« Google Checkout - passport to world domination? | Main | WGAvn isn't WGA. Really. »
June 30, 2006
"Confooozed" about Windows Genuine Advantage? You should be.
Over at the forum, we've been discussing WGA Notify, and to put it politely, the developments in that are enough to confuse the daylights out of even literate users. In fact the long experienced Brian Livingston just said in his Issue 78 Windows Secrets Newsletter that he's probably sitting in front of his screen, "Watch(ing) for downloads in the night".
What's the current fuss about Windows Genuine Advantage? Well, you see, there are two parts in this - Windows Genuine Advantage (which is a mechanism that has been in operation now, for a year or more) and WGA Notifications (which is new). They may share some files in common, but they're not the same thing.
We've borne the inconvenience of WGA for some time now - it's a nuisance but that's about the limit of aggravation it instills. WGA Notify however is getting under the skin people who are charged with maintaining a security posture in corporate IT and to those home and corporate individuals who are intent on keeping Microsoft Windows machines patched and secure.
Initially, when you want to get an added value (free) component or tool from Microsoft, the company wants to verify that you are a valid customer. If you use Internet Explorer an ActiveX program will transparently identify your copy of Windows. If you don't want to use IE (and use Firefox for example), you need to manually download and run a program that calculates a code. You then type this code into a textbox provided on the webpage and if that is approved, you can proceed to get your tool. Long winded but not something to get upset about.
Later on, the Windows Genuine Advantage Validation Tool (KB892130) came to reside on our Windows machines - some of us saw it creep in, some didn't. We thought, it's digitally signed, it's from Microsoft, let it be.
WGA Notifications however, is quite different. It is a new initiative, composed of several files. It was a beta (or what Microsoft now calls a pilot - Beta has too many unsavoury nuances) and it was delivered as part of a batch of Critical Security Updates to Windows. You were supposed to be the voluntary guinea pig and see an agreement banner - the truth is, when Microsoft says that something is Critical, many of us just take their word for it and click "Ok".
Then, things started getting interesting. Because it was a pilot procedure, Microsoft might have wanted this to be an instrumented version - that is, it was designed to "phone home" to Microsoft servers. To do what? Ask for further directions? Pass Microsoft some info about your machine? Prove that it was working successfully? We don't know.
This attempt to phone home was being picked up as alerts - by home users who ran a software firewall. By people who use machines secured by the coporate network firewall. Making all this seem underhanded rather than some poor implementation or a concept gone wrong.
There's been so much hubbub that Microsoft has come up with disable or removal instructions. The instructions themselves do not appear to have been comprehensively tested. They would be alright in the hands of a IT support technician, but they're terse, they leave out some obvious steps (like asking the user to ensure the screen has been set to "Show Updates". And frankly, they're really manual and technical at this point in the Windows lifecycle when someone in Redmond could write an automatic uninstaller with both eyes closed. Maybe one of the 9000 bodies they have on the Windows Vista team?
The instructions ask you to delete LegitCheckControl.DLL - true, it is part of WGA Notify but it is also part of WGA. So, once you complete this removal of WGA Notify, you have also hobbled WGA. And you need WGA because there are really important Windows Updates that you may need in the future (the Australian Commonwealth Games daylight saving adjustment patch notwithstanding).
Brian is so incensed by this carrying on, he's even recommending that people tell Microsoft what it can do with the previously well respected, official and free Microsoft Windows Updates system, take a walk and go Shavlik. Over-reaction? Maybe. But Shavlik, although well presented and well known to IT technicians, might be too much information for the Windows newbie.
What are you going to do?
Posted by Anandasim at June 30, 2006 08:02 PM
Trackback Pings
TrackBack URL for this entry:
http://bleedingedge.com.au/cgi-bin/mt/mt-tb.cgi/955
Comments
What are you going to do?...clobber it!
and I have! I have no issue with the validation process needed for XP (or other MS products) when you install them. But to slide sumthing onto yr PC without telling...or in the guise of a REQUIRED update...NUP!
Posted by: Smitty at June 30, 2006 09:52 PM
I have OEM (if that is the correct term) Win XP Pro and use Firefox. I trusted MS updates for security reasons. I did not know MS would search through my pc with one of it's updates to look at my legality. Now I am illegal in MS's opinion. I have no intention of messing around with dll files. I did not care much until I wanted to download the latest Media Player and could not because I am illegal. And MS wonder why they are hated with such passion.
Posted by: Andrew at June 30, 2006 11:02 PM
Quote from Windows update site.
"Download size: 1000 KB , less than 1 minute
The Windows Genuine Advantage Notification tool notifies you if your copy of Windows is not genuine. If your system is found to be a non-genuine, the tool will help you obtain a licensed copy of Windows"
Posted by: Tony at July 2, 2006 07:39 AM

