Microsoft Releases Windows Server 2003 SP1

Masq666 writes "Microsoft has wrapped up development on the first major update to its Windows Server 2003 operating system and released it for download, The company said that Windows Server 2003 Service Pack 1 is currently available for download via Microsoft's site and will soon start showing up on new servers. Among the primary benefits of the free update is the inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2. News.com.com has more details and commentary."

Comments

Re:heh

[LurkerXXX]

Right! And that's important because we know that no Linux distro has ever had a security patch released within weeks of a big update....

</sarcasm>

Fascinatingly Uninteresting

[OSXexpert]

Ok, I have used Windows for development in 95 and 98 releases and now use OS X very happily. What surprises me is we are in late March of 2005 and Windows 2003 SP***1*** is being released.

Re:Fascinatingly Uninteresting

[Steven Gray (Pulse U]

Why release one if theres no loud demand for it? Seeing as your an Apple user, I'm afraid to break the news to you that not every OS vendor has chance to push out a few mediocre SDK features every half year and name it after some random wild animal. Server is one of the most polished efforts from Microsoft yet, and as a test case of it's new security initiative you'd be hard pressed to find signifigant fault, since practically every bug that's hit the XP range is not a threat to it, and in terms of total security issues it's behind on the Linux kernel itself, let alone any of the distributions. There are some beardy guys who can best even that, but I don't want to talk about theee....arr....ghhhh...heellp... *runs from the Unix geeks*

Re:Free update ?

[varmittang]

Ok, you are basically throwing up the red flag saying, "I don't have a legitimate install of Windows 2003 Server, so I want to know if I can update my server without getting in trouble". To answer that, I say take your chances, because my company has ligitimate copies, so I don't have to worry about if it will let me update or not.

Holy Crap

[omega9]

File Name: WindowsServer2003-KB889101-SP1-x86-ENU.exe
Downlo ad Size: 337230 KB
Date Published: 3/30/2005
Version: SP1

Even without specifics, it blows me away that a service pack is almost 330MB. How can you explain something like that? If it's supposedly not insecure, and that much of an improvement over W2K Server, yet still requires fixes to the tune of half the size of the original install CD... then what am I suppsed to think?

Honestly. Can anyone give a legit reason why this is acceptable?

Re:Holy Crap

[Red Pointy Tail]

It could be that many libraries were completely re-compiled with a better compiler that automatically closes some holes (like data overflows), so the whole shebang needs to be reapplied, even if there were actually no code changes.

Re:Holy Crap

[optimus2861]

Punting the mod points...

This is different from Linux packages how, though? RPM doesn't do deltas. DEB doesn't do deltas. Every time there's a patch to one piece of the kernel, you have to download the entire kernel package again. Mandrake 10.1 has gone through at least three full RPM releases of KDE 3.2 for bugfixes -- that's not a fun set of downloads, let me tell you.

It's a valid criticism for everyone, not just MS.

Re:Holy Crap

[SteveX]

If some of the security updates are related to compiling with different options (like the buffer overflow detection changes Visual C++ has been making), then every binary would be affected.

Posters Don't Know What to Bitch About

[xxxJonBoyxxx]

The usual security complaints about Microsoft OS's are that:
1) They are easy to crack remotely with default installs.
2) Weekly if not daily patches are required.

So, Microsoft comes out with SP1 and people are already whining.
1) What is the "no inbound connections by default" stuff going to help?
2) The length of time between Windows 2003's release and its first service pack.

C'mon people, put it together.

Re:Just once ...

[xxxJonBoyxxx]

"I understand that OSes are probably the most complex bit of software written but the idea of a release occuring while the dev team then immediately starts patching is a bit off putting."

The open-source world must scare you shitless then. A lot of those projects have a release-of-the-day or release-of-the-week...

Re:"beta version of Longhorn Server later this yea

[_the_bascule]

I had a pranoid thought the other day. It seems that the MS policy for supporting products runs for about 5 years. Support for 2K pro was dropped earlier this year. XP was first released in May 2001, longhorn May 2006. Is this the forthcoming strategy for the forced upgrades the we all know and love?

Security Configuration Wizard (SCW) for XP?

[scupper]

Hey, why aren't they rolling out a paired down version of Security Configuration Wizard (SCW) for XP?

The "Security Center" on XP is pretty cheesy, didn't even include an updated MBSA until a couple months after XP sp2 was released. Most folks won't dig into using the Local Security Policy snap-in or Security Configuration and Analysis snap-in, or fiddle with changing their template.

Re:I'm impressed

[SilentChris]

"I'm really at a loss of words to describe this brilliance.
Just think of it, closing all open ports from incoming traffic by default now. Wow. Why didn't anyone else come up with this great idea before?"

It's not what you're thinking of - I don't think you're getting it. This isn't a firewall that gets turned on. Rather, the user can't do anything on the network until the system is up-to-date. It basically sandboxes the user from all internet traffic but the update site. I don't know of a single other OS that does this.

Weeeee!

[Lisandro]

Among the primary benefits of the free update is the inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2.

YES! I bet W2k3 server sysadmins will just love the new security features of XP like that great firewall. You know... the one that blocks local ICMP pings by default!

Re:Free update ?

[quantum bit]

Are you kidding? 2k3 server makes for a far better desktop than XP. All the annoying crap is off by default.

No bubbly playskool theme. No MSN Messenger popups. No product activation. No "take the tour!". No windows media player intruding into everything. IE is crippled by default -- ripe for Firefox installation.

It feels a lot more like if you took 2000 Pro and added the few GOOD things about XP.

Re: Microsoft Releases Windows Server 2003 SP1

[Albio]

I'm a little "meh" about the "security configuration wizard" (personally, if you're using a wizard to configure security you probably shouldn't be admining a server in the first place.

That's not always true. A wizard that quickly macros something you were going to do anyways sounds like a great idea.

Re: Microsoft Releases Windows Server 2003 SP1

[ergo98]

First new and improved script-kiddie exploits available in 3...2..1...

Keep that argument going, but the reality is that Windows Server 2003 has been the most secure Microsoft offering to date (I know I know - that isn't saying much).

Through a minimalist initial setup, to a wide variety of security improvements in things like the way IIS 6 operates, Windows Server 2003 has fallen prey to very, very few exploits. I think the fact that the first service pack took two years to hit the market, and much of it is additional functionality or tweaking (rather than actual fixes), really says a lot for the quality of the product.

I guess my point, if I have one, is that while the anti-M$ hoardes continue the security mantra as if it was 1999, Windows Server 2003 is really an excellent, secure product. I think the mininions need to evolve their FUD.

SP1 Now I Can Install!

[camliner]

Actually... there are a lot of Sys Admins that still will not even think about upgrading their server OS until SP1 comes out.

Re:SP1 Now I Can Install!

[xgamer04]

And for good reason! I don't think many mission-critical servers should be upgraded the moment a new system version comes out (ex: linux kernel 2.6.0)