Everyone panic! You’re getting updates even when you specified not to! I don’t know about you, but I’ve made peace with the fact that Microsoft can get to me whenever they want to. Sure if you specified to download updates but to ask before installing or worse yet not to check for updates at all, and you still get updates, that’s bad. But the fact is that when you configure your update settings, you’re still trusting Microsoft that that’s what they actually do. You may click that radio button, but they still need to honor it. And who really truly trusts Microsoft nowadays anyway?

As Bruce Schneier points out, this is a pretty big hole. He claims that if Microsoft can use this remote install capability to install updates, why can’t anyone else exploit that capability? I would think that Microsoft would have the foresight to lock it down with some good certificate exchanges and encrypted communications, but this is Microsoft we’re talking about.

Either way, what’s to say Microsoft couldn’t do this with XP or 2000 before? We simply don’t know. They wrote the freakin operating system. Who knows what’s in there? When you’re dealing with a closed source operating system, you just really don’t know. Like it or not, you’re trusting Microsoft…