Members of the ISP-Tech list discuss the latest update to Windows 2000, Microsoft's enterprise operating system. There are valuable new features, but beware of the fine print.

[August 14, 2002]

On the ISP-Tech list in July, PJ inquired,

"Any thoughts on Windows 2000 SP3? Is it worth installing?"

JJ said it's definitely worth it:

"I've been testing SP3 for the past two weeks. It fixes a great deal of non-published security holes, and it's pretty stable. I have a customer with no computer experience who set up a Windows 2000 server for his five-person shop, and he has never patched his box: I will be the first person recommending that he install Service Pack 3 (SP3). This is a perfect system to protect us from the next Code Red or other worm, security hole, etc."

RM warned that there's another aspect of the service pack to keep in mind:

"With the latest version of Windows Update, now part of SP3, you consent to sending the following information to Microsoft: your operating system version number and product identification number, Internet Explorer version number, version numbers of other software, and plug-and-play ID numbers of hardware device. Personally, I wouldn't give any commercial vendor the time of the day for free."

Some respondents suggested that such data collection shouldn't be an issue:

[JJ offered] "I have no issues with Microsoft collecting that information: I would guess their goal is to stamp out pirates. Have at it: we all have properly licensed copies, right?…"

[KG agreed] "I'm not a huge proponent of Microsoft collecting this data, but they do go out of their way to indicate that the collected information is not associated with any individual or entity. I've installed Windows XP and Office XP on several computers, and never once has product activation required any personal information. It does inventory several components of your computer which are hashed to create a hardware key of sorts, which is then transmitted to Microsoft and associated with your product registration code. So long as it stays that way, I'm fairly comfortable with it."

Others were much more concerned about the privacy issues:

[DP argued] "What I have for a configuration isn't any of Microsoft's business—not ever. I hate software pirates as much as the next person, but silently collecting information is none of Microsoft's business."

[GG noted] "Now you know why I still use NT 4.0 on production servers. I am all for the elimination of pirates, but I also believe in the right to privacy. Collecting any info from my computer without getting my consent each and every time it is sent is an invasion of privacy. It's also in direct violation of the Federal Right to Privacy Act, not to mention several agreements between federal prosecutors and Microsoft. That is why I am staying with NT 4.0. I don't like giving Microsoft or anyone else any information about my computers and/or software."

[BS agreed] "History shows that the collection of information without 'probable cause' is inevitably abused. Personally, I regard this policy as an attack on the security of our network. I don't want KaZaA or anything else sending data outside our network without our control—and I don't want Microsoft doing so, either."

Still others contended that Microsoft could do a number of things with the data:

[GG observed] "The fact is, Microsoft could be using this information to see what software people are buying, use the information to develop competing products, then market them directly to the targeted users that are using the competing product. Talk about unfair advantages: it would sure be one to have your competitors' customer list! While the built-in process used to send the information doesn't send the person's name, address, etc., it does send product codes, which can easily be matched to the personal information that Microsoft collects during product activation of all new Microsoft software. They can tell exactly who you are, what software you are using, and what hardware you have. Believe me, the marketing group is the reason we now have product activation."

[IL agreed] "They're going out of their way to collect your name, company and product ID, and then they pick up the installation data, including those product IDs, when you run Windows Update? Expecting Microsoft not to link the two databases together is pretty silly-and expecting this information never to reach Microsoft's marketing department is even sillier."

JK pointed out that there is a simple way to resolve such concerns:

"That's the beauty of choice and competition: if you don't like Microsoft's policies, don't use the product. Use something else."

—End