Slashdot Mirror
WinXP SP2 Sacrifices Compatibility for Security
goldragon writes "TechRepublic is reporting that "Microsoft is pulling out all the stops to improve security. So much so, in fact, that it will cause many problems because SP2 will de-emphasize backward compatibility with legacy systems and code for the sake of security." One small step forward for Microsoft, one giant leap backwards for mankind?"
Giant leap backwards?
Let's face it, you can't remain compatible with old software forever. It causes, well, Windows XP. XP is trying so hard to be everything to everyone, that it can't even pop up a delete confirmation fast enough to not make me wait for it (On an Athlon XP 2700+ with 1GB of DDR333, fresh from boot).
Compatibility is an important issue, but at some point shouldn't the ten-year-old programs run in a virtual environment separate from the OS?
That what was all this school was for... to teach us how to solve our own problems. -- janeowit
Keep your eyes to the sky.
...for the comments? I know this is slashdot and all, but that really has no place in the article summary.
Since when was compatibility important to ME. Why cant I open a Office 97 doc in Office XP?
Can't say I'm suprised this happened at all really... seems noone else has problems fixing security while moving forward in developement and backwards compatibility.. *coughlinuxcough*
Even a stopped clock gives the right time twice a day.
less people to patch? I can bet it is going to drive IT managers crazy because now they will have to do hardcore tests of all their software to make sure it still works after the patch.
This might just make things less secure overall because nobody is going to want to bork their software. Will it be possible to roll back the patch quickly if someone finds they cannot run program X anymore?
But then again, who knows, it might "accidentally" break Office 97 so people think they need to upgrade to Office 2003.
I wouldn't call this a small step forward. I'd call it a huge leap. It shows that Microsoft actually cares about security. You can't keep an API exactly the same forever. It'll get crufty eventually.
Hopefully, there'll be more breaking for the sake of security.
TheMadRedHatter
while(1)
{
}
Ah, the story of life.
Just another reason for folks to migrate away from their closed systems with forced expensive updates and security holes.
You mean a free service pack that improves security somehow translates into expensive updates with security holes? I'm sorry I fail to get your bizarro logic.
SP2 represents a big change in Microsoft's security vs. ease-of-use stance.
In the past, Windows shipped with many unlikely-to-be-useful services such as the NetBIOS Messenger service turned on by default installations, meaning that a user who wanted to use the service just needs to start using it and it'll already be there ready to work. Of course, we all know how this has been exploited by spammers.
Now, such non-essential services will default to the "off" position, and the user will have to take a step to affirmatively activate the services they want to use. This makes plug-and-play operation a little harder to accomplish, but Microsoft has finally decided that the security gained is worth more than the ease lost.
One small step forward for Microsoft, one giant leap backwards for mankind?
The day mankind as such depends on a single corporation to that extent, backwards seems the only way to go.
Hey, given the choice between the two, I think MS is right to choose security. You're often forced to lean toward security at the expense of some convenience, or vica-versa. And in this case, given the recent (past 10 years) track record, security is more important right now.
I, for one, welcome our new Antichrist overlord.
OS X did this brilliantly with the Classic compatibility layer. 99% of the time the layer was app-compatible and it ran at least as fast as running OS 9 alone. Many people bitched at first, but when they started using OS X, it was pretty clear that there was a huge advance in stability that made people actively dump their Classic applications and invest in the X architecture. We're still in the transition phase but with Apple proclaiming 9 dead last year, it has been successful for the OS transition.
The reason Windows is in such a hurt is compatibility with everything. Even most Linux distros dont offer the level of backwards compatibility that windows xp or less does. You can still to this day run Win16 apps under windows and still print and save, as if it were no big deal. Thats just not possible with Linux. Try downloading or running a binary from 1994 that was compiled for linux and see if it works, im sure libc and glibc and aout and elf will make things fun.
Its kinda sad how things are around here for Microsoft, Damned of they do, Damned of they dont. Somebody shows progress and they get pounced.
"...one giant leap backwards for mankind?"...And recreating an OS from the 70's isnt? Thats pretty narrow thinking.
http://www.freebsd.org
Ie this message is moreso for the submitter. Love the tone of your voice. We see almost daily MS lack-of security woes and now MS does something about it. Then you have to bitch about not supporing legacy this or that in the name of security. I think I would rather choose security. hell, all you need to be considered a computer security expert is just say "everything's insecure."
You could see it when the finally decided to dump COM DCOM DNA, etc, whatever they were calling their latest crap architecture and go .NET. You could see the future of XBOX2 (really a .Net box) would completely dump the past. Face it, if Microsoft is to move into the future, it's not going to be on their crap architectures of the past. We will see more of this from MS.
One small step forward for Microsoft, one giant leap backwards for mankind?"
/. are met with "All your base are belong to us". Or with slight improvisation, "All your versions are belong to us".
All such posts on
So much for compatibility
http://efil.blogspot.com/
This is a good thing. It's basically going to break applications that make assumptions about the (in)security of DCOM and RPC. It's very easy to add an application as an exception to the firewall. DCOM and RPC are going to be the major issues, so it's not going to affect Grandma's cute shareware apps any. Any app broken by the NX flag was already broken to begin with. I'm looking at you, XFree86...
Compared to this relatively minor loss, the potential security gains are enormous. It remains to be seen how well it all works though...
I wonder how much of the copy protection on software this is going to break. Gamers are probably going to be the loudest yelling demographic when this hits.
You think the spam zombie/pwned newbie PCs will be upgraded?
Blame microsoft for the problems brought on by bad programs made by other companies. Then bitch because windows is insecure. Then bitch because they're trying to fix the situation and remove backwards compatibility to lessen the problems. Then say how microsoft is only doing this so people have to buy updated software. Well sometimes you have to bite the bullet and upgrade. If you're using some ten year old word processor on top for windows XP, then you better have a good reason of doing so. If you don't want to spend the money, switch to open office.
/. uses linux and other 1337 shit.
I can't understand how microsoft gets bashed for having the security holes and then again for trying to fix them. Besides, how many people on here still use windows? I'm always under the impressions that everyone on
I have a funny suspicion the "code monkeys" are not necessarily the ones to blame. Given clear specs and sufficient time I bet they'd love to make good software. Being led by marketing people who are more concerned with features to advertise, and don't have the overall architecture in mind is likely the problem.
"I expect to hear screams of pain as people deploy SP2 and discover that legacy applications no longer work, but those are probably the same people who complain so loudly (and legitimately) that Microsoft doesn't deploy secure systems."
Here goes my karma, but how true will this statement be here at slashdot?
One small step forward for Microsoft, one giant leap backwards for mankind?
Spoken like a true zealot. I'm an OOS advocate, but I disagree with this type of statement. It's a damned if you do/damned if you don't situation when someone makes comments like this. Hey, security is important here, and I'm sure Microsoft gauged this responce carefully before making these changes. Sure it's going to break some systems, but sometimes something has to give to move forward. I don't know about you, but security is very important to me. If the patch breaks your system, don't install it untill you're ready for the change. No one is forcing the service pack down your throat.
So Microsoft should be taking their lead from a company with, what, 3% market share? Ever stop to think that backwards compatibility might be one of the reasons for that?
OTOH, Microsoft just about HAS to break some programs to get security halfway decent. There's no good solution, but I think MS is justified in breaking some compatability in this case.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
You are missing the big problem with backwards compatibility. The problem isn't that they can't run old programs. Who cares. The problem is that programs written after SP2 will have difficulty running on older operating systems. I'm not saying it'll be impossible, but the dev will have to be careful. Many simply won't develop for the older systems anymore. Then everyone who has been hanging on to win2k will have to upgrade to get new software - in other words an artificial product death. Planned obsolescence. If they ever make windows anywhere near as stable and secure as it should be, then I won't mind an upgrade. But that won't happen until there are some major changes.
I submitted this story last night, and it didn't get posted.
Other things that I find good include port management that both handle the opening and closing of ports, but also allows some applications to run as a regular user instead of administrator.
There first complaint with SP2 was the NX command - which isn't available on most current processors. The second sounds like a benefit, not a complaint:
Then they go on to complain about not offering to pirated copies, but forget to mention it's only the ten most pirated product keys. It's still a large number, I imagine, but not the whole picture.That what was all this school was for... to teach us how to solve our own problems. -- janeowit
Ironically, apple has often chosen the path microsoft has now taken - the compatibility with outdated OSes should not be a priority over advancement or security.
Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
spyware makers are beginning to notice mozilla, and it certainly isnt the magic bullet that you think it to be. i have seen several websites attempt to install spyware via .xpi
mozilla wont' fix the problem, it'll make it less noticable until spyware makers *really* begin to focus on mozilla/firefox/etc
It seems that these changes won't break any well-designed applications, with the exception of viruses and worms.
Granted, MS is taking a "giant leap backward" in compatibility - with viruses! Apparently, the author misses having Blaster auto-install itself upon reboot, and still longs for the days when he had to close 5 or 10 popups to view the web page he really wanted.
How could Microsoft do this? After having spent so much time and effort to guarantee that viruses would run on their platforms, now they pull the plug!? The NERVE!
Quite frankly, this is what they should have done a long time ago. If there's any fault to be found, it's that they didn't do this sooner. Any app which breaks because of these changes wasn't well designed in the first place, and deserves to break. As far as I can tell, none of the Windows apps I've written will be affected by this. The only reason MS estimates that 1 in 10 will be affected is because Microsoft considers viruses to be an application for marketing purposes. This way, they can legitimately claim that there are "50,000 applications written for Windows..." True, 45,000 are viruses, but that hardly matters now, doesn't it....
And for once, they're doing the right thing - they're telling users beforehand that this patch is going to break things, rather than letting the user find out unexpectedly... This is an improvement for them.
The society for a thought-free internet welcomes you.
Are you guys ever happy? I honestly don't think you are. First, you biatch endlessly about the lack of security in XP. Then, when MS does something about it, you start right up biatching for more! I'm willing to bet 80% of the people who read this site hate Microsoft because it's the "cool" thing to do around here. I'll wait for the 20% to reply with their reasons for hating Microsoft, most of which will probably be the same babble I hear in every anti-MS thread.
From a linux user, I see backwards compatability as the biggest nightmare of linux today. There is just too much of it, and it's holding back progress. Many of the points I'm about to address come from OS X, as I'm also a happy user of that system, and think it's a model for what can be improved about operating systems if you're willing to sacrifice some backwards compatability.
/usr/include, /usr/lib, /usr/share. This conventional *nix approach practically requires a package manager to keep things straight. Then, all that is required to compile against it, both finding includes and library search path, is a simple '-framework foo' argument to gcc, which follows a single search path. Easier to write makefiles, without wasting your time in autoconf.
Over 4 years ago slashdot was full of posts about how it would take the OOS community a couple weeks, months at most, to match Apple's nifty new compositing window system. Well, today 99% of us are still using X, and it really hasn't changed significantly. Even the extensions being worked on at FreeDesktop aren't in wide use, and it doesn't look like they will be soon.
We're still stuck with an ancient standard directory hierarcy, and multiple search paths meant to find the same thing (what? I still have to have a huge autoconf macro in order to find both the LDFLAGS and CFLAGS necessary to include library foo?). This obviously isn't the best it could be, and yet no one even considers trying to change, because 'that's the way it was always done'. Again, look towards OS X. Headers, libraries, resources, documentation, XML files with library metadata, everything associated with libfoo is contained in a single directory 'foo.framework', not scattered in
A lot of lessons have been learned since these systems have been designed. If you insist on supporting everything ever made, you're never going to get anywhere.
They are two seperate product lines. If you'll compare XP to the previous iterations of the desktop line - 95, 98, ME - then you'll see that it is indeed a "a pretty giant leap forward in desktop computing".
You'd be surprised how stupid most people are. Have you been following any of the recent virus and spyware debacles at all? The current arrangement is actually fairly close to ideal. The people intelligent/capable/informed/(insert appropriate term) enough to know what a file system is will also be aware of the existance of windows 2000 as well as various ways to make XP less idiot-friendly. This arrangement does not work the other way around.
Work is punishment for failing to procrastinate effectively.
While I fully applaud what MS is doing, it seems like the wrong time to be breaking legacy apps. Put out an actual new Windows release, rather than just a point update. People will be far less surprised when old software breaks with a full release, but with an update to the old system you shouldn't be breaking compatibility.
This isn't a damned if you do, damned if you don't situation in reality, it just needs to be managed properly. By jumping the gun on this, they'll likely piss off users, but if it were longhorn or some interim release then some breakages are simply to be expected.
That said, since I don't run Windows on my own machines, I get to be one of those that benefits by not having as much email or log spam due to 0wn3d winboxes (less spam please indeed!) so I can't complain. This is a distinct advantage of the Free software model, since Mozilla, OpenOffice, etc can be updated for no cost if this release happens to break them.
"I may not have morals, but I have standards."
Usually, I'd say this was a good thing. But, as with all things M$, I must adopt the cynical view that this is just another way for them to force people to upgrade to the newer, still buggy, resources hogging software they put out today. Since a large number of places are refusing to upgrade because their systems are stable, and because the reputation of M$ patches and updates is shoddy at best, the promise of something secure, that actually works right seems rather an elusive fantasy.
I mean, who cares about empty promises from a morally bankrupt company that is known for predatory business practices and open hostility toward their customer base?
Apple broke a lot of backward compatibility and it did hurt, but at least the new software at the end of the tunnel didn't blow goats.
In space, no one can hear you moo.
The Internet Connection Firewall is now enabled by default, which should improve security for SOHO users. However, in a corporate environment it could cause problems for users trying to connect to network resources. The firewall will also now activate much earlier in the boot cycle, even before the network stack is enabled. On shutdown, it will now remain active until after the stack is disabled.
A smart start in my eyes - even though network admins might curse until the properly set up all PCs, John Doe is probably safer now.
The Messenger service is now disabled by default.
Praise the Lord, another evil gone (or at least disabled by default)
A pop-up ad blocker has been turned on by default.
Hmmm... probably useful, but as long Internet-"Security Hole"-Explorer is still default, with Active-Security Breach, er.. Active-X turned on it won't help much...
A unified security application called the Windows Security Center has been added (for more information on this feature, see this News.com article). It is supposed to bring all of the most basic security configuration information into one easy-to-manage place that will show whether your firewall is enabled, if your antivirus software is working, and if you have the latest software updates installed.
Again something good for John Doe, though I don't feel comfortable for MS checking out my PC
NX support is added to Windows XP. NX (no execute) will allow NX-enabled CPUs to mark certain areas of memory as non-executable; that is, any code pushed into those areas (perhaps by malware such as Blaster or other viruses) will just sit there, unable to run and therefore will be rendered harmless. This will harden the OS against the notorious buffer overrun threats. NX is currently only supported for AMD?s K8 and Intel?s Itanium processors, but 32- and 64-bit support for this important security feature is expected in most future processor releases.
Probably a good thing, fixing some of the oldest exploits in programming, but with Palladium sneaking round the same corner I have a not that good feeling
DCOM (the Distributed Component Object Model) gets a new set of restrictions in the form of an access control list for nearly every action of any COM server. There will also be a more detailed set of COM permissions, which will allow administrators to fine-tune COM permission policies.
Sounds reasonable
There is improved port management. It will no longer be up to the application to close ports after it is finished. Before, if a developer left out the closing routine or the application crashed, a port could remain open and leave XP open to attack. SP2 encourages port management with an application white list that only a user with administrator privileges can alter. Placing an application (such as a peer-to-peer program) on the white list causes ports to be managed automatically. Such applications can also now be run as a regular user rather than needing local administrator privileges to open ports in ICF.
As with the other Firewall changes, a sensible thing.
New RPC restrictions help tighten communications. The XP SP2 changes in this area let administrators fine-tune RPC services. This granular control over RPC will allow you to specify that a port be used for RPC even if the application is not on the white list. There are a lot of changes for RPC, including a new RestrictRemoteClients registry key that by default blocks most, but not all, remote anonymous access to RPC interfaces on the system. The RPC interface restriction will require an RPC caller to perform authentication, which makes it much more difficult to attack an interface, and helps mitigate against Trojan attacks.
Good... I guess...
All in all, what are the disadvantages?
Some hassle for Sysadmins till they get the settings right, some compatibility trouble with programs that have dynamic code, but all in all a big plus for security.
Seems good to me
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
XP Pro runs faster than Windows 2000 Pro
XP has some serious issues. My previously mentioned "Confirm File Delete" is the most annoying I come across. I'll detail more in a moment.
File Deletion
From Windows 95 on, I was able to press the delete key and immediately press the Enter key to "push" the OK button on the Confirm File Delete dialog. It worked fine with 95, 95 rev A,B, and C, 98, 98SE, NT 4.0, and 2000 Pro. I never used Me, so I can't speak about it. It worked fine with a 486/66 running IE 5.5 on Win98SE on 32MB RAM, it works fine with it works fine with an Athlon XP 2700+ Win 2K Pro SP4 running IE 6 SP1 on 1GB DDR333. It doesn't work under XP. The dialog opens so slowly that I have to for it to open or my keypress will be interpreted as "Open this item", so it launches the application or document before the delete dialog opens.
I have XP Pro on an Athlon XP 1700+ with 768MB of DDR266. I have tried it with other programs running and without, with both interfaces (I stick with the "Classic" interface, BTW). The only thing i haven't actively tested is the result in goddamn Safe Mode. The user interface is slower now than it has ever been. I don't give a shit about startup time - my box runs for weeks at a time. I don't give a shit about program launch - or relaunch - time, I don't spend most of my time opening and closing programs, I spend my time goddamn working.
Convenient Options
I work with a digital camera, a USB keychain, and various CD-RW & audio CDs. I transport pictures, my music files, the occasionaly training video, and various graphics with these different types of media. Every goddamn time I insert one of these items, the very friendly "Windows can perform the same action..." message. Now, I've checked the "Always perform the selected action" checkbox for each device, each time I insert it. I alwasys choose the same action, and it always asks me anyway. I don't care if there is a "fix", I shouldn't have to dick around with it after I've told it to always do something. What, I might change my mind? That's fine. Give me a mechanism to obtain that dialog again, just don't show it to me every time.
XP Search
I hate that fucking XP Search dog. The designer who implemented that should burn in the lowest pit of Hell for all eternity. OK, maybe that's a little harsh. I have a serious dislike of interactive characters that obfuscate the process, especially (slightly off-topic, now) when, like the Office Assistant, they obtain and restrict focus, so you can't ignore them. The entire new search interface is simply cumbersome. When you give someone that many options, a damn sidebar doesn't cut it. If I want to use more any of the additional criteria, the interface is practically unusable.
UI
I mentioned the UI was slower than I've ever experienced it? Sometimes - and I'll attribute much of this to my "25 things open all the time" style - The interface lags. I completely lose interactivity; I can't even move the pointer for seconds at a time while the computer is busy doing whatever the fuck it needs to do right then. What's worse, is anything that happens in the timeframe doesn't always catch up. Mouse movements and keystrokes simply vanish.
Like I said, I'm sure some of it's the way I use the computer. But I run my Windows 2000 Pro box just as hard, and it never lags like that. Even if I can't do anything for seconds as a time, I never lose the ability to move the pointer, even if it does become jumpy and slow.
The "extra touches" like the fading or "windowshade" animations on menus, ClearType (I'm still undecided it it's too blurry) and the like slow the user interface down even more. Those little "amenities" are nothing but a waiting period
That what was all this school was for... to teach us how to solve our own problems. -- janeowit
1) Windows 2000 does everything I want to that Windows XP does.
3) Windows 2000 has fewer dangerous features than Windows XP.
5) Windows XP will run on my Libretto with a Pentium (no MMX no Pro no II) 133 and 64M RAM?
6) I've already paid for Windows 2000.
7) I can upgrade my Windows 2000 PC as much as I want without getting shareware-style nag-screens from Microsoft's product activation demon. Even if I'm still using it after Microsoft has abandoned XP for Longhorn. I've already lost a handful of eBooks to previously abandoned DRM schemes. If my OS is going to throw a hissy fit and lock me out until Microsoft gives me a magic number (assuming Microsoft is still in the magic number business at that point), it better be willing to make breakfast the next morning...
Reverse DNS only returns one machine name. Most likely, they're using one of their server clusters for both windows update and hotmail.