Windows XP security update hits file-sharing networks

Advocates of file sharing are distributing the latest Windows update in an effort to show that peer-to-peer (P2P) networks could play a legitimate role in the distribution of commercial software.

P2P advocacy group Downhill Battle has made a copy of Microsoft's Windows XP Service Pack 2 available at a site called SP2torrent.com through the BitTorrent file-sharing system.

"Now is a crucial time to demonstrate ways that peer-to-peer can be useful," Downhill Battle co-founder Nicholas Reville told silicon.com's sister site CNET News.com. "We are facing a situation where Congress is seriously considering outlawing peer-to-peer for all intents and purposes."

Reville said he was referring to the Induce Act, a bill before Congress that says "whoever intentionally induces any violation" of copyright law is liable for that infraction.

In addition to distributing SP2, Downhill Battle also used P2P technology to distribute video of the congressional hearings on the Induce Act.

By distributing Microsoft's code, the company might be putting itself in violation of other laws, analysts say. Although the SP2 upgrade is free, the P2P distribution of it could well be in violation of Microsoft's licence agreement.

The software maker declined to comment specifically on Downhill Battle's action but reiterated that it feels the best way for consumers to get SP2 is to turn on the Automatic Upgrade feature in Windows and wait for the update to be pulled down automatically.

"We are always looking at ways of doing it," said Stephen Toulouse, security program manager at Microsoft. "The challenge with peer-to-peer is that you never know what you are getting."

Downhill Battle's effort plays on the fact that although the SP2 code was released to PC makers last week, Microsoft has said it will not be available for manual download until later this month.

Indeed, what Downhill Battle is distributing is not the individual PC download of the upgrade - which is still not available - but rather the network installation kit that Microsoft released on Monday for IT professionals. That download, which is roughly 270MB, is more than three times larger than the download the typical user would get via automatic update and is designed for companies that need to upgrade many machines running different versions of Windows XP.

The network installer is also freely downloadable directly from Microsoft, though the company has posted a warning that it is not intended for individual users to upgrade their machines.

"Do not click 'Download' if you are updating just one computer," Microsoft states in bold, capital letters. "A smaller, more appropriate download will be available soon on Windows Update."

The demand from enthusiasts for individual upgrades comes as many corporations are opting to test, rather than quickly roll out, the security-oriented update.

Ina Fried writes for CNET News.com; CNET News.com's Rob Lemos also contributed to this report