Win2K SP3 EULA Legalities

I have seen mention by a few people in various threads that they are not going to implement Windows 2000 SP3 due to the wording of the EULA.

I believe the same wording applies to Windows XP SP1 and the crux of the issue seems to be that by agreeing to the EULA you are agreeing that Microsoft can make updates to your system without your knowledge or consent.

Most companies have extensive patch testing and implementation policies designed to protect business-critical systems from crashing. Obviously, having Microsoft update your system at their discretion goes against this and could make for a very unstable system.

This also seems to violate certain requirements of laws like HIPAA and GLBA that require systems be secure.

Here is my question though- does anyone know on what port or through what service Microsoft intends to perform these updates? If you have your systems locked down and you are protected by a perimeter firewall wouldn't you be able to block Microsoft from entering your network whether you agreed to the EULA or not?

After using AntiSPY on XP...

The only traffic that I see trying to contact m$ is the windows update.
Since I have disabled that service, I haven't seen any unrequested taffic since.

I periodically fire up ethereal to see what is going on. All of the traffic I have seen is legitimate.

I have win2ksp3 installed on a win2k pro workstation and I also have WinXPsp1 installed on a XPpro workstation.

phishphreek is absolutly correct, you should be able to stop it any unwanted traffic.

AntiSPY is a good way of tweaking a lot of WinXP's settings, and preventing unauthorised access to your server/PC by MS. You can disable services that you don't need (like Windows Update).

However, if you have a decent firewall, you will be able to detect this anyway, and disable the unwonted traffic. Even if you don't get it quite right to start off with you should have traffic & packet logs from your firewall to see exactly what happened, which means you can then adjust your firewall to prevent unauthorised access by MS.

And no, as I understand this, it does not violate the EULA - it's up to you which services you run, and which you choose to disable/block.

A good firewall should be able to take car e of the unwanted traffic for now which is what we are doing.... the issues is not what is Microsoft doing now (windows update that you can turn off) but what are they going to do in the next few versions of windows that has us worried. We don't know...but it would be trivial to create the system in such a way that if it didn't talk to MS consistently it would stop working (XP home) forcing you to keep the port open. We se the EUAL as the prep for this type of system they have already expressed an interest in turning windows into a web service. this would just be the first act.

yeah, sounds like it won't be too long before they start making ms office run from the internet only and make buisnesses subscribe to it monthly to keep it running, I'm about certain it's gonna happen. :(

I think all of us can accept that the M$ or anyone software can have bugs and things like that, but i also think no one of us will permit them to make "..upgrades.." when they think we need it .....

xDrack.

Quote:

---

Originally posted here by XDrack
I think all of us can accept that the M$ or anyone software can have bugs and things like that, but i also think no one of us will permit them to make "..upgrades.." when they think we need it .....

xDrack.

---

But thats the issue they can force upgrades on us the EULA that you agreed to says so, if you are in the US that EULA has the backing of the DCMA. But they don't need legal backing look at XP home or Office XP "connect to a MS server or the program wont work" it wouldn't be that hard to change the code into "stay connected to a MS server or the program wont work"

Quote:

---

Originally posted here by UpperCell
yeah, sounds like it won't be too long before they start making ms office run from the internet only and make buisnesses subscribe to it monthly to keep it running, I'm about certain it's gonna happen. :(

---

We need ALTERNATIVES!

Does anyone really believe that a web-based subscription model for apps like Office will actually work or has ANY benefit for anyone but M$? I will fight this in every way possible, including refusing to purchase the upgrade that forces me to run the application software off the Internet.

M$ can only force us into it if there are no alternatives or if there are alternatives but we don't take advantage of them.

Director

Quote:

---

Originally posted here by bballad
A good firewall should be able to take car e of the unwanted traffic for now which is what we are doing.... the issues is not what is Microsoft doing now (windows update that you can turn off) but what are they going to do in the next few versions of windows that has us worried. We don't know...but it would be trivial to create the system in such a way that if it didn't talk to MS consistently it would stop working (XP home) forcing you to keep the port open. We se the EUAL as the prep for this type of system they have already expressed an interest in turning windows into a web service. this would just be the first act.

---

I think you are being a bit paranoid with regards XP home (or XP pro come to that), as the vast majority of users across the world do not have a permanent net connection :)
There is no way MS could get that to work .... lets say they try and do it via IE - well what's wrong with Netscape, Opera etc ??

Office is a different kettle of fish, as it is likely that new versions may require you to 'pay as you go', but if that happens maybe you should be looking elsewhere for your software?

I am not sure if the web-based subscription will be accepted by users but Application Service Providers{the other ASP} have been around a bit. I manage Citrix doing exactly that and the concept is ok. I think for businesses it might be a solution once security gets worked over. I can’t see home users who might only need to read documents sent to them and create simple papers for personal use. That is why I was blown away by OpenOffice when I loaded RH 8. I think it will be big in the home / personal market place.

I have been a Windows user for a long time and a Mac user for even longer and I am not thrilled with the EULA but have to use it for now. I was reluctant to switch from my Mac to Windows because of functionality I had, but over time I can do anything I need to on the PC. I am also working with Linux as much as I can so maybe some day I will make the switch again.

In the trade rags for M$ people I see more and more of their professionals screaming about either the price for their product and the EULA changes. There are loads of people sending M$ a message, so far there has been little change. We’ll see what the future holds.

Let me see if I can find some quotes or articles to back that up, I've heard it over and over again from people I considered experts, and from my point of view, it's perfectly reasonable, at least for buisnesses, to be forced to have always on inet to use these services, and you know ms will come up with a way to have a client prog that only works as itself, not through a browser. they will no doubt do this under the guise of 'the latest software' or 'the way todays buisness works' and other companies like corell will most likely be forced to develop similar services or their products will be considered out of date.

*IMPORTANT* Don't take my word for it, I'll try and get some stuff to back it up, if I can't just ignore my post it's pure speculation at this point. :)

Quote:

---

Originally posted here by UpperCell
Let me see if I can find some quotes or articles to back that up, I've heard it over and over again from people I considered experts, and from my point of view, it's perfectly reasonable, at least for buisnesses, to be forced to have always on inet to use these services, and you know ms will come up with a way to have a client prog that only works as itself, not through a browser. they will no doubt do this under the guise of 'the latest software' or 'the way todays buisness works' and other companies like corell will most likely be forced to develop similar services or their products will be considered out of date.

*IMPORTANT* Don't take my word for it, I'll try and get some stuff to back it up, if I can't just ignore my post it's pure speculation at this point. :)

---

But see that’s where you and MS are wrong. In my industry we are required to guaranty customer data privacy. If suddenly there are untested (untested wit hour software) patches hitting our systems, and third parties accessing our server we are in violation of the law and face stiff penalties / loss of licensing that’s a very bad thing. The new MS EULA violates those regulations and if they where to enforce them we would be SOL so ya this is a very big concern.

And if you hadn't noticed MS patches have a bad habit of breaking other programs, this is why we test all patches on a secondary box first...if the patches are pushed at us without our knowledge we could be doing a lot of restoring from backups.

Quote:

---

Originally posted here by bballad


But see that’s where you and MS are wrong. In my industry we are required to guaranty customer data privacy. If suddenly there are untested (untested wit hour software) patches hitting our systems, and third parties accessing our server we are in violation of the law and face stiff penalties / loss of licensing that’s a very bad thing. The new MS EULA violates those regulations and if they where to enforce them we would be SOL so ya this is a very big concern.

And if you hadn't noticed MS patches have a bad habit of breaking other programs, this is why we test all patches on a secondary box first...if the patches are pushed at us without our knowledge we could be doing a lot of restoring from backups.

---

Well, I agree absoultely.

Why should MS have the ability to update your software without your knowledge?

If they say they are going to charge for MS/Office on line then fair enough - you can always look for alternative products..

You are already paying too much for your software... there are plenty of opensource alternatives... right now.
Unless m$ gets their way with palladium...

OpenOffice is fine for me! It does everything I need at both work and for school. It just doesn't have an e-mail client or database client. There are plenty of other alternatives for those too... who said those have to be in your "office suite"?

/*rant
Alternatives are all nice and what not ...and we are looking into them but what it comes down to is this. If MS has there way and this EULA is enforced I will have a bunch of systems running critical apps that can't be updated. I will have a bunch of systems that where paid for that are not at EOL that can't be fixed, and that have security holes that should be fixed. It will take a long time to rewrite all of our internal code in another language (its in vb..am I going to have to retrain the programmers in perl..that takes time..hire new ones that takes time) during that time we are sol :mad: In the mean time I make sure the firewall is configed correctly and hope to hell no one decides to take their laptop home and gets it infected with something.

It would be nice if I could expect patches for systems that I paid for although we are looking at the enabler program that will let us not agree to the EUAL and still install the software.
rant*/

sorry for the rant its been a long day disscuessing this issue with the department. The devlopers are of the mind to ignore the whole isue and hope the regulators don't investigate

Quote:

---

Originally posted here by bballad
sorry for the rant its been a long day disscuessing this issue with the department. The devlopers are of the mind to ignore the whole isue and hope the regulators don't investigate

---

You know -- I would never recommend that. My boss though, (EVP of Ops) now he's another story.... :D

Director