Ted the Penguin

Apple vs Microsoft; Updates

March 8, 2007 – 11:23 pm

Ok, so more news is coming to light about the WGA fiasco, and even applies to all Windows Updates. I won’t retract my previous statement (about switching), but I’ll provide the info below and let you make your own decision.

As a warning, this is long, and gets kinda technical, hence under a cut. I’ll update it with specific explanations if requested.

Microsoft sends themselves data whenever you do a Windows Update. This information includes (A detailed run-down is here):

• Your IP Address
• Computer make and model
• Version information for the operating system, browser, and any other Microsoft software for which updates might be available
• Plug and Play ID numbers of hardware devices
• Region and language setting
• Globally Unique Identifier (GUID)
• Product ID and Product Key
• BIOS name, revision number, and revision date

Of note, the Windows Update Privacy Policy states:

Windows Update collects the Product ID and Product Key to confirm that you are running a validly licensed copy of Windows. The Product ID and Product Key collected are not retained after you are finished using Windows Update, unless the Product ID is not valid.

If you’ve got a pirated copy of Windows, and you deny WGA but use Windows Updates… they still know. Who would have thought?

And so Microsoft is keeping track of it’s software, ok, kinda imposing, but I can live with that. It goes on,

To generate accurate statistics, Windows Update evaluates a Globally Unique Identifier (GUID) that is stored on your computer to uniquely identify it. The GUID does not contain any information that can be used to identify you. A GUID is assigned and tracked in the following cases:

• To provide customers with the best possible service, Windows Update tracks and records the number of individual computers that visit the site and whether the download and installation of specific updates succeeded or failed. Windows Update records the GUID of the computer that attempted the download, the ID of the item that was requested, whether updates were required, and the configuration information listed above.
• Windows Update logs an additional GUID if you provide responses about whether help and troubleshooting articles were useful in resolving your problem. This allows Windows Update to provide you with increasingly helpful and relevant information.

So in theory, if I install an update to the .NET framework, but decide to keep IE 7 off my system, and if I run into a problem later, Microsoft can tell me it knows I have an issue because of IE 6 and the specific update having issues playing nice? Interesting idea, in practice anyway.

---

Apple’s Software Update also sends Apple information on your computer, and as outlined in the license agreement of the OS, they can do so.

4. Consent to Use of Data. You agree that Apple and its subsidiaries may collect and use technical and related information, including but not limited to technical information about your computer, system and application software, and peripherals, that is gathered periodically to facilitate the provision of software updates, product support and other services to you (if any) related to the Apple Software. Apple may use this information, as long as it is in a form that does not personally identify you, to improve our products or to provide services or technologies to you.

Just to test, I ran Software Update and check to see what data my computer is sending to Apple. The results are below.

POST /WebObjects/SoftwareUpdatesStats HTTP/1.1
User-Agent: CFNetwork/129.19
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate
X-Software-Update-Session-Id: XXXXXXXXXXX
Content-Type: application/x-www-form-urlencoded
Content-Length: 4867
Connection: keep-alive
Host: swquery.apple.com

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ClientConfig</key>
<dict>
<key>BuildVersion</key>
<string>8N1106</string>
<key>FromUpdateNow</key>
<true/>
<key>HW_Model</key>
<string>MacBook2,1</string>
<key>HW_PhysMem</key>
<integer>2147483648</integer>
<key>Language</key>
<string>English</string>
<key>ProductVersion</key>
<string>10.4.8</string>
<key>SWUpdateVersion</key>
<string>2.0.7</string>
<key>ScheduleSet</key>
<true/>
</dict>
<key>SessionID</key>
<string>XXXXXXXXXXXXXXX</string>
<key>UpdatesOffered</key>
<array>
<string>061-2549</string>
............ [I cut most of this to save space]
<string>061-1693</string>
</array>
</dict>
</plist>

Ok, so that was long and painful. I apologize. What Apple sends to themselves is actually quite readable though. It lists, in order:

• The build of the OS.
  • 8N1106
• How Software Update was run, in this case, a forced run.
  • FromUpdateNow
• Hardware Model
  • MacBook2,1
• Amount of Installed Memory
  • 2147483648(2GB)
• Language of the OS
  • English
• Version of the OS
  • 10.4.8
• Version of Software Update
  • 2.0.7
• If you have the machine set to automatically check for updates
• A session ID, think the equivalent of a cookie in web terms.
• A list of possible updates.
  • Some of the updates were marked with “zzz” in front of them. I’m not sure if these are depreciated updates or ones I’ve already installed.

Apple doesn’t get a serial number, hardware or software, any identifying info (except for IP address), and states that even if they did, they can’t use it if it identifies you in any way.

Microsoft gets similar hardware information to Apple (a bit more extensive actually), a software serial number, a code that can identify your computer exactly, and a number that can identify the specific user on your computer.

Yey!