Subject: RE: 1024 bit key considered insecure (sshd)
To: Seth Kurtzberg" , "Curt Sampson <cjs@cynic.net>
From: Actually davidchr <davespam@microsoft.com>
List: tech-security
Date: 09/13/2002 15:09:40
> In fact, in at least two recent cases, governments have=20
> refused to install=20
> Windows XP because of this situation.  I'm told that=20
> Microsoft graciously=20
> agreed to sell them Windows 2000 as long as they pay the=20
> price of Windows XP.

That would be pretty kind of us, seeing how XP costs the same or
cheaper, depending on the SKU (Personal or Professional). =20

I can't say for sure, but I think someone's pulling your leg (or that
someone has had his leg pulled).  Any entity with the clout to negotiate
price at that level with us is probably source-licensed and can see what
we're doing under the covers for itself. =20

> There really is no question about the technical facts; just=20
> turn on a sniffer=20
> while you are installing XP. =20

Intriguing.  What do you see?  (seriously)

The only thing I can think of that might access the network while
someone installed Windows from CD would be the routine looking for
updates to the setup app, and if I remember correctly, it even asks you
before it goes to the network.  "Do you want me to check for updates to
setup?" or something like that.

> What Microsoft does with or=20
> intends to do with=20
> it is, of course, another matter.  From the customer's=20
> viewpoint Microsoft's=20
> intensions make little difference, because if circumstances=20
> dictate Microsoft=20
> can change their policies, and/or the government can impose=20
> policy changes.

Not a valid argument unless you explain what "it" is.  What is "it" that
Windows is supposedly transmitting to us in Redmond?

Last time I heard an argument like this, it was Win95.  On closer
inspection, it turned out that the "mystery traffic" was simply a DHCP
request to determine if the network had that service available. =20

> > The back door is already there. When installing some recent service=20
> > packs, we are required to accept a license that allows you=20
> to, without=20
> > notification, make arbitrary changes to our computers, including=20
> > disabling software.

Maybe I'm not looking in the right place, but I don't see anything of
this kind.  Is this a dialog thrown by the SP1 upgrade app, or by the
download site?

-----
This message or posting is provided "AS IS" with no warranties, and
confers no rights.
Message may originate from an unmonitored alias ("davespam").  If so,
use "davidchr" instead.=20
Any opinions or policies stated within are my own and do not necessarily
constitute those of my employer.
I reside in Washington, USA, where Title 19 declares that sending me
Unsolicited Commercial Email can result in a $500 fine.
Harvesting of this address for purposes of bulk email (spam and UCE) is
expressly prohibited unless by my explicit prior request.  I retaliate
viciously against spammers and spam sites.