Microsoft Does a Good Thing?
The RSS feed for the Anandtech News Channel just came across with an interesting article that I had to check out. According to an article on Computerworld, Microsoft's upcoming release of Windows XP SP2 (that's Service Pack 2 for those of you who never use Windows Update - shame on you!) could break some existing applications.
Blasphemy, you say?! Maybe to the hardcore zealots out there that have nothing positive to say about Microsoft in the first place. But for those out there will bother to RTFA, you'll find that Microsoft has chosen to eschew some backwards compatibility in taking a step towards making Windows a more secure platform. Regardless of your feelings towards Microsoft, it's difficult to argue against the fact that backwards compatibility has certainly bogged down the Windows code base over the years. Despite the fact that Microsoft's most popular consumer OS is based on NT, let's not forget that Windows NT 4.0 (the predecessor of Windows 2000 and step-father of XP) was released in 1996. Do you remember computers in 1996? The world of computers was much different 8 years ago.
Fear not, fellow computer user. Microsoft's decision to favor security in circumstances where backwards compatibility becomes an issue arises only out of certain circumstances: when an application was coded without consideration of security. That's certainly a pretty vague statement to make which is open to broad interpretation. Does this mean that Windows will attempt to prevent buffer overruns from occurring that would compromise a user's system (as a co-worker put it, if that's the case, will IIS even run?). Who knows? Kudos to Microsoft for getting the word out so early and organizing support materials and training to assist major vendors in ensuring their products are safe and secure under Windows XP SP2.
The Microsoft product manager quoted in the article does make a good point - developers need to be aware of and involved in the process of security as well. As the saying goes, security is not something you buy; it's something you do. It's a process that requires attention at all levels of the computing process. It certainly starts with the hardware and core software processes that comprise the platform of your choice as these are the things that the end-user has the least control over. However, complete security means using and deploying applications from vendors you respect and trust. It means understanding enough about how you use your computer to ensure its safety. It's no different than locking the doors to your house or car except we all understand how a door and lock works The computer is a powerful tool, especially when connected to the Internet. There are certainly things that the major software vendors can do to ease this strain on an uninformed and (relatively) uninterested computing public. But that does not excuse you from your own personal responsibility over your computer and it's use.