While Microsoft may have suffered some embarrassment from the worm's exploitation of a known defect in Windows, the Microsoft security-hole-of-day seems such a regular thing that these flaws surprise few anymore. While any other company with this track record would be long gone, we just accept the fact that Microsoft software is riddled with bugs. And, hey, at least in this case Microsoft can point to the fact it had released a patch to fix the problem almost a month before the worm hit.

Pointing at that fact is exactly what Microsoft security officials have been doing in the aftermath of the Blaster attack. Earlier this week, the Washington Post quoted Mike Nash, Microsoft corporate vice president, as saying the company is "looking very seriously" at requiring at least home users to have their operating system automatically updated when Microsoft sends out a fix. Another Microsoft security official was quoted elsewhere as saying that having home and small business users automatically receive and install software fixes "would help the safety of a lot more customers."

As the Blaster worm demonstrated, what Microsoft is saying is quite true. Security would most certainly be enhanced if everyone automatically received the fix when one is available for a known security hole. But at what cost?

Even if Microsoft's motives were as pure as the driven snow, one price that would be paid comes from the tendency of Windows updates to break things. Windows is simply not a robust platform, and it has the added vulnerability of being used in a multitude of diverse environments filled with ill-behaved applications and devices. Few business users choose to install Windows updates now without carefully testing them first, and the prospect of Microsoft making changes to the OS on its own would cause a rebellion. No doubt that's why Microsoft officials for the time being are only talking about forcing home users and small businesses to get automatic updates.

What could be an even bigger price tag on automatic updates is the fact that you'd get them whatever Microsoft's motives are in sending them out. Given the ability to make changes to the software whenever they please, would Microsoft restrict themselves to only providing critical security updates? I don't think so, and Microsoft's biggest fans probably wouldn't either. Remember, from the day XP was introduced, Microsoft's license agreements have given it the right to make automatic updates to the operating system . So far, Microsoft has kept Windows Updates voluntary, but Redmond lawyers were planning long ago for the day it wouldn't be.

Remember also that the type of automatic downloads the EULA language usually refers to are updates of DRM (Digital Rights Management, or Digital Restrictions Management, depending on your point of view) modules in the OS. The ability to instantly put copy protection on any Windows system whenever it wants would be a dream come true for Microsoft. Not only could Microsoft then function as the restrictions manager for its own software, but for other software companies and eventually perhaps even the movie and recording industries as well. Automatic Windows updates could therefore lead to all manner of usage restrictions on a variety of product and services.

As we've all learned from the war on terrorism, security if a funny thing. The dangers in not having enough security are all too real, but there are also dangers in letting the need for security overrule all else. The terrorist who sent out the Blaster worm might have thought it would harm Microsoft, but its real victims are Windows users who will have to choose between too much security and too little.

--------------------

To receive this column every week in my free e-mail newsletter, please go to my subscription page and follow the instructions to opt-in for the EdFoster mailing list.