WinXP SP2 Sacrifices Compatibility for Security

goldragon writes "TechRepublic is reporting that "Microsoft is pulling out all the stops to improve security. So much so, in fact, that it will cause many problems because SP2 will de-emphasize backward compatibility with legacy systems and code for the sake of security." One small step forward for Microsoft, one giant leap backwards for mankind?"

Compatibility Woes?

[Oculus Habent (562837)]

Giant leap backwards?

Let's face it, you can't remain compatible with old software forever. It causes, well, Windows XP. XP is trying so hard to be everything to everyone, that it can't even pop up a delete confirmation fast enough to not make me wait for it (On an Athlon XP 2700+ with 1GB of DDR333, fresh from boot).

Compatibility is an important issue, but at some point shouldn't the ten-year-old programs run in a virtual environment separate from the OS?

Re:Compatibility Woes?

[arose (644256)]

Compatibility is an important issue, but at some point shouldn't the ten-year-old programs run in a virtual environment separate from the OS?

DOSEMU and WINE under GNU/Linux?

Re:Compatibility Woes?

[by Anonymous Coward]

aren't ten year old programs the only thing DOSEMU and WINE capable of running? *ducks*

Re:Compatibility Woes?

[Ubergrendle (531719)]

I think this is a realistic perspective. SP2 will have numerous enhancements and functionality changes, and will fix some long-standing bugs. For those programs that are 'broken' by SP2, businesses always have the opportunity to continue to run @ SP1 for a period of time while the kinks are worked out. I doubt MS will stop providing hotfixes for major problems under SP1 for a period of time.

I'm not a big fan of MS, but some of the criticism they receive is unfair -- damned if they do, damned if they don't. I'd rather have SP2 with some pain and be more stable and secure, vs running indefinitely under SP1.

Re:Compatibility Woes?

[MoonBuggy (611105)]

Quite right - the blurb of this article was bordering on being a troll, it's the kind of thing that makes us as the OSS community look bad and as usual is caused by the vocal minority.

I am a multi-OS user, I spend time on open source projects and I strongly support the EFF. I hate MS as a company for their evil business practices and destruction of competitors, they create FUD and use weasel tactics in their advertising. I do not, however, go around screaming about them to anybody who will listen - I will point out open source solutions when possible but I do not moronically bash MS simply for being who they are.

I hold a certain amount of mistrust simply because of their past record, but that does not mean I can't see a positive thing when it comes along, and enhanced Windows security is most definitely a positive thing. I don't like them, but this time they're in the right.

Re:Compatibility Woes?

[YouAreCorrect (573646)]

Almost all comments below stories are trolls. If story X is submitted 100 times by 100 different people, the one that will invoke the most responses is the one that will be chosen by the editors. Because this site is driven by responses (More ads viewed when people go to read the comments, etc, etc).

If someone submitted this story as "Microsoft toughens up Win XP with SP2" and wrote thoughtful, balanced comments to go along with it, it would be rejected in favour of the current one because it would not generate as many responses/page views/ad views.

So if you want to get a story accepted, write a flaimbait/troll comment with it. It rewarded when it's part of a story submission, just not when part of the discussion.

And besides.. it wouldn't be as much fun without the flaimbait/troll articles.

OS X did it with Classic mode - works great

[tentimestwenty (693290)]

OS X did this brilliantly with the Classic compatibility layer. 99% of the time the layer was app-compatible and it ran at least as fast as running OS 9 alone. Many people bitched at first, but when they started using OS X, it was pretty clear that there was a huge advance in stability that made people actively dump their Classic applications and invest in the X architecture. We're still in the transition phase but with Apple proclaiming 9 dead last year, it has been successful for the OS transition.

Re:OS X did it with Classic mode - works great

[by Anonymous Coward]

Interesting how the Classic layer is "brilliant" when it comes to bashing Windows. But if when read the Mac boards, Classic is totally unusable and every vendor was under extreme pressure to produce a native version of their app immediately. Using mainstay apps like Quark or Outlook was apparently impossible under Classic.

Classic is fine for what it is (us old OS/2 users used to call the VM the "Penalty Box"), but lets not pretend it's the compatibility solution for the ages. Frankly it's slow and the redraw is buggy and one only uses it when there is abosolutely no other choice.

Besides, the article is about MS breaking modern Win32 applications, not legacy apps running inside a VM.

Re:OS X did it with Classic mode - works great

[LightningBolt! (664763)]

> OS X did this brilliantly with the Classic compatibility layer.

It's not an OS transition. The "compatibility" problems will come from the enabling of no-execute memory regions on the few processors that support that feature. This will cause problems for the rare old program which contains self-modifying code. I imagine it will also require Sun and others to modify their JIT compilers to declare runtime-compiled code as executable.

In any case, there isn't really an analogy to OS9/OSX differences.

Re:Compatibility Woes?

[Torinaga-Sama (189890)]

That was exactly what I wanted to pipe in with.

I was amazed to see the first comment say excatly what I thought.

XP is a pretty giant leap forward in Desktop computing, as a Linux enthusiast grudgingly decided that was true a couple years ago. Now M$ is trying to go back and fix some of the things we have been telling them is messed up with their OS. I see nothing wrong with that at all.

Re:Compatibility Woes?

[argent (18001)]

Fast User Switching is a nifty toy for home, but it's nothing more than a crippled subset of the virtual consoles that have been a standard part of PC-based UNIX (Linux, FreeBSD, even SCO) for over a decade. For Jobs to copy it instead of just taking advantage of the virtual console capability that's inherent in the OS Apple based Panther on is a wonderful example of the triumph of style over reality.

XP's "faster boot time" is an illusion. It takes XP a long time to complete booting... it just brings up the login dialog and lets you start logging in before it's finished booting. This can cause problems when you need services that don't get started until later from the users' login script... we always tell our users to wait for it to stop beating on the disk before logging in.

Re:Compatibility Woes?

[swordboy (472941)]

Let's face it, you can't remain compatible with old software forever.

Especially spyware.

I've found, that if you go into IE's securty preferences (TOOLS > INTERNET OPTIONS > SECURITY > CUSTOM LEVEL) and set all of the options that are set on "prompt" to "disable" keeps a PC from contracting spyware (that propagates through web browsing).

I've found that this is a better solution than telling my father-in-law to use the power button when he encounters a web page that LOCKS a user into picking YES when prompted with that ActiveX security warning garbage.

What will the slashdot community do when Microsoft fixes all of their problems? If they execute the antivirus and spyware solutions properly, It'll be a while until I look back.

Re:Compatibility Woes?

[WIAKywbfatw (307557)]

Let's say that you have incompatibility problems with some of your common office applications and the Microsoft solution to this situation is to upgrade your applications.

Now, would you be happy that to get a secure computing platform you have to spend hundreds of dollars/whatever per seat upgrading to the latest version of your commonly used apps? To get a properly working version of Windows XP should you be forced to abandon those applications that work for you?

Microsoft has used incompatibility problems to its own advantage time and time again. Indeed, breaking the compatibility of competitors' applications was one of the company's standard operating procedure for many years. WordPerfect, Lotus 1-2-3, DR-DOS, etc all were victims at one time or another. There was even a little saying that went round Microsoft during the time that one major version of DOS was being developed: "DOS isn't done until Lotus won't run".

When you look at this new story in that context it's hard not to be suspicious of Microsoft's motives and difficult to give them the benefit of the doubt.

Damned if you do, damned if you don't

[Cro Magnon (467622)]

OTOH, Microsoft just about HAS to break some programs to get security halfway decent. There's no good solution, but I think MS is justified in breaking some compatability in this case.

Re:Compatibility Woes?

[by Anonymous Coward]

if it didn't start any services by default

Try launching Linux with NOTHING RUNNING and see how productive you are. No cron, no logs, no fucking getty or login. Some services are necessary. Some of Microsoft's need to be fixed. Very few truly need to be disabled.

Re:Compatibility Woes?

[Mr. Neutron (3115)]

Very few truly need to be disabled.

WinXP by default starts 36 services. I doubt any one user needs more than 10 of those.

http://www.winnetmag.com/Windows/Article/Article ID/40722/Windows_40722.html

Re:Compatibility Woes?

[Xeleema (453073)]

True, but how many of those services that you mentioned even know what a network adaptor is? login doesn't have any sort of interaction with a NIC, (by default) neither does cron. I don't think I've even seen a way to configure login to do anything over the network. The only major thing in my experience with most Linux distros is that the X server keeps port 6000 open and waits for requests. However, that lil' nuance can be taken care of by changing a line in the appropriate config file. For Example; if you're running XFree86, find the file(s) "Xaccess" and change the "#*" and "#* CHOOSER BROADCAST" to "!*". This will reject any requests for a logon window (which is maybe where you get the assumption that the login service is exploitable via the network).

P.S: I know I'm feeding the Troll, but I just want to calm any worrried n00bs before they fall for this kind of FUD.

Firewall

[Oculus Habent (562837)]

Actually, yes. The first listed security change is turning on the firewall by default. Before the network stack loads, even, to prevent a gap between network availability and firewall protection.

Other things that I find good include port management that both handle the opening and closing of ports, but also allows some applications to run as a regular user instead of administrator.

There first complaint with SP2 was the NX command - which isn't available on most current processors. The second sounds like a benefit, not a complaint:

there are literally scores of RPC-based services running, all of which provide a window for attack. That changes dramatically with SP2.

Then they go on to complain about not offering to pirated copies, but forget to mention it's only the ten most pirated product keys. It's still a large number, I imagine, but not the whole picture.

One small step for M$?

[boarder8925 (714555)]

One small step forward for Microsoft

Actually, any security step taken by Microsoft is an enormous step.

Re:One small step for M$?

[VividU (175339)]

M$ [penny-arcade.com]

Can we save the MS Bashing...

[kevin_conaway (585204)]

...for the comments? I know this is slashdot and all, but that really has no place in the article summary.

Might this encourage

[foidulus (743482)]

less people to patch? I can bet it is going to drive IT managers crazy because now they will have to do hardcore tests of all their software to make sure it still works after the patch.
This might just make things less secure overall because nobody is going to want to bork their software. Will it be possible to roll back the patch quickly if someone finds they cannot run program X anymore?
But then again, who knows, it might "accidentally" break Office 97 so people think they need to upgrade to Office 2003.

Re:Might this encourage

[BlueNexus (95800)]

I agree with you. We're going to have to spend months testing compatibility with the software our company uses. Even with the "promise" of better security management will allow us to install something that breaks critical software.

Then there are the home users who will hear "SP2 breaks 'Product X'" from the mass media and will be afraid to install it. We already have a hard enough time getting them to install normal patches that are supposed to be "safe". Image how eager people will be to isntall it when they hear it might break their favorite software!

What?

[TheMadRedHatter (716344)]

I wouldn't call this a small step forward. I'd call it a huge leap. It shows that Microsoft actually cares about security. You can't keep an API exactly the same forever. It'll get crufty eventually.

Hopefully, there'll be more breaking for the sake of security.

TheMadRedHatter

Sacrifice? Windows Users are used to it

[Gunfighter (1944)]

Aren't all Windows users already sacrificing security for compatibility just by using Windows? Perhaps this is just meant to level the playing field.

I'm sure Microsoft will be releasing an update full of application compatibility fixes shortly after the SP2 release. Even in vanilla XP, you can run applications in Win95/98 compatibility mode. I don't see any reason to change it now.

I figured it out!

[marnargulus (776948)]

Microsoft is making it more secure by not allowing their applications to run!

Seems deceptive

[stanmann (602645)]

The article indicates that most of the things being broken will be viruses and trojans.

And that the only other major change will be to Finally honor the NX(Non-executable) memory designation, IOW if you want self-modifying code, you can still have it, but you can't place a call to an area that has been marked as Data-only or NX.

Seems to be all good to me...

Re:Seems deceptive

[steve.m (80410)]

The NX flag was only announced 18th March [theinquirer.net], so I'd say that was 'quickly', not 'finally'. It only made it into Linux 20 days ago [lwn.net]

Part of the design...

[LostCluster (625375)]

SP2 represents a big change in Microsoft's security vs. ease-of-use stance.

In the past, Windows shipped with many unlikely-to-be-useful services such as the NetBIOS Messenger service turned on by default installations, meaning that a user who wanted to use the service just needs to start using it and it'll already be there ready to work. Of course, we all know how this has been exploited by spammers.

Now, such non-essential services will default to the "off" position, and the user will have to take a step to affirmatively activate the services they want to use. This makes plug-and-play operation a little harder to accomplish, but Microsoft has finally decided that the security gained is worth more than the ease lost.

Compatibility is Overrated.

[PhxBlue (562201)]

It was overrated when Apple told its users, "deal with it." And it's overrated now. If you want backwards compatibility, use a Win2k emulator.

backward?

[Feyr (449684)]

this is a giant step FORWARD. if it can keep my network from being bombarded by all those damned windows viruses it's GOOD no matter what. and i don't even use windows.

i'd say this is the brightest idea microsoft had in the last decade (if they deliver that is)

To Be Fair

[sabat (23293)]

Hey, given the choice between the two, I think MS is right to choose security. You're often forced to lean toward security at the expense of some convenience, or vica-versa. And in this case, given the recent (past 10 years) track record, security is more important right now.

SP2 Install Instructions

[cyb3rllama (625448)]

1. Launch Windows Update.
2. Prepare sacrificial animal in accordance with the EULA.
3. Open CD tray.
4. Allow some blood to drain into computer and close tray.
5. Smear remaining blood on monitor frame.
6. When install completes, reboot and enjoy the ritually clean goodness!

Progman

[mobets (101759)]

Does that mean they will finaly ditch program manager? I realy hope there isn't any one still using programs for win 3.1 that still require that. And if so, why are they running it on XP anyway...

Don't believe me, or just feeling nostalgic for windows 3.1, go to run, or a comand promt and execute progman.

Funny how that works

[thefatz (97467)]

The reason Windows is in such a hurt is compatibility with everything. Even most Linux distros dont offer the level of backwards compatibility that windows xp or less does. You can still to this day run Win16 apps under windows and still print and save, as if it were no big deal. Thats just not possible with Linux. Try downloading or running a binary from 1994 that was compiled for linux and see if it works, im sure libc and glibc and aout and elf will make things fun.

Its kinda sad how things are around here for Microsoft, Damned of they do, Damned of they dont. Somebody shows progress and they get pounced.

"...one giant leap backwards for mankind?"...And recreating an OS from the 70's isnt? Thats pretty narrow thinking.

And you are complaining WHY?

[British (51765)]

Ie this message is moreso for the submitter. Love the tone of your voice. We see almost daily MS lack-of security woes and now MS does something about it. Then you have to bitch about not supporing legacy this or that in the name of security. I think I would rather choose security. hell, all you need to be considered a computer security expert is just say "everything's insecure."

Games...

[sqlrob (173498)]

I wonder how much of the copy protection on software this is going to break. Gamers are probably going to be the loudest yelling demographic when this hits.

Good in the long run, but...

[ErichTheRed (39327)]

I've been looking at XP SP2's release canadidate for a couple days now, and it's pretty obvious that it will cause nightmares for Windows admins for quite a while. However, it looks like they're making steps towards better security, which will be better in the long run.

Anyone who works in Windows shops knows the proliferation of COM-based software that was thrown together in Visual Basic, and this software often performs critical functions. It will take lots of testing/planning to make sure SP2 doesn't break these extremely fragile apps. There are many, many in-house applications that are still chugging along, even in compatibility mode, because they simply can't be replaced easily. Unfortunately, Microsoft can't test these in-house apps.

We'll see what happens...

Typical /. hypocracy

[Stevyn (691306)]

Blame microsoft for the problems brought on by bad programs made by other companies. Then bitch because windows is insecure. Then bitch because they're trying to fix the situation and remove backwards compatibility to lessen the problems. Then say how microsoft is only doing this so people have to buy updated software. Well sometimes you have to bite the bullet and upgrade. If you're using some ten year old word processor on top for windows XP, then you better have a good reason of doing so. If you don't want to spend the money, switch to open office.

I can't understand how microsoft gets bashed for having the security holes and then again for trying to fix them. Besides, how many people on here still use windows? I'm always under the impressions that everyone on /. uses linux and other 1337 shit.

Hmmm

[C_Kode (102755)]

One small step forward for Microsoft, one giant leap backwards for mankind?

Spoken like a true zealot. I'm an OOS advocate, but I disagree with this type of statement. It's a damned if you do/damned if you don't situation when someone makes comments like this. Hey, security is important here, and I'm sure Microsoft gauged this responce carefully before making these changes. Sure it's going to break some systems, but sometimes something has to give to move forward. I don't know about you, but security is very important to me. If the patch breaks your system, don't install it untill you're ready for the change. No one is forcing the service pack down your throat.

Re:Hmmm

[fzammett (255288)]

I agree completely. It's the supid-ass comments posted with the headlines that reveals Slashdot for what it is: Anti-MS Zealots Central.

I don't care if comments like that are posted, but they should be kept off the front page in my opinion. If your trying to be a semi-serious news site, then do it, which means keeping crap like that out of the headlines. If you just want to be a community of Microsft haters, that's fine, but get rid of your grandiose tagline because it doesn't apply.

About the news itself... Geez people, hate Microsoft all you want, there's plenty of good reason. But even they deserve SOME level of fairness applied, and as the parent here posted, they are damned if they do, damned it they don't, in the eyes of this community anyway. That's unfair, and even THEY deserve some degree of fairness.

Backwards?

[MasterVidBoi (267096)]

From a linux user, I see backwards compatability as the biggest nightmare of linux today. There is just too much of it, and it's holding back progress. Many of the points I'm about to address come from OS X, as I'm also a happy user of that system, and think it's a model for what can be improved about operating systems if you're willing to sacrifice some backwards compatability.

Over 4 years ago slashdot was full of posts about how it would take the OOS community a couple weeks, months at most, to match Apple's nifty new compositing window system. Well, today 99% of us are still using X, and it really hasn't changed significantly. Even the extensions being worked on at FreeDesktop aren't in wide use, and it doesn't look like they will be soon.

We're still stuck with an ancient standard directory hierarcy, and multiple search paths meant to find the same thing (what? I still have to have a huge autoconf macro in order to find both the LDFLAGS and CFLAGS necessary to include library foo?). This obviously isn't the best it could be, and yet no one even considers trying to change, because 'that's the way it was always done'. Again, look towards OS X. Headers, libraries, resources, documentation, XML files with library metadata, everything associated with libfoo is contained in a single directory 'foo.framework', not scattered in /usr/include, /usr/lib, /usr/share. This conventional *nix approach practically requires a package manager to keep things straight. Then, all that is required to compile against it, both finding includes and library search path, is a simple '-framework foo' argument to gcc, which follows a single search path. Easier to write makefiles, without wasting your time in autoconf.

A lot of lessons have been learned since these systems have been designed. If you insist on supporting everything ever made, you're never going to get anywhere.

They're Too Early

[krmt (91422)]

While I fully applaud what MS is doing, it seems like the wrong time to be breaking legacy apps. Put out an actual new Windows release, rather than just a point update. People will be far less surprised when old software breaks with a full release, but with an update to the old system you shouldn't be breaking compatibility.

This isn't a damned if you do, damned if you don't situation in reality, it just needs to be managed properly. By jumping the gun on this, they'll likely piss off users, but if it were longhorn or some interim release then some breakages are simply to be expected.

That said, since I don't run Windows on my own machines, I get to be one of those that benefits by not having as much email or log spam due to 0wn3d winboxes (less spam please indeed!) so I can't complain. This is a distinct advantage of the Free software model, since Mozilla, OpenOffice, etc can be updated for no cost if this release happens to break them.

Re:Thank you, Microsoft!!

[azaris (699901)]

Just another reason for folks to migrate away from their closed systems with forced expensive updates and security holes.

You mean a free service pack that improves security somehow translates into expensive updates with security holes? I'm sorry I fail to get your bizarro logic.

Re:Pah.

[WormholeFiend (674934)]

You think the spam zombie/pwned newbie PCs will be upgraded?

Re:Pah.

[MoonBuggy (611105)]

Spam zombie/pwned newbie machines will be running dog slow. The owners of said machines will either pay a techie to "fix AOL for them" at which point the techie removes viruses and spyware and installs the latest Windows updates (i.e. SP2) or the machines will simply be considered 'broken' by the owners (you'd be suprised how many people think they need to upgrade their hardware because they broke the software by installing crap) at which point Dell/PC World/Emachines will ship them a shiny new box complete with a patched up version of SP2. It might take a year or two, but assuming SP2 is as secure as MS is making out its proliferation will be very good for the internet at large.

Re:Bleh

[irokitt (663593)]

Microsoft tries to make their operating systems backwards-compatible to the point of running about half of the old 16-bit DOS programs that are still floating around out there. If you've studied WinAPI, you'll note that about half of the arguments and functions are never used, legacies of decisions made by Microsoft in the elder days. Yet those functions are still implemented and, for the most part, work the same way they did when they were first created.

This isn't fuel to bash Microsoft, this is good news for those of us who use their operating system, whether by choice or necessity.

Re:Surprise Surprise

[joshmccormack (75838)]

I have a funny suspicion the "code monkeys" are not necessarily the ones to blame. Given clear specs and sufficient time I bet they'd love to make good software. Being led by marketing people who are more concerned with features to advertise, and don't have the overall architecture in mind is likely the problem.

Check the dates-- both articles are old news.

[phillymjs (234426)]

The WinXP article is dated June 7. The link points to a Silicon.com article [silicon.com] about a security flaw in OS X, and that article is dated May 26.

It was on June 7, the same day, that Apple released a second Security Update that fixed the remaining vulnerabilities.

~Philly

Re:Hotmail?

[thedillybar (677116)]

'Generic Host Process for Win32 Services' from your computer wants to connect to law15-f93.law15.hotmail.com [64.4.23.93], port 80

>You have absolutely no evidence to support your claim that SP2 is causing your machine to access hotmail.com.
You are correct, I have no evidence. I only know that it "happened" to occur as I was running Windows Update and that Windows Update "happened" to stall until I permitted the connection. I agree this is circumstantial at best, but interesting nonetheless.

>In fact, it was probably a virus your machine got earlier that is making it act as an email relay. You're just aware of it now.
First off, AVG scans daily and Adaware gets run once/week. Second, the "hotmail" machine in question isn't an MX server and won't accept connections on port 25 (SMTP). The connection attempt was on port 80 anyway.
Third, and most important, http://law15-f93.law15.hotmail.com:80/ [hotmail.com] redirects to http://windowsupdate.microsoft.com/ [microsoft.com].