Microsoft WGA Phones Home Even When Told No

Aviran writes "When you start WGA setup and get to the license agreement page but decided NOT to install the highly controversial WGA component and cancel the installation, the setup program will send information stored in your registry and the fact that you choose not to install WGA back to Microsoft's servers."

Comments

Gibberish

[AmateurCruzer]

Anyone have any insight what exactly they're sending back?

Re:Gibberish

[NinjaTariq]

I would have thought this kind of thing would be annonymous usage or configuration, simply so that they know how people use it... Though i don't know.

Re:Gibberish

[xzvf]

Doesn't matter. The only home software on my computers should have is my home.

Re:Gibberish

[Anonymous Coward]

Your comment is not anti-microsoft enough, so it has been bitchslapped.

Re:Gibberish

[Rogerborg]

We're not sending anything. Trust us.

Oh, you checked, did you?

Then what we meant to say was... it's nothing to worry about.

Trust us.

Re:Gibberish

[gigne]

I have no idea, but it looks like some sort of unique id.

an image from the now slashdotted page is here, it shows what gets sent to MS

http://img266.imageshack.us/my.php?image=wgahp5.pn g

Re:Gibberish

[TubeSteak]

http://www.heise-security.co.uk/news/86294

There's an english language article about the same packet dump
Some of the data is encrypted, some of it are just acronyms you don't know

Re:Gibberish

[Opportunist]

I don't trust MS as far as Steve can throw a chair.

Re:Gibberish

[Anonymous Coward]

HDSLN is your Hard Disk SeriaL Number, so no, that's not particularly anonymous, given they could do a join into their WGA Validations database.

In fact, that looks almost exactly like the WGA Validation POST.

Question is, why's it doing it before installation, and even if you declined the WGA EULA? That's not right, and it's quite possibly in breach of regulations. It should just quit in that circumstance.

Re:Gibberish

[Headcase88]

They can paraphrase Sony during the Rootkit debacle.

"Most people, I think, don't even know what WGA is, so why should they care about it?"

Re:Gibberish

[Anonymous Coward]

The only home software on my computers should have is my home

Sounds like someone set you up the bomb.

Re:Gibberish

[Ciggy]

In the UK, at least, it would appear to be in breach of Section 1 of the Computer Misuse Act 1990:

1 -- (1) A person is guilty of an offence if--
(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b)the access he intends to secure is unauthorised; and
(c)he knows at the time he causes the computer to perform the function that that is the case.

The data sent home is noted by (a). As the user has expressly not agreed to the WGA EULA, unauthorised access is noted by (b) and (c) - in particular (c) as there was no agreemnt to the EULA; assuming of course that the data sent home is that that would be sent home IFF the EULA had been agreed and WGA installed.

As an aside, the Sony rootkit that installed something even when the EULA or whatever was decined was probably in breach of Section 3 of the same Act - doing "...any act which causes an unauthorised modification of the contents of any computer..." - those discs weren't sold in the UK?

The question is who is the responsible entity for a company: they have programmers that have written the code that does the unauthorised access (are they responsible), or is it their managers (who defined the specs) or the company as a whole (the directors)?

Re:Gibberish

[Cro Magnon]

I dunno, I hear that's pretty far.

Re:Gibberish

[davester666]

The data sent home is noted by (a). As the user has expressly not agreed to the WGA EULA, unauthorised access is noted by (b) and (c) - in particular (c) as there was no agreemnt to the EULA; assuming of course that the data sent home is that that would be sent home IFF the EULA had been agreed and WGA installed.

What it's sending home is not covered by the WGA EULA, because the user just cancelled it. But, it could be covered by the Windows XP/Vista/whatever EULA, which I'm sure has a clause like "All your Data Are Belong to Us" [maybe in more legal-speak[... So it really is nothing to worry about.

Re:Gibberish

[rvw]

I don't trust MS as far as Steve can throw a chair. But do you trust them beyond that point?

Re:Gibberish

[h2g2bob]

Better yet, it's an extraditable offence.

Although extradition with the USA seems to be a one-sided agreement at the moment.

Re:Gibberish

[h2g2bob]

When asked by heise Security, Microsoft merely stated that it collected data to improve the quality of the WGA for users. Part of that process, the vendor said, was knowing where the user cancelled setup.

... I'll bet their results show that people canceled setup right where it said it would send their details to MS if they clicked Yes.

Re:Gibberish

[Anonymous Coward]

insightful? where the hell is the insight? what he's written isn't even coherent, let alone insightful. the only insight I'm getting is that xzvf cant write an English sentence.

Re:Gibberish

[Samah]

Actually it'd be "set up you" :)

Re:Gibberish

[Samah]

I'm assuming it sends this info when you click "No"?
This is why on a fresh install I never plug my network cable in until all that crap is disabled.

Re:Gibberish

[rtb61]

Ahh, but the windows EULA does not hold in the majority of countries because by law in most countries they have to clearly displayed at the point of sale to be legal. For example if you buy windows retail in Australia, the EULA has to be on the outside of the box and clearly legible.

If you buy a computer online in Australia you have to agree to it prior to completing the purchase and the fudge of clicking OK after the machine is delivered is just sheer bull and a legal delaying tactic.

Most people would just call WGA a built in M$ root kit and I am sure it is not the only one.

Re:Gibberish

[mgiuca]

We're not sending anything. Trust us.

Oh, you checked, did you?

Um... excuse me. What the hell do you think you're doing poking around in our operating system?

the route your kids take to school, of course

[swschrad]

probably all the apps information. naysayer, meet the Business Software Association, also known down around the docks as "the muscle."

can't RTFA because they're slashdotted already.

Re:the route your kids take to school, of course

[DarthChris]

Interesting you say it's slashdotted because I can read it fine.

It's very light on details, however. There is a screenshot from wordpad of the data sent; it's an XML-type document which appears to have pulled a couple of id/hash numbers out of the system registry, e.g. OS version, but no personal info. They can't really get any personal info anyway, since data protection laws here in the UK and other countries would land them in shite, and also I suspect that they have more important things to do than snoop random people's names.

Personally, I think that they're just trying to get an idea of the number of people who won't install it. These people either have pirate copies and know they'll fail validation, or simply are opposed to the idea of their OS phoning home. From a cynical viewpoint, it's important for MS to gauge the reaction to this early so they know how far they can push these sorts of thing without there being a massive backlash.

Re:the route your kids take to school, of course

[lazlo]

So, how hard might it be to generate random but valid data to fill out this XML? And then have a little daemon that does nothing but post it over and over 24/7? "Wow. Looks like a NAT/proxy server with millions of users behind it who really don't like WGA."

Petty, I know, but fun.

Re:the route your kids take to school, of course

[PitaBred]

Naah. It's more like cache poisoning. You aren't trying to take them offline, you're just sending them bad information.

Re:the route your kids take to school, of course

[rben]

I refused to install WGA for a long time for several reasons, not the least was the fact that it was marked in the EULA as BETA software. Why should I be forced to install software that MS admits hasn't been fully tested yet? I have enough problems with MS bugs. Also, I resent the implication that I have to constantly prove that my software was purchased legally. I've always paid for the software I use, even when I was a poor college student.

Most copies of Windows in the U.S. are paid for, because Windows comes installed, by default, on almost every retail machine sold. That alone makes piracy a non-issue in the U.S. However, WGA does give Microsoft a way to shut down every Windows computer connected to the Internet. What a scam. Once they've got everyone using WGA, they can start dictating terms to governments instead of dealing with irritating lawsuits.

Lets say that the kind souls at MS never even think of using WGA as leverage on say, Europe. I still think it's possible for a clever hacker to use WGA to do some real damage. The hacker would have to do some DNS spoofing and probably crack some encryption, but then, that's what these guys do. Whose to say someone might not use WGA to pull off the biggest Denial of Service extortion in history? Perhaps I'm a bit paranoid, but my caution has kept me from ever having one of my computers compromised.

Piracy is a problem, but not nearly as big a problem as MS would have us believe. If people are stealing you blind, you don't make billions of dollars in profits, you lose money. If MS is feeling a pinch lately, it's due to their own foolish policies and assumptions that they would be able to dictate terms to the world forever. Google Apps and Open Source software will, hopefully, eliminate the need to put our computers at risk simply because a company is greedy.

Microsoft seems to believe that if there were no piracy, everyone in the third world who is now stealing their software would pay for it instead. Yeah right. One of the reasons they steal it is because there is no way they could possibly pay for it. If MS ever finds a way to shut down piracy, it will merely hasten the move to Linux in 3rd world countries. Ironically, that will speed the demise of Windows.

Re:the route your kids take to school, of course

[0p7imu5_P2im3]

Hmmm... I like the way you think... *Starts plotting the end of Microshaft Winblows Genuine A$$vantage* Hoohoohahahahahahaaaa! ... Wait, did I type that out loud?

Re:the route your kids take to school, of course

[PhxBlue]

There is a screenshot from wordpad of the data sent; it's an XML-type document which appears to have pulled a couple of id/hash numbers out of the system registry, e.g. OS version, but no personal info.

Any unique identifier is personal info.

Re:the route your kids take to school, of course

[bl8n8r]

Dunno. Are you assuming the 'hash' [0] is not encrypted personal info (eg: HDSLN,CSID)?

> "They can't really get any personal info anyway..."
Remember: 60 Billion can get around an awful lot of laws; foreign and domestic. legal and political.

[0] - http://img266.imageshack.us/my.php?image=wgahp5.pn g

Re:the route your kids take to school, of course

[Dog-Cow]

Don't worry, nothing was sent to Microsoft. We think.

Re:the route your kids take to school, of course

[tambo]

I suspect that they have more important things to do than snoop random people's names.

I'm not so sure. Microsoft hasn't been very aggressive about piracy yet - their most assertive move has been deactivating (allegedly) illegitimate Windows installs - but they've certainly made enough overtures to put an RIAA-type enforcement scheme within the realm of possibility. And that trend will probably accelerate as their tech portfolio continues to founder (weak upgrade responses to Vista and Office 2K7, etc.)

I think that they're just trying to get an idea of the number of people who won't install it.

Isn't that an awfully intrusive way of gathering that data? I mean, the WGA installer is being pushed from their own webservers... can't they just analyze their own IIS logs? (or Apache, if that's what they're running ;) )

I don't understand why they need my computer to generate some kind of coded message and transmit it to MS. Not only is it plainly unnecessary - it's also surreptitious, which is way sketchy - it's like the FBI keeping a dossier on you as a potential dissident.

Also - the user action that generates the message is akin to "Cancel." You'd expect it would do nothing. That's misleading.

And finally, this goes hand-in-hand with some of MS's other crappy anti-consumer, "MS Online" promotion tactics:

• Windows Update offers an auto-update option that reads: "Download updates for me, but let me choose when to install them." When I selected that option, I anticipated that the installer would tell me: "I have the following six updates: ... Which ones would you like to install now?" Instead, it tells me: "I'm going to install a bunch of updates now - that's OK, right?" ... Not nearly enough granularity or detail to let me make an informed decision. And, of course, that's the point - MS can shoehorn whatever patches they want into your box, right under your nose and with your (un)informed consent.
• Office has a preference for running your help queries through its online Office Help database. Of course, this is even more craptacular than prior incarnations: not only do you get the same array of largely irrelevant documents, but now it takes extra time (sometimes a long time) to run the query and respond. Now, you can configure it not to do that: Office has an option to run only offline. That's all well and fine. But mysteriously, this option often reverts to the online version, and Office keeps hitting the damn online site (thus wasting even more of my time.)
• A growing number of common features are getting snarfed up by MS's online services. NetMeeting was never anything but crap - but it got even worse when they jammed parts of it into Windows Messenger. So what should've been a decentralized peer-to-peer collaboration tool became rooted in a (crappy) Microsoft online service. Similarly, MS's "CardSpace" feature of .NET 3.0 is a blinkered,overcooked mess of identity and credentialing services (much like every other MS attempt to tackle this field)... and, of course, they offer to simplify this mess by letting you obtain security tokens from their online service.

So, to me, this looks like just another one of MS's tricks to push people forward - first into the DRM-blighted Vista, and next into the online software rental model (see also Hailstorm.) The more they push, the more trust they lose with me. And I've run every Microsoft OS since MS-DOS 3.2 (which I cut my PC teeth on at the age of 14.)

- David Stein

Re:the route your kids take to school, of course

[walt-sjc]

Once they've got everyone using WGA, they can start dictating terms to governments instead of dealing with irritating lawsuits.

I'm pretty sure that if they did anything like that to the US Gov, Jack Bauer would be sent in to torture Steve Balmer and would have all computers back to normal in less than 24 hours. Beyond that, Microsoft would end up as a department off Homeland Security.

Re:the route your kids take to school, of course

[glesga_kiss]

Most copies of Windows in the U.S. are paid for, because Windows comes installed, by default, on almost every retail machine sold. That alone makes piracy a non-issue in the U.S.

Sure, most if not all retail machines are legit, however it would be interesting to see the percentage of raw motherboards sold, either to small independent shops who build, or two home users. I'd think a large number of them are iffy.

And then there's all the XP upgrades people have done...

Re:the route your kids take to school, of course

[HermMunster]

Foolish is what Ballmer is made of. He claimed to financial analysts that the caution on Vista sales is for at least 2 reasons: 1) corporate pricing was too low, and 2) piracy.

This was stated by him in the past couple days, if not today.

Both are flawed. on item 1. Windows Vista is very expensive. Giving forecasts on certain pricing to corporate is what companies do. They forecast on those prices so that is really a moot point unless corporate just isn't purchasing. Then the low cost would make a difference, as they feel they should have made it higher so that the lack of corporate sales didn't affect the bottom line so much.

On item 2. According to Microsoft pirating is impossible under Vista. Well, even if that is about 3 months outdated it still is an issue that needs to be addressed. What is the average number of pirated installs vs. legit installs of Vista. Are people choosing to pirate instead of purchasing? Is it easy for the average person to pirate Vista and is the future potential of loosing activation worth it to the average user?

The answer to those is unknown so Microsoft can't be using that as a legitimate reason why their forecasts are so far off. Even if it was EASY to pirate Vista (which Microsoft said 3 months ago was impossible) it would have to be much easier than to pirate XP, which although is semi-easy to pirate if you can get the corporate product key or you can snatch a key from some unsuspecting person it is possible to get locked out by virtue of the WGA/WGN spyware programs.

So, essentially it isn't possible to claim that corporate pricing and pirating is the cause of Ballmer's and Microsoft's woes. It has to be something else. That something else, at least to me, is pretty obvious. It is the restrictions on use, the violation of privacy (constantly claiming you are a thief -- incessant checking of your workstation using spyware programs (WGA/WGN)), the high cost to the consumer (parts as well as purchase price of Vista).

When I talk to people, and I do so every day as I own a computer repair shop, I hear that they want nothing to do with Vista. I even have people that bring in the computers they bought with Vista on them to have them wiped and to have XP installed instead. The reasons they give are the same I read about day in and day out on the web. Microsoft accuses them of being a thief, Microsoft is spying on them, the technology in it will interfere, the costs to upgrade are too high, the cost of the OS is excessive, there's no compelling reason to upgrade. Vista is just a pretty interface on top of a massive spyware program.

I'd have to say that Ballmer is very foolish and to try to pawn off on the financial community two very flawed reasons for Vistas lack of success is just pathetic. Microsoft is on a downhill slide. The fact that Linux and OSX just might be made valid viable attractive has to be affecting every thing they do. On top of that they have known for a couple years that Microsoft would not see growth anywhere near what it has seen in the past. I think one could forecast some very serious financial problems with Microsoft in the next couple years and that they need to get people switched over to Vista so they can better control your computer and purchases so that the major stock holders have time to divest themselves and reinvest in other arenas.

Bill Gates and Steve Ballmer are killing Microsoft. Every DRM/CRM implementation makes Windows a lot less attractive to everyone. Every attempt to monitor our use is looked upon as a violation of our privacy (which it is) and is an accusation that we are a thief or will be a thief sometime down the road. When they don't care that they are invading our homes we realize they are too far gone to even consider giving a second chance. When they can use their monopoly power to extort business, other countries, and private citizens then that's the time everyone must look up and say "no". They know they have you by the short ones because they know that i

Re:the route your kids take to school, of course

[FreakWent]

"Perhaps I'm a bit paranoid, but my caution has kept me from ever having one of my computers compromised."

You shoudn't say things like that here, many regard that as a gauntlet....!

Re:the route your kids take to school, of course

[LiENUS]

Which is still Denial of service, You are making it more difficult for them to use their own service. Thats like saying sending someone 10000s of emails is just cache poisoning, you arent taking them offline, just filling their mailbox up with stuff they dont want to read and will likely delete en masse with their real emails.

Re:the route your kids take to school, of course

[drsmithy]

Windows Update offers an auto-update option that reads: "Download updates for me, but let me choose when to install them." When I selected that option, I anticipated that the installer would tell me: "I have the following six updates: ... Which ones would you like to install now?" Instead, it tells me: "I'm going to install a bunch of updates now - that's OK, right?" ... Not nearly enough granularity or detail to let me make an informed decision. And, of course, that's the point - MS can shoehorn whatever patches they want into your box, right under your nose and with your (un)informed consent.

If you select "Custom", you can pick and choose the updates you want installed.

Re:the route your kids take to school, of course

[senatorpjt]

I dunno. I've asked around on warez channels, and nobody has even bothered to download Vista for free. Piracy isn't not just not the problem, it isn't even helping where it has in the past - people won't even use it for FREE.

Re:the route your kids take to school, of course

[tambo]

If you select "Custom", you can pick and choose the updates you want installed.

Right (and that's what I always do), but only if you visit the website. I wasn't discussing that. I was discussing the Automatic Updates feature built into the System widget in the Windows XP control panel, which gives you only four options for auto-updating (and "Custom" isn't one of them.)

- David Stein

Re:the route your kids take to school, of course

[drsmithy]

Right (and that's what I always do), but only if you visit the website. I wasn't discussing that. I was discussing the Automatic Updates feature built into the System widget in the Windows XP control panel, which gives you only four options for auto-updating (and "Custom" isn't one of them.)

If you are using the "Download and Install Later" option (from Control Panel - Automatic Updates), when you get the balloon reminder and the little yellow shield icon that there are updates available, in the subsequent dialog box that opens (where you click the "Update" button to do the "Installing Later" part), there is a "Custom" radio button that turns the "Update" button into a "Next" and allows you to select which updates you do (or don't) want to install.

This has nothing to do with the Windows Update website. It's part of the built-in Automatic Updates tool (and always has been, IIRC).

time to modify the hosts file

[GuyverDH]

notepad %windir%\system32\drivers\etc\hosts

127.0.0.1 genuine.microsoft.com

Re:time to modify the hosts file

[$RANDOMLUSER]

Or use a firewall that checks egress, too. I use one, and find that RealPlayer and Adobe Reader also phone home even when you tell them not to.

Re:time to modify the hosts file

[ColinPL]

0.0.0.0 genuine.microsoft.com
is better, because 127.0.0.1 redirects the request to a local webserver.

Re:time to modify the hosts file

[AmiMoJo]

This probably won`t work. You can`t, for example, redirect Windows Update. The IP address of the server is hard coded into the Update service, and bypasses hosts etc.

If you did it at the router level it would work, but I cant find any info on this. I am betting that the IP info is sent to is not the same one used for the web host.

Re:time to modify the hosts file

[rainman_bc]

and find that RealPlayer and Adobe Reader also phone home

All the old Macromedia studio products also phone home too...

That means Adobe Dreamweaver etc...

Re:time to modify the hosts file

[$RANDOMLUSER]

Tiny Personal (I use the older free version on my Win2K box), but you have to understand IP addresses and ports and stuff - it's not for your granny.

Re:time to modify the hosts file

[QuietLagoon]

Microsoft bypasses the hosts file for their own hosts.

Re:time to modify the hosts file

[alx5000]

You are about to send Micros... download nice new MSN emoticons. Cancel or Allow?

Re:time to modify the hosts file

[penguinstorm]

Does anybody use Adobe Reader anymore? That thing's become so insane I don't even waste time -- I just open things in Preview.app

Is anybody actually surprised that Microsoft is spying on them in ways that they're not disclosing?

Re:time to modify the hosts file

[mrchaotica]

Is there a WRT54G firmware that can do that? I wouldn't trust anything like that running on a Windows host...

Re:time to modify the hosts file

[Technician]

Anybody do installs without a network connected? I wouldn't install any MS OS with a broadband connection live. Is the program silent then? Does it complain that it can't find your connection? MS assumes everyone is online.

Back when Optical Mice first hit the scene, I picked up a MS optical mouse for a machine I was building on my coffee table. I loaded the driver and the install stalled and nagged me because it could not find my network connection. Please configure up your networking or start your dialer...without a mouse driver installed! I wonder to this day if the software would have informed me that it was attempting to phone home if it did find a connection. That mouse got put back in the package and passed along to some other sucker. I would rather throw the brand new mouse away than permit that driver on my system. The lack of a configured network connection is probably the only way I would have discovered that the mouse driver phones home. I've stuck with Logitech mice since then for that very reason.

With several Linux distro's being easy to install and use, when WGA came out, I stopped MS upgrades and started moving to Linux. Love my Ubuntu box.

Anybody tried a WGA refusal with the network disconnected? Does it nag for a connection?

Re:time to modify the hosts file

[holdenholden]

Add an entry in your (hardware) firewall or router. Most modern routers allow "Block by URL" and "Block by IP" for outgoing connections.

Re:time to modify the hosts file

[Isotopian]

Try DD-WRT. I use it and love it.

Re:time to modify the hosts file

[thanksforthecrabs]

Would pointing this address locally just increase the frequency it phones home??

Re:time to modify the hosts file

[drix]

Dude, /everything/ phones home. Is this even news anymore? I just take it for granted and use a good firewall.

Re:time to modify the hosts file

[bendodge]

Adobe Reader 7 is junk, but 8 is actually pleasant to use (and about 4 times a fast).

Re:time to modify the hosts file

[certain death]

Ummm...You are wrong. All you have to do is point Yum or APT to a local repository, and it works just dandy without an internet connection... Get the facts straight before posting...Oh, wait, this is /.

Re:time to modify the hosts file

[zcat_NZ]

That might not work..

http://archive.cert.uni-stuttgart.de/bugtraq/2006/ 04/msg00301.html

Re:time to modify the hosts file

[walt-sjc]

I prefer to force every app to use a proxy, and have no direct internet connectivity at all. Anything that won't work with a proxy isn't worth installing.

Re:time to modify the hosts file

[walt-sjc]

the marvelous Synaptic (Apt) or Yum (rpm) or any other package manager *requires* a live internet connection in order to install any program.

This is 100% false. Those package manager's search internet based repositories by DEFAULT, but it is hardly required. In fact, all my servers point to a local repository so I don't have all 500 servers downloading the same packages over and over.

Re:time to modify the hosts file

[jackbird]

And both are left in a cloud of dust by Foxit.

Re:time to modify the hosts file

[LazyBoyWrangler]

Microsoft ignores the hosts file for Microsoft addresses - they are hard coded in the TCP/IP stack. If you read Slashdot you'd know this.

Re:time to modify the hosts file

[FireFury03]

Dude, /everything/ phones home. Is this even news anymore? I just take it for granted and use a good firewall.

How about just avoiding using any software that phones home without your permission?

Re:time to modify the hosts file

[14CharUsername]

Yup and you can also set it so that it only gets software or updates from the CD. So you can keep your system up to date without any kind of network at all.

Re:time to modify the hosts file

[thanksforthecrabs]

I do read Slashdot. It must have been buried within the ever-growing MS bashing. (and yes, I do loathe WGA)

Re:time to modify the hosts file

[deviceb]

What firewall does that? After sygate got discontinued i switched to zonealarm on my windows machines.

Re:time to modify the hosts file

[Technician]

Yup and you can also set it so that it only gets software or updates from the CD. So you can keep your system up to date without any kind of network at all.

I was in that boat for a very long time until I moved. I have a very fast connection at work and had a super slow dial-up account at home. Brunt CD's carried home was the primary way to download software and install it. Most modern MS things are very difficult to even attempt in this fashion. At least Ubuntu loads and ran fine without a connection. Breezy Badger gave you a fairly long wait as it tried to set it's clock to a network time server, but even that's not a problem in Dapper Drake. Been there, done that.

Re:time to modify the hosts file

[jma05]

Perhaps because sometimes these software offer something that people can't find a good open source alternative for (Quanta Plus is barely a replacement for say, Dreamweaver). Hence the firewall work around. I don't mind the calling home part so long as they specifically and unambiguously tell me what information they are passing back.

Re:time to modify the hosts file

[AlHunt]

>Or use a firewall that checks egress, too. I use one, and find that RealPlayer and Adobe Reader also phone home

Zone Alarm does this just fine.

I know a lot of people will want to jump and and criticize ZA for one reason or another. But it's free and it stops outbound traffic.

Re:time to modify the hosts file

[j79zlr]

Interesting idea, unfortunately MS bypasses the hosts file for its own servers:
See here

Re:time to modify the hosts file

[cjsm]

I would never buy a Microsoft mouse for the same reason. I've read that in order to fully enable all the deluxe featuures, you have to go online. Who needs this kind of crap? Microsoft is going to find out that the bad reputation they've built up over the years is going to come back and and bite them in the ass.

Re:time to modify the hosts file

[olman]

Except if you want to print on A4 paper or somesuch.

Re:time to modify the hosts file

[BrokenHalo]

In any case, the hosts file thingy is only useful if you happen to know every hostname Microsoft has assigned to that purpose, since wildcards won't work. Does anyone have a comprehensive list of them?

Not that I personally need to worry, but others may be interested...

Re:time to modify the hosts file

[ioshhdflwuegfh]

And both are left in a cloud of dust by Foxit. Definitely better than Adobe Reader.

Re:time to modify the hosts file

[jackbird]

My use case tends to be complex architectural drawings on very large paper sizes, which adobe reader sits there drawing over and over and over for minutes at a time. I don't have any experience with using it as you describe.

Spyware?

[Quaz and Wally]

Doesn't that make it spyware? I'm sure there's something about it in the license agreement to make it legal. Boy that does suck.

Re:Spyware?

[Opportunist]

Spyware isn't illegal in most countries. Actually, given the amount of Spyware being used by many not so shady corporations, I'd be surprised if it was.

As long as you are informed (usually in about 100 pages of legalese)...

Re:Spyware?

[Quaz and Wally]

Hmm, interesting. What about the license agreement when you install Windows? Maybe they have some dumb, "We reserve the right to get information from your computer if you do not complete the installation of WGA"? I don't know much about this stuff, so maybe someone can enlighten me.

Re:Spyware?

[Quaz and Wally]

Well, perhaps this doesn't fall under the US's Computer Fraud and Abuse Act, but maybe it falls under the UK's Computer Misuse Act. But regardless, there's probably some line in some EULA that lets them do whatever they want.

Re:Spyware?

[jb_02_98]

If you aren't accepting the EULA (by clicking no) then they don't have that right correct? Even if they do put it into the EULA that you are rejecting.

Re:So?

[sqlrob]

Ethics. If you choose not to install something, it shouldn't do anything.

What it really does...

[Iphtashu Fitz]

It actually uploads an entire bit-for-bit copy of your hard drive so that MS investigators can perform a forensic analysis on it and determine exactly what MS software you have installed illegally since not installing WGA is an implicit admission of guilt. You can expect to be arrested by the MS Police within a few days of declining to install WGA if you have any pirated MS software on your machine.

Re:What it really does...

[Iphtashu Fitz]

Probably got modded as a troll by somebody who works at/for Microsoft.

Re:What it really does...

[pembo13]

So said - so done.

English version of the original article

[Peter Simpson]

The English version of the Heise article is at:
http://64.233.179.104/translate_c?hl=en&langpair=d e%7Cen&u=http://www.heise-security.co.uk/news/8629 4

Re:English version of the original article

[ColdWetDog]

When asked by heise Security, Microsoft merely stated that it collected DATA ton improve the quality OF the WGA for users. Part OF that process, the vendor said, which knowing where the user cancel LED setup. Ton of COUNTs reliably, the GUID is used, though Microsoft says the user is emergency identified. Microsoft says that the OTHER DATA transmitted ton talking moon contain information about the version OF Windows used and the LANGUAGE and more whether the machine is registered in A domain. Microsoft did emergency explain why setup does emergency inform the user that DATA of acres being sent, much less GET the user's consent. It is thus emergency CLEAR more whether there wants A future updates after this one that does without communication with Microsoft concerning cancellations. Those who want ton of protect of themselves from unsolicited DATA transfer CAN DO so,

: That's English? My head asplode!

I guess Microsoft did something bad again and they're trying to weasel out of it by saying they NEED the data to make Windows SAFE (or protect the children, or get Osama, wasn't all that clear).

Back to our regularly scheduled bashing of Microsoft.

Adobe, will you PLEASE either code Photoshop for Linux or just let it run in Parallels? Oh, and while you're at it, I'd like a pony.

Interesting

[jesusphish]

Yay, I believe RMS's essay on treacherous computing may apply here. Not to start an argument over RMS and his stance with open source and free software. But i believe we should all have the right if you use windows to know what they are sending. I use gnu/linux so i really don't affect me much.

Re:Interesting

[shoemael]

I use Linux also so I'm not vulnerable to this particular issue, however there are some other "phone home" issues that are cross-platform and totally hidden from most people. Have you ever taken a look at how much information you send to google-analytics.com? You're probably thinking 'None' but you're wrong. I added a firewall rule to log all the connections to google-analytics.com and there are hundreds of them established everyday for me alone (or there were until I decided to drop them all). The amount of data Google has on your website visits is scary... and you were never asked if you wanted to provide it. And turning off cookies, etc. won't help you at all. Now that's invasive, IMO.

Re:Interesting

[dbIII]

Yay, I believe RMS's essay on treacherous computing may apply here

Is that treacherous as in beer?

He really has an interesting way with words which should never be removed from the entire context they are in. I liked it better when he made up his own new words instead.

Re:Interesting

[strider44]

Though you probably already know this, Customise Google will block google-analytics for you, or perhaps you can just edit your hosts file.

Re:So?

[DJCacophony]

Why was I marked redundant? That's not redundant at all..

Great...

[pchoppin]

... Now you're going to tell me that all Microsoft is in business for is to make money. You're ruining a perfectly good fantasy. Thanks a lot!

Re:Great...

[Catbeller]

That Free Markets religion again. Businesses cannot do anything they like; they are corporations, fictional entities created by license of the people of the country through their government. They are granted super-powers as non-existent individuals, exempting real operators from liablity for their own actions. In return, they hew the line we set for them. They have more responsibilty to the nation that created them other than pleasing shareholders, no matter what propoganda they pump to the contrary. They are not gods. And Microsoft is a monopoly, ruled so by the courts, and is under even more stringent strictures, because they have constantly abused their power in the past to invade and hold new markets.

So, no, making money is not all they have to worry about. Deceit and chicanery should have consequences other than making them more money. And if they need to cheat to win, it might be time to think about a new concept: revoking the corporate license, and reinstituting personal responsibility for their underhanded actions, with civil and criminal penalties.

Re:Great...

[Dilaudid]

So you've been watching The Corporation, like so many before you. The Corporation is a film that spouts some guff about how Corporations (which are made of people) are given some rights in the court - as if they were actually a person.

The Corporation, of course, was made by a corporation, the Big Picture Media Corporation, which the Canadian Film Board created in order to distribute it. I guess they must have found the "religion" you speak of to be quite convincing. It also popularised the views that you are espousing, while making a healthy profit for the Canadian Film Board. Milton Friedman would say this goes to show how capitalism fosters freedom - it gives a voice to those who seek to attack it.

Re:Great...

[Belial6]

I have always thought that if the 'corporation' as an entity commits a crime, then it should face the same penalty that a real person does. The corporation should be locked up, and deprived of the ability to make money. Of course it should be much cheaper to house a piece of paper than a human criminal, but that just works in our favor. Now, one might say that the shareholders are the ones being punished. Well, maybe they shouldn't be so quick to invest in a criminal organization. We all face financial loses because of human error. Whether it is making a driving mistake and having to pay for the damage to another persons car, or saying the wrong thing to your boss and getting fired. It certainly is a lot easier to diversify in investment than it is in your job. Most people have everything on the line in just one job. You might also say that stopping the corp from doing business hurts their customers. Well, that is no different than if my building contractor goes to jail. You might say that people will loose their jobs. That is no different than if my building contractor goes to jail. You might say that it will likely force the corp into bankruptcy. That is no different than if my building contractor goes to jail. While I do have a problem with a fictional entity being given the rights of a person, at the very least, if we are going to do that, we should be holding them to the same standards as a real person.

Re:Great...

[cuantar]

But since corporations are NOT people (whatever they may be legally), they need people in order to break the law. People who break the law are punished under the law. Therefore, those in charge of corrupt corporations are behaving corruptly themselves, and this corruption is something that should be punished.

wall of fire

[mastershake_phd]

Use Zone Alarm or other free firewall, problem solved.

Re:wall of fire

[failure-man]

Do you really think the people who wrote the kernel can't get around all that ZoneAlarm silliness if they want to? They already ignore the hosts file and such for *.microsoft.com.

Re:wall of fire

[Stefanwulf]

Use Zone Alarm or other free firewall, problem solved.

The problem isn't solved, you've simply put a local workaround in place.

Re:wall of fire

[wkk2]

My version of the Zonealarm firewall appears to phone home every time I execute a command. So I'm not sure that's a cure.

Re:wall of fire

[dbIII]

There are many very good hardware firewalls - at least one fits in a PCI slot and looks like a network card to the OS, and has a nice web front end to set the firewall rules and alternatively put in iptables rules for anything the GUI designers didn't think of.

Re:So?

[DJCacophony]

You chose to install the Windows Update ActiveX control, didn't you? And you clicked "I agree" when it told you it could send this info to Microsoft, didn't you? So why would you be angry when it does exactly that? Perhaps people need to read the licensing agreements they agree to before agreeing to them, instead of just clicking "yes, I agree" like a madman.

Easy enough to deal with

[KC7GR]

From the image in TFA, it looks like they're sending back the Windows version code, and the installation-unique CSID, along with some other stuff that I didn't recognize.

There didn't appear to be any identification of the specific user in there.

It seems to me that it would be easy enough to determine what port WGA is using to send this stuff, and lock down said port at one's firewall. That's the method I'd choose to deal with it (if I were even running anything with WGA installed -- which, thankfully, I'm not).

Re:Easy enough to deal with

[Rogerborg]

Your IP address doesn't identify you? Someone should tell the RIAA that.

Re:Easy enough to deal with

[drinkypoo]

From the image in TFA, it looks like they're sending back the Windows version code, and the installation-unique CSID, along with some other stuff that I didn't recognize. There didn't appear to be any identification of the specific user in there.

so let me get this straight. the ID that identifies your installation is there, and you don't recognize all of the other information, so you concluded that there doesn't be any identification of the user?

Truly, your intellect is astonishing.

Re:Easy enough to deal with

[Slashcrap]

It seems to me that it would be easy enough to determine what port WGA is using to send this stuff, and lock down said port at one's firewall.

Great idea. Except that obviously you can't filter by the source port because that will be almost random. And then you find that they're using Port 80 as the destination port anyway because it's about the only port guaranteed to pass through most firewalls/proxies.

So you filter it by IP address instead, but then find that they're using a huge range of probably Akamized IPs. Eventually you give up and just put an entry in your Hosts file. Which is bypassed for MS sites.

You could just filter it based on the name of the executable. I'm sure they wouldn't dream of changing or randomising that just to piss you off.

Re:Easy enough to deal with

[silas_moeckel]

Or you could filter via a layer 7 rule ditching connections to port 80 asking for anything *.microsoft.com there are better filters than early 90's ip proto and port based.

Re:Easy enough to deal with

[KC7GR]

Sorry to disappoint you. I'm a lot better with a logic analyzer or O-scope probe than I am with bizarre-looking high-level code.

We all have our different strenths. Someone else pointed out that the code is XML'ish. Considering that I never made a detailed study of XML, I'm not surprised I didn't recognize it.

Let me put it this way: Would you be able to read a document written in Sanskrit, or Hebrew? I certainly couldn't, not without a lot of help.

So, with that said: I hereby send one of those high-quality Bronx cheers that I specialize in manufacturing in your general direction! ;-)

Re:Easy enough to deal with

[drinkypoo]

We all have our different strenths. Someone else pointed out that the code is XML'ish. Considering that I never made a detailed study of XML, I'm not surprised I didn't recognize it.

I'm not berating your ability to parse XML - it's probably superior to mine, in fact. And I'm sure you're better with a scope (I can barely use one) or a logic analyzer (never tried.) But your skills with logic are, well, nonexistent. Maybe you could hook the logic analyzer up to yourself :)

Put simply, if you know that you don't know what you're looking at, how can you come to the conclusion that nothing is there? You don't even know what you're looking at! It would be like me deciding that some complex electronic circuit didn't have a... something, I don't even know what it would be. Since I am so utterly unqualified, I might still speculate, but I wouldn't decide that whatever-it-was wasn't in there, because I wouldn't understand how or where it could be hidden.

Re:Easy enough to deal with

[QuietLagoon]

There didn't appear to be any identification of the specific user in there.

HDSNL is the hard disk's serial number

Re:Easy enough to deal with

[Bill Kilgore]

Well, you didn't get it straight at all. He did not conclude that no user identification was sent. He merely said that that he didn't *see* any (look up "appear"). Ironically, you're the one jumping to conclusions. If you want to be a wiseass, remember to work on getting that wise part down as well as the ass part.

Re:Easy enough to deal with

[drinkypoo]

Well, you didn't get it straight at all. He did not conclude that no user identification was sent. He merely said that that he didn't *see* any (look up "appear").

Which definition do you want me to use? "to have the appearance of being" or "to be obvious or easily perceived"? Either one could apply solely from context.

If you want to be a wiseass, remember to work on getting that wise part down as well as the ass part.

Pot, kettle, black.

Re:Easy enough to deal with

[FoamingToad]

It seems to me that it would be easy enough to determine what port WGA is using to send this stuff, and lock down said port at one's firewall. That's the method I'd choose to deal with it (if I were even running anything with WGA installed -- which, thankfully, I'm not).
At a guess I'd suggest port 80 - sure you want to block that one?

Resistance if Futile

[Anonymous Coward]

It matters because it could give them justification to pursue an investigation along the lines of "Well, if they are innocent, why not prove it? So, they must be hiding something. knock knock knock - Microsoft Police."

Doesn't work

[alexhs]

Seems you haven't read the past story about MS bypassing HOSTS file for microsoft sites.

Re:Doesn't work

[peragrin]

In MSFT's defense it is a smart move. That way a virus can't modify update.microsoft.com .

The last time i had to set apt-get's update I used the IP address as well.

Re:Doesn't work

[billcopc]

I have to agree with you, the first thing most decently smart people do when their computer acts wonky is update their malware scanner(s) and OS. It is trivial for any malware to finagle with the HOSTS file on a Windows system, which is hidden in such a dumb obscure place (C:\winnt\system32\drivers\etc), a far cry from the self-explanatory /etc/hosts of every other goddamned OS on the planet.

Anyway as I was saying, once a virus takes over the HOSTS file, it could fool the common user into downloading malicious "updates". If someone put a little effort into it, they could use McAfee/Symantec's auto-update feature to replace the scanner with a 100% evil application that merely simulates the scanner's interface. The user points it to his/her/its sensitive files and lets the dumb app chug away for hours.. rather than scanning for viruses, it could be compressing and shipping off confidential data over the net.

While it may seem like just another entry vector to vulnerable machines, it's actually far more dangerous than most security holes because it has the potential to impersonate trusted hosts and exploit that trust to full effect.

Re:Doesn't work

[un1xl0ser]

That's a great idea.

Now the virus has to change the DNS servers the system uses in order to redirect important domain names.

Re:Doesn't work

[Hatta]

The last time i had to set apt-get's update I used the IP address as well.

Apt will complain if you're installing unsigned packages. If the packages you're installing
have been signed, it doesn't matter where they come from, they're real.

Re:Doesn't work

[Tarlus]

Modifying the entry in a local DNS server solves that problem.

Re:Doesn't work

[14CharUsername]

Yeah... and this makes me wonder why MS doesn't sign their updates too so it doesn't matter where its downloaded from. Oh, right they like to do things half-assed.

Re:Doesn't work

[ender81b]

Worst troll ever!

Also, you missed the point. It's so viruses and/or spyware can't prevent the machine from getting windows updates.

This is good

[Devir]

While many think this is bad and invasion of privacy, think of it as this:

when we normally click "I DONT Agree" the software does nothing. But if it sends the message back home with statistics of how many dont agree, it tells the software company some people dont agree.

We can argue EULA's till our fingers are raw and bloody, but it doesnt matter if the company in question doesnt read the conversations.

In short, by clicking the Dont agree button and having it sent home to MS we're telling them we dont want that crap on our machines. Maybe (deity willing) MS will start to listen. More companies may adopt that approach and we'll get less and less one sided (retarded) EULA's.

anyone Remember Borland's |"like a book" EULA? Great stuff.

Re:This is good

[MaggieL]

But if it sends the message back home with statistics of how many dont agree, it tells the software company some people dont agree.

I guess "the software company" doesn't read Slashdot, or they'd already know.

Re:This is good

[ccvqc]

It is remotely conceivable that the company in question knows how many copies of WGA it has pushed, can count how many acceptances it receives, and could possibly perform the calculation that would tell it how many copies were not accepted by users, without the need to receive direct confirmation of the latter.

Re:This is good

[Lumpy]

So let's have fun.

anyone got a way to dissect it completely so we can write a little app to send maybe 20-30 fake entries a day? now spread that across 100-300 people and microsoft thinks that there is a mass rejection of WGA starting to brew.

Re:This is good

[db32]

Now the next logical step is to write a cute little program that generates that information and sends it to the server that WGA talks to. I would be fairly interested to see the legal ramificaions of that play out.

MS: "Your honor, they 'hacked' our system and sent false identification and statistics to our server" Defendant: "Your honor, they just admitted that they are collecting indentifying information about everyone's computer against their wishes."

Re:This is good

[stmfreak]

I'll have to keep your perspective in mind the next time they ask me to register my guns.

"Dear Handgun Control. I elect to not register my 9mm stubby, .45 short nose and .38 backup pistol. Please stop asking us to register our guns because we don't appreciate it."

I don't understand why it is so difficult for people to grasp the concept of "no."

Re:This is good

[codepunk]

Why dissect it...just code a loop to send a fake version of the file with trash in the fields,childs play...

Re:This is good

[psaunders]

anyone Remember Borland's |"like a book" EULA? Great stuff.

I didn't remember this EULA (not surprising, since I can't recall actually having read one) so I started hunting around a bit... Googling such phrases comes up with quite a few hits. Is this a common part of EULAs?

...and does this mean every time my software closes itself for no apparent reason, I have to start reading again from the beginning?

--Pete

on a related note

[jjeffries]

This is kinda old, but some years ago my neighbor got a new Win ME (!!!) machine, and I helped him put in a NIC and put it on our little neighborhood network. I was curious if it was going to phone home, so I had a sniffer running on my router...

The damn thing picked/guessed a valid (NATted) IP address, netmask, and gateway without using DHCP (arp tricks?), and sent a load of mystery packets to an address in a Microsoft IP block. Only then did the computer do the "new device detected" routine, but could not find a driver for the NIC and I had to go fetch one on another machine.

W T F ?

Unfortunately I have since lost the pcap dump.

Moderation: -1, no proof

Re:on a related note

[Slashcrap]

The damn thing picked/guessed a valid (NATted) IP address, netmask, and gateway without using DHCP (arp tricks?)

Did that IP resemble 169.254.x.x by any chance?

But really there's no point trying to find technical explanations when the obvious one is at hand - you can't read a sniffer trace for shit.

Having the ability to install Ethereal does not magically confer on you the ability to interpret the results correctly.

Re:on a related note

[electrosoccertux]

The damn thing picked/guessed a valid (NATted) IP address, netmask, and gateway without using DHCP (arp tricks?)

Did that IP resemble 169.254.x.x by any chance?

But really there's no point trying to find technical explanations when the obvious one is at hand - you can't read a sniffer trace for shit.

Having the ability to install Ethereal does not magically confer on you the ability to interpret the results correctly. Last I checked, none of those should be happening without a driver.

Re:on a related note

[AK Marc]

So, you're saying Microsoft has some secret way for it's OS to phone home without a driver for the ethernet card?

Yeah, it's called NE2000. Almost all cards support it. If you don't have the drivers for a card, you can usually force Windows to use generic NE2000 drivers and the card will work. But if it can't identify the card, or identifies it and doesn't have drivers, then it will tell you that it can't install it, even when it knows it can use it just fine with the generic drivers. So yes, I do think it quite plausable that Windows can use a NIC it does not have drivers for. But I wouldn't call NE2000 a secret.

Re:on a related note

[jjeffries]

Did that IP resemble 169.254.x.x by any chance?

No, it was a valid, unused rfc1918 address in the correct subnet. MAC address was the one on the card in the computer in question.

My home shorewall box correctly drops 169.254.x.x made-up addresses, and my ISP does not forward traffic from IPs not assigned to it. I know, I configure the routers.

But really there's no point trying to find technical explanations when the obvious one is at hand - you can't read a sniffer trace for shit.

Having the ability to install Ethereal does not magically confer on you the ability to interpret the results correctly.

tcpdump, actually. I know what I saw, and I get to practice my sniffing skills on several hundred DSL & T1 subscribers daily. :)

And I agree with the ne2000 thing, I think it was a card that worked with the ne2k-pci driver on linux (an old linksys maybe?)

anyway, creepy and very real.

Ok, say Joe Sixpack installs WGA.....

[8127972]

.... is it as simple as going to add and remove programs to uninstall the two components for WGA or does it "break" something when you try to uninstall it? Or worse, does it leave anything behind?

Re:Ok, say Joe Sixpack installs WGA.....

[J0nne]

You can't uninstall it. You need to find a third-party program to remove it (I don't remember the name of it, but the tool works).

Re:Ok, say Joe Sixpack installs WGA.....

[orielbean]

I was able to do so by deleting the 2 files out of the registry and out of the system32 folders (I think). The steps were in the top few google results for "remove wga" It's been a while, so I'm not 100% sure that was the way to still go. I think it was WGAcheck.dll...

Re:So?

[Rob the Bold]

Perhaps people need to read the licensing agreements they agree to before agreeing to them, instead of just clicking "yes, I agree" like a madman.

Ya, that would fix it. Maybe, just maybe, some of us don't have an army of lawyers at our disposal to determine if what we're clicking on really means what we think it means. It seems to me that it is unethical to have a consumer product license that is unreadable/unparsable to an average consumer. The "madman" here would be anyone who thought that such nonsense was an enforceable contract.

Perfect marriage of technologies?

[Joe Random]

Sounds like a perfect place to use MS speech recgonition:
Computer: "Where do you want to go today?"
You: "Nowhere."
C: "I heard 'Microsoft Validation Site'. Is this correct?"
Y: "No!"
C: "I'm sorry. I heard 'Dear aunt, let's set so double the killer delete all'. Is this correct?"
Y: "NO!!"
C: "I understand. So 'Microsoft Validation Site' was correct. Redirecting now. Thank you for using My Microsoft Live Enterprise Genuine Advantage Ultimate. Have a nice day."

Re:So?

[spun]

You posted a short, one word post with no information content and an inane question in order to get first post. Mods love to bitchslap anyone who does this.

The question "So?" is redundant because it doesn't need to be asked. If you feel this isn't an important issue, explain why you think it isn't important.

Software that sends personal information about you back to its master when you say you don't want to install it is generally considered spyware.

I see your "So?" and raise you a "Because!"

Holy cow, this is Bad

[blind biker]

I am no lawyer, but this seems very similar if not the same as wiretapping. The user, quite explicitly, doesn't want to even have the software installed on his/her computer, let alone have his information (the information stored in the registry is private) sent to a company or individual.

Maybe I am just not used to spyware (never had a piece of spyware installed on any of my computers) so I am still quite allergic to this stuff. But no matter how I look at this issue, I am outraged.

Re:Holy cow, this is Bad

[MightyMartian]

I am no lawyer, but this seems very similar if not the same as wiretapping.

You're right. You're no lawyer.

Like the GPL?

[Anonymous Coward]

it is unethical to have a consumer product license that is unreadable/unparsable to an average consumer.

Oh my fucking god.

Have you ever tried to read the GPL?

Re:Like the GPL?

[jorgevillalobos]

Have you ever tried to read the GPL?

Unreadable as well. Your point being...

Re:Like the GPL?

[Knuckles]

AC said: "Have you ever tried to read the GPL?"

The GPL is not a consumer product license. In order to use the software you don't even have to agree to the GPL. Only if you distribute are you bound by its terms, and software distribution is a complicated topic.
Even so, when you compare it to proprietary EULAs, the GPL is entirely readable in its main parts. Furthermore, the GPL is not written in caps as most EULAs are (IMHO this obvious attempt at obfuscation alone should make EULAs unenforceable).

Re:Like the GPL?

[BarryJacobsen]

Have you ever tried to read the GPL?

Unreadable as well. Your point being...

Exactly! The GPL is GIVING YOU EXTRA RIGHTS, while EULAs are TAKING THEM AWAY. This may just be me, but I'll allow the verbiage that gives me something extra to be considerably more esoteric than the verbiage that tries to take something away from me.

Re:Like the GPL?

[mrchaotica]

1. The GPL is much more understandable than any Microsoft EULA
2. The GPL is a distribution license. If you're doing anything that causes it to apply to you, you're no longer an "average consumer!"

Re:Like the GPL?

[LocalH]

The GPL isn't a "consumer product license", it only applies to developers and those who redistribute binaries.

Re:Like the GPL?

[essh10151]

From an end-user's prospective, perhaps. But from a developer's perspective, the GPL takes away the right to distribute closed-source programs if you, in any way, use an GPL'd product. That would be a large TAKING AWAY of a right if one didn't read and understand the contract.

Re:Like the GPL?

[644bd346996]

Certain portions of the EULAs are supposedly required to be emphasized. Most software makers choose to use all caps rather than a rich text license.

Re:Like the GPL?

[SirTalon42]

Um... No. The GPL doesn't to take away your rights to distribute a closed source program. You can distribute them all the time. But if you link against a GPL program/lib THEN distribute your program/lib, you would have to follow the GPL. If you don't accept the GPL you have to follow normal copyright law which means you can't distribute it REGARDLESS of your license if you link against it.

The GPL is NOT limiting anyones rights beyond copyright law, you might say its more limiting than the LGPL or modified BSD, but you can't say its more restrictive than no license at all.

Also an EULA is an agreement the end user is supposed to agree to to be able to use the software, the GPL is a copyright license that a distributor must agree to to be legally able to distribute any program that includes/links against GPL code.

Re:Like the GPL?

[Zonk (troll)]

The GPL gives you a right you would otherwise not have. That is, redistributing and modifying the software. All it asks in return is that you give others the same freedoms you received yourself. This is in contrast to the BSD license which would allow you to profit off of the work of others without giving back and denying everyone else the freedom you received. The GPL gives everyone more freedom.

Re:Like the GPL?

[Knuckles]

But from a developer's perspective, the GPL takes away the right to distribute closed-source programs if you, in any way, use an GPL'd product.

Stop the obvious trolling. For the record:

• If you use a GPL'd product, it does not influence your rights to distribute your closed-source program in any way. Or do you think IBM cannot distribute AIX because some web guy they employ edited a photo in the Gimp?
• Even if you include GPL'ed code in your proprietary software and distribute the result, no court will take away your distribution rights immediately, unless the vast majority of your code is actually infringing. The usual course of action is to remove the infringing parts, or to negotiate an license with the owner of the GPL'ed code

Just read up on the cases where companies were found infringing.

Re:Like the GPL?

[Knuckles]

How does it emphasize anything if the whole fucking text is in caps?

Re:Like the GPL?

[mungtor]

Actually, you're wrong. Replace the word "freedom" in your post with "resources" and you would be correct.

The GPL does not grant additional "freedom" no matter how many people repeat the same tired bullshit. It takes away the freedom to use somebody else's code in your proprietary, for profit, application. Unlike the BSD license, for example.

Also, simply because the BSD license allows people to incorporate code and close the source, the original source doesn't simply disappear. Nobody is at a disadvantage because the code became part of a closed source product.

The GPL isn't about freedom. It's about being selfish in the guise of supporting the community. If you aren't going to profit off the code, you don't want anybody else to be able to either.

Re:Like the GPL?

[cbreaker]

Your line of thinking is the result of so much FUD being spread and you're adding to it.

The GPL does not, ever, in no way, TAKE AWAY rights. It specifically GRANTS you rights to use other people's software source code for whatever you want to use it for, as long as you follow some guidelines. At any time, you can simply not use that source code, and close source all you want.

I don't understand the mentality. I mean, if you're a software dev company, what makes you think you should be able to take GPL code, build a product out of it, and sell it closed source? Why do you think you should get a free ride?

Plus, the GPL is very easy to understand. But, it's not a consumer license, it's a developer license. You don't have to display it to the user when they are running the software.

Re:Like the GPL?

[BarryJacobsen]

The GPL isn't about freedom. It's about being selfish in the guise of supporting the community. If you aren't going to profit off the code, you don't want anybody else to be able to either.

Yup, I tend to think of the GPL like that bratty kid on the playground with the ball. Every group of kids had one, the kid who would say "If you don't play by my rules I'm taking my ball and going home".

God I hated that kid.

Odd, as all the other kids are saying "you can play with my ball if you pay me a bunch of money, but it's still my ball, and at any time I can change what you're allowed to do with my ball" and this kid is just saying "if you don't play by my rules of sharing the ball with everyone, I'm taking my ball and going home". I may not like that I have to play by that kids rules, but it's better than playing by his rules and paying him to do so...or going out and making my own ball.

Re:Like the GPL?

[Ph33r th3 g(O)at]

It does no such thing. It declines to grant (not takes away, because you never had it) the right to incorporate GPL'd software into your proprietary, closed-source software. The GPL, in so many words, says "If you want to run this program, that's great. If you want to modify it, close it, and sell it, tough shit-WRITE YOUR OWN CODE."

Comparing that with software that's sold usurping the "right" to call home by means of an obfuscated EULA is the height of disingenuousness.

Re:Like the GPL?

[FiloEleven]

But how do you know the difference? The GPL concept is familiar enough to most of us even without having read it, but think back to the arguments over GPL2 vs. GPL3. If you can't easily read the license and you don't read Slashdot, the differences between the versions could go unnoticed, and (from what I gathered reading the discussions here) the differences are enough to potentially bite someone who doesn't know them in the ass.

Clear language is necessary for clear communication. It could be argued that licensing language is necessarily esoteric and complex because of the way our legal sytem has developed, but if that is the case then there should be a layman's summary in the license preamble. If hundreds of slashdotters can concoct concise, accurate summaries in response to every GPL question posted, why not put one in the license itself so people will actually read it and understand what they're getting into? And aren't we geeks supposed to abhor inefficiency? =)

The GPL is used as an example and is not a specific target - I am arguing that all licenses should clearly inform licensees of their effects, and that even a good license can contain gotchas.

Re:Like the GPL?

[T.E.D.]

The GPL is a distribution license. If you're doing anything that causes it to apply to you, you're no longer an "average consumer!"

I'm not trying to pick on you, I've seen something like this said in a couple of places. However, it is simply not true. If it were, then no-one would be able to run the software (as the default in the US is "no rights").

However, it is true that the part of the license that applies to running the software is rather short:
"The act of running the Program is not restricted".

Your point about the GPL being more understandable is bang on though. Perhaps sheer size isn't the best indicator, but the GPL (sans preamble and other unrelated fluff) is only about 2k words long, with a total of 12 clauses. The Microsoft XP (Home) EULA (sans identification info, foreign language versions, etc.) is nearly 4k words long, with a total of 30 numbered and subnumbered clauses and 6 more paragraphs.

At the risk of going back on-topic, I notice that 2.3 and 2.4 give the software the right to "phone home" without notice to you.

Re:Like the GPL?

[BarryJacobsen]

I guess I simply go by where I feel the burden of work should be. Releasing something under the GPL is an authorial act (as in, I created or modified something, which takes a non-trivial amount of work) and part of that work is determining how I want to distribute that software (and how other software that is part of my package is required to be distributed) and under which license.

In the case of EULAs my goal is as a software user (a much more common act) and my goals are to use the product I paid for, preferably quickly and easily. It should never be easier to make a product than to use a product (if the two items are of a similar nature, obviously coding a tic-tac-toe program could be easier than use advanced statistical software), as such it seems that a company who has sold me a product should spell out clearly what I'm not allowed to do with it that common sense (in the sense of what an average person would assume) alone would allow me to do as that is part of the work of preparing that item to be sold.

Condensed Version: In cases like the GPL, it is the author doing the work and more time should be invested in to determining exactly what happens than in cases of EULAs where it's the user doing the work of interpreting the license (which is an impediment to doing what they paid to do: using the software).

Re:Like the GPL?

[dthable]

Technically both grant you rights to use the software. You do not have any right to use a product developed by someone else or a company until they grant you the right to use it. You can't walk into my backyard and use my pool until I grant you the right to do so.

Re:Like the GPL?

[Columcille]

If the language is hard to digest, how will you know what the license is doing? You'll still need someone else out there interpreting it for you. If we didn't all know what the GPL was, you wouldn't know that it helped you unless you dug through the text on your own.

Re:Like the GPL?

[Ciggy]

a large TAKING AWAY of a right

Hmmm...I never realised stealing other people's copyright was a right.

The only licence you have to use someone's code is the licence they give you. If you don't understand their licence, then you should at least look at copyright law. That, I'm sure, is rather explicit that you can't just take stuff, eg open-source program, someone has written and use it in any way you please, eg in a closed-source program. If you don't fully understand the GPL, then contact the author as to his/her requirements for use of their code; if you can't make contact then assume Copyright Law - the GPL gives extra rights that Copyright Law doesn't and all you would lose is those extra rights.

Re:Like the GPL?

[Knuckles]

You should quote the whole sentence:

Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted ...

Re:Like the GPL?

[mungtor]

Not all the other kids. The BSD kid is saying the same things that the anti-RIAA people speak of. He's saying:

"Have a copy of my ball. I lose nothing by giving it to you, so have a blast and do whatever you want."

I don't even have a vested interest in the licensing one way or another, but I'm really tired of the GPL zealots touting how "free" their code is.

Re:Like the GPL?

[MeNeXT]

The GPL does not grant additional "freedom" no matter how many people repeat the same tired bullshit. It takes away the freedom to use somebody else's code in your proprietary, for profit, application.

The GPL isn't about freedom. It's about being selfish in the guise of supporting the community.If you aren't going to profit off the code, you don't want anybody else to be able to either.

First and foremost copyright prevents you from distributing work that you have not created and therefore the GPL gives you an additional freedom.

Now could the kettle please stop calling the pot black. Nobody ever said they didn't want to profit from the GPL. Everyone wants to profit. It's just not in cash but in help, support, innovation, improvements....etc. What you seem to be looking for is slave labor. Where you can re-brand someones work and not pay anything for it.

If you want to use someones code ask them for it just as you would with Microsoft. Please don't do as Microsoft, copy code, Windows 2000 TCP/IP stack, and hide the copyright where nobody can see it. have the courtesy to give the author credit. Selfish? Who are you calling selfish?

Re:Like the GPL?

[GrubInCan]

It takes away the freedom to use somebody else's code in your proprietary, for profit, application.

WTF? It's Copyright law says you have no freedom to use somebody else's code in your proprietary, for profit, application. The GPL grants you the freedom, as long as you respect the wishes of the author.

Re:Like the GPL?

[99BottlesOfBeerInMyF]

The GPL does not grant additional "freedom" no matter how many people repeat the same tired bullshit. It takes away the freedom to use somebody else's code in your proprietary, for profit, application. Unlike the BSD license, for example.

BZZZZT! Wrong! Copyright law takes away the freedom. The GPL restores some of the freedom. Think of it this way. I just wrote some code. Can you use my code in your proprietary, for profit application? No. Why? Because copyright law makes it illegal.

Enter the GPL. The GPL is simply a license that says I'll let you use my code, if you promise certain things to me. It is a trade. I'll grant you certain freedoms that copyright law took away if you do certain things for me as specified in the license.

The GPL isn't about freedom. It's about being selfish in the guise of supporting the community.

No, the GPL is about building communities that share work (what it asks in return for said freedom) in such a way that no one can benefit from the work of others in certain ways without returning some work of their own.

If you aren't going to profit off the code, you don't want anybody else to be able to either.

Most GPL code is written by commercial enterprises for profit. IBM doesn't say they're licensing GPL code for the good of the world, they say they're doing it to maximize shareholder value. It is about making a business deal with any and all comers that they can use your code if you can use theirs and thus all parties benefit. Maybe you've noticed that most of the projects that get a whole lot of code contributed are GPL licensed, not BSD. Do you know why that is? It is because it provides a better return on the investment in the opinion of most companies and for that matter most individual hobbyists. If I spend weeks of my life writing some code, I don't particularly want someone else to sell that code back to me a few years from now. I'd much rather make them a deal that if they add to it they can use my code in exchange for letting me use their additions. There is no such thing as a free lunch buddy.

Re:Like the GPL?

[syousef]

So let me get this straight. A license that says "you can only use me in a very limited way and you have to pay me for the privellege" is okay, but one that says "use me any way you like for free, except you have to let anyone else use what you build for free as well" is selfish.

That's twisted and disingenuous. Why don't you just admit that what you want to do is sell other people's work and turn a profit using the fruits of their labours (with only minor changes)? You're just bitter that they won't give it over. Yet proprietary software makers certainly don't give you more freedom.

Re:Like the GPL?

[99BottlesOfBeerInMyF]

The GPL relies on copyright law to function.

Not at all, the GPL is a response to copyright law that is more restrictive than some copyright holders would like. If there were no copyright laws there would be no GPL because there would be no need for the GPL. The GPL, however, takes away no rights, it merely restores some (but not all) rights restricted by copyright law.

By definition, the GPL removes freedom because it does not allow you to do whatever you want.

I see, so by your definition shoes remove freedom because they don't let me walk through the bars in a jail cell? Shoes don't grant me the freedom to do anything I want (although they do grant me the freedom to walk across broken glass without injury) but since they don't help with lava or jail cells they remove freedom?

Your logic is very broken.

You'll simply have to accept this fact...

You are quite simply wrong. Just admit it and demonstrate that you're a rational person, rather than reacting emotionally and trying to illogically defend your indefensible and factually incorrect argument.

Re:Like the GPL?

[kocsonya]

BSD says: I wrote this code, you can use it for anything, I don't care, as long as you tell people that I wrote it.
GPL says: I wrote this code, you can use it for anything but if you add to it, you must let others use your additions as well.
You say: I want to use your code and make money out of it without giving you a dime and if you don't let me you're a selfish pig!

Did I get it right?

Re:Like the GPL?

[Achromatic1978]

Also, simply because the BSD license allows people to incorporate code and close the source, the original source doesn't simply disappear. Nobody is at a disadvantage because the code became part of a closed source product.

No no, you don't understand! You're only allowed to use that argument when the product you are obtaining is an MP3, not source code!

Re:Like the GPL?

[99BottlesOfBeerInMyF]

The GPL isn't a respond to copyright law. It's entirely dependent on it.

You've failed to demonstrate how those two things are mutually exclusive.

The purpose of the GPL is to make sure source code is redistributed in software releases, so if there were no copyright laws, the GPL would be violated because nobody would have to redistribute that source code.

Nope. The GPL would not be violated if there were no copyright law, because no one would need to abide by the GPL in order to freely copy the code.

Therefore, the GPL takes away the freedom to do whatever you want with the source code you download.

Do you know what "non sequitur" means?

Um, what? You walk through physical matter when your shoes are off?

Just as much as I can legally copy the code in question if it is not GPL'd.

This is one of the most bizarre metaphors I've ever read.

It's not a metaphor, it's an analogy. Are you truly this dense or are you being intentionally obtuse?

The fact shoes let you walk on broken glass has nothing to do with the GPL restricting what you can do with source code.

Shoes grant you the freedom of movement if you happen to be surrounded by broken glass. They, thus, grant you more freedom than you had. The GPL grants you more freedom when you are restricted by copyright law. It grants you more freedom than you have. Shoes don't grant you complete freedom to do anything you want. If you're surrounded by metal bars they don't allow you to walk through them. This does not mean shoes take away freedom. The bars took away the freedom. The GPL does not grant you the freedom to take copyrighted code and close the source. This does not mean it takes away freedom. Copyright law took away the freedom. Do you know understand the analogy and the flaw in you logic it demonstrates now that I've used really small sentences?

You're one to talk, fella.

Yes, I am. I've pointed out several of your logical fallacies. You've pointed out none of mine. Please do elaborate and explain where exactly my logic fails. You do actually know what logic is, right?

You're right, let me just slip my shoes off and walk on out of this jail cell.

I am right. You can't slip off your shoes and walk out of a jail cell in the same way you can't get someone to rescind their GPL licensing of code and suddenly be free to use it without permission. In one case you're stopped by bars, in the other by copyright law. This isn't rocket science friend, you need to revisit your very sloppy thinking.

Re:Like the GPL?

[Dirtside]

I was under the impression that copyright confers rights regarding copying and distribution, not use. If I buy a book that has, printed on the cover, a copyright license saying that I'm not allowed to read the book, as far as I know that's legally unenforcable -- once you sold it to me, I'm legally free to do whatever I want with it except distribute copies. (And, of course, anything it would be illegal to do with any object, like beat someone to death with it.)

Re:Like the GPL?

[init100]

If you aren't going to profit off the code, you don't want anybody else to be able to either.

You have obviously never heard about companies like Red Hat. They seem to make a tidy profit off software licensed under the GPL.

Re:Like the GPL?

[HuguesT]

There would be a lot of things to say about your post, but I'll leave it at that :

There isn't a single line in your comment that is correct. Not a one.

Cheers.

Re:Like the GPL?

[init100]

The GPL isn't a respond to copyright law. It's entirely dependent on it. The purpose of the GPL is to make sure source code is redistributed in software releases, so if there were no copyright laws, the GPL would be violated because nobody would have to redistribute that source code.

Are you sure that you are not contradicting yourself? First you say that GPL is dependent on copyright law (which I agree with, as GPL violations amount to copyright infringements), but then you claim that the GPL would be violated if copyright laws wouldn't exist. How could that be? Without copyright law, there would be no GPL to be violated.

Re:Like the GPL?

[Tacvek]

I was under the impression that copyright confers rights regarding copying and distribution, not use. If I buy a book that has, printed on the cover, a copyright license saying that I'm not allowed to read the book, as far as I know that's legally unenforcable -- once you sold it to me, I'm legally free to do whatever I want with it except distribute copies. (And, of course, anything it would be illegal to do with any object, like beat someone to death with it.)

True. Although there may be limitations on creating copies that are not distributed. I've heard it both ways.

Re:Like the GPL?

[init100]

The rights extension thing for plugin use is rediculous. You can link to this software as long as your software operates under the same terms as ours... In many settings thats unacceptable and the definition of what this actually means and the parameters of it has never been specifically understood. (The "Viral" MS termed effect is not a function of no license, it is a restriction *ADDED* by the GPL)

Are you claiming that the GPL is unique in demanding that users (in terms of software programs) of a certain package follow its license? I'd guess that most or all proprietary licenses demand that programs that use the covered code have to abide by its license. Do you think that you can incorporate any random Microsoft-developed library into your code without abiding by the license for that library? Such restrictions were not invented by the GPL.

Re:Like the GPL?

[homer_ca]

It takes away the freedom to use somebody else's code in your proprietary, for profit, application. Unlike the BSD license, for example. That's the whole point. It's somebody else's code. Don't like it? Then write it yourself, or go back to the author and pay them for a commercial license. Some developers will do that.

Re:Like the GPL?

[Mprx]

That right is not taken away by the GPL, it is taken away by copyright law.

Re:Like the GPL?

[Rakishi]

By definition, the GPL removes freedom because it does not allow you to do whatever you want.

By that definition so does the BSD license as it forces you to credit the original author which clearly is removing a freedom (ie: ability to not credit anyone). Anything except public domain is by your definition a removal of freedom.

You assume that the default level of freedom is no copyrights but to many people the default level (ie: the one in practice) is the existence of copyright laws. Hell by your logic giving any sort of new freedom of speech to people in china would be limiting their freedom despite them being able to say more than they used to (since they are still limited). It's sheer idiocy honestly, apparently your hate of RMS or the GPL has more or less removed most shreds of rationality in your brain.

Re:Like the GPL?

[poopdeville]

There are some respects in which the BSD licenses are more free than the GPL. But both grant additional freedoms above and beyond the fair use guaranteed by copyright law. If you don't like it, you don't have to play.

Re:Like the GPL?

[drsmithy]

The GPL is NOT limiting anyones rights beyond copyright law, you might say its more limiting than the LGPL or modified BSD, but you can't say its more restrictive than no license at all.

Can we have a show of hands to see who thinks linking to a library violates the copyright of the creator of that library ?

Ironic that you don't need to follow any special agreements to write software that links to the libraries included with, say, Windows...

Re:Like the GPL?

[drsmithy]

I don't understand the mentality. I mean, if you're a software dev company, what makes you think you should be able to take GPL code, build a product out of it, and sell it closed source?

Because - at least with regards to a large proportion of it (shared libraries) - that's what they can do with closed source code.

Re:Like the GPL?

[mrchaotica]

Yes, actually. Nobody even tries to understand the Microsoft EULA!

Re:Like the GPL?

[senatorpjt]

Although the GPL "forbids" it, it's probably not a copyright violation to link to a library, it's a copyright violation to distribute a library, so if you were to distribute a closed-source program that uses a library, you wouldn't be able to provide the library. This only applies to dynamically linked libraries, obviously. Statically linked libraries are definitely a copyright violation.

This specific case has not been tested in court, but Galoob v. Nintendo seems to set a precedent.

As for the irony, to link to the libraries included with Windows, each user has to have purchased a license for the libraries - by purchasing Windows.

Re:Like the GPL?

[senatorpjt]

1) The GPL does grant additional freedom over standard copyright. In a straight copyright, nobody has the freedom to use the code in any application.

2) The developer is at a disadvantage because the code became part of a closed source product. The point of creating code under the GPL is in a sense to receive payment in the form of services rather than money, in two ways: First, If another person decides to improve your code, you receive "payment" in the form of improvement. If you released code, and someone improves it and sells it as closed source, you do not gain the use of the improvements in your own code. Second, if someone incorporates your code in a completely different project, your "payment" is the free use of the new project. A lot of people who develop GPL code probably use a GPL operating system, and it does them no good if someone uses it in a closed-source Windows app.

Re:Like the GPL?

[Pofy]

>You do not have any right to use a product developed by someone
>else or a company until they grant you the right to use it.

Actually you do in a whole bunch of countries all over the world. The same applies to most everything else. You don't need permision to read a book, sit in a chair and so on. Copyright would not restrict iut either since "use" is not a right of the copyright holder in most countries (if any?). The copying needed to "use" software is in most countries specifically allowed and not infringing. The exact nature of this exception to the copyright holders right to create copies vary. It can for example be that as long as you are a lawfull user or in a lawfull possession of the software, it is allowed. Check your own copyright law for your country what applies to you and realise it vary for others in details.

>You can't walk into my backyard and use my pool until
>I grant you the right to do so.

You are confusing copyright with ownership. They are not related hence your example is quite irellevant.

Re:Like the GPL?

[Pofy]

>Certain portions of the EULAs are supposedly required to be emphasized.

Required by what? Is there a law stating so? And what makes everyone thing using all caps emphasizes anything? I would say it is the other way arround since it gets a lot harder to read.

Re:Like the GPL?

[Craig Maloney]

Have you ever tried to read the GPL?

No, I succeeded.

Re:Like the GPL?

[mgiuca]

That's the best analogy I've seen for the GPL. Thankyou!

Re:Like the GPL?

[SillySlashdotName]

Not a "GPL zealot", but you are somewhat mistaken.

BSD gives away all rights to the software (except for advertising/copyright notices) which allows anyone to take the free code and chain it up in a propriatary product. They can also make changes to the base and not disclose the changes or the base on which they are made.

GPL does what BSD does, but with the additional requirement that the developer has to "keep the software free" by not allowing them to lock it up in a propriatary product or make derivative works and not make them as free as the base used.

BSD says 'This is free, I don't care what you do with it.', while GPL says 'This is free, you can do anything with it EXCEPT MAKE IT LESS FREE THAN WHEN YOU GOT IT.'

GPL is less free than BSD, in that GPL puts restrictions on the your ability to ADD restrictions to the original copyrighted work.

Which is more free: software released free under a license that allows you to make it non-free, or software released free under a license that requires you to keep it free? The additional requirement is a restriction on your freedom, but it ensures the freedom OF THE SOFTWARE.

Re:Like the GPL?

[cbreaker]

For some reason, I don't think he's going to reply to you this time =)

Re:So?

[Anonymous Coward]

You chose to install the Windows Update ActiveX control, didn't you? And you clicked "I agree" when it told you it could send this info to Microsoft, didn't you?

Why yes, I did. And yes, I did agree.

So now, explain what that has to do with me telling WGA to not install, and not agreeing to allow it to send this information, and it sending it anyway. You are aware that contracts do have limits and only apply to the particular transaction, right? If I buy two cars from a dealership and agree to pay $300/mo for one and $200/mo for the other, the dealership cannot bill me $600/mo while claiming that my agreement to pay $300/mo covers both cars, as you seem to claim that my agreement to allow WU to send information to microsoft overrides my disagreement for WGA to do the same.

Re:So?

[whargoul]

Yeah, and?

And they will get away with it.

[Caspian]

Are you getting the picture yet? Powerful organisations (and politicians) really CAN and DO get away with anything they want. Microsoft is a prime example. I'll be very surprised if they ever get in any serious trouble for this (and no, for MS, a multi-million-dollar fine is not "serious trouble", it's a slap on the wrist. A $10,000,000 fine wouldn't hurt them. A $10,000,000,000 fine... maybe, yes.

Re:And they will get away with it.

[Opportunist]

Well, the problem is, if you did that, you'd go to jail for 2 years or so. But how do you jail a corporation?

My Firewall is Full of Herons

[spun]

Or use a firewall that checks egress, too.

How does a firewall check female herons?

That is what an egress is, right?

Re:So?

[rainman_bc]

You chose to install the Windows Update ActiveX control, didn't you? And you clicked "I agree" when it told you it could send this info to Microsoft, didn't you? So why would you be angry when it does exactly that? Perhaps people need to read the licensing agreements they agree to before agreeing to them, instead of just clicking "yes, I agree" like a madman.

Okay, despite your trollish comments, I'll bite.

1. WGA != Windows Update. RTFA.
2. Has the validity of an EULA ever been tested? AFAIK, an EULA cannot violate your privacy rights, even if you sign those away. Argue as you like, statute always trumps contracts.
3. Microsoft releases an OS that's broken and tells you the only way they'll fix it is if you'll subject yourself to their privacy terms. Not freaking cool. My copy of Windows is paid for, but that doesn't mean I want them invading my privacy.

Ever installed XP without any service packs? Do you know how many minutes it takes before the machine is pwn3d? IMO that's not a functional OS any more.

Ever tried getting that refund from your hardware manufacturer for the part of your purchase that went to Microsoft? It's a freaking pain in the arse, and one where you have to usually drag a vendor to small claims court to get your money.

Most people just don't care....

[EmbeddedJanitor]

Sometimes the only way to exercise your rights effectively is to just walk away (as you and I have). Ranting sure does not work. Enough people have yelled from the rooftops of Vista's crapness and MS's evil methods but that will not stop sales. DOJ does not work. MS just ignore them.

The masses are not concerned with threachery, privacy, liberty and other high-browed virtues. Give them a full belly and a reality TV show and they are happy. Take away XP and substitute Vista and they will buy Vista.

Re:What Port You Ask?

[mpapet]

I have an older version of Kerio's firewall and most recent "phone home" applications do so on port 80. Older apps use custom ports. Kerio's product is very good in this way.

I'm not sure why this is an issue _now_. It's been this way for years starting with Microsoft's MSI installers that phone home to certificate servers and certificate revocation list servers. I have screenshots to prove it should there be any doubt. It should be obvious by now they are slowly paving the way to a PC with their OS that is mostly like an Xbox.

Given the Microsoft fan boys/astroturfers typically don't post on stories where there is no opportunity to spin the story in a manner that enhances their image, I'm probably preaching to the choir when I state this is another reason users should choose another OS. Today.

Re:So?

[Flibz]

Nice response....

Plus, on this occasion I thought "So?" was a reasonable response too.

It's not sending personal information, so I'm assuming it's tracking pirated keys stats or something, for which you can't really blame Them (ooh no, not Them!).

But it's good to bash MS anyway...

Re:So?

[Junior J. Junior III]

Nope, I tried reading the agreement, and even that doesn't disable the WGA phone-homing. Back to the drawing board! I'm guessing I'll have to set up a rule on my firewall if I really want to stop this traffic...

Re:So?

[iminplaya]

The "madman" here would be anyone who thought that such nonsense was an enforceable contract.

Ca-ching! $50 million plus. Such madness! The solution is to block Microsoft until you find an alternative. To keep it really safe, run a live cd.

I detect hypocrisy

[suv4x4]

I can understand people not wanting WGA on their PC-s as it can cause issues on legitimate installations as well, in certain situations.

But sending back a little XML that you denied the EULA? Don't you detect hypocrisy here. You send your "identification" in the form of IP, browser user agent string and what not to virtually any site you visit, without "agreeing" to this every time. Why is nobody whining about this?

Having privacy and right to deny something is cool. But I think some of the most vocal opposition is simply using pirated Windows and not being honest about it.

I don't install WGA on existing (legit) computers as it doesn't help me with anything. I don't have any problem with Microsoft getting my "no" back though. In fact, I *want* them to hear my no.

Re:I detect hypocrisy

[Stumbles]

No... it's not hypocrisy at all and nothing to do with illegal copies, especially when your given the choice to say no. They don't really need to send anything back at all when when clicking no now do they. All they need to do is count those who say yes. In any event it causes even less trust in Microsoft when they lead you to believe the software will do as you ask when in fact it does not. There is no confidence.

Re:I detect hypocrisy

[*weasel]

Not only that... but you only get the WGA install from Microsoft's proprietary binary windows update apps.

They already know everything they care to know about your machine at that point .
It can't really spill any more of your private information. You just allowed them to do a full audit of your machine, for the express purpose of transmitting that information back.

When you see that WGA installation box, the update software just finished asking microsoft for the lastest drivers for each and every piece of hardware you have installed, any OS patches, MS software patches, the last client-scanning malware detection/removal tool, etc.

Re:I detect hypocrisy

[mwillems]

I disagree. When I send my IP to a web site, it is because I have chosen to browse there.

In the WGA example, on the other hand, one chooses NOT to do something, and yet data is sent. That is very different to browsing voluntarily to a web site.

Re:I detect hypocrisy

[deehoc]

To me it seems that when you use windows, you agree to their update system. When you update, and connect to their servers, it's protocol that when they send a request, say, whether or not to install WGA, they have to wait for a reply from you that says whether or not you got the information, not even if you said yes or no, just whether or not you got the request. If they don't receive an ack, they keep on sending that request until they know you got it. Now I'm no means a pro at this stuff, and am ready for the possibility of this getting ripped apart, but this is just the way that I understand it.IP's are thrown around all the time, and they need to be.

Re:I detect hypocrisy

[whitehatlurker]

You send your "identification" in the form of IP, browser user agent string and what not to virtually any site you visit, without "agreeing" to this every time. Why is nobody whining about this?

Because many of these people change their user agent string, use TOR and "what not" while browsing. I suppose that these are also the folks for whom firewalls will catch and optionally block this traffic as well, so they might be complaining out of principle. I'm not entirely sure I detect the hypocrisy.

I think your decision to vocally (so to speak) say "no" is a good one. I hope it is heard.

Re:I detect hypocrisy

[Todd Knarr]

Not quite. The Windows Update protocol should be:

1. I connect to Windows Update. They get some identifiable information.
2. Windows Update sends me a list of what's available.
3. I select what I want to install.
4. Windows sends Windows Update a list of what I want to install.
5. Windows Update sends me what I've asked for.

Note that nowhere in there should my computer be sending Windows Update anything about what I haven't asked for. It doesn't need to know that to send me what I did ask for, it's got no business sending that information without telling me it is or giving me the opportunity to say "No.". If Microsoft chooses to collect information it doesn't need, that's it's prerogative but that doesn't give it a "get out of jail free" card to avoid the consequences of that choice.

Re:I detect hypocrisy

[suv4x4]

I disagree. When I send my IP to a web site, it is because I have chosen to browse there.

In the WGA example, on the other hand, one chooses NOT to do something, and yet data is sent. That is very different to browsing voluntarily to a web site.

Just choose not to use Windows Updates, and problem solved. Just turn it off. Really.

Does that make you happy? I bet not, let's whine about how Microsoft can send your full system specification to Microsoft to assist for retrieving the proper updates, but OMG it can't send your "no" to their EULA, this would be so wrong!

Re:I detect hypocrisy

[Pantero Blanco]

It isn't "a little XML that [shows] you denied the EULA". It's a large piece of XML with several encrypted fields, which you can see here. . A message saying "no" shouldn't need any of that.

Also, a public IP address can't be used to reliably identify a single machine or OS installation.

Re:I detect hypocrisy

[14CharUsername]

I agree that windows update shouldn't send an info they don't need but given your steps they could simply check the list of software they offered you and compare it with the software you actually downloaded, and that would tell them all the software you don't want.

Re:I detect hypocrisy

[nurb432]

If i say no, its none of their business.

Having your IP and date/time IS identifying you. All it takes is a quick phone call to your ISP, and they can instantly have your address and name.

Re:I detect hypocrisy

[Hucko]

I am opposed to this, and I am running Ubuntu!
If it said "Can I tell Microsoft you didn't wish to install Windows Genuine Advantage" sure that would be fine. I would be less avid in discouraging my influencees to install a decent and reasonable O/S (They insist it is too hard as they ask me to solve problems with Windows. :s I now have a standard response. :)

If one says do not install, one means do not install. Users WANT to control the computer that said users bought! There should be no obligation to install/update/alter behaviour unless said behaviour is illegal or immoral (It is terrible that they are distinct differences.) and the only obligation would be to stop.

I do understand that I am displaying my ID the world, but it is part of my implied co-operation to be a part of the 'internet community' or whatever it is called now. Reading my credit card # in my pocket remotely without my knowledge isn't. MS can have my ip, not my hardware/software details. I don't mind people knowing who I am, I mind people being dishonest and sly with me.

My opposition to our Beloved Microsoft is because I love quality and morality. If they start behaving reasonably I'd only have a paradigm to argue for.

Re:I detect hypocrisy

[Jeremy_Bee]

I think the big point though is that this is actually illegal in a lot of countries. All of Europe for instance. It may not be a big deal to some, but a smart move on MSFT's part it is not.

To do this after all the antitrust troubles they have had over there, and then to hide it ....

Like you, I don't feel this stunt is particularly nefarious in origin but regardless of MSFT's intent, it just reeks of incompetence that they even allowed it to happen. For one of the biggest companies in the US to just ignore the laws of one of their biggest trading partners and assume that no one will find out about it can only be categorised as a dumb move.

A smart company would make sure they are in compliance with the law of the land in all their markets, no mater how much they hated it. It doesn't seem to me like it even occurred to anyone at MS that this might be illegal.

why I said TFA was slashdotted

[swschrad]

CGI overload message. this means server fart under load.

Report this to "StopBadware.org"

[Animats]

This should be reported to "StopBadware.org". StopBadware.org's definition of badware requires prior consent to send personally identifiable information to a site. This should be enough to put WGA on the Badware list.

Google is now flagging sites that have been identified by StopBadware.

StopBadware is run by law professors from Harvard and Oxford, with assistance from Consumer Reports. StopBadware is effective. They complained about the Jessica Simpson screensaver, which installed spyware in May 2006. The makers of that didn't listen. In October of 2006, a US federal judge shut that outfit down.

Re:Report this to "StopBadware.org"

[Blakey Rat]

A hardware profile of a computer isn't "personally identifiable." I would argue an IP address isn't, either, personally, unless you know for sure that it's static.

Re:Report this to "StopBadware.org"

[Todd Knarr]

I'd argue you're incorrect. As far as IP address goes, my ISP assigns them long-term enough to consider them permanent (typical is 2-3 years between changes) and ties that address directly to my billing information. It's personal information in the same sense my bank account and credit-card account numbers are: they don't in themselves reveal my identity but they're tied uniquely and directly to it and can be used to get it without my knowledge and consent. The computer information is the same: part of what's sent is the GUID assigned to the computer, which is intended to be unique to that computer and which is tied directly to information like my name embedded in word-processing documents and other information available to the same entity receiving the computer information. This is sufficient to let them tie that WGA data directly to my personal identity. At the very least it allows them to identify everything else they have that belongs to me, even if they don't know my name (yet). That's personal enough in my book.

Re:Report this to "StopBadware.org"

[Ash-Fox]

Warning: Your computer is currently broadcasting an IP address!

Re:Report this to "StopBadware.org"

[Todd Knarr]

Only if I want it to. If I don't, I've several ways of insuring that, while the receiving end gets an IP address, it's not my IP address. :)

Re:Report this to "StopBadware.org"

[taustin]

Since the program cannot possibly know whether or not the IP address is static, you've just argued that this is badware.

not surprised

[botkiller]

surpised? no. scared? not really. Laughing? A lot.

Re:So?

[value_added]

I see your "So?" and raise you a "Because!"

LOL. Sounds like conversations I had with my daughter when she was just short of kindergarten.

Why?
Because.
Because why?
Because ...

She usually wins the round.

Software that sends personal information about you back to its master when you say you don't want to install it is generally considered spyware.

The interesting bit. One generally associates the term spyware with smaller shady companies out for a quick buck. In this case, we're discussing a multibillion dollar corporation respected by business-types, so I imagine many would consider the term inappropriate.

On the other hand, given the incremental nature of the changes Microsoft has put into effect since WinXP was released, those who do object to the term spyware might very well be like frogs in a pot of slowly heated water. The choice of words has a tendency to define the terms of the conversation, so while you say spyware, the folks in Microsoft's marketing department are using words like genuine and advantage. No one wants spyware, but we all want the advantages of things genuine, don't we?

Explain, please

[Petersko]

"It is trivial for any malware to finagle with the HOSTS file on a Windows system, which is hidden in such a dumb obscure place (C:\winnt\system32\drivers\etc), a far cry from the self-explanatory /etc/hosts of every other goddamned OS on the planet."

Exactly why is this something that bothers you? If you're savvy enough to know what the HOSTS file is, then you'll know how to go about finding it. Like, say, a search on google or wikipedia. Or bringing up the XP help and support centre and typing "hosts file" in the search box. Name resolution comes up as the second of two topics, right after "glossary".

Why is /etc/hosts self-explanatory? It only makes sense to people who already know *nix. Everybody else would have to look it up, just like they'd have to look up the windows one.

With the wonderful array of problems that Microsoft presents you have many opportunities to nitpick about valid issues. This complaint is silly.

Re:Explain, please

[Petersko]

"I can understand putting it in the Windows/WinNT directory. I can understand putting it in the System or System32 directory in there. But the drivers directory?!? Does that make any sense?"

Well on linux the /etc directory contains all sorts of configuration information, a lot of which contains information that configures your drivers, such as the XF86Config file and soundconf. HOSTS can be considered an input into your network drivers, so it's not completely illogical to create the /etc directory under the drivers directory. The fact they put it somewhere other than the registry should make the *nix lover in you happier.

Re:Explain, please

[PitaBred]

It makes sense because all configuration stuff is either in your home directory, or in /etc. On windows? Could be a .ini in the program directory, or a .ini in you home directory, or perhaps a registry setting under some obscure key, or a random file in your %SYSTEMROOT%/system32 directory, or it could be system, or maybe just %SYSTEMROOT%, or...

Re:Explain, please

[Petersko]

"Several times I've had to manually modify the hosts file on both Linux and Windows systems, I've never had a problem finding it on Linux, but every time I try to find it on Windows I generally have to use Google (WHY IN DRIVERS?!?!?!)."

I replied a bit higher up as to why it's not completely unreasonable. But if you have had to look it up more than once then you're just not paying attention.

Besides, if you know it's under ..\Windows (and you should at least know that) then searching for files or folders named "hosts" under there using the standard search tool will bring up a grand total of two files, one of which happily is called "hosts".

Which part of "Trust Microsoft"?

[david.emery]

do you not understand (to be an oxymoron)?

      dave

firewall MS

[vparkash]

I'm no software guru but if you just firewall www.microsoft.com, wont it be a cure for all your problems?

Re:firewall MS

[TheZax]

I'm no software guru but if you just firewall www.microsoft.com, wont it be a cure for all your problems?

Not if it's trying to go to update.microsoft.com ;)

Re:firewall MS

[vparkash]

what would happen if we firewalled that too?

I deplore it!

[Anna Merikin]

What more can I say?

Re:So?

[LinuxIsRetarded]

Ever installed XP without any service packs? Do you know how many minutes it takes before the machine is pwn3d? IMO that's not a functional OS any more.

Come on, troll. Have you ever tried installing an old version of Apache without any patches? How many minutes before it's compromised? But wait- you would never install an old, unpatched version of Apache, would you?

Re:Do I have a choice on which button I click?

[digitig]

Anyway, here in Canada, an EULA is non-binding (in theory, nobody has the money to test this in court) because you have to pay before being able to read the contract. Really? Here in the UK I can go to microsoft.com, search for "EULA" and read lots of EULAs for software that I haven't paid for. Don't tell me Canada has followed China in blocking politically undesirable web sites!

Re:So?

[cfulmer]

(1) Yes, EULAs are generally enforceable. All you need is the chance to say 'No' before being bound. Heck, check http://yro.slashdot.org/article.pl?sid=05/01/20/13 34256/
(2) To what statute are you referring? To my knowledge, there's no general reason you can't sign away privacy rights. (There are contexts where you can't, but in general, you can. Heck, check your employment agreement -- you may have signed them away there!)
(3) Statute does not always trump contract. People often waive statutory rights in a contract.

This is not good

[jifl]

That would be true if it was just a message saying "Someone said no". But it doesn't. It includes a variety of information to uniquely identify the machine.

"That's ok, it's not personally identifiable" you say? Well, indeed it does not contain your name, address, phone number, bank account details and gender preferences directly in the message, no. But all it takes is for the user at some point to provide their personal details to Microsoft or any affiliates of Microsoft, or vendors with suitably worded contracts with Microsoft, using some program that also sends the machine's unique ID, and now you can match someone to the computer. Not just in future, but with all anonymous (or so you thought) dealings with Microsoft in the past.

Sign up for MS Passport? Register for an IE beta? Your personal details could easily have been sent along with your machine's unique ID, and now any other information stored by MS for that unique ID can be matched up with your personal information.

Re:So?

[grylnsmn]

I see your "So?" and raise you a "Because!"

I don't know. He's on third. And I don't give a darn!

Answer:

[Overzeetop]

Delist them from the market.

If you really want to punish them, revoke their corporate status.

Re:Answer:

[Opportunist]

That's exactly the problem, it is really hard to "fine grain" the punishment. It's like with the advertising commitee here, who should be observing that product placement doesn't get out of hand. They have only 2 options: Telling them to not do it again (i.e. slap on the wrist and shaking fingers) or revoking the broadcasting license. One is too little, one is too much.

You will not find a judge who'd actually issue a verdict that a company has to be disbanded or has to stop making business. Simply because it will never hold in revision (and that they go into revision is a given, it's pretty much a death penalty against a corporation). It's simply "too much" punishment for a rather minor crime.

Also, don't forget that with the company you immediately also punish its employees who face unemployment when their company ceases to exist or at the very least ceases to be able to do business. How do you warrant punishing them? It's hardly a trivial issue to revoke a corporation's status.

Capture IP addresses from large companies?

[jamiebecker]

Well, they obviously get the sending IP address, so how about a reverse hostname lookup on the IP address to determine that it's a "Global 2000" company? Perhaps this information could be used as "evidence" to incite an invasion^H^H^H^H^H^H^H^H audit?

Re:Capture IP addresses from large companies?

[FoamingToad]

Nice idea, but the number of such companies that give the user control over the installation of WGA will be pretty much zero.

Whether WGA will be installed on such a corporate desktop is debatable - none of the WGATray binaries appear to be running on my corporate machine. There would be little benefit to a large corporation to implement this update, particularly if (as you suggest) such a company had a number of illicit license keys.

Add to that the suggestion that large scale rollouts of updates would tend to be deployed via WSUS or SMS and would run silently, and the user would simply not be given the opportunity to cancel the update if it was deemed important to the infrastructure.

Re:So?

[ari_j]

The difference is that you can directly install a new, fully patched version of Apache. You can't directly install a fully patched version of Windows. Instead, you have to install what you have on CD, which will at best be the most recent service pack not including patches released since then but is more typically an older service pack or the original version of the OS, and then patch it while it is running. When I install, for instance, Debian's 'stable' distribution, I have the option of doing so using packages from the internet, which means that there is never a point at which my system is running an old or known-insecure version of any piece of software.

Re:So?

[644bd346996]

Apache is not an operating system. And you are about the last person to be calling somebody else a troll.

The simple fact is that for most of the time it has been on sale, Windows XP has been too insecure to install out of the box. How long did it take before SP2 was included by default in the retail copies? If the average time to rootkit installation is less than the time it takes to download the necessary updates, then the OS is insecure.

Re:So?

[Dregnus]

Ever looked at the length of some of these EULAs? For instance, Claria Corporations GATOR, in one version of its EULA, did disclose that the software was "advertising supported". This EULA was six times than the United States Constitution. Most people I know don't even know the main ideas of the Constitution, but the average consumer is expected to fully understand each and every EULA on software they install?

Re:So?

[rainman_bc]

It seems to me that it is unethical to have a consumer product license that is unreadable/unparsable to an average consumer. The "madman" here would be anyone who thought that such nonsense was an enforceable contract.

The problem here is that courts have ruled on this in the past... At least in Canada, if you have the ability to read you can read the terms of the contract yourself or pay a lawyer to explain it to you.

Not being able to understand a contract is not grounds to get a contract thrown out...

Although like someone else has pointed out, the EULA in Canada is untested yet. I'd tell microsoft to lick my balls if they ever waved an EULA in my face. Hell they can lick my balls anyway ;)

Re:So?

[phorm]

Microsoft releases an OS that's broken and tells you the only way they'll fix it is if you'll subject yourself to their privacy terms. Not freaking cool. My copy of Windows is paid for, but that doesn't mean I want them invading my privacy.
Ever installed XP without any service packs? Do you know how many minutes it takes before the machine is pwn3d? IMO that's not a functional OS any more.

Damn straight. What if Dell started telling people they had to sign a new contract before they could get a replacement on their defective batteries. What if Ford told you that you had to sign an EULA before you could get a fix to a factory-recall vehicle defect.

I can understand EULA for things like newer versions of components (upgrades for media player, etc), but not for bugfixes.

Re:So?

[Zonk (troll)]

WGA != Windows Update. True. However, you can no longer use Windows Update without installing both WGA and the wgatray spyware.

Any software that phones home is unacceptable.

Re:So?

[rainman_bc]

Apache is not an operating system. And you are about the last person to be calling somebody else a troll.

Are you responding to me or the post above you?

My post never mentions Apache and the post above you never uses the word Troll. I'm so confused!

Well

[Anonymous Coward]

At least they send out the cpu ID. So they know how many copies you owned and how many you've installed. For example, I am sure lots of us already experienced when XP trys to reinstall on other machines, hardware configuration changes will lead to re-enter the 20 digits serial. If it fails (WGA), you just have to call in Microsoft to get a new code. I did that several times already. It seens like WGA did keep track on serial and your CPU ID that hardcoded into your cpu. That way they know how many copies of windows you have. which machine you've installed, and which you've tried to reinstalled.

M$ windows color applet also phones home

[TheGratefulNet]

surprised me!

this is an applet that photo guys care about. it lets you set up color profiling (color managed workflow) on 2 diff monitors on a single video card (assuming dual LUT engines). this is the only way to get 2 color profiles installed, one per display.

damned thing tried to connect to M$ when I booted and had komodo firewall installed.

I added 'never allow' to the list - but still - this is going WAY too far.

(similarly, I'm building a home theater pc and there is a lot of software that seems to 'want' a net connection even if it makes no real sense in that application. sigh.)

Adobe? Interesting.

[SanityInAnarchy]

But in all honesty, RealPlayer is just your fault for letting that shit on your system. My Windows-loving, open-source-mocking friends actually discovered VLC before I did, and one of the reasons they tell me is "RealPlayer behaves like a virus."

MS knows when you PC is on?

[brunascle]

i've noticed that whenever i try to upgrade to SP2/etc on a new install of XP, it will fail if any other PC using the same CD key is online at that moment. but once i unplug the other PCs, the upgrade works fine.

assuming this isnt a fluke, that really frightmens me, the fact that MS knows when any of my PCs are online.

Re:MS knows when you PC is on?

[drew]

Hmm. These PC's wouldn't, by chance, happen to be on the same network, would they?

Re:MS knows when you PC is on?

[brunascle]

nope, both are connected to our ISP through the same hub, but they're not on a local network.

keep in mind, though, that i havent done extensive testing of this. i've only reinstalled 2 or 3 times in the past year or so, but it happened every time.

anyone else seen this happen?

Re:MS knows when you PC is on?

[Dynedain]

both are connected to our ISP through the same hub

That probably means they're on the same local network (unless you have a mess of firewalls/routers in between them).

Windows is probably doing a NetBIOS check for the serial number. This isn't anything particularly new or exciting. Apps on Apple operating systems have been doing this same thing for years (even predating OSX by quite some time) through the AppleTalk protocol.

Tag

[Anonymous Coward]

This deserves a "duh" I reckon.

I always pull the ethernet plug and disable wi-fi if I know there's activation built in. Can't trust these buggers.

It has nothing to do with movies

[Moraelin]

I haven't watched "The Corporation", but nevertheless I too think that "they're out to make money" should _not_ be a wildcard excuse for everything. Making money is good and fine, but ultimately it's just the incentive we give some people to make them work better for the benefit of society as a whole. Briefly it's a means, not an end.

Turning that on its head and making the means sacrosanct, even at the expense of acting against the very purpose it was supposed to serve... well, is as stupid as forgetting which is means and which is end in the army's using weapons. We let them use weapons to defend us all, not as a means in and by itself. If any army started shooting random people on the street just because they think the whole purpose is to use their guns, you'd probably have no problem understanding why that's contrary to the whole purpose of that army. But when a corporation does the same swapping of means and ends, half the population seems to just assume that, sure, if it's for the purpose of making money _of_ _course_ it's normal to cheat, lie and worse.

Re:It has nothing to do with movies

[Dilaudid]

Money is not just an incentive. It's a means of exchange, a store of value and a unit of account (i.e. it tells us what things are worth). Corporations are valuable to us because they produce things we want - first and foremost. Secondly because they employ people and make profits for shareholders, and lots of other reasons like them doing R&D.

In short, I'd say if you don't like corporations, and Microsoft specifically, don't use its products. The reason you are walking into the barrel of a gun, to use your metaphor, is because you chose to install a Microsoft product on your computer. And there are alternatives.

Re:It has nothing to do with movies

[Moraelin]

Money is not just an incentive. It's a means of exchange, a store of value and a unit of account (i.e. it tells us what things are worth).

Nothing against all that, but I wasn't talking about money generally, but about the "they're out to make money" excuse. The act of making money is the incentive I'm talking about.

Corporations are valuable to us because they produce things we want - first and foremost. Secondly because they employ people and make profits for shareholders, and lots of other reasons like them doing R&D.

Nothing against that either, but:

1. That's exactly the kind of thing I'm talking about. That is the real goal: that they do that for the rest of society. Just making money for the CEO is not the goal. So "they're out to make money" should never be taken as an automatic excuse for anything and everything. The real criterion and end is how well they serve us, as a society. Making money is just a means to that end. It's not the end itself. If money becomes the goal itself, and it comes at the expense of acting against the interests of society, then I do believe that that shouldn't be tolerated.

2. I don't think even that excuses unethical behaviour. There are ways to make money, produce stuff, employ people, and do R&D without being destructive in the process. (I don't think Enron created more value than companies which didn't break the law, for example.)

3. I don't think it should absolve anyone of personal responsibility. Ultimately a corporation isn't some AI, but _people_ taking those decisions. Sure, we do give them some amount of shielding from such stuff as market fluctuations, bad/uninformed decisions, etc, and it's perfectly fine that way. Noone is proposing to send someone to jail or auction their house just for going bankrupt, or anything. But ultimately they do bear the responsibility of those decision. If a decision wasn't just bad or uninformed, but _malicious_, then at the very least we should be aware that it's a human there taking it. He's, at best, an asshole. It's not some nebulous corporate entity whose decisions appear out of nowhere, it's a human asshole who chose to act that way.

Same, if you will, as we don't blame the car for running someone over, we blame the human who was drunk at the wheel. Or we don't blame the army as a whole and leave it at that, if a squad decides to shoot a bunch of villagers, we actually go after the ones who did it and after the officer who should have stopped it. Being part of some big impersonal entity does not absolve one of responsibility for one's own decisions and choices.

In short, I'd say if you don't like corporations

I never said I didn't like corporations or capitalism. There are plenty who make their money without being malicious. What I don't like is simply taking the "they're just out to make money" as some blanket excuse to do anything and everything, no matter how screwed up and immoral.

don't use its products. The reason you are walking into the barrel of a gun, to use your metaphor, is because you chose to install a Microsoft product on your computer. And there are alternatives.

Cute, but it's a return to self-styled vigilante justice, and it just doesn't work. It worked like that in, oh, say the stone age, but in the meantime we discovered such concepts as "laws", "justice", etc. If someone acts against the interests of society, then I'd rather society regulated it via the modern and efficient means, rather than each member fending for himself.

Re:It has nothing to do with movies

[Dilaudid]

Can't see anything to disagree with here. Good point.

Re:So?

[rainman_bc]

IANAL first off, but I have had disputes in the past with employers that made me sign bogus agreements - stuff like signing away accrued vacation days in order to continue employment. I took those up with a lawyer who laughed off the agreement and told me to go ahead and sign it because it's unenforceable anyway and you can sue their asses off plus interest and court costs.

(1) Yes, EULAs are generally enforceable.
It's still not tested yet here in Canada where I'm at. From what I've understood, Canada and the UK share similar common law, and a contract only exists where the money has changed hands. Under contract law the Ginger Beer case would have failed because there was no contractual relationship between the manufacturer and the purchaser of the soda. EULA != Contract as far as English Common law is concerned.

(2) To what statute are you referring? To my knowledge, there's no general reason you can't sign away privacy rights.

See my point below about statutes trumping contract. Again, I'm not certain about privacy rights in the US, but in Canada there's Privacy legislation that prevents that.


(3) Statute does not always trump contract. People often waive statutory rights in a contract.


This article from Yale would suggest otherwise:

This article from Yale Law seems to refute your assertion

*In his best E.T. Voice*

[Arceliar]

P.C. Phone Home

Hard Drive Serial Number Gives Up the Game

[Master of Transhuman]

This is really the kicker.

Why the hell would Microsoft want the Hard Drive Serial Number just to indicate that someone didn't want to install WGA?

What possible use could that information have in connection with why someone refused WGA - except to be able to IDENTIFY that machine in the future for some OTHER nefarious reason? Obviously Microsoft expects ANYONE who refuses WGA to be intending to use a fake Windows key in the future, if not now.

In other words, Microsoft is TAGGING EVERYONE who refuses WGA as a potential pirate well in advance of their being so - or their being so at all.

I mean, how much more obvious does it get?

They may not be identifying YOU personally - but they are definitely identifying your MACHINE individually.

Which is pretty much the same thing depending on what ELSE they have done or may do in the future.

People need to realize what utter ASSHOLES the management who runs Microsoft ARE. These guys make the jerks at Enron look like Orphan Annie.

And STUPID to boot! I mean, no matter WHAT they've done over the years, they STILL have millions of pirate copies running around. So they spend all this effort dreaming up new activation and detection methods - for what? It's all been an utter waste of everybody's time! Windows Vista has had its activation cracked within a few months despite all their efforts.

Way to go, Bill, you paranoid, greed-sucking moron!

Why not try concentrating on producing an OS that doesn't FUCKING SUCK rather than worrying about nailing down every goddamn dime from everybody's pockets?

If the goddamn OS didn't cost $500 - and wasn't an illegal monopoly to boot - there wouldn't BE that many pirates out there. Not that it matters. Bill doesn't care about "pirates" - he just wants control of everybody's money regardless. He's not trying to prevent "pirates" - he's trying to nail down control of each and every individual customer so as to make sure that customer pays him every single dime HE thinks he's OWED by the world.

"You hobbyists steal your software."

That's Bill's defining mantra.

Get this asshole out of business. Now, please.

Re:Hard Drive Serial Number Gives Up the Game

[PenguinGuy]

Makes me glad I stuck with Windows 2000. It does everything I need and I don't see any reason to upgrade

You're just a little bit TOO cynical

[cbreaker]

You could look at it that way, but I think that's kinda a warped view of the GPL.

BSD license is all well and good, but if it wasn't for the GPL there wouldn't be so many people involved in development of GPL software. Your view does have some merit, but not because of selfishness. Novell doesn't want Microsoft to take their code, put it in Windows, and blast Novell away again. Red Hat doesn't want IBM to secretly switch AIX to all Linux code, and sell it for a mint, and never give anything back. So, that's understood, and everyone can feel free to develop the code base without worrying about it. Your payment for being able to use everyone else's work (and saving a lot of money by doing so) is to also release your improvements to everyone else. So your PROFIT is the improvements you get back on the code you wrote.

It should be noted that the big companies pushing Linux actually do turn a bit of a profit, in terms of cash.

The GPL *is* about supporting the community. If a piece of software is community developed, that same community (as well as anyone that uses it) really wants the software to improve. If ACME Corporation wants to use the software in their product, because it would be a LOT cheaper then developing in-house, they'll take it, improve it, and package it with their product. In the meantime, they'll also make their improvements available to everyone else. That's their payment for saving millions in licensing or development. How is this selfish?

If you don't want to release your code under the GPL, then simply don't. If you don't LIKE the GPL, then don't use GPL code, it's as simple as that. Or, are you pissed that you can't just do whatever you want with someone else's work?

The GPL, in fact, does allow a lot more freedom for the code you write then general copyright laws allow for. It's obviously a lot more open then closed-source. Why must you compare it to the BSD license? (Extra Points: If the BSD License worked so well, why did it take the GPL to bring open source software to the forefront? Explain and cite references.)

Re:You're just a little bit TOO cynical

[mungtor]

"If you don't want to release your code under the GPL, then simply don't. If you don't LIKE the GPL, then don't use GPL code, it's as simple as that. Or, are you pissed that you can't just do whatever you want with someone else's work?"

If the code is as free as it is supposed to be, the issue of who's "work" it is should be irrelevant. If the GPL code is so good, there should be no way I could use it in a for-profit project since I couldn't add any value to it. The GPL restricts people with a good idea (and not me personally) from building something worthwhile on a larger body of work by removing the profit motive. Really, that may be the only way a small shop can afford to open up.

Big companies pushing Linux make money from support, which is a much different business model for a large corporation than a small one. Linux support is a good business to be in because a) people mistakenly believe that since Linux is "free" it will cost them nothing to run, and b) there are a lot of bugs and/or opportunities for enhancement.

"The GPL, in fact, does allow a lot more freedom for the code you write then general copyright laws allow for. It's obviously a lot more open then closed-source. Why must you compare it to the BSD license?"

The fact that the GPL offers more freedom than general copyright law is interesting, but I think the the comparison the the BSD license is more relevant since it is another open source license. BSD licensing allows everybody to improve their products (look at the current MS TCP/IP stack) and has the possibility of making all products better. The GPL only makes a subset of products better.

"Extra Points: If the BSD License worked so well, why did it take the GPL to bring open source software to the forefront?"

I think there's a fundamentally incorrect assumption in that question. The GPL has been around a fairly long time, much longer than most people have been paying attention to it (V1 was 1989). I think Linux pushed open source into more of the spotlight since it was GPL'd and was released around the time that computing became a commodity item. I've been aware of and installed GPL'd software for quite a while, before Linux was really on the radar screen of the general population. Linux distributions came with a huge number of pre-compiled GPL'd applications, most of which were required for getting anything actually done with the machine. That caused people to really pay attention to the GPL more than anything else.

Re:You're just a little bit TOO cynical

[Dun Malg]

If the code is as free as it is supposed to be, the issue of who's "work" it is should be irrelevant. If the GPL code is so good, there should be no way I could use it in a for-profit project since I couldn't add any value to it. The GPL restricts people with a good idea (and not me personally) from building something worthwhile on a larger body of work by removing the profit motive. Really, that may be the only way a small shop can afford to open up. You need to educate yourself on the purpose of the GPL, I think. "Profit" has fuck-all to do with it. The GPL is about enriching the commons, not small shops becoming successful. GPL is not the same as Public Domain. People deriving proprietary software from his public domain original source is what prompted Stallman to come up with the GPL in the first place.

Besides, you can still secure private licensing agreements with the authors and make proprietary software--- but oh, that's right: your small startup can only make a profit if everyone gives them "free beer" to sell....

Re:You're just a little bit TOO cynical

[senatorpjt]

BSD licensing allows everybody to improve their products (look at the current MS TCP/IP stack) and has the possibility of making all products better.

How has MS improving their TCP/IP stack improved any other products? It doesn't allow anybody to improve their products if they don't have to release their modifications.

Re:You're just a little bit TOO cynical

[Hooya]

i like to think of GPL as the block party. the whole block is invited - come as you are, or bring something if you want. feel free to eat as much as you'd like. just don't expect to show up and take all the food home with you depriving everyone else. so yes, it's not *totally* free, there's just one restriction - you can't hog all the food after the rest of the block spent time preparing it.

analogies are just that - analogies. perfect for setting up a straw man. but that's kinda how i like to think of it. i have this mental image of a tv ad with linus, RMS, Alen Cox and a few hippie/hacker types and IBM suits (in suit and tie) having a block party. i think that would make more sense than the 'boy growing up' ads IBM put out a few years back.

Re:You're just a little bit TOO cynical

[mungtor]

MS improving hasn't improved any other products. BSD licensing their stack in the way that they do allowed MS to improve their product, as well as anybody else who chooses to use it.

Re:You're just a little bit TOO cynical

[mungtor]

No, I know that profit has nothing to do with the GPL. That's why almost all work on GPL code is done by volunteers and the quality of most GPL applications is marginal at best. Occasionally there are some real gems, but they are the exception. The primary purpose of the GPL is to distribute an ideology on people under the guise of "freedom". The ideals that it promotes pretty effectively stops anybody except the biggest players in the space from having any incentive to do anything constructive, and those players (IBM, Redhat, etc) are selling support, not software.

Securing private licensing agreements with the authors of GPL'd software is nearly impossible unless the program is so small that you could re-write it yourself anyway. You aren't going to be able to get 150 individual developers all over the world to agree on anything, much less using their code in a proprietary product. You can argue that's a problem with the developers and not the GPL, but another license would prevented the issue from arising.

Re:You're just a little bit TOO cynical

[cbreaker]

No, I know that profit has nothing to do with the GPL. That's why almost all work on GPL code is done by volunteers and the quality of most GPL applications is marginal at best. You speak volumes here about your bias.

No profit in GPL software huh? Tell that to TiVo. Or IBM. Or Novell. Or Sun (ever heard of Java?) or most web sites that use almost all GPL software? Nobody uses PHP to make a profit. I've never once heard of a successful web site running on Apache.. Ohh yea. I forgot. MOST web sites run on it!

Let's not forget the app side. OpenOffice is very good, and many companies and municipalities are embracing it. (I dare you to find a feature on MS Office that's not available on OpenOffice apps.) Amorak is one of the best music players I've used. Ever heard of FireFox? Word is, they make money. But.. HOW? They're GPL!

You're just an ignorant bastard that tried to install Linux and couldn't figure it out. I'd bet you my TV that you own several linux-powered devices and might not even know it.

Re:You're just a little bit TOO cynical

[senatorpjt]

I guess I wasn't looking at it from that direction, but if MS improved the stack, then it doesn't improve any other products. If the stack was GPL, it would improve everything else that used it as well.

I'd definitely like to see a license written somewhere inbetween the GPL and the BSD license - where the code is free to use in closed source, but changes to the code must be given to the original author. I don't know how/if it could be done legally, since the border can be kind of vague (the line between incorporation into a separate work, which would be allowed, and improvement of the code in the context of its original use)

Re:You're just a little bit TOO cynical

[mungtor]

Well, you're a retard, and you've lost your TV (assuming that I'd want it).

If you want to pull your head out of your ass, you'd look up the fact that Apache doesn't use the GPL for theit primary license. They use the Apache license, which is an OSL-approved license, but NOT THE GPL. They realize how fscking ridiculous the GPL is and how much anybody who actually understands it should oppose it.

And, you're not understanding that IBM is making profit off SUPPORT on shitty GPL software, not writing GPL software.

OpenOffice frankly sucks compared to MS office. Better now, but still only 80% there. Features? Quick, unencrypt a .xls file in OpenOffice even with the correct password. Ohhh.. unfair? Fine. Load a .doc file without fucking up the table format. Yeah, I thought so.

Firefox is OK, but there are better options out there (Seamonkey, Opera) and the only reason they haven't been exposed as the bug-riddled ham-fisted morons they are is because they have a 0.1% market share compared to IE. Nobody bothers to hack FireFox because there's no install base. And show me any money they make that isn't PR donations from companies trying to cuddle up to open source for the geek cred. Yeah, yout can't.

For the record, I have a Zaurus, know that my DVR runs Linux, have installed Debian on Sparc, and have compiled Gentoo from Stage 1 on both Sparc and x86. I've run RedHat since 5.2 when all I had was an IPX. Still you miss my point....

Free software enriches all. Given. The GPL sucks because it discourages people from creating truly free software. Adopting the GPL is literally "drinking the Kool-Aid". It sounds good if you haven't been paying attention, but is ultimately fatal.

What kind of TV do you have, and where can I pick it up? Actually, don't bother. I'm sure that it's a GPL TV, which means that it's 13" B&W, and only gets VHF channels. 20 years behind the curve, but "free".

Re:You're just a little bit TOO cynical

[cbreaker]

Why do you bother with GPL software when it's so "shitty?" And are you trying to impress me with your l33t Gentoo skillz? A monkey can install Gentoo from stage 1; they have enough step-by-step guides to drive an AA member to booze.

You know that Seamonkey utilizes the Firefox codebase? Whatever, it all sucks according to you. I mean, Firefox is just OK.. it's only become a household name in three years. If it wasn't for the shitty GPL Microsoft could have taken all the code and made it a household name in two.

You go on to complain that OpenOffice "sucks" because it can't open the very much obfuscated document formats from Microsoft with 100% accuracy. What are you going to do next, blame rape victims for being raped because they wore provocative clothing? Still, you don't answer the real question, which was *what can OpenOffice not do that MS Office can*?

Linux has always had IP support. I have no idea what kind of shit you were smoking when you installed RH 5.2 and thought it only had support for IPX? Are you fucking kidding me? I mean, IP is older then IPX you know that right? Shit, you DOWNLOADED Slackware 1.0 from FTP. (Hint: FTP is an IP service. Another hint: Slackware 1.0 was released years before RedHat 1.0.)

But anyways, the GPL frees the software, not YOU. The GPL allows you to do whatever you want with the software, except make it less free then when you got it.

I like the GPL, obviously. I won't say that I don't see the merit in a BSD-style license, and I wish a license like that could truly work on a wide-scale. But, I don't believe it can. I believe you need the GPL to ensure that the software remains free - that it improves for the community, that it enriches everyone. The GPL has proven that it works. I really don't understand how someone can ignore the fact that GPL software is wildly popular and is being both used and developed by some very large firms? Nearly of the big GPL software suites is developed by paid programmers.

I really shouldn't argue with you, because you can't win an argument with an ignorant man. I mean, seriously man. You can disagree without inventing complete bullshit to bolster your claim. There's valid reasons for preferring BSD style licensing. Can't you at least admit that you can see the other side of the issue as well?

ps. It's the shitty 52" Aquos LCD TV. It probably runs Linux - almost everything else does now a days. Especially because it's so shitty. Too bad it's hooked up to my shitty PS3 which runs shitty Fedora.

Re:You're just a little bit TOO cynical

[cbreaker]

To tell you the truth, I prefer the LGPL over the GPL for most cases, but I'll take the GPL over the other alternatives out there. (I think you should be able to link to binary GPL code such as libraries and other software with your own closed-source software. However, I do see a dilemma - if you wanted to, you could build a closed-source program built entirely on "binary GPL software" without giving anything back. So I guess it's a good thing that the LGPL is generally limited to system libraries.)

Your idea about releasing the changes back to the original author presents it's own set of problems, and really doesn't do anything to benefit anyone. I mean, if you wrote code, you can release it under the GPL, and also another license that allowed for that style if you wanted to. I don't see the point. It wouldn't be much different then the GPL.

The point that a lot of people seem to miss (not saying you are one of those people) is that you don't have to release a complete copy your software, download-able with documentation, on the Internet. You really only need to make available the changes you've made. You can write software based on GPL code and sell binaries in the stores. If someone wanted to use your changed code and re-build your software package, the could do it, but you don't have to. Most people DO make their software available, though.

It's just a new way of developing software and it does work. Maybe OSS/GPL has been so successful is because it's the only way to compete with Microsoft. Maybe it's because there's a lot of talent out there that wants to contribute. Maybe it's because the resulting software is better.

Re:You're just a little bit TOO cynical

[mungtor]

OK, I was in a really bad mood last night since there was a funeral this morning for the 23 year old sister of a friend of mine. I was way over the top. Sorry.

I can see the reason people like the GPL, but there is nothing that you can do with GPL software that you couldn't do with BSD-style licensing. The GPL is more restrictive than BSD style licensing, and I think it hinders development of some really great software in the same way software patents kill development. The GPL stops me from taking something like OpenOffice and working really hard on it and trying to sell it myself for $9.99 a copy with my improvements. Yeah, I could link in non-GPL code and then have to distribute the source for all the GPL stuff, but that's a pain in the ass.

I think that your view gets more code out there, so there will be some better code developed. I think that allowing people to close the source again and try to create something for profit more easily would result in more polished products. You have to admit, compared to most commercially produced software GPL produced code lacks polish and documentation. One of the major reasons for that, IMO, is that documentation is not fun. You have to pay people to do it, and in a lot of cases there isn't the money available to pay people for that.

Still, most of your big shops that are paying people to write GPL code are making money supporting the code, not selling the product. That's a big difference. I think it's an important one to recognize too. It makes it harder for smaller organizations to get in the game.

Anyway, keep your Aquos. I'm going DLP projection next. Sorry for being an asshole.

But you DID choose to run windows

[cybrthng]

Its not like someone tied you up and said "run windows you stupid fucker" and held you at knife point and made you bleed yourself to death if you didn't authorize WGA to run.

Re:So?

[thephotoman]

Oh, that's our shortstop.

Now, if you would please tell me, who's on first?

Maybe I'm misunderstanding something here, but ...

[Keeper]

Isn't WGA validation required to download non-security updates off of the Microsoft website? Meaning if you refuse to run WGA you are not allowed to download non-security updates? Shouldn't your refusal to run WGA send a "user refuses to run WGA" notification to the website so that it does not allow you to download those non-security updates (you have 4 states that need to be tracked: "new" machine [send user to download WGA stuff], user refuses WGA [tell user they can't download xyz because WGA was refused], user passed WGA [let user download stuff], user failed WGA [send user to priracy reporting site])?

Where's the fire here?

Re:So?

[cfulmer]

First of all, a 1941 law review article is awfully slim authority for the proposition that people cannot waive statutory rights. Here's a counter-point: the contractual waiver to a jury trial or even to a trial at all (in the US, a contractual provision specifying arbitration is legal.) In a corporate context, stockholders can waive their statutory right to notice. Heck, many liability releases are just waivers of statutory rights. There are also a variety of rights which cannot be waived--the minimum wage, for example.

Sorry for the US-centric post. I don't know anything about how Canada deals with EULA enforceability or privacy law. I do suggest that the US EULA rule is sound: if you are given notice that the manufacturer only wants to deal with you on certain terms and you are given the chance to reject those terms, then you ought to be bound when you accept them.

I have also seen overreaching employment agreements which contain unenforceable clauses. But, some are enforceable -- I was thinking of clauses that allow, for example, the employer to go through your email.

Original article

[juct]

You might want to read the original article WGA notification just doesn't stop by heise Security instead of the gibberish google translation of the german version ;-).

Re:So?

[Ciggy]

Has the validity of an EULA ever been tested?

No idea, but this bloke might just be trying it.

In the end, it does not matter.

[WindBourne]

MS owns the software, you do not. It is what you agreed to. MS has always done this and will continue to do more. If they stop in one place it will pop up again. The simple fact is, there is truth in saying that you are owned. Whether it is is by MS or by a cracker (from any number of avenues on the windows platform), you are till owned.

Re:In the end, it does not matter.

[Pofy]

>MS owns the software, you do not.

No, they hold the copyright to it, that has nothing to do with ownership.

Re:In the end, it does not matter.

[Pofy]

You get ownership of it when you buy it in a shop (or whatever other way you aquire it). Demanding that you should give the software back in a contract offer (that in many countries have no requirement for thw user to accept) in order to give you basically nothing back but prevent the use of your program if you do not accept the contract is really not something that is supported by contract law in many countries. You could argue the contract is part of the purchase, but then you end up conflicting with consumer sale and consumer contract term laws that similar void, not the contract but the term in many countries as well. So general statement that Microsoft owns the copy of the software you have doesn't work out many countries. Of course, in the countries it DOES work in, you may ask how it comes you are in a possession of something someone else owns. Is it a loan? Do you hire it? Some other way of possessing something someone else owns? WHat was the ownership status prior to the agreement acceptance. Who owns the copy before you install and so on? Feel free to tell the details about your country since it seems to be one of those were either forcing someone to give away something they own thorugh a contract offer (and in case you don't accept the contract, they are allowed to prevent you using what you own). Since you refer to the acceptance of a contract is what gives up the ownership, that seems to be the case in your country so the other possibilites would not apply. It would be nice to know how the laws on contracts demanding onwership transfer works in your country.

Re:In the end, it does not matter.

[pnutjam]

Actually, since my software is a perfect duplicate of their software, made by me on my machine, how can they own it? I owned the blank CD, and all the equipment reading the "CD they own".

Re:In the end, it does not matter.

[den479]

My understanding is that with xp & vista you are not buying the software only a license to use it. It still belongs to MS

Re:In the end, it does not matter.

[Pofy]

Buying and ownership has nothing to do with use, they are not related. Ownership (of copies of a work) is not related to the use in itself. You can use something without owning it and you can use something and also own it. Some countries has copyrigth laws with varying requirement for USING a work although many if not most does not. Regardless of if you get a contract/license to use some work, you still need to get hold of a copy of the work to actually use though. Claiming that you just get a license to use a work would still raise the question how you would then get the actual copy to use your license with. Is it something you hire or loan? Is there some contract for that? If not, how do you come in posession of the copy? Of course in most countries in the world, you do in fact buy copies of software (and thus becomes the owner of those copies). There might be additional contractual issues with a purchase, but that doesn't change the ownership. YOu may also like to look at the sales law of your own country which would define and deal with sales and ownership changes. Just because someone claim it is not a sale when you enter a shop and pay money for a chair you bring with you doesn't mean it was in fact a sale and that you are the owner of the chair. Although appearantly in some countries, it is OK for the seller of the chair to later come and demand you agree to give the ownership of it back if you want to sit on it.

Re:So?

[HermMunster]

Their active x control installation has nothing to do with the WGN installation and the cancellation of it. The "activex" control is just the tool that allows them to invoke the WGA process. Even if you agreed to install it, you didn't agree to let Microsoft (via the cancellation of the installation of a different program) send information about your computer back to their location. When you choose to cancel you choose to NOT allow them to collect and redirect that info to their location. That's the purpose of cancellation.

The use of WGA/WGN is a violation of your privacy and it is similar to a police action. Your computer is an extension of your home and to allow Microsoft to put WGN on your computer is akin to allowing them to put a camera into your home to monitor you. Just because they don't get any physical pictures doesn't mean the process isn't the same.

This is a non-governmental private entity taking a police action against you, even tho you are a legal owner of the product, by monitoring your computer (hence your home). The purpose of the WGA/WGN is to collect information in order for Microsoft to update their database. Everyone knows this deep down. The more of these records they have the easier it is for them to identify pirates. It is unethical to collect that when tell them that you do not want them to make you a participant.

If they collect information without you giving them permission in advance then they are in violation of several state's laws. Microsoft has been sued in both WA and CA over this being spyware. When they collect information even if you so no, it is doing the same thing as a spyware program is doing--sending information about you without your knowledge.

You people need to get it through your heads that your computer is an extension of your HOME. Period. No ifs, ands, or buts. That's what your computer is. Microsoft is not entitled to do anything that is not explicitly permissible under law just because they are the OS. Keep in mind that Microsoft is the type of organization that will continue to do this sort of thing until they are told to stop. You tell them to stop by asking your Congressman and Senators to put and end to this sort of behavior. Write letters to them and let them know you are unhappy. They'll get the message.

Microsoft is the kind of company that knows they have all kinds of cash to throw at lawsuits, etc., and they even have money for fines. But when there are laws enacted that send these people to jail then it will stop.

They are invading your home. Do you really want to allow them to do this? Even the police can't enter your home and monitor your activities without a warrant from a court of law signed by a judge.

Re:So?

[ari_j]

Re-reading my comment, I am fairly certain that I allowed for installing SP2 directly. What about the security updates since then? Let's even assume that you can slipstream the most recent security updates into the WinXP install process. You still need (1) another machine with (2) a CD burner and (3) Windows installed on it. I need none of these three things to do a direct install of the most up-to-date Debian system. Am I wrong?

Install the WGA update?

[thedellos]

If you don't agree with M$ WGA, why choose to install the WGA update(s)?
I understand some may have auto updates configured to install automatically and are choosing 'no' to the EULA as a way to abort the install.
However, updates can be configured so that an end user can choose which updates are installed during the update process.

Looks like

[TwistedSpring]

All this is conjecture, but this is what I'm guessing the elements in the ID block are.

UGD: Not sure. Looks like a UUID.
HDSLN: Hard disk serial
USID: User security identifier (id of logged in user, Microsoft can tell if you're any of the default SIDs like Administrator)
CSID: Computer security identifier

So Microsoft can tell whether you're an admin or not, they know the unique ID of the computer (CSID), your account if you aren't "Administrator" and - perhaps - the hard disk. If UGD turns out to be something that is unique to each individual copy of Windows, then all the people who've ripped it off could find life inconvenient in the future. I'm not sure what the tracking implications are, it depends how many Microsoft products report the HD serial or USID to them.

Re:So?

[Runefox]

I AM a mod, you insensitive clod!

M$ already thought of that

[CaptainDefragged]

I believe that doesn't actually work. The addresses for Microsoft's update servers are hard coded elsewhere in the system. See this story for a brief overview.

Why?

[sleepykit]

Why do you people bother talking about how evil the WGA is? It's been known for a while now that Microsoft is reaching far beyond its moral limits to prevent piracy, so why even bother to whine. Switch to some other systems (pick your own poison) and forget that MS even exists. Don't like their attitude, don't like their spyware, then don't take it. Sitting around and complaining how much they suck does no good because it encourages them. You talk about WGA and they know people are paying attention, they know that their product is impacting you, and since you've already been branded a thief in their eyes, they now see you as whining about a product that locks you our of your PC. Sure, for most geeks, this is a blatant lie but remember that Windows was not made solely for the technically-savvy. Pick up the pieces and move on, choose your own path, your own operating system. Don't just let MS win!

Re:Why?

[smash]

Erm, the issue is that it microsoft is sending information after being explicitly told "no". This is newsworthy. Don't like the story? Fuck off...

Re:Why?

[ioshhdflwuegfh]

Why do you people bother talking about how evil the WGA is? It's been known for a while now that Microsoft is reaching far beyond its moral limits to prevent piracy[...] How would you know how evil the WGA is if not because of the people who actually do not bother to check out what's going on over the net when one does not want WGA installed?

Re:Maybe I'm misunderstanding something here, but

[arkhan_jg]

Online Genuine Advantage checks do not appear to be related to the WGAnotify app (yet) that is being pushed as an automatic critical app. I know my organisation pcs are valid, as they're running the VLK assigned to my organisation, and they pass genuine advantage checks on the MS website despite refusing the latest WGANotify update. I see no need to install an application which sole purpose is to popup nag screens on those computers that are determined to be invalid by microsoft's super-secret formulae. I've had several perfectly valid installs fail the old wganotify check (OEM installs only ever used on their original PC), including one on the same VLK, so frankly I'm not letting it near anything I control if I can help it.

They better make damn sure people are copyright infringers before accusing them of it, because WGA so far has done a pretty piss poor job of it with false-negatives all over the shop.

Comment removed

[account_deleted]

Comment removed based on user account deletion

WGA Got me a free copy of XP - I was ripped...

[Anonymous Coward]

I bought a used laptop at a computer show and was promised that even though the restore disc was a copy the S/N was good. So first thing I did was update to SP2 and no dice due to WGA. Called the store which is in queens NY and was told to deal with it, no refund, the windows is fine and I'll get all updates via automatic updates. WGA even told me the serial used was a coporate serial that is no longer valid. You can't get IE7 or media 10 without passing WGA either.
Instead of the MS police knocking down the door it gave me a form to fill out and sent it to them with a copy of the recipt - gave the guy one more chance to make good before sending it in and after a colorful exchange mailed it.
sure enough I got a new serial to activate. Funny but if I wanted an actual disc I have to pay, the copy will work fine I hope.
Funny thing is I just really wanted a discount for not having windows since I'll probably run Fedora or pref. FreeBSD but haven't heard how it works on a laptop hadwarewise yet? This weekend I'll be playing.

Isn't MS being sued for NOT protecting privacy?

[Anonymous Coward]

I wonder if this would fall into the realm of NOT protecting privacy, similar to the prono guy who tried to wipe out his browser cache. You've said NO you don't want it GA installed, and it STILL sends stuff home.

The other aspect is that having a machine CPUID and even a disk drive ID, and perhaps a NIC card, your account name, etc it would be a PERFECT cache of data for law enforcement to want for the purpose of determine whether or not you WERE on the net grabbing RIAA sensitive data or pron.

Can you imagine surfing on someone's wireless connection, and it's calling home with info all the time? It would seem to be to be a sure fire way to determine whether someone is really downloading copyrighted stuff or can use the "someone else used my wireless connection" defense.

umm, but...

[Phil Urich]

From an end-user's prospective, perhaps. But from a developer's perspective, the GPL takes away the right to distribute closed-source programs if you, in any way, use an GPL'd product. That would be a large TAKING AWAY of a right if one didn't read and understand the contract.

But if it wasn't under the GPL then they wouldn't have the right to use it anyway. It doesn't take away any rights! It adds certain conditional rights, yes, but it doesn't remove any rights that you otherwise would have had. And also it isn't if you "in any way use" something written under GPL, otherwise for example the NVIDIA binary blobs would be breaking the GPL (go ahead and tell me that it isn't using GPL'd 'products' when I install the NVIDIA driver on my debian-based system!).

And honestly, what developer worth his or her salt doesn't understand the GPL enough to make an informed decision on this?

Re:Do I have a choice on which button I click?

[Pofy]

So, as long as the contract is available at some place, through some media, somewere in the world, with or without your knowledge, it is considered as "available"? I suppose every single shop in UK also has a bunch of computers for people to line up at before they shop to search for a possible "EULA" for each and everything they want to buy, no? Last I was in UK I did not see those computers but perhaps I did not look carefully enough.

MS License

[Odiche]

I have always felt, that since MS includes the terms "Microsoft reserves the right to change the terms at any time without prior warning" it also gave me implicit grounds to change the EULA at any time according to my wishes.

"***** hereby informs MS that pursuant to changes made to the license that upon termination of said license, all such rights and ownership shall revert to the user ******, any further communication by the former MS products shall be considered an invasive intrusion, and considered to be a criminal computer misuse" /sarcasm off

Re:So?

[DJCacophony]

Their active x control installation has nothing to do with the WGN installation and the cancellation of it.

Guess which one sends info to Microsoft when you cancel the installation? HINT: It's the activeX control. So just to be clear, lets get the order of things straight;

1. You browse to Windows Update website
2. You install activeX control
3. You install WGA USING activeX control
4. You cancel WGA installation
5. Windows Update activeX control sends information to microsoft on your installation statistics

linux too

[equivocal]

On Fedora Core 5&6, for reasons I cannot determine, bonobo phones google.

Aha! I get you!

[avanaardt]

You mean like Synaptic on Ubuntu, right?