
Here’s a quick question–do you have a ‘original’ version of Windows running on your PC or is it pirated?
If you’re like me, then obviously you’ve learnt long ago to only use original versions of software–especially when it’s the operating system of your PC. Of course, I wasn’t always like this, back in my university days, I couldn’t afford the couple hundred dollars it cost to buy an original Windows XP, and hence used a pirated version–my windows installation CD was actually burnt from a pirated CD, I wonder if that made me a pirate of a pirate?
One of the things that puzzled me was that even with my obviously pirated software, I could still download Windows software security updates–something I thought represented Microsofts failure to engineer a way to check on the legitimacy of my software. It wasn’t until much later, that I discovered the true reason for Microsoft seeming benevolence–Microsoft was merely protecting it’s paid customers by providing free updates to the pirates.
Say what now?
It may sound ironic, but one of the best ways for Microsoft to provide security for their paying customer is to ensure that even the pirates receive security patches.
Imagine for a moment if Microsoft didn’t allow patching for pirated Windows, and assume that 20% of the Windows machines on the internet were pirated. What that would mean is that 20% of all PCs on the internet would be vulnerable to each and every Windows vulnerability discovered. That’s a large chunk of customers that would be affected, and the real down-side is that the 20% of pirated customers could end up re-infecting legitimate paying Windows customers. So in order to reduce the spread of vulnerabilities in it’s ecosystem, Microsoft had to protect it’s paying customers, by patching its pirated copies.
Vulnerabilities aren’t fun for Microsoft, but they’re a fact of life–and being the dominant Operating System of the 1990’s and 2000’s meant the Microsoft received more than it’s fair share of attacks, the problem of course was how to address the vulnerabilities as and when they’re discovered?
There are two ways to deal with this problem: Limit the number of people who know about the attack or reduce the number of systems that are vulnerable. The first method has been tried for years with little success. This leaves us with the option of reducing the number of vulnerable machines on the Internet. Or as one team of researchers noted (pdf), “a vulnerability dies when the number of systems it can exploit shrinks to insignificance."[1]
So Microsoft followed the science and attempts to shrink the number of vulnerable systems to insignificance, and that can only mean allowing patches for pirated versions of Windows, no two ways about it, a world where Microsoft didn’t allow pirated version of Windows to be patched would be a dangerous world to live in.