Langa Letter: Microsoft's Controversial New EULA Terms
Fred Langa looks at the new language in Microsoft's End User License Agreement, and shows how you can protect yourself against unwanted software updates.
As the Register acknowledged in its newest posting, the key word there is "may," as in "... Microsoft may automatically check the version of the OS Product and/or its components ...". (Emphasis added.) This checking is under your control. It happens only if or when you allow an update to occur.
For example, I downloaded and installed SP3 on a copy of Windows 2000 here. I had previously disallowed any automatic updating to occur because I want to choose when, what, and how my operating systems get altered. After SP3 installed, the Windows Update icon was in my system tray, with a standard "balloon help" dialog suggesting that I turn on automatic updates. I declined, and automatic updating was not, repeat not, turned on. (The Update reminder in the system tray is annoying, but is not in itself a threat to security or privacy.)
This isn't new behavior. It's been going on for some time in all versions of Windows software that offers the option for automatic updates, including Windows Update itself. For instance, if you tell the software that it's OK for it automatically to download and install new patches as they appear, then that's what will happen. But, despite sensational articles and users' fears to the contrary, I have neither seen nor heard of any case--not even one--where an auto-updater violated the user's express wishes. In every case I've seen or heard of, if you tell the auto-updater not to download and install things without your express permission, it won't. Likewise, if you decline any available manual updates, they don't install.
As far as I can tell, the only thing that's really changed is that Microsoft is now spelling out the actions of its updaters in the EULA, probably to cover its butt legally, so that if people allow updating to happen, they can't later claim they had no idea that it meant that their software will be checked and changed.
Rational Watchfulness, Not Paranoia
Even though the EULA isn't really doing anything new, I still continue to believe that auto-updating is in principle a very, very bad idea. That's why I've always recommended that you not allow any software to update itself automatically. Instead, I've always suggested that you check for updates manually, and install only those that you're sure you want and need. For example, item #4 in "Ten Ways To Make Windows XP Run Better" says:
Just Say "No" To Phoning Home
By default, XP wants to contact the Microsoft servers to auto-search for patches, downloads, and updates...
You can turn [it off] by right clicking on My Computer, selecting Properties, and choosing the Automatic Updates tab. Select either Turn Off or, minimally, Notify Me.
The same principle applies to other versions of Windows software (including Windows Update): Turn off the auto-update feature, and no auto-updating will happen. That puts you in control of the whole update process.
And even with manual updates, I'm not suggesting that you simply trust Microsoft (or anyone else) to have your best interests at heart. For example, I've also long advocated using a desktop firewall (like Sygate or ZoneAlarm) that alerts you when any software tries to dial out or phone home. That way, if any secret updating tries to go on against your express wishes, you'll know and can stop it by denying outbound access to the update component. (See "Firewall Feedback" and "How Much Protection Is Enough?" )
Manual updates need attention, too: Before you allow a manual update to proceed, take a moment to read in full what the update, patch, bug fix, or upgrade actually contains, and to check the fine print to ensure that you're not agreeing to anything you don't want or need. If you see something in the software or legal language that alarms you, simply decline the update.
Combined, those three steps--turning off auto-updates, using software to watch for illicit back-channel communication, and using care and caution in applying manual patches--should prevent unwanted changes from happening on your PC.
But even if an unwanted software change does somehow slip past your defenses, you're still not powerless: A good system of backups will ensure that you can always put your system back the way it was prior to any change, wanted or otherwise. (See "Fast, Easy Backups
Building A Mobile Business MindsetAmong 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps – and it's past time for those with no plans to get cracking.
InformationWeek Must Reads Oct. 21, 2014InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.