Slashdot Mirror
Stealthy Windows Update Raises Serious Concerns
UniversalVM writes "What is the single biggest issue that bothers open source advocates about proprietary software? It is probably the ability of the vendor to pull stunts like Microsoft's recent stealth software update and subsequent downplaying of any concerns. Their weak explanation seems to be a great exercise in circular logic: 'Had we failed to update the service automatically, users would not have been able to successfully check for updates and, in turn, users would not have had updates installed automatically or received expected notifications.' News.com is reporting that all of the updated files on both XP and Vista appears to be in windows update itself. This is information that was independently uncovered by users and still not released by Microsoft."
Here's the complete list to prove it (sorry for the lame formatting, it's Slashdot's lameness filter):
Just a bunch of people bitching for no reason, trying to generate traffic to their blogs. Let's see...
The update only updated the Windows Update software itself, nothing in Windows.
It did not update if you have automatic updates turned off.
It did update if you had "Notify me" turned on. This is a point of contention, but MS says they needed to do the update to continue to notify users of actual updates.
Finally, this doesn't apply to any networks running a WSUS (or whatever it's called now) server.
We already did this one just two days ago.
The anti-Microsoft FUD was thoroughly debunked by numerous Slashdot posters. It was also thoroughly debunked by numerous comments in reply to the various external sources cited in the older Slashdot article.
They updated Windows Update, when people explicitly visited the Windows Update site. That is all. They are not pushing out updates to critical system files without any user intervention.
Last time, several posters asked whether Slashdot would at least have the decency to correct the blatantly Microsoft-bashing headline/article. They didn't, they posted it again. <sigh> Go Zonk!
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
So now that hackers know there exists a backdoor to the windows update which will let them update a stealth patch to anything they want in the system because it runs with admin rights, this isn't a big deal to you?
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
If you're using an internet-facing Windows XP to run mission-critical systems, let us know which ones - so I can make a mental note never to use your services.
The biggest problem I have with this update, is that it proves beyond any doubt that Microsoft deliberately placed a "hole" in the security of their OS for their own purposes. It is nothing less than something on the internet contacting the OS, opening a hole, then running software with root/admin permissions to change something in the OS itself. Something many people have suspected because of the so-called security patches that move holes around instead of actually closing them, has now been proven to be true.
This must be a holy grail for a Windows hacker. This hole was put in the OS specifically to take over a computer, and Microsoft's reaction to its discovery shows they obviously have no intention of closing it - just continuing to use it when desired. You can bet that finding this hole and ways to exploit it are now the top priority of hackers around the world.
If I suppose this sentence true :
Had we failed to update the service automatically, users would not have been able to successfully check for updates and, in turn, users would not have had updates installed automatically or received expected notifications.
What append when someone install XP (OR Vista) from zero and get the OldAndBad Windows Update ? He will never be able to get update ?
Someone have feet in his mouth.
Ceci n'est pas une Signature !