In article <1189759736.25369@ftpsrv1>,
says...
> from Nick White, Vista Product Manager at Microsoft ...
> "This self-updating is done regardless of whether the user has enabled
> automatic checking, download and/or installation of updates."
> http://windowsvistablog.com/blogs/wi...c-updates.aspx
Yes, and then he further gives a link to the Update Product Team Blog:
http://blogs.technet.com/mu/
Where, if/when you read the full document you will come across the following:
Begin quote >>
The point of this explanation is not to suggest that we were as transparent as
we could have been; to the contrary, people have told us that we should have
been clearer on how Windows Update behaves when it updates itself. This is
helpful and important feedback, and we are now looking at the best way to
clarify WU=3Fs behavior to customers so that they can more clearly understand how
WU works.
<< end quote
and just below you can read:
Begin quote>>
Before closing, I would like to address another misconception that I have seen
publically reported. WU does not automatically update itself when Automatic
Updates is turned off, this only happens when the customer is using WU to
automatically install upgrades or to be notified of updates.
<< end quote.
In other words: if you turn it off, it's OFF. If you have it on any other
setting, it will update itself to maintain functionality. When it's OFF it will
NOT go online and update itself.
Fair enough. Hell, they even say that they should have made the functionality
of the thing more transparent. What more can you ask for?
This is one conspiracy theory that doesn't wash.
>
> and from Bruce Simpson ...
> "And, if Microsoft is effectively using a "silent back door" to your
> computer, what happens when some "evil little sod" (ELS) cracks the
> protection such a system (hopefully) has built into it. ...
> So, given that it's been proven MS has (and is willing to use) a back-door
> into your PC, how on earth can we be sure that this isn't being used for
> whatever purpose suits those who have access to such a system? We all know
> that power and abuse of power go hand in hand - and the chances of the
> later are almost directly proportional to the level of the former."
> http://aardvark.co.nz/daily/2007/0914.shtml
Exactly. This is why I keep Windows Update turned OFF. I don't need unwatched
backdoors into my system. I control what updates I want and what gets
installed. The issue Bruce raises is one reason why I was so horrified by the
whole rootkit saga. Any backdoor, any stealthing can potentially be exploited
by ELSs. Imagine the botnet one could create by slipping a fraudulent dns
record used by such software into one of the backbone servers for a mere 15
minutes ... how secure is WU handshaking/authentication I wonder? There are
some very very capable hackers working out of Russia and Romania (among other
places) some of whom are black hats working for syndicates with lots of
resources.
Co-incidentally:
One of my first experiences after installing XP was, literally seconds after I
went online with it the first time, and before I had had/taken the opportunity
to batten down the hatches (well,I was about to _get_ an up-to-date firewall),
my system was hacked, either via Windows Update or by spoofing it somehow, &
very well. It started downloading and installing automatically (I was not using
IE, and whatever it was did not come from MS). After gaping at the screen for a
couple seconds like a stunned mullet I hit the hard reset switch. It didn't
finish doing whatever ...
It never happened again
-P.
--
=========================================
firstname dot lastname at gmail fullstop com