Patch Tuesday Brought Windows 10 Ad Generator

jones_supa writes: Microsoft has been very aggressive on getting Windows 7 and 8 users to upgrade to Windows 10. The company has introduced a "Get Windows 10" system tray icon, moved the upgrade to "recommended" category in Windows Update, and even initiated the OS download automatically. The latest trick is almost comical: KB3139929 is an actual security update for Internet Explorer, but it also deploys a trojan horse, KB3146449, which is an advertisement generator for Internet Explorer. On computers not joined to a domain, it adds a blue banner when a user opens a new tab, saying "Microsoft recommends upgrading to Windows 10".

Comments

Even less likely to update

[michelcolman]

I don't use Windoze, but if I did, I would be even less likely to update now.

If you are using IE, that's what you get

[rjejr]

Nice timing of the article, right after the one about Opera's native ad blocking. I will update my Win 8 machine before the free Win 10 option goes away, but not much before.

Re:If you are using IE, that's what you get

[Chas]

Really. Care to explain how you're less secure on two operating systems that are still receiving support and patches vs their new adware delivery platform?

Specifics please.

Re:If you are using IE, that's what you get

[evolutionary]

Well..if MS can add an ad trojan to IE, they could add plugins to Opera as well to circumvent it like they did with their .NET plugin for Firefox. Wish that just not using IE would stop this sort of nonsense from MS, but they control the OS. And as they have all the backdoors and all the keys, that means if you "own" their OS, in point of fact, they own you. :-(

Re:If you are using IE, that's what you get

[jones_supa]

More eyeballs looking at the code.

Re:If you are using IE, that's what you get

[Anonymous Coward]

Really. Care to explain how you're less secure on two operating systems that are still receiving support and patches vs their new adware delivery platform?

Specifics please.

Specific Win10 security improvements include:

- Improvements to address space layout randomization (ASLR), Data Execution Prevention (DEP), the heap architecture, and memory-management algorithms reduce the likelihood that vulnerabilities can enable successful exploits.
- Protected Processes isolates nontrusted processes from each other and from sensitive operating system components.
- VBS, built on top of Microsoft Hyper-V, protects sensitive Windows processes from the Windows operating system by isolating them from user mode processes and the Windows kernel.
- Configurable code integrity enforces administrative policies to select exactly which applications are allowed to run in user mode. No other applications are permitted to run.

Re:If you are using IE, that's what you get

[KGIII]

Microsoft has been collecting this information for years and years. At this point, we've no known security incidents involving the data collected via telemetry. It could have been compromised and they not told us but that's a bit unlikely. At any rate, they've been collecting metrics, in one form or another, since the XP days. They're certainly collecting more now but they do have a history of keeping that data to themselves - at least publicly. And no, I'm posting this from Lubuntu, not a Windows computer. I don't have any computers with Windows installed.

Re:If you are using IE, that's what you get

[Anonymous Coward]

Specific security implications in Windows 10:

- Sends your data to a large host of Microsoft addresses without your permission.
- Ignores your attempts to disable this activity.
- Installs and displays ads to you in a manner similar to PUP adware
- Changes your settings to actively promote their money making ventures.
- Lies and hides changes in the attempt to mislead the user into thinking they are secure.

On one hand Win 10 might might help prevent an infection from a third party actor. On the other hand you guarantee that Microsoft has unfettered access to your computer, its usage, and all of the data it contains.

In that case I will stick to the might get infected and mitigate the risk with antivirus. It is safer.

Re: If you are using IE, that's what you get

[bill_mcgonigle]

Privacy is a good to many people, not just a principle. The new technical security features in Win 10 only help when the attacker isn't Microsoft.

Re:If you are using IE, that's what you get

[Dunbal]

You can't - unless you pirate it. If I recall correctly, the "condition" of the free upgrade is they invalidate the key to your previous version. It's Windows 10 or nothing, suckers! There's no going back!

Re:If you are using IE, that's what you get

[QuietLagoon]

...The only reason to stay on 7 or 8 at this point is principle...

The reasons I stay on Windows 7 are (1) it works for my needs, including security, and (2) I don't want Microsoft data harvesting my family.

.
If there were a documented way to turn off all the data harvesting in Windows 10 (and have it stay turned-off), I'd have moved to Windows 10 weeks ago.

Re:If you are using IE, that's what you get

[Dunbal]

- Ignores your attempts to disable this activity.

From what I've read it doesn't simply ignore your attempts to disable this activity, it actively bypasses around it by connecting to different servers, etc.

Re:If you are using IE, that's what you get

[Anonymous Coward]

Specific security implications in Windows 10:

- Sends your data to a large host of Microsoft addresses without your permission. - Ignores your attempts to disable this activity.

I know there was a story saying Win10 was pinging MS IP addresses even if telemetry was disabled, but there was no information on what information was transferred. So say "sends *your data*" is hyperbole. And about the telemetry that most of this is about: I'm actually with a competitor of MS, but we too use telemetry as an incredible useful tool to improve the product for our users. I'm not sure what people believe is being transmitted, because they jumble this issue together with the ad business and personal information/tracking issue, but we have no interest in *your* personal data in a telemetry context. We want to know where our users encounter problems, and what they actually use and prefer, in their use of of the product to improve it.

Also, it is a bit strange that this anger over tracking of personal data is directed at Microsoft while the really big elephant in the room on this issue is Google. Microsoft has a miniscule ad and info-peddling business. They actually closed down and sold off much of it late last year. Google has a gargantuan data collection business. And almost no matter how much you think you are blocking, they have advanced server side finger printing that tracks you anyway. So long before boycotting Win10, boycotting all of Google's services would be a minimum if you really care about this.

- Installs and displays ads to you in a manner similar to PUP adware

I've configured and uninstalled apps so my Win10 is not showing any ads that I see. You could argue I shouldn't have to, but it wasn't hard. YMMW.

- Changes your settings to actively promote their money making ventures. - Lies and hides changes in the attempt to mislead the user into thinking they are secure.

Can't say I have experienced this but would be interested in any specific examples..

Re:If you are using IE, that's what you get

[Anonymous Brave Guy]

(I'm not the AC you replied to, but I have a similar position on this issue.)

And about the telemetry that most of this is about: I'm actually with a competitor of MS, but we too use telemetry as an incredible useful tool to improve the product for our users. I'm not sure what people believe is being transmitted, because they jumble this issue together with the ad business and personal information/tracking issue, but we have no interest in *your* personal data in a telemetry context. We want to know where our users encounter problems, and what they actually use and prefer, in their use of of the product to improve it.

I'm sure you do want to know that, and I've no reason to doubt your good intentions. The thing is, I work with clients in security-sensitive industries. So regardless of what you'd like to know or whether I believe in your good intentions, the fact is that if you have any phone-home behaviour that I can't completely and reliably disable, my business isn't going to use your product.

Also, it is a bit strange that this anger over tracking of personal data is directed at Microsoft while the really big elephant in the room on this issue is Google.

We don't use a lot of Google services, either, for exactly that reason. Just because we're avoiding Windows 10 in significant part because of the privacy concerns, that doesn't mean we aren't also avoiding other software or services for the same reason.

Re:If you are using IE, that's what you get

[Anonymous Coward]

Not quite true. You *can* go back with a clean or image reinstall, but will have to negotiate with the phone drones to reactivate.

Re:If you are using IE, that's what you get

[Anonymous Coward]

You can roll back up to 30 days after Win 10 install. I did it, no problems with activation.

Re:If you are using IE, that's what you get

[Fieryphoenix]

You do not recall correctly.

Re:If you are using IE, that's what you get

[spire3661]

What if i dont want my computer to send you that information? It doesnt matter what YOU want it for, I DO NOT WANT YOU TO HAVE IT. Why is that so hard to understand? Telemetry is great, we all know its benefits, thats not the argument here. The argument is that the user ultimately should have the right to decide what data you get and that choice should be sacrosanct.

Re:If you are using IE, that's what you get

[Anonymous Coward]

That's how you recognize a Microsoft shill these days. I call it "the kindergarten defense", "Steve did it too!!" Of course it's just as much bullshit when it's on /. as it is in kindergarten, but these morons doesn't seem to understand it, nor that the rest of us are grownups and see it for what it is.

Re:If you are using IE, that's what you get

[thegarbz]

- Ignores your attempts to disable this activity.

From what I've read it doesn't simply ignore your attempts to disable this activity, it actively bypasses around it by connecting to different servers, etc.

You get your news from reddit don't you. The guys who block a single IP address and then a shocked SHOCKED I TELL YOU that their PC would dare attempt to communicate with a different IP because we all know redundancy is the work of Satan.

Re:If you are using IE, that's what you get

[thegarbz]

behaviour that I can't completely and reliably disable, my business isn't going to use your product.

As a matter of interest do you suggest your clients use a Home version of an OS in a security related enterprise routinely? Because Windows 10 has specific features that allow enterprises to control this behaviour in great detail.

Re:If you are using IE, that's what you get

[Anonymous Brave Guy]

You're setting up a false dichotomy. Don't forget that a huge amount of the business world is small businesses and independent professionals.

Those smaller businesses have traditionally run Pro editions of Windows, and in many cases will not even have access to Enterprise. The relationship of Home:Pro:Enterprise in Windows 7/8/8.1 is not the same as the relationship in Windows 10.

Plenty of those smaller businesses also won't have dedicated IT staff responsible for things like checking the background for every update and trying it out in a controlled environment before deploying it via WSUS, or spending hours reading up on how to configure new software not to phone home. If you want their custom, in any regulated or security-sensitive industry, then either you give simple, robust guarantees and controls, or you're probably out of luck on that sale.

Re:If you are using IE, that's what you get

[danomac]

The reasons I stay on Windows 7 are (1) it works for my needs, including security, and (2) I don't want Microsoft data harvesting my family.

I thought this was fairly well known now, but Microsoft backported the telemetry to Windows 7/8/8.1. If you're blindly installing updates without checking to see what they are, you've already installed it.

Re:If you are using IE, that's what you get

[dagoalieman]

I actually wonder why it's so hard for any company to say "Here's what we collect, here's why we use it. Here's an option to submit automatically, review before submit, or not send at all. And oh yeah, here's an option to remove data from reports or to decline to ever send a selected field."

I can say this- if a company were transparent and provided a means to verify what they were doing (IE not secretly sending a few extra undocumented pieces), I might be more inclined to send data based on that honesty than I should be. There might still be stuff I take out, but if I know what's being sent instead of just "Hey there's a crapton of data on my line, I've no clue what it is, where it's going, or why!!"

Barely related side note- crap like this actually makes me miss dialup. With broadband, sending these little reports back isn't too noticeable if you're just on a workstation on a dsl line at home, and while you might have firewall or other setup, most folks including IT nerds "set it and forget it.". People really don't tend to care if there's no user experience impact.

Back in Win XP days a friend of mine, who *damn well* shoulda known better, linked a pretty cool Matrix screen saver in group chat about the time the movie was gaining steam in media. Everyone knowing he's competent admin, always does due diligence etc, checks it out. At the time I was at bumfuck Missouri visiting family where dialup was the only option (even until less than 5 years ago.) Well, after installing the screensaver, I noticed that the modem activity indicator was going in the systray for 10-20sec periods. I only had IRC loaded, no web browser, nothing else that would be hitting the network, and knew what to expect traffic wise of standard OS functions. (I HEREBY ACCEPT MY PUNISHMENT OF ETERNAL JUDGEMENT, UNPAID MALWARE REMOVAL, AND FINGERPOINT AND LAUGHING- You guessed it, this screensaver had a new nasty riding its coattails. Yes, I should have checked myself etc etc, trust me I knew instantly my errors, and have used that lesson well in life since. The screensaver actually wasn't sending much data at all, apparently a C&C check that had no new instructions at that time.. but enough data that I noticed- only because of dialup. The group chat of admins did some reverse engineering on it, reported to McAfee and Norton (back when, relatively to today, they didn't suck, and were the big AV players, we hit several minor ones as well)- both companies worked with us, updated defs within 6hr, gave us credit for the find. Seriously though- dialup was the hero here, it would have likely gone undetected for a while if not for seeing small data being forced to take a long time to transmit.

Kinda sucked, because for the time, it really was a dang decent screensaver with 3d effects that by today's standards wouldn't be awesome but not aged/antiquated.

Hyperbole

[Anonymous Coward]

"but it also deploys a trojan horse"

A trojan horse is something that claims to be something that it isn't. Everything is very up front about what it is so long as you actually read what it is. It may be a bit underhanded, but it most certainly isn't a trojan horse.

Remember folks, hyperbole rarely helps your cause.

Re:Hyperbole

[blackomegax]

Yeah no. 98% of users just see "update available" and click ok. 1 more % might read KB###### and click OK. the other 1% might actually read what it is. SO yes it's a trojan horse.. The entire update system's vagueness allows for that. Until it's telling the 99% "you're getting ads now, yes or no?" it's a forced, trojan, horse.

Re:Hyperbole

[ThosLives]

That's one thing I've always disliked about Windows updates. Why can't they put a description in Windows Update instead of making us look up KBxxxx? It takes forever to click on them and see what each one claims to do.

Re:Hyperbole

[dfm3]

A trojan horse is something that claims to be something that it isn't.

Ever followed through to figure out exactly what most of the updates presented in Windows Update actually do? The description for KB3035583, for example, reads, "Install this update to resolve issues in Windows." Yeah, if the "issue" with windows is that I have 7 installed instead of 10... It's only after clicking the CORRECT link for more information (there are two, the second just takes you to the generic support page) that you discover this update actually installs the Get Windows 10 app.

That level of obfuscation sounds exactly like a trojan horse to me.

Re:Hyperbole

[mrclevesque]

It's Security update that contains non-security updates including an ad for Windows 10. So it's claiming to do one kind of thing but it's also doing another kind of thing that doesn't conform to what was claimed would be done.

Re:Hyperbole

[fisted]

I think you answered your own question there.

Re:Hyperbole

[Anonymous Coward]

A trojan horse is something that claims to be something that it isn't. Everything is very up front about what it is so long as you actually read what it is.

It's not up front in this case. Read the description page for KB3139929. You need to dig deep to find that there's an advertisement included. In the list of meta-updates, KB3146449 (which adds the advertisement) is simply described as "Updated Internet Explorer 11 capabilities to upgrade Windows 8.1 and Windows 7".

Re:Hyperbole

[Anonymous Coward]

It's a security patch for CRITICAL vulnerabilities in IE, that also includes Windows 10 advertising. I repeat, this is a CRITICAL security update. Advertising should not be any part of this.

How do I deploy the CRITICAL exploit patches without also getting Windows 10 advertisements? I don't? That is a trojan horse as far as I'm concerned. Fuck everything about this update.

Re:Hyperbole

[JustAnotherOldGuy]

Why can't they put a description in Windows Update instead of making us look up KBxxxx? It takes forever to click on them and see what each one claims to do.

Because if you knew what it was, you might not install it.

Re:Hyperbole

[ilguido]

Yeah because feeding deep detailed information to non-technical masses works so really well for wide spread acceptance of Linux and other more technical OSes right?

I don't know how someone could think that "Install the Get Windows 10 app" is a more technical, more obscure description than "Install this update to resolve issues in Windows". It's even shorter...

Re:Hyperbole

[dissy]

A trojan horse is something that claims to be something that it isn't. Everything is very up front about what it is so long as you actually read what it is.

Fair enough. Let's actually read what it is then, and I'll let you show us where it mentions up front that it inserts advertisements into Internet Explorer.

https://support.microsoft.com/en-us/kb/3139929

This security update resolves several reported vulnerabilities in Internet Explorer. The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage in Internet Explorer. To learn more about these vulnerabilities, see Microsoft Security Bulletin MS16-023.

Additionally, this security update includes several nonsecurity-related fixes for Internet Explorer.

The only hyperlink is the phrase "Microsoft Security Bulletin MS16-023" which directs to the page:
https://technet.microsoft.com/library/security/MS16-023

This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

This security update is rated Critical for Internet Explorer 9 (IE 9), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers. For more information, see the Affected Software section.

The security update addresses the vulnerabilities by:
- Modifying how Internet Explorer handles objects in memory

For more information about the vulnerabilities, see the Vulnerability Information section.

Personally I do not consider the phrase "Additionally, this security update includes several nonsecurity-related fixes for Internet Explorer." to be anything resembling up front about what it does. There are no further details.

Worse, the phrase "non-security related fixes" appears at first glance to be a hyperlink, but it actually links to https://support.microsoft.com/
There is literally no additional information and the hyperlink is useless.
The main support landing page in fact makes no mention about Internet Explorer anywhere, let alone details any changes to it.

Where is this up front explanation about the advertisements added to the browser?
Where is any mention of the non-security update that this new ad clearly is? Or any other potential non-security updates since it is specifically worded as plural meaning more than one?
Where is this greater-than-one-item listing you claim exists that we simply are ignoring?
Exactly what phrase actually stated on those pages would lead one to believe this behavior would be changed to make any type of informed choice regarding the update?

Re:Hyperbole

[Stan92057]

And its blackmail don't agree to install the adware you don't get the security fix. That's blackmail in my book.

Re:Hyperbole

[Cederic]

You are a cunt.

I could write a full knowledge base article explaining why in technical terminology but I can summarise my point in four words that any Slashdot reader can easily grok.

Windows updates are no different. "Fixes remote access bug" is easy for users to understand. "Installs annoying fucking popup" is easy to understand. "Improves windows update" is a fucking lie, dishonest and fraudulent.

Walks like a duck...

[Anonymous Coward]

The fact that they are pushing it so hard tells you everything you need to know. This update benefits Microsoft in a very big way. Scratch that -- in a HUGE way. And if it benefits Microsoft in a huge way, take a wild guess how much it benefits you.

We don't even need to know the first thing about what the update actually does. All we need to know is that Microsoft is extremely determined to make it happen, to the point where they will actually try to trick you into it.

Re:Walks like a duck...

[RenderSeven]

The fact that they are pushing it so hard tells you everything you need to know.

Kirk: You should take the Vulcan too.
Kruge: No.
Kirk: But why?
Kruge: Because you wish it.
- Star Trek III

Re:Walks like a duck...

[quintus_horatius]

This update benefits Microsoft in a very big way. Scratch that -- in a HUGE way. And if it benefits Microsoft in a huge way, take a wild guess how much it benefits you.

They're already adding a trojan to your old version of Windows using a security update, so they can also add the tracking infrastructure as well -- they don't need you to upgrade to Win10 for that. Whatever bad nasty things they have in Windows 10 they can easily add to your old version of Windows as well.

Maybe they're just sick of the old versions making them look bad, and they just want them to go away by replacing them with a better version?

Re:Walks like a duck...

[darkain]

It isn't the tracking system they want to push, though. They want to push the Windows Marketplace to compete with the Android Play Store and Apple App Store. While in theory they could install and operate the Windows Marketplace on Windows 7/8, Windows 10 comes with new architecture under the hood which is required for many of the new applications to run (such as the new Universal Apps). Their whole game is being a massive storefront, just like their main competitors.

Re: Walks like a duck...

[spire3661]

He killed Kruge in honrable comabt and thus became Captain of the Bird of Prey. Thats how Klingons roll.

Re:Walks like a duck...

[MitchDev]

Old versions of IE certainly make them look bad, but they could aggressively upgrade IE without forcing a change to OS version.

Edge is no better...

Re:Walks like a duck...

[thegarbz]

Maybe they're just sick of the old versions making them look bad, and they just want them to go away by replacing them with a better version?

Maybe they are a company which realised a product and are pushing the new version of that product. Screw em I say. Never buy from a company that releases a product and then pushes it.

Side note: Owncloud client said an update was available today and I'm using an old version. What is the world coming to!

Re:Walks like a duck...

[PCM2]

Win10 is maybe better for touch screens

I was actually one of the people who appreciated the touch screen features of Windows 8, since I had a lot of (free) tablets and touchscreen laptops lying around. The irony is that there was so much backlash against Windows 8 that Windows 10 actually doesn't work as well with touchscreens as Windows 8 did.

Re:Walks like a duck...

[thegarbz]

I know of a couple cases where the owners of the computer tell me that W10 installed itself, without inut on their part

Plenty of people managed to confuse "input on their part" with "stupidly clicking yes to anything that pops up".

It downloads the updates and bugs you to install it, but quite frankly what OS doesn't these days. (Don't say Linux, I just SSHed into an Ubuntu server which told me a system reboot was required as it downloaded and installed updates. And you can't blame forced updates on this since we're talking about Windows 7)

Re:Walks like a duck...

[MrNiceguy_KS]

It isn't the tracking system they want to push, though. They want to push the Windows Marketplace to compete with the Android Play Store and Apple App Store...

There was actually a massive "App Store" on Windows long before IOS or Android even existed: Steam. Microsoft has been trying for years to siphon off Steam's role as the "gateway to gaming", and Valve lately has been working to "Microsoft-Proof" their business model with SteamOS and cross-platform games.

Re:Walks like a duck...

[cas2000]

That's exactly why MS are doing it.

They want to destroy that established software market so that all software has to be bought on their app store (this, BTW, is why Valve has become so interested in Linux in recent years - they need an OS to jump ship to if/when MS destroys their business by abusing their control over the Windows OS to lock out competitors).

and MS will claim they're doing it for security - installing third party software that hasn't been vetted by microsoft is "too dangerous".

of course, they won't acecpt any responsibility or liability for their "vetting" process.

Re:Walks like a duck...

[Ol Olsoc]

I know of a couple cases where the owners of the computer tell me that W10 installed itself, without inut on their part

Plenty of people managed to confuse "input on their part" with "stupidly clicking yes to anything that pops up".

It downloads the updates and bugs you to install it, but quite frankly what OS doesn't these days. (Don't say Linux, I just SSHed into an Ubuntu server which told me a system reboot was required as it downloaded and installed updates. And you can't blame forced updates on this since we're talking about Windows 7)

Actually, I have to approve every update on My Mac, and the same with my Linux machines.

I have the Mac set to automatically check for updates. If there are any, I can decide - I've never had an issue with them screwing up my computer, Linux also checks but doesn't download or install. And a complete OS update? No, W10 is the only OS that downloaded the entire OS without my permission. And you have no choice with W10, you are getting those updates whether you want them or not. On Pro, the rumor was you could turn off updates, but you can only delay them, and the update whne it happens often rests the updates to automatic.

So tl;dr version - you are wrong.

Re:Walks like a duck...

[erapert]

and Valve lately has been working to "Microsoft-Proof" their business model with SteamOS and cross-platform games.

I believe it's a good move that will work for Valve if they can get more acceptance of SteamOS and Linux in general. I'm not a fanatic about everything being open source, and I do play a lot of games so I was ecstatic when Steam came to Linux. Alien Isolation ran flawlessly for me, XCOM and XCOM 2 are running great, Empire: Total War was a blast, Chivalry runs great for me, the Source games run great-- the point is that there are real AAA titles on Linux and they really do run well.

Because of the huge variety of high quality and easy to use desktops available for Linux and because Steam has brought good solid gaming to the Linux desktop now is, without sarcasm, the best time to switch to Linux.

I urge you slashdotters to seriously consider using Linux (Ubuntu, Mint, Debian whatever) as your primary or even full-time desktop for a couple months. If you like it and it works for you then why not stay?

As if we trust the real pirates...

[GeekWithAKnife]

I never allow windows to automatically download anything. I go to the trouble of reading the updates despite microsoft saying shit like "recommended update" and "Fixes critical vulnerability in windows" without actually saying what the fuck it does. I click through and read the darn KB.

I didn't like M$ at the best of times but I appreciated windows 7, it works. It seems that they were dissatisfied with that and couldn't figure out how toi give people MORE VALUE so they decided to piss us off with shoving the damn thing down our throats.

We are sufficiently angry to tell M$ they can go fuck themselves and their stupid windows 10.

What is the real reason for this push?

[ka9dgx]

Why is Microsoft pushing Windows 10 so bloody hard? What financial incentive is there for this?

Re:What is the real reason for this push?

[nine-times]

There have been theories that Microsoft is gathering a lot of telemetry that they intend on leveraging or selling, but there is a pretty simple, non-nefarious reason why they would want to push people to the latest version: support costs.

This was one of the theories for why Apple stopped charging for OS upgrades, that it's easier and cheaper for developers to deal with support and patching if almost everyone is running the same version. In a weird way, Microsoft has sort of shot themselves in both feet by basing such a large part of their business into vendor lock-in and backwards compatibility. It's left them trying to support their old OS for a very long time, and even if they discontinue support 13 years later, large portions of their customers complain and freak out. The vendor lock-in part of their plan created vast amounts of software that needs to run on Windows XP and IE 6, and trying to make a lot of that stuff work on newer versions of Windows leaves them maintain legacy code.

I suspect a lot of the Windows 10 stuff (e.g. making it free, pushing people to update, making it hard to disable automatic updates on Windows 10) is about getting everyone to get the latest version and then keep up to date with the latest version. That way, MS can start breaking backwards compatibility and stop wasting their time making updates for an release from 10 years ago.

Re:What is the real reason for this push?

[joboss]

MicroSoft is doing what would be the right thing, but they are doing it the wrong way. We have always needed better options for updating software automatically in a centralised fashion. But if I wanted what microsoft are doing I would just install android or OSX on my PC instead.

Re:What is the real reason for this push?

[iampiti]

Now with nice formatting... I had already modded but I feel I have to contribute...
- On Win 10 they heavily push they services and if you eventually use them:
-- They get tons of data about you which they can presumably monetize
-- They can also make money directly off them.
Those services include : Windows Store (30% cut of all the purchases like Google and Apple in their mobile app stores), OneDrive (data and maybe you'll plunk down money for extra space), Cortana (data), etc.
Also they get you into their ecosystem (Win 10 integrates quite well with Xbox One) and they figure that'll make them extra money: Maybe you'll buy a Windows Phone or an Xbox. The intention is also to help them gain marketshare on mobile where they trail Android and iOS by a wide margin. And the PC is a stagnant market while the growth and money is on mobile.
To sum up, they basically saw the PC as a platform on decline (which it is) and thought using their dominance on PC to try to push you to their services and devices ecosystem and try to gain marketshare on mobile where they were practically dead.

Re:What is the real reason for this push?

[hmckee]

All of which would have been fine if they did it correctly, instead they:
1. Changed default app file associations
2. Upgraded to buggy or non-working drivers
3. Installed unwanted software that was difficult to remove (Windows OneDrive)
4. Installed monitor software that should ask for permission
And probably other issues I've missed. Don't mess up my system which I'm using to do work and depend on for my livelihood.

Re:What is the real reason for this push?

[Opportunist]

If you do that, the customer improvement failed since you for sure are not an improved customer (from MS' view, at least).

Re:What is the real reason for this push?

[Opportunist]

XP and Vista are out of support already, there is no need to cater to their users. They are, as far as MS is concerned, dead anyway.

Win7 and Win8.x they still have to support and patch.

Re:What is the real reason for this push?

[wierd_w]

Due to MS's insistence on pushing the Get windows 10! "update" to my systems, I have started treating it like it was a very aggressive form of malware.

So far my solution is able to block installation.

Basically, create a dummy GWX folder in the %systemroot%/system32 folder, then put DENY ACL on everything for the Everyone object. This keeps windows update from putting anything in there. (And even if somehow it manages to actually put something in there, it wont be permitted to run.)

Then do a similar thing with all the registry keys associated with the get windows 10 update. (Then the keys already exist, but cannot be read by anyone. This prevents the windows update service from setting any values, essentially hamstringing the software it wants to install.)

From then on, every time windows tries to install the "update", it will fail. (For obvious reasons.)

This is a bit of a PITA, but it works, and works more reliably than some other options. Windows update screams angrily in the system log about it, but MS can go fuck itself. I can't think of a better way to tell MS that, "No, I DO NOT WANT Windows 10, Stop asking!" than that.

Calling it a Trojan Horse is a bit much

[Gojira Shipi-Taro]

It's annoying, certainly, but Trojan Horse? Come on. Dramatic much?

Re:Calling it a Trojan Horse is a bit much

[war4peace]

Here's what's really sad:
It all started with this Infoworld.com article. There's no definitive proof that "On computers not joined to a domain, it adds a blue banner when a user opens a new tab, saying "Microsoft recommends upgrading to Windows 10"."
I checked my Windows 7, windows 8 and windows 8.1 VMs. All have the update. None exhibit the behavior presented above.
None of the other machines I managed to check (which I don't own) exhibit the behavior.
There is no screenshot I could find online that shows the blue banner.
This seems to have blown out of proportion based on ONE single article which might just as well be a load of bullshit, and Slashdot is making it even worse.
What the fuck has /. become, Faux News?

Re:Calling it a Trojan Horse is a bit much

[pr0fessor]

The fact that it's bundled with a security update is underhanded but given that it does describe what is being installed and what it's doing it can't be a trojan, more like adware.

Re:Calling it a Trojan Horse is a bit much

[Anonymous Coward]

Really?

https://support.microsoft.com/de-de/kb/3139929#bookmark-nonsecurityfix

Scroll down to "non-security related fixes", last table entry: 3146449 Updated Internet Explorer 11 capabilities to upgrade Windows 8.1 and Windows 7
From there look up 3146449: https://support.microsoft.com/de-de/kb/3146449

"This update adds functionality to Internet Explorer 11 on some computers that lets users learn about Windows 10 or start an upgrade to Windows 10. Before you install this update, see the Prerequisites section. For more information about Windows 10, see Windows 10."

So when does the public wake up?

[evolutionary]

Okay, Microsoft has been injecting all sorts of stuff in their interest a the expense of their customers since Windows XP (WGA). We've had more "phone home" since WGA, and progressively more with each release. Windows 10 is the result of prodding a broom handle up our butts progressively deeper and seeing how deep it goes before we say "stop". The "telemetry" (really?!?) data collection, which MS admits you cannot turn off, and now ads in IE? We pay MS for this POS (well I don't touch windows 10 and legal firms and medical practices are aware of why they cannot go to Windows 10 to protect their clients), and MS find more ways to get money from us at the cost of our privacy. When do we say "enough is enough". Unless you are a gamer or have specific hardware (medical mainly), nobody needs MS Windows. Linux (Mint although hacked previously due to carelessness although fixed now), Elementary OS (for mac users), Debian (My favorite, can modify KDE to look like MS Windows/Mac), or even Ubuntu (think they still have a deal with Amazon on desktop searches which is why stopped using it but at least you can turn the amazon forwarding off). Any of these will serve any user. Even gamers may be happy with Linux as there has been an an explosion of games for linux (even 'AAA'...see Pillars of Eternity and Tides of Numunera for example). For those who like privacy I suggest the Tails distro (uses the Tor proxy network by default :D) . We all need to tell MS, enough is enough and we have choices.

Re:So when does the public wake up?

[Flavianoep]

The public gave privacy long ago to Facebook and will never wake up. Most people just think that "10" is better than "7", that Windows must be the best OS or no many people would not be using it. There are even ones that think that Ubuntu is the best, or easiest, Linux just because it is the most popular.

Re:So when does the public wake up?

[ColdWetDog]

Have you ever watched what OS X does? Using a neat little program called "Little Snitch" you can see that everybody tries to phone home. Apple, Adobe, Alphabet (and I'm only on the 'A's). You can think you've shut everything off and up pops another 'can I haz Internet access plz?' warning.

If the net every really shuts down, it will be back to typewriters and correction fluid in a week. Ah, the buzz from mimeograph stencils .....

Staying on Windows 7

[surfdaddy]

I am on the Win10 insider program on my laptop, which I use for surfing, etc. But all my data and real important use is on my desktop, and that's a Win 7 machine. As I approach the time limit for upgrading, I've decided to stay on Windows 7 on my main machine. I don't really see any benefits to Windows 10 that are that important (to me), and I hate the intrusive advertising in Windows 10. I don't really need my OS to serve me ads - lord knows there are enough ads everywhere else without my OS doing it, too. If and when Win 7 becomes unusable or unsupported, I'm seriously thinking desktop Linux, as there is enough software out there now that almost fully replicates what I need and use. Oh, and I'm using the GWX control panel to get rid of the Windows 10 nags in my Win 7 system. I really hate MS for doing this aggressive bit, and I'm throwing them the proverbial finger as much as I can - no Windows 10 on my main machine for me!

Re:Time for Linux

[Archtech]

All of this underhanded nagging to upgrade really aggravates me to the point that I'm now willing to investigate using an alternate OS.
Good Job Microsoft!

Well, at least they got you to change operating system...!

Thats ok, really...

[johannesg]

I've turned off automatic updates as being the greater security risk. Now no Microsoft-spam is getting through.

GWX Control Panel blocks all the annoying prompts

[Archtech]

GWX Control Panel is your friend. http://ultimateoutsider.com/do...

(I have no interest in, or connection with this free utility).

Re:Forbes : Crapitalist Toolbox

[ColdWetDog]

"Ironing"?

Either you've been attacked by your autocorrect again or you really, really like starch.

RTFA

[Zalbik]

Or for those who RTFA, perhaps it DIDN'T include an ad spamming "trojan horse":

I spent most of the night trying to replicate this behavior -- a blue banner on new tabs in IE11 with "Microsoft recommends upgrading to Windows 10" -- and couldn't get it to trigger.

Keep pushing...

[JustAnotherOldGuy]

I never got any update notice, but then I've done some things to block the Win 10 updates.

But keep pushing Microsoft- I've got Linux Mint already installed on my laptop (dual boot) and it won't take but about 15 minutes to install it on my desktop too.

The first time I see anything related to Windows 10 on my PC, you're toast. Any conversion, any forced "upgrade", anything like that...and that'll be the last time I run Windows on my PC.

It'll take ~10 minutes to backup and offload my most recent data and 15 minutes to load Mint, and we'll be done. Get it through your heads- I like Win 7, I do NOT want Windows 10, period.

So yeah, just keep pushing and you'll push me right off your OS.

Re:Keep pushing...

[Sir_Eptishous]

Yes, I have done that...
At home.
Obviously things at work are an entirely different scenario.

At home I have an iPad, a Mint media server, a Zorin laptop and a Windows 7 pc used for gaming and recording.

I am using the GWX Control Panel now on that last machine.
I also don't plan on upgrading to 10.

I can guarantee though that MS knows they are losing a small amount of installs of 7/8 to Linux, all while gaining a massive amount of them to 10.

Re:Keep pushing...

[thegarbz]

So yeah, just keep pushing and you'll push me right off your OS.

Carefactor zero. You're already a lost cause. You're not on the monetized platform, you're just running a legacy piece of software that they need to maintain. You're a support cost with a threat to jump ship if you stop requiring one.

I don't think MS would give a crap about your threat, they may just make an update specifically for you to push you over the edge.

Security and privacy are not equivalent

[NoImNotNineVolt]

I generally help pile on the Microsoft hate along with the rest of slashdot, but I'd like to point out that security and privacy are two distinct concepts. You've listed privacy implications that have little bearing on security. Your third point is the only one that is a potential security hole, but even that's a bit of a stretch, as the ads displayed by Microsoft are likely vetted quite a bit more thoroughly than what you see with a typical ad network.

Re:Security and privacy are not equivalent

[Cederic]

If someone else can access your data outside of your control, it is not secure.

Whether that data is transient on a stateless system or carved 3 inches deep into granite is irrelevant.

Without control over the access to data you have no security. The confidentiality is the outcome of exercising that control.

If you can't understand this then you may be in the wrong job.

Re:windows update is now malware chanel!

[UnknownSoldier]

/Oblg. old Windows Virus jokes:

Q: What's the difference between a virus and windows?
A: Viruses rarely fail.

and

Is Windows a Virus
------------------------
No, Windows is not a virus. Here's what viruses do:

1.They replicate quickly - okay, Windows does that.

2.Viruses use up valuable system resources, slowing down the system as they do so - okay, Windows does that.

3.Viruses will, from time to time, trash your hard disk - okay, Windows does that too.

4.Viruses are usually carried, unknown to the user, along with valuable programs and systems. - Sigh.. Windows does that, too.

5.Viruses will occasionally make the user suspect their system is too slow (see 2) and the user will buy new hardware. - Yup, Windows does that, too.

Until now it seems Windows is a virus but there are fundamental differences: Viruses are well supported by their authors, are running on most systems, their program code is fast, compact and efficient and they tend to become more sophisticated as they mature.

So Windows is not a virus.

It's a bug.

--
M$, Microshit, Microshat, Microshaft. Same shit, different OS.
When Windows 2000 ships with over 65,000 bugs you think it is any _less_ with newer versions??

And that was the last of the trust

[Anonymous Brave Guy]

Yes, this is the line they should never, ever have crossed.

You don't call something non-security a security update. Ever. You just don't.

I already knew a lot of people who haven't been routinely installing Windows updates for a long time because of all the junk Microsoft have been throwing in as "recommended". But at least until this week you could still trust that you should install security updates.

The scale of screw-up that crossing this line represents in terms of Microsoft's remaining credibility is staggering.

Re:sucks to be you..

[drinkypoo]

i have windows vista.. the BEST and LEAST ANNOYING windows version that hasn't been EOLd.

The only way in which Vista is better than Win7 is that they haven't bothered, to the best of my knowledge, to push telemetry out to it like they have 7. It has a bunch of serious performance problems, though, especially its ridiculous memory use.

I love Windows 10

[melting_clock]

MS has created a huge incentive for more people to try Linux. Increasing the number of desktop Linux users will attract more commercial software which will eliminate the vendor lock-in that MS has enjoyed.

Friends and family were disgusted by Windows 8. Mostly, they just moved to Android tablets and stopped using their laptop/desktop Windows for all but that rare times it is needed. It is a little odd to see my mother using her Android tablet for just about everything but it works for her. They will even do things on the Android smart phones that used to require getting out their laptops. As someone that grew up when many people did not have a PC at home, and long before Android came along, it is amazing just how much general computing is being done without the need for a laptop or desktop computer.

I've been using Linux as my main OS for around 15 years, with Windows dual boot for some games. There has been a lot more interest from friends and family in Linux, particularly when they see me using KDE and how familiar it is to the good old Windows that MS ruined. For those used to older Windows versions there is a learning curve and putting that effort into learning Linux requires no more effort.

MS seems to be doing everything possible to kill Windows and they have my support in their mission.

Re:They bricked computers with last update

[Cro Magnon]

This is not the first time either.
I waited a couple months to install it last year to give them time to get their sh!t together.
I then upgraded and it immediately bricked my computer.
I had to use freaking linux to flatten my hard drive and I then reinstalled win 7.
I have now turned off the windows update because I'm afraid that it might install without my permission.

This is the most half @ssed way to do things and totally pisses everyone off, even long time Microsoft fans like myself.

A Win 10 update borked the wifi on my desktop. I ended up installing Ubuntu. It didn't brick my W10 laptop, but for awhile it had issues when I put it in sleep. Currently it seems to be working okay except for the spyware, but who knows when an update will break something else.