Millions of Windows users may unwittingly be test subjects for an unfinished Microsoft licensing enforcement tool.
The software maker has been delivering a pre-release version of Windows Genuine Advantage Notifications software to PCs as a "high priority" item in the built-in update feature in Windows. The tool, also known as WGA Notifications, is used to validate the authenticity of Windows software installed on a PC.
The move is a first for the software maker. Microsoft normally asks people to join test programmes before it initiates the download of any such trial software.
"I don't think that we have done it before," David Lazar, director of the Windows Genuine programme at Microsoft, said on Monday. "WGA Notifications is a unique programme."
Microsoft has been expanding its effort to distinguish pirated copies of Windows from legitimately acquired ones. The original WGA programme, launched in September 2004, calls for people to validate their Windows installation when they download additional Microsoft software from a Microsoft Web site. In November, it introduced the separate WGA Notifications program. It now sends prerelease WGA Notifications software to people in a number of countries.
But some security experts are troubled by Microsoft's decision to deliver pre-release software to millions of Windows users without clearly notifying them. People may not realise they are participating in a trial and have in essence become unsuspecting guinea pigs, they said.
"It shouldn't be offered to such a wide audience without more notification of the fact it is beta," said Russ Cooper, a senior scientist at Cybertrust, a security vendor. "Even with more notification, I think it should not be offered in the way it is."
Microsoft notes that this is "pre-release software" in the user licence, which is displayed when WGA Notifications is about to be installed. People can decline the download at that point, but experts believe that most won't understand the licence and that many don't read user licence details.
No immediate benefit
Some suggest that pushing the antipiracy tool out as a "high priority" update in the same way as security fixes is a ploy to get people to install it.
"I don't see any way for Microsoft to get the software run by a large fraction of the user base except by calling it 'high priority,'" said David Walker, an IT professional in Las Cruces, New Mexico.
Running the tool doesn't offer any immediate benefit for users, Walker noted.
"You could argue that this is mislabelling," he said. "I suppose it is a high priority for Microsoft to get rid of counterfeit software... It's not critical for the continued operation of the user's computer."
Michael Cherry, an analyst at Directions on Microsoft, agreed.
"While I have been supportive of Microsoft's Genuine Windows Program, there are no circumstances that I can think of where it makes sense to use Windows Update or Automatic Updates to distribute beta or non-final code," he said. Automatic Updates is the update feature in Windows.
Microsoft needs to find a better way to distribute noncritical or test software, Cherry said. The company should consider coming up with better labels for updates so that customers can understand when an update is needed to resolve a security problem or when it is needed to improve reliability, he said.
No warning label
Indeed, most consumers won't know what to do when Automatic Updates offers them the piracy tool and thus will simply accept it, said Michael Silver, a Gartner analyst.
"There's not a lot of benefit for consumers to allow this to be installed, but most won't know what it is and will probably just allow it," he said.
Although the WGA Notifications tool isn't finished yet, the software doesn't come with the same caveats as other Microsoft beta software, such as warnings that it could cause system crashes or otherwise affect PC performance, Microsoft's Lazar acknowledged.
"It is prerelease software. We're still testing it end-to-end, including the delivery mechanism," he said.
But, he added, "I want to assure everyone that WGA Notifications has been rigorously tested, and we're confident that the software can be installed and used safely."
Microsoft does understand the distribution concerns, Lazar said.
"We can see that people are very concerned about this particular feature or this particular aspect of the rollout, and it is something that we will consider in our future plans," Lazar said, indicating that Microsoft is not about to change the way it is testing WGA Notifications.
WGA Notifications is an exception to Microsoft policy, Lazar noted. Microsoft has not...
Talkback
Sony's rootkit got blasted worldwide. Yet deploying beta software with unclear real goals (why would a one time validation tool need to phone home daily?) as a high priority security update amounts to nothing really. That's a sure way to invite 'the next runner up' because now Microsoft will think: we got off easy so what's next? Thanks everybody.
Also, all that Microsoft needs to do is clear a few lines in that XML file of theirs and no longer will WGA be a high priority security update. So why don't they do that today?