[rakeshishere]

Originally Posted by eddie

Can you please tell me why these sites are not recommended? I have been mentioning windizupdate to a friend or two and your post makes me sceptical about doing it.

WindizUpdate.com is not a recommended solution

Many readers in the past few weeks have asked me about WindizUpdate.com. This Web site, launched in 2005, scans your computer for needed Windows patches and then displays links to the relevant download locations at Microsoft.com.

Unfortunately, as promising as this approach may seem, after investigation I can't recommend this site. Here are a few reasons why:

1. The site installs an unsigned control, which performs the scanning and reporting function. Without a digital signature, you can't verify that the control is really from the same people who manage the site itself.

2. The scan process asks several times to read the Registry. If you know that WindizUpdate is perfectly legitimate, which I have no reason to doubt, this might be fine. But it's bothersome, while at the same time it's too risky to click "Always allow this site," which would permit too many unknown future actions.

3. The site is a part-time hobby with no visible means of support. There are many fine pieces of software and Web services that are free of charge. But WindizUpdate is performing a serious security task and doesn't have a team of programmers that's adequate to develop it, much less provide technical support if the user base grows.

I called the prime mover behind WindizUpdate, Phil Young, who is based in Auckland, New Zealand. He's a director of 62nds Solutions Ltd., a consulting firm with two employees and a few part-time staff on the island.

When asked why WindizUpdate didn't use a digital signature to provide a verifiable identity for its control, Young replied, "I haven't got the $400 to spend on the security signing certificate. Because it's a free site, it's not high on our list of priorities."

I inquired whether the site might become supported by advertising or voluntary contributions by users. "I have considered putting some ads on," Young said, "but I dislike sites that have more advertising than content."

Besides having no digitally signed code, WindizUpdate also lacks the ability to scan for and deploy Microsoft nonsecurity updates, Office updates, or security updates for products other than Microsoft's, such as RealPlayer.

All of the above nonfeatures cause me to advise readers to hold off on WindizUpdate. As attractive as the idea of a non-Microsoft patch-management system may be, other companies do a much better job.

One final strike against WindizUpdate is that it has no apparent uninstall procedure. If you've ever installed a WindizUpdate control, I recommend removing its components using the manual procedure described on the site's page entitled Uninstalling.

Source