an Admin account and a Limited user and told them only to use the Admin to install software. Sooner or later they found stuff didn't work right in Limited user and switched over to the admin account.
Then a misclick in IE just yesterday, one month after getting it (not sure how they got it up, I set firefox as their default and deleted the IE shortcuts) caused their computer to be infected with so much spyware it needed a reinstall. The only experience I had with that on the family linux computer was when someone got the WINE install infected with spyware... I just blew it away and started again.
it can't play some media files (whether it be because of lack of mp3 support out of the box or some random .wmv format) it lacks proper support from many hardware companies (Linux on laptops anyone?).
This is a problem, but it's a very hard to solve one. The solution is sadly getting enough people on Linux that free formats like ogg become more commonplace (or using that fluendo mp3 plugin). Unfortunately it means there's going to be a period of format 'flux'.
Another point of interest is that Windows is often easier to get help on
I agree. At the moment, you search for help on something and you're nearly bound to get something detailing how to do it in RedHat 6 via the command line, despite it possibly being 2 menus away on a modern install of Ubuntu (as changing the resolution is). Possibly more focus should be put on the brand name of the distro and trying to get their help pages (wikis and such) high on the search results as MS tech support articles often are. A better online help system wouldn't go unappreciated either.
If you can execute the software on your hardware without taking the action of copying the software into your computer's memory (and remember, copying is the basic right granted to the creator of a work by copyright, hence the name), you might have a point there. As it is, Microsoft grants permission through a license to do the copying that's required to run the software. It's their position that you own a single copy of the software on the physical media it was sold on. The fact that you need to copy it for it to be of any use to you is the whole basis for the EULA.
Now, you may argue that the copying needed to execute software once you've paid for it is noninfringing under Fair Use, and that you're legally free to use the software however you want without a license at all, but I don't think you'll find much case law to back you up at the moment.
You can probably also bet that if courts did start ruling in your favor, Congress would move quickly to close what they'd call "the fair use loophole" once the BSA's lobbyists made a few phone calls.
Don't blame me; I'm never given mod points.
What annoys me about this is 2 things, even with it working as it should.
A. The have it as a critical update, and not only that they have released it as such twice off the standard patch days. I deactivated my critical updates alert because of this cause I got tired of it going "You have critical updates not installed, bla bla bla, your computer is at risk" just for the WGA.
B. You have to restart to apply it.
Common! you already make people with servers restart enough with required patches because your OS is a POS that cant just restart that specific module, but now your making people do restarts just for your WGA, something which in itself is questionable?
All misspellings and grammatical errors in the above post are intentional and part of my artistic expression.
If they own it, they can do anything that they want. Not you. The EULA is not about protecting your rights or even spelling out your rights. It is about protecting MS's rights, wether they are real or not. Like I said elsewhere, I suspect that this will lead to a court case where MS's rights (and all closed source code) will be tested. This case could have some major impact on society (and MS's plans).
I prefer the "u" in honour as it seems to be missing these days.
Windows Genuine Advantage.
You know because that Pirated version doesn't crash as well as the good version.