The Dolphins Make Me Cry.com - Forums

I come home to change into my monkey suit for the afternoon, check a couple emails, and items watched on EBay...The little bubble on the right hand corner of my desktop pops up..."Windows Updates Available" 1 Critical,8 optional....I noticed alot of them optional ones, were for stuff...I've got no clue about, Clicking the Knowledge base trying to read it, It might as well be Mandarin Chinese...

Alot of the Stuff,.Net Framework,Media Center stuff,Windows Live essentials,Games for Windows,Do I really need this Shit?

I ask because I've already got Framework Vers.(whatever),Because they told me I needed it to run modded Versions of old games.I installed windows Live Because Bioshock2 said it required it to run the game....IE Compatability stuff, I quit using IE....

I understand these are optional Should I still keep these up to date? Possibly because I might be leaving myself open for a loop hole,for hackers and viruses...Or whatever?

For me the important things are, My Antivirus updates, Malaware updates,spyware crap,my video drivers,and certain other program updates....

Modified to add...Some of the stuff, I understand...The biggest SD card I've got is 16 GB,So unless I buy a card bigger than 32 GBs, there isn't a need for the update....Those I get...some of these others not so much....Thanks for light anyone is able to shed....

Personally I always do all the updates, even the optional ones.  I figure the most current software is probably the best even though that's not always true.  It's probably true a lot more often than it's not though and even if you are not using the software, then it probably won't matter if you do update it.

For me the risk versus reward indicator falls over to the reward side.  Your mileage may vary.  Besides, if you ever do an update that seems to cause problems you can always roll back the changes provided you have system restore turned on.

Ever since Microsoft came out with Windows Genuine Advantage, I don't do Automatic Windows Updates.  That "security update" was really just glorified spyware that nagged you if it thought you had a pirated copy of Windows, which is actually useful (for the user) to about 0.00000001% of the population.  And it would be one thing if it was just annoying people with unlicensed copies... but even people with real, legitimate copies were caught in the net.

No thanks.  If there's a specific update I need, I'll download it and install it myself.

If you don't like WGA, uncheck it. It isn't a forced update. Just like newer versions of IE, if for some reason you want to keep your IE6/7 chugging away.

If you have automatic updates turned on, you don't pick which updates to install and which not to.

Furthermore, even if you have it set to automated download but manual install, how are you supposed to know what new unwanted software MS is pushing on you?  When "Windows Genuine Advantage" came out, there was no way to know what it would actually do, much less that it could ruin your legitimate system.

MS can roll out a new security update called "Windows Security Assurance" and do the same thing or worse, and you wouldn't know until it's too late.

Unless of course you have Windows System Restore turned on and then you can just roll it back a day and undo the changes.  I've been using Windows since about '94 and not once have I had a problem after doing a windows update.  Not saying it doesn't happen, just that it's very rare and it can be undone in most cases.  A single bad software release shouldn't stop anyone from doing regular updates.

That would only be a viable solution if you found out that this new Windows Security Assurance was, in fact, an undesirable spyware program... within 1 day of installing the update.  Which, again, would require you to know the exact day that this new program was installed.

Sorry, but MS has breached its trust on this one.  If I cannot depend on MS not to install self-serving faux-security updates, then I'd rather roll the dice with standard malware/viruses.  Those can at least be thwarted by cautious PC usage and anti-malware programs.

That would depend very much on your System Restore settings.

In any event, there's OFTEN a better "official" way of rolling back patches: The uninstall scripts in your Windows folder, appropriately named after each individual Knowledge Base article describing that patch. Since Microsoft didn't want you to uninstall this particular patch, they neglected to provide an uninstall script for it. (You can search for one, though, and they are readily available from reputable sources).


Sometimes.

Remote code execution exploits do happen. Sometimes these are in the wild before MS issues a patch, but NOT patching isn't going to improve your odds ;)

Which kind of defeats the purpose of the uninstall script: the unwanted patch that you are trying to avoid can't be easily removed.

Yeah, but that's no different than finding a malware cleanup script.

I can still manually reduce the chance of getting compromised by where I go and what I do.  I can't do that if MS is installing malware through Windows Update.

Not true as already pointed out.  WGA is not spyware, most updates can be uninstalled after the fact and depending on your system restore settings you can often roll back weeks at a time.  If you want a little more objective discussion on WGA, look here (http://en.wikipedia.org/wiki/Windows_Geniune_Advantage).

To each his own.  If you'd rather roll the dice with viruses than update your PC because of one poor software release that happened years ago, then be my guest.  And it's not just viruses that you're opening yourself up to by not updating, it's also possible hardware/software conflicts, missing features, missing bug fixes, missing peformance improvements etc.  By not updating you'll be causing more problems for yourself then you would avoid. 

I think you're vastly overestimating your ability to control that.

Flash plugins, PDF plugins, Apple's own PDF plugin... all have had (or have, in the case of Apple) remote code execution exploits over the past few years. So have various audio plugins and even image rendering. Considering that most forums (including this one) allow you to embed images and (yes) flash directly in your message, just perusing a forum is exposing yourself unless you've disabled pretty much everything in your browser.

It seems that your cited link indicates that MS has admitted that WGA dials home once every 2 weeks without notification or permission.  Sounds like spyware to me.

I was actually talking about a hypothetical new MS software, but in the case of WGA, according to MS's own glossary (http://www.microsoft.com/security/portal/Threat/Encyclopedia/Glossary.aspx), it meets the definition of both malware and backdoor trojan.

Hardware/software conflicts?  It's exponentially more likely that an update would break something that's already working.  If there's something that's not working because I don't have a needed update, I'll install the update that I need to make it work.  Pretty simple.

Missing features, bug fixes, and performance improvements are not worth a potential 20% chance (according to the article you cited) of having my legitimate copy of Windows flagged as unauthorized.  Most of the bug fixes I actually want are contained in updates to non-Microsoft applications (e.g. Firefox, Flash Player), which is outside the scope of Windows Update anyway.

You're talking about web browser plugins.  Given that a) I don't use IE and b) Windows Update does not update Firefox or any of those third-party browser plugins, you aren't making a very strong case.

If we were talking about something like Linux (where the built-in update will also download and install security fixes for damn near every piece of software for your computer), then that would be one thing.  But given that Windows Update won't patch any browser but IE and won't patch non-MS plugins, where's the benefit?

The browser is (probably) the gateway for most of the data that arrives on your computer, but even if you're using Firefox, it's exceptionally difficult to avoid various Microsoft components. There are those that Firefox will use more or less automatically (like Media Player) and there are those that Windows uses "on its own" on files you have downloaded or that have been cached by the browser. Say you download an image from somewhere. Most people would use Microsoft's built in Picture Viewer, but let's assume you use Irfanview or something else. Even then you are not in the clear. Anytime you open the Windows file explorer and access the folder that image is in, Windows will process the file (even if you tell it not to display thumbnails). The same goes for movies and many other types of media.


Yes, it would be extremely nice to have a unified update module that handled all (well-behaved) installed programs. There's nothing preventing Microsoft from opening up their update process and allowing third-parties to serve secure, verified patches over it. Sadly, I doubt that's going to happen anytime soon, so we're stuck with a billion programs each managing their own -- and if you haven't updated e.g. your image viewer in a long time (say you haven't used it) and load a malicious image, you are screwed even if you viewer tells you that there's an upgrade available. (That's for all the programs that don't stick a process in start up and continually and eternally monitor the state of its parent program).

So, to summarize:

 - Windows Update has been used to distribute unwanted, difficult-to-remove spyware programs from Microsoft in the past
 - Nevertheless, one should run Windows Update anyway, because the security risk outweighs the risk from Microsoft
 - However, the security fixes from Windows Update will not patch the most common vectors of infection: Flash Player, browser plugins, and your web browser itself (if running a non-IE browser)

What is the benefit of running Windows Update, again?

The browser is the gateway, but once that data passes through that gateway, odds are, core Windows elements are going to interact with it some of it at some point.

Then there are all the remote code execution flaws that will allow anyone on the same network as you to take over your system. You could avoid most of those issues by locking down your local network, using a NAT router, a properly configured (hardware) firewall etc.

Done all that?

All right, let me return to the previous attack vector -- the browser. As I explained, it's quite difficult to prevent Windows from interacting with the media on the pages you visit. Are you using Media Player? If not, are you using a player that relies on Windows codecs?

Go to this page: http://www.microsoft.com/technet/security/current.aspx

And take a look at the last 6 months worth of CRITICAL (patched) flaws. The majority allow remote code execution.  There are 21 critical flaws in all. That's > 3 a month (and that's low-balling, because MS likes to include multiple fixes in a single patch, sometimes without documenting it properly). Do you honestly believe you aren't vulnerable to ANY of those?

There are critical flaws in codecs, media player, DirectShow (even VLC will use the DirectShow framework), the tcp/ip stack (hard to get around using THAT), activeX (okay, so you're not using that, probably), the Shell handler, Samba, VB Scripting engine (used more than you'd think) and so on.

To avoid ALL of those flaws, you'd pretty much have to turn your computer off (or not run Windows).

You also seem to be ignoring the fact that many third-party applications (and I'm assuming you DO use your computer for SOMETHING) use various Microsoft dll's, frameworks (compositing, codecs, DirectShow, DirectInput, DirectX, .NET etc) and what-not. Even if you keep ALL those applications up-to-date, you'd still be vulnerable to flaws in the Microsoft components that they use.

If you keep reading it also says that MS was sued as being spyware and the case was dismissed.  In my humble opinion if you take it the courts to decide and you fail to win your case, you can't still argue that it's true.  That's just me.

Surely you're not suggesting that 20% of the PC's that use Windows are incorrectly flagged as having an unauthorized copy of windows?  According to Microsoft that 20% number actually refers to the number of false positives of those that do not pass the test, not of the overall number of windows users.  That number is actually under 1%.

From the link (http://arstechnica.com/old/content/2007/01/8690.ars) in the wikipedia entry

"Last summer Microsoft admitted that over 20% of WGA failures were caused by something other than key piracy, that is, piracy involving either a product key generator or use of a volume licensing key. The company would not reveal the exact nature of these results, other than to say that a portion of them stemmed from unauthorized use of OEM keys on non-OEM hardware (i.e., someone using a Dell copy of XP on a non-Dell machine). At the time, Microsoft refused to comment on the rate of pure false positives, that is, the rate of verifiably incorrect identifications of pirated software. With the release of this latest data, Microsoft said that WGA had a false positive rate "under 1 percent." A more precise number has not been forthcoming."

MS has literally hundreds of updates every year, perhaps thousands.  Compare the under 1% chance to test false positive to the hundreds or thousands of updates that have a chance to prevent you from having a problem? I'll take my chances with the nearly 0% chance of having a problem overall. 

This straight from Microsoft...

"To be precise, an actual 'false positive' would occur if WGA identifed a specific copy of windows installed on a system as non-genuine or unlicensed when in fact it was genuine and licensed. Of the hundreds of millions of WGA validations to date, only a handful of actual false positives have been seen. Most of these were due to data entry errors that were quickly corrected and only occurred for a short period of time. "

http://blogs.msdn.com/b/wga/archive/2006/07/16/667063.aspx

So to summarize:

1)  Yes approximately 20% of all WGA tests fail.
2)  The vast majority of those failures are due to non genuine Windows installations outside the US where piracy is rampant.  Over a million PC's in China alone were using a single license.
3)  Many of the "false positives" are in fact true positives where the customer is unaware they are using pirated software or software that somehow violates the licensing.  They only assumed it was a "false positive" because they didn't know they didn't have a valid license.  This can occur if you try to install the same copy of windows on multiple PC's or if you try to install a Dell specific copy of XP on a non-Dell PC for instance or even if you purchase a PC from a less than reputable source.

If someone on your own network is attacking your system, you have problems that extend beyond security updates.

I am not using a player that relies on codecs that would be updated by Windows Update.  So that's another dead end.

As for the laundry list of Microsoft critical patches: taking a cursory glance at them, I'm still unconvinced that there is anything of significance.  So I challenge you to find two (2) examples of critical security patches delivered via Windows Update that would:

1) affect a person using Firefox as their browser
2) successfully address the vulnerability in question after the patch was installed

Because the only vulnerabilities I've seen so far that would meet those criteria would require something along the lines of clicking a link in an unfamiliar e-mail or attempting to execute a random shortcut file, which is precisely the type of behavior that I'm talking about when I say that modifying your behavior can prevent your PC from being compromised.

FYI: As far as I can tell, Gecko (Firefox's rendering engine) does its own rendering of HTML, XML, images, etc. (i.e. anything that doesn't require a plugin), so I'm not sure that Windows image rendering vulnerabilities would apply.  I welcome evidence to the contrary.

Pappy, WGA sucks and should be illegal. (A separate point from the one I was making about using the Updates in the first place).


That's a lie. A handful? I've seen a handful myself.

Microsoft has, in other situations, said it won't release exact numbers but that it's less than 1%. That's still MILLIONS of users.


And this is one of the many, many reasons WGA sucks and Microsoft should be taken out back and shot. MS may consider an OEM version of their OS tied to a single machine, but they are subject to LAWS (in the relevant location) NOT whatever their post-purchase EULA says. Most countries allow you to sell your copy of Windows, yet another thing Microsoft doesn't recognize and which could easily cause a (genuine false positive) WGA failure.

This reminds me of those warnings before NFL broadcasts... "This broadcast may not be used for any purpose yadaydayada..." which is complete bullshit, since it doesn't take the lawful concept of Fair Use into account. The warnings on DVDs actually made it to court, but a judge deemed that no one could possibly think that they didn't have more rights than those (none) and thus didn't constitute a problem. *shrug*

On a personal note, I can say that I've had my copy of Windows go totally nuts simply because I hadn't used it in a really, really long time. Since I couldn't give WGA access to the 'net (had no connection right then and there), Windows went apeshit. This is something Microsoft WOULDN'T consider a WGA failure (of any kind), since the "service" (their server) wasn't contacted. However, from a user point of view, WGA certainly screwed me royally, despite my copy being fully legal. And, I should note, it didn't come with a stipulation that they could cripple the OS (or even nag me incessantly) if I didn't use their POS often enough and couldn't provide access to the Internet at WGA's whim.

According to MS's own glossary, spyware is defined as "a program that collects information, such as the Web sites a user visits, without adequate consent. Installation may be without prominent notice or without the user’s knowledge."

WGA collects information with no consent (and transmits it back to Microsoft).
WGA is installed without prominent notice.
If you have Windows Update set to Install Updates Automatically, WGA is installed entirely without the user's knowledge.

By Microsoft's own definition, WGA is spyware.

Surely you don't believe that the question of WGA's status as spyware is decided entirely by whether or not MS's opponent's lawyers are able to defeat Microsoft's lawyers in a lawsuit?

Let's take everything you said as fact.  From the MSDN article you cited, of the 20% of all PCs that fail WGA, 80% of those are because of actual piracy.  That leaves 20% that fail due to data entry errors, improper installation procedures, or something else that is not actual piracy, or 4% of the total population.

The excuse that WGA flagged a system because of various licensing antics does not carry water.  MS themselves does not dispute that the copies of Windows are, in fact, genuine (i.e. not pirated or counterfeit); they have simply determined that that have been installed in a manner inconsistent with their licensing.  WGA does not advertise this "feature," and I'd argue that said feature is of zero value to the consumer.

So again, given that Windows Update itself seems unlikely to patch the actual programs that I need patched to browse the Internet (read: Firefox, Flash, et al), a 4% failure rate for something that provides little-to-no actual benefit is about 4% too high.  If I have to patch all my key programs manually anyway, why expose myself to the risk of WGA (or other future MS shenanigans) unnecessarily?

I take it you don't use public WiFi networks.

(Or semi-public wired networks, like many businesses).


I'd be interested in knowing what player that is. VLC uses the FFMPEG library for *almost* everything, but will use DirectShow codecs (on Windows) if FFMPEG doesn't have support for the relevant codec. And it will do so without asking you.


True.

However, all browsers cache images (unless you explicitly tell them not to). As such, they are stored on your computer. If you open the cache folder (in your profile folder) using Windows Explorer (which is what 99.99999% of everyone uses to browse files), Windows will parse those images regardless of whether or not you actually open the image in an "external" viewer. Even if you tell Windows (at least XP) not to generate thumbnails etc., it will still do it (just not show it).


You don't need to execute it (and that goes for oh so many things in Windows these days). Take, just as an example, the following remote code execution flaw from 4 days ago:

http://www.microsoft.com/technet/security/Bulletin/MS10-046.mspx

The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed.


The less you do with your computer, the less exposed you are. The two examples already presented in this reply fit the bill, provided you actually "do" normal stuff with your computer (in addition to using Firefox).

Others that fit with "normal usage" of Firefox:

MS10-007 / KB975713 (http://www.microsoft.com/technet/security/Bulletin/MS10-007.mspx)
The vulnerability could allow remote code execution if an application, such as a Web browser, passes specially crafted data to the ShellExecute API function through the Windows Shell Handler.

This would be where you open e.g. a PDF file with Firefox. The vulnerability exploited would not be in any Adobe product, but a Windows API. And, as your criteria stipulate, it would be fixed by applying this patch.

Similarly, there are a handful of critical flaws within the last 6 months related to DirectShow, codecs, etc. If you downloaded an AVI file (or MP3) file with Firefox and navigated to the Download folder, you'd already be exposed -- even before playing the file with your NON-Microsoft player.

If you want to limit this to the (completely unrealistic) scenario of no other programs being involved, fine:


MS10-009 / KB974145 (http://www.microsoft.com/technet/security/Bulletin/MS10-009.mspx)

TCP/IP stack. If you have IPv6 enabled and the attacker can send ICMP packets to you (not unusual, although a NAT router or hardware firewall would prevent it), you are open to this attack. All you have to do is have your computer connected to a network / the Internet.

MS10-042 / KB2032276 (http://www.microsoft.com/technet/security/Bulletin/MS10-042.mspx)

Help and Support Center. Doesn't sound relevant, does it? But Firefox registers (or at least did) the hcp handle by default, meaning you'd only have to follow a link on any web-page. A meta-refresh redirect of an iframe would presumably work as well. Even a site that allowed iframes by others would suffice (Facebook, MySpace etc all did, not sure if they still do). Popops are another delivery vector (there have been several instances of popular "normal" sites serving ads (popup and otherwise) with malware). Full (and I mean full) details in this little exposé:

http://seclists.org/fulldisclosure/2010/Jun/205

Conclusion from the above: In general, choice of browser, mail client or whatever is not relevant, they
are all equally vulnerable.

KB2032276 / MS10-043 (http://www.microsoft.com/technet/security/Bulletin/MS10-043.mspx)

Have Aero turned on in Win7? Then this affects you. The "problem" is that Firefox (or any other program) uses Windows libraries or APIs in order to accomplish a wide range of things. In this case, it's Firefox's GUI that triggers the vulnerability when running Aero (as would any other app with a GUI). Exactly how the exploit would work in this particular case is beyond me, but then I'm not a cracker ;)

---

And those 3 were just from the critical flaws of the last 6 months.

No and no.

I use Media Player Classic (mplayer), with a fairly robust set of FFMPEG codes installed.  That is, when I am watching videos on my PC at all; I do the majority of my non-Flash video watching on an XBMC machine hooked up to a TV.

I think I have browsed through my cache folder maybe two times since Windows XP was released.  Maybe.  I don't think it is a realistic threat vector.

How does this shortcut get on to your PC?

From what I can tell, these kinds of problems (ShellExecute exploits that utilize passing of malformed URLs) have also been patched at the Firefox level (https://bugzilla.mozilla.org/show_bug.cgi?id=389580) in the past.  If that's still the case, keeping Firefox updated (which should be among your highest of priorities) would make the Windows patch redundant.

I literally do not know a single person who is directly connected to the internet (i.e. not behind a router) in 2010.

In any case, I don't dispute that the exploits that you mention are potential threats.  But as I see it, these threats still pale to WGA and WGA-like successors.  While manually installing patches is certainly best, I still prefer careful PC usage to Windows Update.

I'd rather risk having to go through some annoying steps to roll back a Windows update than have somebody own my system, steal my banking details etc. But that's just me.

Before I go on to address the rest, I'd like to point out that a flaw like the Security Center (HCP) one, is ONLY addressed by getting the fix from Microsoft. If you don't do that (or take steps to manually disable the handler), just viewing a web page is all it takes for someone to get full access to your system. And since the site I listed contains sample code for an exploit, do you honestly believe no "bad guys" are abusing this?

Oh, and I just thought you should know... Microsoft is patching 8 critical flaws allowing remote code execution on Tuesday (a new record, btw). Betting you won't be affected by a single one of those?

(A further 2 flaws addressed also allow remote code execution, but are "just" market important, not critical -- only a single one of the critical flaws is related to IE, the rest are "Windows").


So you always check the codec requirements of any clip before you watch it? (I'll admit I don't).


It was an example. The pertinent point is that any media file you get, whether PDF, video, audio, image or a Word Document (even a plain text document) gets read by Windows as soon as you open the containing folder. It doesn't matter what you use to display the file, Windows as already gotten its hands on it.


This was in direct response to your claim that a shortcut had to be clicked. I merely pointed out that it doesn't; it only has to be viewed.


I have no reason to believe that generally to be the case and I was unable to locate any information on Firefox fixes for the shell handler flaws I tried.


A router or cable modem is not sufficient. It has to perform NAT (in what is often called moderate or strict mode), as opposed to just forwarding everything anyway. Comcast cable modems shipped like this not too long ago.

Regardless, every time you use your Internet connection, you are using the TCP/IP stack in Windows. Even if you are behind a properly-configured NAT router, you would still be vulnerable to attack by a server that you initiated a connection to. In other words, if the server at www.example.com is hacked, YOU are stuffed just by visiting the site.

Says who?  Not the department of justice which dismissed the case against MS.  That's your opinion.

A handful of what?  False positives or just WGA failures.  WGA failures happen all the time, but it's because the program is working as designed.  Lots of illigitimate software out there.  If you're saying you've seen a handful of WGA false positives, are you absolutely sure it was a false positive?  How would you know?  Sometimes it's hard to spot a fake CD. PC Manufacturers have been caught selling brand new PC's without a valid license.

Who says?  Less than 1% could mean millions or 10, we don't know.  Only MS knows that and the article I read above says it's a handful which in MS speak is probably thousands or 10's of thousands, but not millions.  Also note that it says most of those were early on, like in 2005 when the software was first released and that the problem has been corrected.  False positive WGA failures are very rare according to MS.  If you don't believe MS, that's fine but it always struck me as much ado about nothing.  I've have worked for about 5 different VERY large companies that each have had 10s of thousands of PC's with Windows on them and I have yet to hear about a WGA false positive on any of them.  I'm pretty sure that if there was demonstrative proof that false positives happen all the time we would know about it.  It happens, but it's rare.

Setting aside the presumption that the "next WGA" is even capable of being rolled back, I'd rather take the responsibility of using my computer safely myself than give Microsoft the opportunity to arbitrarily make my computer useless.

Like I said, I rarely watch any non-Flash video on my PC anyway.

No modern consumer-grade router is going to ship without NAT (and for the record, when I said I didn't know anyone without a router, that's what I meant).

In any case, since this entire line of discussion is about me and what I do, I'm probably a bad example to pick if you're trying to prove a point.  I run NoScript on Firefox in Windows, I have a Linux fileserver that I use for browsing questionable sites at home, and I regularly set up Linux machines for friends and family that have had problems with malware.

So if this conversation has done anything, it's convinced me that I shouldn't be using Windows to browse the Internet at all.  Because I'm not using Windows Update, no matter how you slice it.

Agreed.  So if we were to talk about a typical Windows user, do you think it would be wise for them to install the updates?

Yes, my opinion. Hence the should.


False positives.

Yes, I'm sure they were real. They are actually not difficult to "cause". Switching components and IP address.

I've also seen quite a few false positives that MS might not consider false positives (but that their customer service reps "cleared" in the system, so that the license number would validate afterwards, which is an admission of a false positive). These were caused by people using a vendor-specific OEM Windows license on new computer. It was perfectly legal in the relevant jurisdiction (which is why Microsoft's customer service fixed it).



Very large companies don't use WGA, so that's not exactly a surprise.

They use WSUS servers to push specific patches to all their Windows computers. WSUS provides companies the ability to select exactly which patches are applied (and forced) to which systems. This level of fine-grained control is essential to ensure that mission-critical applications are not adversely affected by patches.

Then it was probably time for a reinstall anyway ;)


Your usage pattern doesn't seem to point to a NEED to run Windows, so why not jump ship completely?

I very, very rarely boot up in Windows (one thing that can cause problems with WGA), using Linux for everything.

This should not cause a false positive, it will however require you to reauthenticate.  That's 2 seperate issues.  Anytime you change components you have to reauthenticate, that doesn't necessarily mean it's going to fail WGA.

Depending on the circumstance this might be perfectly reasonable.  If the product key had been previously registered you might have to have customer service "clear" it.  That has actually happened to me when I've had to reinstall my OS several times.  While it might be inconvenient, it's not really a false positive.  Maybe that's not the case you are talking about, I'd have to know the exact circumstance.  For the most part it's explainable and not really a false positive on non geniune software, but more of a data issue that causes the WGA to require reauthenticating.  The point is that it can be cleared with a simple phone call to MS.

Agreed.  That was a bad example.

WGA will trigger an authentication failure in certain circumstances (I've seen it happen, so I know it happens). I suspect, but don't know for sure, that the IP address has to change as well. I believe this category of failures is why MS has introduced the new intermediate status.


BS. That's a false positive. Like I said, MS might not consider it one, but it is. WGA claims piracy. You product is properly licensed. ==> false positive.

Sure, these issues can be cleared by a simple phone call to MS, but I shouldn't HAVE to call MS (and doing that might not be so simple, esp. after work hours or during weekends / holidays) just to get the product I PAID FOR to work.

The simple fact is that if they didn't have a monopoly on operating systems (there are alternatives, yes, and I use one, but what they have is a monopoly), they wouldn't be pulling sh*t like this. They are making things difficult for their users, but they don't care. They have no incentive to care.

Games.

Failing WGA does not claim piracy, it simply claims that your system is not legally licensed which can happen for all sorts of reasons, piracy just being one of them.  Having a legal version of Windows on 2 different PC's for example is a license agreement failure of the WGA, it's not a piracy claim, so it depends on the situation.  Without knowing the specifics you can't really know why WGA failed and if MS can just clear it, it's not because you have an illegal copy of the software, it has something to do with the licensing agreement.  It's not really that they simply allow it to bypass the WGA, it's that MS already had some information on that particular license which conflicts with what it's now been given.  MS clears the old information and allows the new information to replace it which makes that system valid and the old one invalid.

I don't agree completely with you about what constitutes piracy, but since that's neither here nor there, I'll stop using the word in this discussion.

The bottom line is that when WGA reports a failure for a licensed copy of Windows, that's a false positive -- regardless of WHY that WGA failure happened. MS (and you, to some extent) seem to be redefining false positive to get as small a number as possible.

If I'm not breaking local legislation and have paid for my copy of Windows... ANY and ALL failure reports by WGA constitute a false positive.

And how does MS determine if you have paid for your copy of Windows?  They use the Product key that you provide to them.  If you provide a product key that is already registered within their database and you are using it on a different PC than it was registered with than that IS a violation of the license agreement.  There's no way for MS to know for sure whether it is in fact the same PC only with different hardware, so it makes you reauthorize that license key with that PC.  That is not a false positive, at least I don't agree that it's a false positive if you are saying it is.  Now if that's not the case, it may in fact be a false positive, but this is the most common reason as to why you have to reauthenticate and in most cases it's done automatically.  Sometimes it won't do it automatically and you have to call in and MS will do it manually for you, but MS will do it.

Is it flawless software?  No.  Is it Malware?  Hardly.

We're arguing a lot of different things, but let me just address some of the issues I have with WGA *on principle*:

- Microsoft added WGA after-the-fact, so the product that I purchased (of which Automatic Updates is a prominent feature that Microsoft advertises) was neutered to some extent. That's not generally permitted, as Sony recently found out with their removal of the "Install Other OS" option on the PS3.

- Microsoft tailored WGA to an internal ideal of what they would like the law to be. We like to call it a license and what-not, but the fact is that in most places, if I go down to a store and purchase a boxed version of Windows, I'm buying a PRODUCT (not a license to use a product) and those consumer rights cannot be taken away from me. What they should have done, although not as effective I grant, is tailor the WGA to the ACTUAL applicable laws. It would be a hassle, but that's what they should have done, if they really wanted to push something like  WGA on the public.

- Microsoft originally misrepresented what WGA was in an effort to get the widest possible adoption and subsequently refused to release instructions on how to remove the "update".

- Microsoft still won't come out and say clearly what information WGA collects and what their procedures are with regards to data retention. Just take a look at their FAQ on WGA (http://www.microsoft.com/genuine/downloads/faq.aspx?displaylang=en). It says "The tools collect such information as..." (my emphasis).

- In fact, Microsoft harvests a lot of information that is absolutely none of their business, including the MAC address of any networking cards installed and a GUID that, if leaked, can subsequently be used to connect MS Office documents uniquely to your system. No, I don't trust MS with my data.

So, yeah, I have a lot of problems with WGA and I don't think it should be legal in its current form. I also think its very clear that it qualifies as spyware under most definitions. Basically, if you explained exactly what WGA does without giving the product names, most people would consider it spyware. Why is it suddenly okay just because it's Microsoft? That makes no sense.

Is Windows a Virus?

No, Windows is not a virus. Here's what viruses do:

**** They replicate quickly - okay, Windows does that.

**** Viruses use up valuable system resources, slowing down the system as they do so - okay, Windows does that.

**** Viruses will, from time to time, trash your hard disk - okay, Windows does that too.

**** Viruses are usually carried, unknown to the user, along with valuable programs and systems. Sigh... Windows does that, too.

**** Viruses will occasionally make the user suspect their system is too slow (see 2) and the user will buy new hardware. Yup, that's with Windows, too.

Until now it seems Windows is a virus but there are fundamental differences:

**** Viruses are well supported by their authors, are running on most systems, their program code is fast, compact and efficient and they tend to become more sophisticated as they mature.

So Windows is not a virus.

It's a bug.

The courts disagree with you.  There are numerous cases where an End User License Agreement has withstood the test in a court of law.  Most recently the one with Blizzard and MDY industries comes to mind that Blizzard won. MDY is appealing.(http://dockets.justia.com/docket/arizona/azdce/2:2006cv02555/322017/)

The fact of the matter is that even if you don't realize it you are not purchasing the software you are licensing it from Microsoft and Microsoft is within it's rights to try to enforce that license agreement including preventing you from having full use of the software if you break it.  You may not agree with it, but companies can and do win lawsuits based on licensing agreements all the time.  This isn't something specific to Microsoft.

The fact of the matter is that someone sued MS over this very concept and the case was dismissed.  So while I respect your opinion, I think you have to admit that it doesn't seem to be supported in a court of law at the moment.  That could change and if it does, you won't see me trying to defend MS.  My problem is that a lot of folks don't like MS for the wrong reasons and they try to find any reason they can to put MS in a bad light regardless of the facts.  I'm not saying you are doing that here, just that it's a common problem.  As soon as someone comes up with the hard facts that prove MS is trying to push spyware on us, I'll be the first one on board to throw rocks at them, but opinion alone, I don't care how much of it there is, is not enough for me.

No, they don't.


Blizzard was selling an account in addition to the physical product. Microsoft is not. Blizzard cannot prevent someone from selling the product. The account is another issue. Perhaps Microsoft could leverage this concept and put essential parts of Windows "in the cloud", I don't know, but that's not what they are doing.


Companies can and do lose lawsuits all the time where they try to act like they are not selling a physical property when in reality they are. The first-sale doctrine, for example, has been held to apply to software products.

I'm not saying EULAs are illegal or not enforceable, although their legal basis is not nearly as solid as you infer. However, EULAs cannot take away fundamental consumer rights.

When I purchase Windows, I purchase the product. No, I am not allowed to COPY the product (except for making a backup, although companies try to prevent that all the time -- fortunately, it appears the SCOTUS has struck down even the DMCA barrier to making backups), just like I would not be allowed to make a copy of any number of other products, including music and books. The PRODUCT, however, is mine to do with as I please (in this context, doesn't include copying / distributing etc) and courts have held that time and time again (with a few mishaps here and there, sadly).

Companies, including Microsoft, are constantly trying to increase their control over how we use their products. That is NOT LEGAL. They have NO RIGHT to do so and the courts have held as much. However, when people like you (it appears -- sorry for the ad hominem attack) believe that whatever they write in EULAs, TOSes etc is valid, regardless, then they've pretty much already won.

I brought it up earlier, but it's not entirely unlike the warnings at the beginning of sports broadcasts or DVDs. I recall discussion on this very site where people simply took that for granted (not being allowed to reproduce, in whole or in part, for any reason) and were completely sold on it. While the courts hold that this is in fact NOT the case (despite the "TOS" displayed), it doesn't really matter if everyone believes the companies.


There are plenty of valid reasons for disliking, and distrusting, Microsoft -- including the numerous times they have been found (in a court of law) to be breaking laws, repeatedly and deliberately, and their top officers lying under oath. Sadly, if you're the CEO of a big corporation, you can get away with lying under oath in court or before Congress. Such has always been the case, it seems.

Ok, I'm done.  I won't argue with you over whether or not the courts agree with you on license agreements.  That was in fact one of the exact arguments that MDY tried to use in the case they lost.  I guess they didn't actually lose the case either.  Below is the judges ruling in the case they lost.

Public Knowledge’s amicus brief contends that WoW users are “owners” of copies of the game client software within the meaning of section 117, that copying the software to
RAM is an essential step in using the game client software, and that the act of copying to RAM is, therefore, not an infringement, even when done in connection with Glider.
Dkt. #65. MDY adopts this argument in its reply memorandum. Dkt. #69 at 2, 5, & n.7.

The resolution of this issue is controlled by Ninth Circuit law. At least three cases – MAI, Triad, and Wall Data Inc. v. Los Angeles County Sheriff’s Department, 447 F.3d 769
(9th Cir. 2006) – hold that licensees of a computer program do not “own” their copy of the program and therefore are not entitled to a section 117 defense. See MAI, 991 F.2d at 518
n.5; Triad 64 F.3d at 1333; Wall Data, 447 F.3d at 784-85. Wall Data provides a two-part test for determining whether the purchaser of a copy of a software program is a licensee or
an owner: if the copyright holder (1) makes clear that it is granting a license to the copy of the software, and (2) imposes significant restrictions on the use or transfer of the copy, then the transaction is a license, not a sale, and the purchaser of the copy is a licensee, not an “owner” within the meaning of section 117. Wall Data, 447 F.3d at 785.

Under the two-part test for ownership in Wall Data, the transactions between Blizzard and persons who acquire copies of its game client software are licenses, not sales.

First, Blizzard makes clear that it is granting a license. The EULA expressly states in section 1 that Blizzard is granting a “limited license.” Dkt. #42 at 2. Section 3 goes further and states that â�

I have only read two court cases on software licenses agreements. (They were in my contract text book.) Two different courts.  Exact same issue regarding enforceability.  Two exact opposite results.

While I am not an expert on this particular area of law, it is my understanding that this is still very much an area of unsettled law.  That what the courts have said in one state or one federal circuit can vary greatly from another state or federal circuit.  And that both Pappy and fyo can find case law that supports their position.

Pappy13, you keep saying that the lawsuit against Microsoft (re: is WGA spyware?) was "dismissed," but it was dismissed the day after Microsoft and the plaintiffs agreed to drop the lawsuit. (http://www.computerworld.com/s/article/9154178/Judge_dismisses_Windows_anti_piracy_software_lawsuit)  This hardly proves anything about whether or not WGA qualifies as spyware.

As I already said, according to Microsoft's own definition, WGA is spyware.

The plaintiffs agreed to drop the lawsuit a month after the Judge ruled they couldn't make the case a class action suit which is what they were wanting.  When you are the plantiff and you agree to drop the lawsuit, you know you have lost or at the very least the odds are stacked against you and it's not worth pursuing.  If it's so clear, why did they drop the lawsuit?  Strange thing to do when it's so clear wouldn't you say?

Well this was a fairly recent case and fairly well known.  I know there were a lot of very upset people with the outcome, like Public Knowledge for instance because of the precedent it set. Public Knowledge did argue almost exactly what FYO mentioned in his post and the judge ruled against them.

I'd be interested to read about the other case if you have it.

I am pretty sure neither of the cases I read is the ones you are referring to.  My point is on various issues regarding legal issues in this area there is no settled law.  There is a split among the courts. Unless or until the supremes weighs in, it will remain that way.  Cases being well known or more recent do not make them more important. 

And if it is the situation where the parties settled out of court it is completely meaningless. 

It is possible that there has been s.ct cases that have settled some of the conflicting issues, I haven't really been following along much as this is an area of law I find about as interesting a paint drying. 

Meaningless as a point of law.

Very simple reason.  There are costs involved in suing someone. And in a suit like this it cost lots of money to pay attys, experts, etc.

The plaintiffs wanted this case to be class action because that allows them to sue on behalf of everyone who has ever purchased the product.  Lots of $$$.  The judge said…nope.  You can only sue on your own behalf.  Very little money, not enough to even cover the legal bills of the suits.  Plaintiffs drop the suit.  Says absolutely nothing about whether the plaintiffs would have won on the merits.  It just wasn’t worth the money to pursue it anymore.  If it was class action the legal costs would have been spread out over everyone in the class.   

That was your entire point in mentioning that lawsuit!  You were claiming that THE LAW said that WGA is not spyware!

If we don't care about points of law, then (once again) by Microsoft's own definition, WGA is spyware.

You misunderstood what I meant when I said it's meaningless as a point of law.  What I mean by that is that it can't be used in a court of law.  You can't in a court room argue something based on a case that was dismissed.  You can only argue based on something that was actually ruled on.  So from a court of law perspective it's meaningless.  It's absolutely NOT meaningless outside a court of law.  They tried to sue and they failed.  Pure and simple.  You can spin it any way you want, but the fact of the matter is they realized they weren't going to win the lawsuit.  That's meaningful outside a court of law, just not inside one.

That's a nice way to spin it.  They would have gotten all their costs back and more if they won so what does that mean?  It means they figured their chances of winning were small, so they dropped the suit. 

Not necessarily.  Plenty of people have won and lost money on the deal. 

Dropping a case is meaningless for precedent.  Heck even winning at trial is meaningless.

The only way thing that creates precedent is an appeal. 

Pappy13, if I am to understand you correctly, you are saying that any time someone drops a case, it proves that the other side was right?

P.S. I notice that you have yet to address the fact that WGA meets Microsoft's own definition of spyware.

No, it doesn't prove the other side was right, but I think it does say something about the strength of their case.  If you think you can win the case you don't drop it.  To suggest anyone would is silly.  Now maybe you don't bring the lawsuit in the first place even if you think you can win because of money, but once you start heading down that road you don't simply give up if you think you can win.  You give up when you don't think you can win.

Obviously Microsoft's definition is wrong if it defines WGA because it's not spyware.

In his January ruling, the judge had also said that Microsoft could demand compensation for the money it spent contesting the class-action charges. At the time, he gave Microsoft until Feb. 12 to come up with its expense report.  As part of the stipulation to dismiss the case, however, the plaintiffs and Microsoft agreed that each would pay their own attorneys' costs and fees.

Perhaps they were just worried that they would eventually lose the case and end up having to pay Microsoft's fees?

How about "they were worried that even winning the case wouldn't provide them enough money to pay for their own attorney's fees"?

Litigation is expensive.  Even if you think you can prove that WGA is spyware, unless you can also prove that the damage caused by it was great enough that you can get a substantial judgment in your favor, it's a waste of time to proceed with the trial.  The amount of legal fees they would run up (for going through with the entire trial) could greatly outstrip the money they get from MS.

Even if they could get their attorney's fees as part of the judgment, there's still the issue of the time involved vs. what you expect to get in return.  Do you think it's a pure, random coincidence that they agreed to drop the case right after the judge said that they didn't have the standing to make their lawsuit class-action?  Did WGA somehow magically become less intrusive because of that ruling?

Since you seem to be certain of what is and is not spyware, please provide me a link to the definition you are using.

Because it seems like the only reason you object to the classification of WGA as spyware is because Microsoft created it.

Absolutely not.  As soon as the judge told them that they couldn't make it a class action suit they knew that MS was under no pressure to give in.  They were hoping that the possibility of a class-action suit where MS could lose millions would force MS to make a deal.  When that went out the window, the advantage they had also went out the window.  At that point they knew they would have to win the case to get anything and if they lost they would end up owing MS money.  THAT's when they decided it wasn't worth it and agreed to dismiss the case.  I think that says a LOT about what they thought their chances were of winning the case.

The question as to whether or not something is spyware is simple, it's simply a matter of intent.  Microsoft was merely trying to enforce their license agreements with their customers, their is absolutely no evidence that they were trying to do something malicious.  Therefore it's not malware.

If you absolutely must have a link, how about a quote from wikipedia's malware entry. http://en.wikipedia.org/wiki/Malware

"Software is considered to be malware based on the perceived intent of the creator rather than any particular features"

I think this discussion has run it's course and strayed off topic far enough now.  I will drop it.

Why are you substituting "malware" for "spyware"?  They are not interchangeable; spyware is merely one kind of malware.

Are you seriously claiming that because Microsoft only wanted to "enforce their license agreement" (using a method of questionable legality), that automatically makes it OK?  So I guess you have no problem with Sony's audio CDs installing rootkits on Windows PCs (http://en.wikipedia.org/wiki/Sony_BMG_CD_copy_protection_scandal) that they were inserted into, because Sony was "only trying to protect its intellectual property rights by preventing people from copying the disc"?

Unauthorized spying is still spying, regardless of the reason.  If Disney thinks I might be distributing bootleg DVDs of The Little Mermaid, that does not automatically give them the right to install a program on my PC that reports my activity to them.  The law does not work like that.

No they are not interchangable in all regards, but all spyware IS malware.  Not all malware is spyware.

I'm done discussing this.  We've gone from whether people should install MS updates to WGA false positives to the legality of license agreements to what does a dismissed lawsuit mean to is WGA spyware and now onto what software companies can legally do to protect their license agreements.  I'm not going to get into the DMCA and what you can and can't do legally.

Lets just agree to disagree.

I was rereading some of this thread when I came across the above and I wanted to respond to it.  Sorry I missed this the first time through and sorry for continuing the debate after I said I was done, but I think this is an interesting point you brought up and worth a little more discourse.

I think what you are referring to is the "non-literal bits", not the account.  Never once did I see the account mentioned in the trial transcripts.  MDY tried to argue that Warden wasn't a technological device that controlled access to Blizzard's software because the software itself had no copy protection on it.  You could read the contents of the disk, copy them, even put them in some kind of viewer to view them all without the need for Warden.  The judge ruled they were absolutely correct about that, but he called that the "literal bits" of the software and that what Blizzard was really copyrighting were not these literal bits of software found on the CD but actually the whole package including the non-literal bits you could only access through the servers.  Blizzard claimed that you could only experience WoW fully by connecting to their servers and access to their servers was controlled by Warden and therefore Warden was a technological device that controlled access to the copyrighted game and the judge agreed.

In fact you could argue that WGA is to Windows what Warden is to WoW.  It's a technological device that controls access to the copyrighted material.  In effect MS HAS put a part of Windows (MS Updates) in the "cloud".  You can't access those non-literal bits unless you satisfy WGA.

But this was only pertinent to the DMCA claim, it had absolutely nothing whatsoever to do with the licensing agreement.  I copied and pasted the relevant portion of the judges findings about the licensing agreement and it never mentions the account nor does it mention the literal or non-literal bits.  That's an entirely different argument and has nothing in common with MS and it's licensing agreement.  The ruling the judge made as far as the licensing agreement that Blizzard had with it's users would apply equally as well with the one that MS has with it's users.  You're correct that the EULA cannot overstep the rights granted to the user by law, but only those specific rights granted to the user are immune, any other relevant portions of the EULA would still apply.

I thought you were referencing the first-sale case of WoW, not whether or not someone has the right to produce a "cheat" (or, presumably, other application that hooks into and takes control of a WoW account or similar) for an online game.

In my opinion, the case you reference has zero bearing on the topic we were discussing.

And, I *am* done posting in this thread ;)