locked
"not trusted" message during connector install RRS feed

  • Question

  • After upgrading to Power Pack 2, each of my computers automatically initiated a re-installation of the connector software. Although it seemed to go alright, there was a scary message during the process, saying that the download was from an "untrusted source", and may be contaminated with a virus. Is this considered "normal"? If Microsoft doesn't trust itself, why should we?
    Tuesday, April 21, 2009 3:16 PM

Answers

  • "Untrusted source" in this case is your home server. The connector upgrade process downloads the new version from your home server via HTTP, and if you haven't changed the default settings for your browser, it will be treated as an untrusted source. There's really little that Microsoft can do about this; your browser comes configured the way it does to provide greater security for the average user.
    I'm not on the WHS team, I just post a lot. :)
    Tuesday, April 21, 2009 4:25 PM
    Moderator
  • The message didn't provide a filename. I don't have it in front of me, but I believe it just said, "one or more of the files" in the download was from an untrusted source. In any case, my "supplier" is Microsoft; the Powerpack software came from Windows Update. Until your post, I never heard of Fujitsu Siemens Scaleo. If Microsoft is bundling 3rd party software with their system, I think getting it be to "trusted" by Windows is their responsibility, not mine.

    I'm still not clear, though: Is this a message everyone sees, in which case I will just move on, or is it unique to me?


    This is not a message that everyone sees. Some OEMs like HP provide additional software unique to their hardware. In a few cases, binaries went out that were unsigned which prompted this message.  Either your AV is prompting this message or the OEM binaries on your system are not signed.

    Thank you
    Lara Jones [MSFT] | Program Manager
    Community Support and Beta | Windows Home Server Team
    Windows Home Server Team Blog
    Connect Windows Home Server
    Windows Home Server
    Tuesday, April 21, 2009 4:30 PM
    Moderator

All replies

  • Fujitsu Siemens Scaleo?

    If yes, it's the SCALEO wake-up application that's installed together with the connector that is causing the message. If you feel this is a problem (which I think it is) you should contact your supplier or Fujitsu Siemens support.

    Tuesday, April 21, 2009 3:22 PM
    Moderator
  • The message didn't provide a filename. I don't have it in front of me, but I believe it just said, "one or more of the files" in the download was from an untrusted source. In any case, my "supplier" is Microsoft; the Powerpack software came from Windows Update. Until your post, I never heard of Fujitsu Siemens Scaleo. If Microsoft is bundling 3rd party software with their system, I think getting it be to "trusted" by Windows is their responsibility, not mine.

    I'm still not clear, though: Is this a message everyone sees, in which case I will just move on, or is it unique to me?

    Tuesday, April 21, 2009 3:30 PM
  • "Untrusted source" in this case is your home server. The connector upgrade process downloads the new version from your home server via HTTP, and if you haven't changed the default settings for your browser, it will be treated as an untrusted source. There's really little that Microsoft can do about this; your browser comes configured the way it does to provide greater security for the average user.
    I'm not on the WHS team, I just post a lot. :)
    Tuesday, April 21, 2009 4:25 PM
    Moderator
  • The message didn't provide a filename. I don't have it in front of me, but I believe it just said, "one or more of the files" in the download was from an untrusted source. In any case, my "supplier" is Microsoft; the Powerpack software came from Windows Update. Until your post, I never heard of Fujitsu Siemens Scaleo. If Microsoft is bundling 3rd party software with their system, I think getting it be to "trusted" by Windows is their responsibility, not mine.

    I'm still not clear, though: Is this a message everyone sees, in which case I will just move on, or is it unique to me?


    This is not a message that everyone sees. Some OEMs like HP provide additional software unique to their hardware. In a few cases, binaries went out that were unsigned which prompted this message.  Either your AV is prompting this message or the OEM binaries on your system are not signed.

    Thank you
    Lara Jones [MSFT] | Program Manager
    Community Support and Beta | Windows Home Server Team
    Windows Home Server Team Blog
    Connect Windows Home Server
    Windows Home Server
    Tuesday, April 21, 2009 4:30 PM
    Moderator
  • Thanks to all who responded. Lara and Ken, while your explanations are quite different from each other, neither would lead to the conclusion that there is anything really wrong. So, I will get on with my life.

    I've got to say, though, that I don't see how alarmist system messages do anything to provide "greater security for the average user". The real result is that users are implicitly being trained to ignore all warnings. By the time a real attack comes along, they've gotten used to just hitting OK no matter what the system tells them. Cf. "The Boy Who Cried Wolf".



    Wednesday, April 22, 2009 5:02 AM
  • Whether it's an unsigned binary (Lara), or it's just how the browser works (me), there's no real way to determine automatically that this one is safe, but that one isn't. So a warning is displayed. The alternative is to never display the warning at all, which is demonstrably less safe than what we have today.
    I'm not on the WHS team, I just post a lot. :)
    Wednesday, April 22, 2009 11:24 AM
    Moderator
  • Ken,

    I've been using Norton Internet Security for several years. The older versions used to ask me endless questions that I was unprepared to answer, such as "Do you want to allow SVC5607.LOL to access the Internet?". I would answer yes or no, depending on my mood and intuition. The newest version just keeps its mouth shut, and does its best in almost every situation. I would argue that, for non-technical users and even for most highly technical users, it is more secure, not less.

    My point is that in a better-architected world, Windows would "understand" the whole situation better, and make the correct decision that this particular download is ok instead of presenting the user with a Hobson's choice. The lack of holistic design leads to all kinds of anomalies. Use scissors on your Ethernet cable, and one part of Windows will say, "A cable is unplugged" while another part will complain that there is no such address as google.com, and suggest that you check the spelling and try again.

    I've said my piece, so I will not post further on this topic. Thanks for your help.
    Wednesday, April 22, 2009 1:23 PM