Community Outrage Over Unauthorized Windows Updates
Most people are aware that Windows comes with an Automatic Updates feature. I recommend that users, particularly home users, turn this feature on and let Windows do the dirty work of downloading and applying the appropriate patches and updates. When you are configuring Automatic Updates though, there are actually four options. You can choose to have Windows automatically download and install updates, automatically download and let you install updates, notify you that updates are available for download, or just never check for updates. Seems simple enough, right?
Well, you would think so. But, it was recently discovered that even users who chose one of the three options that should not automatically install the updates, are being updated without their knowledge. Some users- especially those at small and medium companies that may have reason not to update or have protocols in place to test and validate patches before installation- are irate that Microsoft would do such a thing. Microsoft has issued apologies and explanations regarding the matter. Scott Dunn at WindowsSecrets.com has written a detailed article with step-by-step instructions to make sure that your system does not get secretly updated by Microsoft without your knowledge. For most home users though, I recommend just leaving things alone, especially since I recommend that home users configure Automatic Updates to actually install the updates to begin with.
September 25th, 2007 at 5:00 pm
understanding this message is key to understanding the troubles in computer security today
if you read essays on computer security, particularly related to public key systems ( PKI ) and certificate authorities ( CA ) you will quickly learn that you must protect your computer from un-authorized use and tampering. both from the physical security aspect (OPSEC) but also from the network/internet/communications (COMSEC) aspect
adequate OPSEC is likely attainable for most individuals considering using their computer for electronic commerce but while microsoft continues to refuse to provide COMSEC their OS will continue to be unsafe to use for electronic commerce or for any business which requires COMSEC
it’s a sad state of affairs. the sooner the general public recognizes the severity of this issue the sooner we will get ourselves right. only after we get ourselves right will we be able to conduct our sensitive business electronically with reasonable confidence that we will not be robbed or compromised.