The EULA is indeed a problem. As security administrator for
a government entity, I have to worry about things like HIPAA
compliance, which mandates both security and privacy for many
users in health-related fields. If we apply SP1, we show due
diligence for security in some respects, but fail totally in
another (giving root to a vendor), and the privacy requirement
precludes letting MS have full access to our systems if we
wanted to. Result: we will be applying SP1 but blocking MS
at the firewall. It may not be what MS would consider
acceptable treatment of their EULA, but we cannot violate
federal law just because Bill wants us to.

I hope that MS will start releasing their patches without
such stupid and illegal conditions attached. I also hope
that Lindows and such will continue to improve, so that we
have a good alternative if MS never does come to their
senses. We have already banned some of their products on
security grounds, and will lengthen that list as needed.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/112/16671#16671