Surprises in Microsoft Vista's EULA

androthi writes "Scott Granneman takes a look at some surprises in Microsoft Vista's EULA that limit what security professionals and others can do with the new operating system. You want to post benchmarking results? Well, Microsoft may now have a say in it. Vista's EULA no longer shows up on Microsoft's software licensing page, but does still exist — also take note of Windows DRM deciding what you can and can not listen to, and Defender deciding and removing what it considers spyware automatically (by default)."

a way around?

I don't 'sign' the EULA when i use a public machine...

What an Awesome Idea!

If we keep brainstorming great stuff like that, we will be able to do all kinds of awesome stuff, like:

study our own computers' performance.
tell people what we find
share ideas on how to improve them

Before you know it, we'l have "free speech" as I like to call it.

UCITA and EULAs

There is indeed an attempt to make EULAs contractually enforceable, the so called Uniform Computer Information Transactions Act (UCITA).
Wikipedia's article on the subject, http://en.wikipedia.org/wiki/UCITA [wikipedia.org], does however claim the UCITA "has only been passed in two states as of 2004 -- Virginia and Maryland". If you live in one of those, you might be out of luck.
In other jurisdictions, EULAs are probably unenforcable. Wikipedia has another article that covers the US situation:
http://en.wikipedia.org/wiki/Shrinkwrap_license [wikipedia.org].
In Germany, a few years ago Microsoft failed to enforce the EULA that disallowed separate sales of OEM software. The court ruled that an equivalent of the First-sale doctrine http://en.wikipedia.org/wiki/Doctrine_of_first_sal e [wikipedia.org] applied. The EULA that said otherwise was obviously disregarded.

sined, sealed and delivered

To quote the Buckaroo Bonzai [imdb.com] movie, Microsoft's locked in monopoly is sined, sealed and delivered. The EULA for Vista provides more evidence Microsoft is the 800 lb. guerilla that doesn't care about potential faceoffs on these issues any more. The article seems to think differently:

If you thought that the legal troubles the company faced in the late 90s would perhaps mellow it out, you were wrong. Far from it. The draconian limitations I've discussed could only be enacted by a monopoly unafraid of alienating its users, as it feels they have no other alternative. Microsoft may yet learn, however, that there are limits to what its users will bear. To paraphrase what my fifth-grade teacher often told his rambunctious class, "Beware the wrath of a patient user base." Security pros have already given Microsoft a deserved black eye over the never-ending string of gaffes and vulnerabilities streaming out of the company. It seems now as though another black eyes and a bloody nose may be coming, along with a final wave goodbye. There comes a point at which corporate hubris causes a fall, and we may be seeing the beginning of that collapse. If so, Microsoft will have no one but itself to blame.

I'm not sure how the article's author would see the user base reacting. Pick a different platform? How? At what expense? No, Microsoft has got this one in the bag.

I predicted in the late 90's if Microsoft didn't have to pay real consequences for their business practices, eventually they would be rolling out OSes at any price they wanted and noone would be able to do much about it. This was at a time where hardware dramatically was decreasing in price but Windows, all flavors, continued to sustain an amazingly different cost curve. I predicted eventually:

• Microsoft would put out an OS at around $400
• Their OS would eventually be the largest cost of a new machine

It looks like we're pretty close to both. I'll continue to do my development in my Linux world, but I'm guessing there will be a momentary raised eyebrow with Microsoft's Vista, Vista's EULA with it's almost amazing restrictions (especially compared with already draconian past EULAs) and then business as usual.

Re:sined, sealed and delivered

Yeah, tell me about it. Soon, MS's EULAs will require a paper contract, with a notary cosine. And with every little thing they get away with, they'll get more obtuse. Of course, I feel like I'm going off on a tangent, here...

Oh boy

Defender automatically removing stuff without the user knowing. That's just asking for problems. How long before there's a widespread outbreak of Defender deleting perfectly legitimate software?

The only winning strategy

Is not to play

Moo

I have the best comment *ever* about this story.

I'll post it as soon as Microsoft oks it.

The Benchmarking is for .NET 3.0 only (FUD)

There are only restrictions involved in posting benchmarks for .NET 3.0 [microsoft.com]. And these restrictions only require that you state what version you were using and the methodology you took. It doesn't have any restrictions on "bad" results or any attempt to stop people from reporting accurate results. They wrote these restrictions to prevent people from testing .NET on a 386 and then JAVA on a 3 GHZ and saying "See JAVA is faster!" and it's similar to the restrictions for .NET 1.1 and 2.0... it's just because it's bundled with Vista that it's now included with the Vista EULA.

Might as well be hanged for a sheep as for a lamb

After reading the Vista EULA while installing a copy at work for compatibility testing, it became very obvious to me that the only way Vista would make it onto any computer I own is if I were to install a pirated copy of Vista Ultimate with all the anti-piracy features removed. I figure that since there's no way in hell I'm going to comply with the EULA, why follow copyright law, either?

Stupid, tired arguments

Where to start...
1. The benchmark testing and posting applies to .NET Framework components. I do not see this being some great ending of benchmarking the Windows OS. Also, the link for further information does not (currently?) work. So, this could just be an issue that isn't an issue at all.
2. This version argument is really tiring. In some ways I see their logic, in other ways I think the six version idea is stupid. Actually, there are more versions of XP then two. Technically, there are four. Windows Media Center Edition and Starter Edition. I imagine Starter Vista will be virtually unseen like XP SE. As for Win MCE, I suppose that would be Home Premium. XP Home = Vista Home, XP Pro = Vista Business. Guess this only leaves two extraneous versions...
3. The Virtualization argument is pointless. How many home users do virtualization? How many business (which do the most virtualization) actually use XP Home licenses? I really think this is a non-issue like #1.
4. The license transfer is more stringent version of the current license transfer. The example they give is a bit weak. At work, if you get a new workstation? I seriously think that corporate licensing will have provisions for this sort of thing. How many people buy their own work computer licenses? Unless you own your own business, not many. Most home users keep a machine for several years. If you assume a home user is on a 3-year replacement cycle (the most common business practice I have found), they will probably only need a single transfer before the new OS is out (though after this, you never know.) Also, how many new PC purchases do not come with a new license?

I by no means am a Microsoft supporter. I have said on multiple occassions that Windows XP would be the last Windows OS I would ever use. I intend on changing my mom to Linux when XP support disappears. I do think that some of these arguments are very bogus though. There are plenty of other reasons to hate Vista, including the evil DRM, more Microsoft monopoly violations, and stupid, half-assed "security" tools.