full-disclosure - RE: Windows 2000 Service Pack 3 now available.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: RE: Windows 2000 Service Pack 3 now available.

Colin Stefani <cstefani@...eworks.com> wrote:

> Be sure to read the new EULA/privacy statement for Windows update, it has an
> interesting portion about how Windows Update and Automatic Update (which
> gets installed with SP3) can, by agreeing to this license, send the
> following pieces of info to Microsoft, this was posted on the MS focus list
> by Javier Sanchez:
> 
> "With the latest version of Windows Update (essentially a mandatory download
> and now part of SP3) you consent to sending the following information to
> Microsoft:
> 
> * Operating-system version number and Product Identification number 
> * Internet Explorer version number 
> * Version numbers of other software 
> * Plug and Play ID numbers of hardware devices 

This adds further irony to the blurb about enabling scripting and 
ActiveX, should you visit those pages with (a browser masquerading 
as) IE with no scripting nor ActiveX support:

   If you are on a Web site that you trust (in this case, Windows
   Update), and the ActiveX Control is provided by a publisher you 
   trust (in this case, Microsoft), it is safe to click Yes in the 
   dialog box to accept the certificate and allow the control to be 
   installed.

Seems MS is attempting to redefine "trustworthy" how it once tried to 
redefine "open" (who else remembers the early NT launches??).

It seems the option "trust MS enough to run its software but not with 
any possibly identifying information" falls outside the gambit of 
"trustworthy" in MS-think!  I hope they point this out _in advance of 
taking their money_ to all future potential customers...

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854