Feeds

MS security patch EULA gives Billg admin privileges on your box

It's finally happened

  • alert
  • submit to reddit

High performance access to file storage

If you caught our recent coverage of the Windows Media Player trio of security holes you may have followed a link to the TechNet download site for a patch, or you might have activated Windows Update. If you did the former (though, oddly, not if you did the latter), you would have been confronted with an End User License Agreement (EULA) stating, most ominously, that:

"You agree that in order to protect the integrity of content and software protected by digital rights management ('Secure Content'), Microsoft may provide security related updates to the OS Components that will be automatically downloaded onto your computer. These security related updates may disable your ability to copy and/or play Secure Content and use other software on your computer. If we provide such a security update, we will use reasonable efforts to post notices on a web site explaining the update."

"Reasonable efforts to post notices" somewhere on the Web. I think it's clear from the wording that MS has absolutely no intention of bringing this behavior to our attention.

Instead, Microsoft has just assumed the right to attack your computer and surreptitiously install code of its choosing. You will not be warned; you will not be offered an opportunity examine the download or refuse it. MS will simply connect remotely and install what it will, or install it secretly when you contact them.

This means MS will have administrator privileges on your personal computer. What they feed you may be infected with viruses; it may break your applications, corrupt data files, destroy weeks or months or even years of work, but you'll have no recourse if it does. By downloading this WMP critical security patch, which you must do to operate WMP safely, you'll agree to give Billg deed and title to your personal property and to leave Microsoft immune from legal retaliation if they damage your machine.

The pusillanimity of wrapping what amounts to a digital land-grant into a needed, critical security patch is matched only by the arrogance of assuming that Windows is now such a fundamental linchpin of a human life worth living that no retaliation in the courts or at the retail counters is conceivable. (And that's not to mention 'informal' retaliation by outraged IP warriors, which we fully expect to see.)

We've heard the Billg rubbish about Trustworthy Computing until we're sick to death of the trivial incantation. Ironically, Microsoft has just taken steps to make the Internet immensely more untrustworthy than it already is. When we know that arbitrary code will be secretely installed on our connected boxes by software vendors who are not accountable for the damage they may do, any issue of trust is obliterated.

May I suggest my (personally) favorite solution to that problem? ®

Combat fraud and increase customer satisfaction

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Inside the Hekaton: SQL Server 2014's database engine deconstructed
Nadella's database sqares the circle of cheap memory vs speed
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
IRS boss on XP migration: 'Classic fix the airplane while you're flying it attempt'
Plus: Condoleezza Rice at Dropbox 'maybe she can find ... weapons of mass destruction'
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
New Facebook phone app allows you to stalk your mates
Nearby Friends feature goes live in a few weeks
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.