August 7, 2002

A month or so ago, Microsoft changed the licensing agreement for Windows Media Player without notice in a way that would allow Microsoft to arbitrarily disable software on your computer, in the name of Digital Rights Management compliance. This change was piggybacked on a patch that fixed a security hole in the Player. Unwilling to give an external company this kind of control over my computer, I uninstalled Windows Media Player. The only other choice was to use an older version of the Player with known security holes in it.

Now, Microsoft has implemented a licensing agreement change in security patches for Windows 2000 and Windows XP that allows Microsoft to automatically install software on your computer without your knowledge or explicit consent. While Digital Rights Management facilities are not explicitly mentioned, this is obviously covered by "upgrades," especially given the Media Player incident. I can live without Media Player. Uninstalling Windows is a much bigger ordeal.

I used to consider Microsoft's free critical patch service a morally and socially responsible thing for the company to do, especially considering the severe lack of accountability software companies have for selling faulty merchandise (thanks to licensing agreements that overwhelmingly favor the software vendor). The service makes up for the sad realities of software quality by providing to me the functional, secure product which I paid for in the first place, and should therefore be delivered to me under the license I agreed to when I purchased the software. Holding security fixes hostage with a ransom of signing over my rights to privacy is appallingly immoral, and ought to be illegal.

Software licensing is a complex issue, of course, and "ought to be illegal" is easy enough to say without proposing an actual working legal philosophy for the software industry. I want to explore some of these issues here, but for now, just remember that the way it appears-- that you "agreed" to a "use as is" license, that software is not owned, that bug fixes or simply license to use a software product are an on-going "service" provided by the vendor, and that the vendor can require agreement to license changes at any time during continued use of the service-- is the way software vendors want it to be and want you to believe it is, not the way it actually is or ought to be.

In the meantime, there's not much I can do but be outraged and look for alternatives. Time to get a Mac? Time to make Linux my primary OS? I can't leave an unpatched Windows machine connected to the Internet, and I can't agree to a "license" that gives Microsoft undue control over my computer (including the ability to limit my control of my computer). It doesn't matter that I'm not violating a sensible notion of a DRM policy, I don't trust Microsoft to set that policy, I don't trust Microsoft to install a software installation pipe to my hard drive open to the Internet, and I won't sign any contract that allows another party to control or limit my computer without my explicit, knowledgeable consent. Even if click-thru software licensing agreements are not legally binding, this license change is effectively notice that Microsoft will be attempting to deploy such methods, and I cannot allow that kind of software on my computer.

comments...

Donny, August 7, 2002 8:54 AM:

You can install SP3 and then immediately disable the Automatic Updates Service. This will prevent the OS from automatically downloading and/or installing code that you may or may not want.

Dan Sanderson, August 7, 2002 11:30 AM:

But I cannot disable the aspect of the licensing that contractually allows Microsoft to modify my computer, regardless of the Automatic Updates Service.



If all Microsoft wanted to do was include an auto-patcher to more quickly deploy security fixes on the majority of machines, all they need to do is offer to the user to install that software and ask permission then. Those who want to see the updates as they come in can turn on notification and require explicit permission to install patches (like the existing Critical Update Notifier, which I use), those who don't can let patches install themselves. No license change was necessary to do this.



I'd like to believe Microsoft only intended this license language to facilitate quicker deployment of security fixes. But as it stands, the language opens the door for much more. I'm hoping MS will respond to user outcry over this by making the language more specific, or removing it in favor of an optional auto-update service that can be enabled or disabled by the user. MS has already indicated their intent on several fronts to move towards a restrictive style of computing, with someone else's best interests involved. I may be able to count on watchdog groups to tell me to, say, not install WinXP if I don't want to abide by a new kind of license, but when it's possible for MS action to immediately cripple my computer and I won't find out until it's too late, that makes the software I paid for unfit for use.



It's also worth mentioning that Adobe Photoshop 7 already implements a kind of auto-updater. I haven't had time to read up on their licensing, but I'm pretty sure it doesn't allow for implementing wide-spread changes to my computer. If Adobe implements stuff I don't like, I can uninstall, then reinstall with auto-update disabled or simply use a different graphic program. Switching from Windows is a much bigger deal.



There are many other ways that this can be construed as an overreaction, and it's important to clarify this position. Keep 'em comin'! :)

Brennan, August 8, 2002 6:49 AM:

Are you running Windows 2000 or XP? If it's XP, then how in the **** do you uninstall Media Player? I must have spent fifteen minutes looking for a way last night; it doesn't seem to be in either "add/remove programs" or "add/remove Windows componnents". (Then again, I am capable of looking directly at something without seeing it.)



I made the mistake of installing the patch in question a while back, before I became aware of this issue. Apparently, I no longer own my computer; I'm just permitted to use it at Microsoft's sufferance.



Here's a funny one for you: I've heard that one of the features of the XP service pack is that it will allow you to uninstall (or at least disable) components like the Media Player and MSN Messenger, which you couldn't before. From what you're saying, this requires opening your system up to let Microsoft shove in anything else that serves their purposes rather than yours. Lovely.

Dan Sanderson, August 8, 2002 11:58 AM:

I was able to uninstall Windows Media Player from Windows 2000. Haven't had a need to install WinXP yet.

Donny, August 15, 2002 2:38 AM:

The Register: Snooper Licence Workaround

Donny, August 20, 2002 7:34 AM:

The Register: How to Defang SP3

al, November 17, 2002 2:14 AM:

"If Adobe implements stuff I don't like, I can uninstall, then reinstall with auto-update disabled or simply use a different graphic program."



OK, what if I uninstall something, doesn't the auto-updater simply look for the lack of said program and re-install it next time I'm online?



I'm seriously considering seperation my online computer and my main work computer.



I think auto upgrades are great, but not when they don't ask permission, and you should be able to disable them. I'm tired of being asked if I want quicktime. That used to be good, but now it takes over files I don't want it to takeover, without asking, and won't be deleted from my start up menu without deleting the program. That sucks.