From: John Beckett 

"Geo."  wrote in message
news::
> > I don't know the details, but the official statement is that all SUS
> > downloads are checked as being signed and unchanged both by SUS, and by AU
> > on each client (when it gets the update from SUS).
>
> so if one is unsigned, does it ask if you want to accept it or does it just
> reject the download?

I don't know -- you would need to somehow inject a fake file to find out.

I'm not saying that signing is invincible. Presumably people will take a
serious look at it once the easy vulnerabilities have gone.
However, Microsoft at least have their heart in the right place, and if
they did it correctly, it would be pretty well impossible to download a
fake update without some sort of warning (and the admin has to approve the
updates before they are actually applied).

John

--- BBBS/NT v4.01 Flag-5