Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Windows Operating Systems Software Bug

Last Words On Service Pack 2 542

Posted by michael from the we-can-only-hope dept.
thejoelpatrol writes "So did Slashdotters call this one? Windows XP SP2 seems not to be so secure after all. A Register reporter goes in depth to find out just how safe a fresh install is. He provides a list of which dangerous ports are left open and which services are left on by default. I guess now we know why Microsoft's security timetable is 10 years." Reader ack154 writes "ZDNet is reporting that many Dell Inspiron users are reporting an extreme performance decrease since installing Windows XP SP2 - decreases as much as from 2.6ghz down to 300mhz. Dell claims no responsibility, claiming it is 'externally loaded software' and they don't support it. In the mean time there has been a fix posted on Dell's forums, which rolls back the processor driver." Finally, Marxist Hacker 42 writes "Amid complaints of too much XP Service Pack 2 coverage on ZD Net, David Berlind writes that Service Pack 2 deserved the scrutiny it got- and charges that it failed to live up to Gates' Trusted Computing Initiative." Finally, Microsoft warns that installing SP2 on a spyware-infested PC is a bad idea.
This discussion has been archived. No new comments can be posted.

Last Words On Service Pack 2 More

Last Words On Service Pack 2

Comments Filter:

  • Performance decreases that exxxxtreme... (Score:5, Funny)

    by Anonymous Coward on Friday September 03, 2004 @05:53PM (#10153991)
    ...deserve some extra 'X's.

    • Slowed Down? (Score:3, Interesting)

      by Jon.Laslow ( 809215 )
      I'm currently running on a Toshiba Tecra 8100 (500Mhz, 192MB RAM), and after slipstreaming SP2 on to my Windows CD and doing a clean install it's running faster than ever. On SP1 I had to turn off all of the visual options (drop shadows, ClearType, Themes, etc...) or the thing would run at a crawl. Now I can have everything on and use custom themes without any slowdown.

      • Re:Slowed Down? (Score:5, Funny)

        by Anonymous Coward on Friday September 03, 2004 @07:50PM (#10154733)
        Thanks Bill.

      • Re:Slowed Down? (Score:4, Informative)

        by Anonymous Coward on Friday September 03, 2004 @08:12PM (#10154820)
        I don't see how SP2 could be faster. Microsoft added new bloat compared to SP1. Two new kernel drivers that I can tell, fltmgr.sys and http.sys. Both of those stay in memory. There were also new/existing services enabled, like Windows Security Center, Network Provisioning Service, Application Layer Gateway, Dcom server, Network Provisioning Service, among others. I'm still investigating hidden features that were stolen by Gates and his gang. Here's two: command line ftp no longer has a pipe feature. Before you could type
        dir . |more
        for long directory output. Or you could type
        get filename |more
        to read text files. Now its gone. Also about:mozilla no longer works in IE.

        • Re:Slowed Down? (Score:3, Informative)

          by Long-EZ ( 755920 )

          I don't see how SP2 could be faster. Microsoft added new bloat compared to SP1.

          I think the reason it was faster after SP2 might be...

          ...and doing a clean install

          Windoze gets a bad case of registry rot from installing and uninstalling software, and all that spyware in there slows things down a lot, too.

          Obvious solution... I gotta see a man about a penguin.

      • Re:Slowed Down? (Score:3, Insightful)

        by mike_sucks ( 55259 )
        So, the clean install that flushed all of the worms, viruses and sypyware really helped, hey?

        And now that you have SP2 installed, it will take longer than evar!11! to get bogged down again.

        Yay111!1

  • Last Words? (Score:5, Funny)

    by Anonymous Coward on Friday September 03, 2004 @05:54PM (#10153994)
    Somehow, I doubt that these are the last words we'll see on the subject....

    • Re:Last Words? (Score:5, Funny)

      by skeptikos ( 220748 ) on Friday September 03, 2004 @06:13PM (#10154139)
      Famous last words: "I'll install SP2!"

    • Re:Last Words? (Score:4, Funny)

      by sharkey ( 16670 ) on Friday September 03, 2004 @07:32PM (#10154655)
      Sure they are. At least, until Taco dupes it tomorrow.

    • Re:Last Words? (Score:5, Insightful)

      by rd_syringe ( 793064 ) on Friday September 03, 2004 @11:05PM (#10155637) Journal
      It's a total flamebait article. This sort of article would have gotten modded down if it was a comment. It's just an attempt to bog people down with anti-"M$" links. I could create an article with just as many positive SP2 ariticles--and believe me, the response to SP2 was very positive and not at all this phony letdown that Slashdot is trying to put out to its readers--but it would never get posted on the front page of Slashdot.

      The entire summary is inflammatory. "Did Slashdotters call this one?" Well, gee, I'm so surprised that Slashdotters think SP2 is a failure. And then it even links to the widely criticized "Windows Secure In 10 Years, Says MS" article.

      I am fully convinced there is a smear campaign going on against Microsoft that goes beyond merely being a pro-Linux site--as in, it is going beyond normal levels of criticism. I suspect it has to do with the fact that this website is corporate-owned, an entity of OSTG which is a company that makes money off of selling OSS and Linux products. The rate of anti-Microsoft articles has increased dramatically with the release of SP2, and headlines/article summaries are often wildly exaggerated or even completely false. If Microsoft owned a tech news site, and the articles it posted were inflammatory and exaggerated in the same way Slashdot's are, you know that Slashdot itself would be all over it with criticism! But Slashdot's misleading "news" is given a pass because a lot of people here have chosen this website as the haven for their frustrations with Microsoft. This place is the Ain't-It-Cool-News for IT nerds.

      I'm sure many of you will disagree, and I respect that because I used to like Slashdot too back in the 90s when it was still a good place to find cool science and computer news, but since the corporate buyout, it has been a major source for three major things--anime news, anti-Microsoft news, and OSS project releases. In between those are scattered various articles intended to generate page hits by inciting emotions in the majority viewpoint of Slashdot--anti-capitalist, anti-corporate, left-leaning computer geeks (which makes it all the more amusing that Slashdot is actually corporate-owned, displays large banner ads, and sells subscriptions). That's why we get "More Automated DMCA Lies" articles--as if an automated system was an actual live being that could "lie" to you, when it's really just some automated system that made a mistake--and anti-RIAA, anti-SCO, and anti-copyright articles. We all know the formula for those articles.

      Finally, it does not surprise me one bit that this article was posted by michael. Plenty of others have said enough about him. Even Jon Katz's articles were at least genuine in their subject matter. Michael's are almost always a cynical backslap against someone. Let's not forget his all-caps "ANTI-INTEL" troll in the 64-bit chip article, which would have been modded down had it been a normal comment and not an article on the front page.

      If you disagree, reply and let me know why you do. But this whole obsessive-compulsive desire to bash and bash and bash Microsoft is just boring me to death. This is supposed to be a LINUX site, remember? Isn't there anything cool going on in OSS lately? I miss the old articles we used to get on Slashdot, and the fascinating discussions that used to take place (as opposed to the karma point games that go on now as everyone plays comedian and makes +5 Funny jokes that aren't funny). Do we really need yet ANOTHER SP2-bashing article?

      • Agree with you (Score:4, Insightful)

        by Donny Smith ( 567043 ) on Saturday September 04, 2004 @03:46AM (#10156406)
        Excellent post.

        I have complained about editorial policy in several of my posts, but (silly me) haven't ever suspected that ownership of Slashdot could have to do with what gets posted here.

        I have also complained about low quality FUD troll articles by michael and suggested that articles be moderated, too, so that we can filter out that cheap propaganda that pollutes the site.
        Of course, it seems it'd be "complicated" (suddenly it became hard to tinker with /. source code - where is that often lamented upside of the free software), but cheesy color schemas are never in short supply.

        This year has been really bad.
        I my opinion, some 40% of all articles and 80% of all comments are of miserable quality. Sometimes one has to browse four pages of comments to find 3-4 insightful posts. And as the parent post says, you can't get rid of worthless comments because totally stupid articles get modded insightful or funny.
        As articles can't be modded or filtered ("michael filter" anyone?) either, it's becoming quite unbearable.

        Sadly, that is the new Slashdot - perhaps it's "If you don't like it - leave!", so I've been thinking if I should still visit Slashdot.org any more or perhaps join one of commercial tech sites with quality articles and forums.

        Truly pathetic.

        P.S. In past months I've been getting to moderate ONLY anonymous posts - now I have started to suspect that happens because I've voiced my dissatisfaction too many times... Anyone else gets only to moderate only posts by anonymous cowards?
      • This is not a linux site, it is news for nerds, although you may consider it pro-linux. Nerds use MS products too, so we need to know what is going on with everything from linux to XP to Mac to more obscure (dec, sgi / mips, etc).

        Smear campaign agains MS? You sound like you could be on the MS payroll, one of those "grassroots" marketing efforts they can fund with the stacks of cash they make sellin you a $1 CD / software package for $300. I have never met a legitimate fan of MS products. People may be

  • It deserves scrutiny (Score:4, Insightful)

    by ebsf1 ( 689864 ) on Friday September 03, 2004 @05:56PM (#10154008)
    I don't get them moaning that there is too much scrutiny being given to this. It is going to affect 90% + of all the computers in the world.

  • any time now... (Score:5, Funny)

    by dirvish ( 574948 ) <dirvish&foundnews,com> on Friday September 03, 2004 @05:56PM (#10154011) Homepage Journal
    Well, just wait 'til Longhorn. It will be way better...in like 12 years, or maybe 14...

  • CPU Driver Problem? (Score:5, Informative)

    by kevlar ( 13509 ) on Friday September 03, 2004 @05:56PM (#10154013)
    ZDNet is reporting that many Dell Inspiron users are reporting an extreme performance decrease since installing Windows XP SP2 - decreases as much as from 2.6ghz down to 300mhz. Dell claims no responsibility, claiming it is 'externally loaded software' and they don't support it. In the mean time there has been a fix posted on Dell's forums, which rolls back the processor driver."

    Aren't 99% of drivers 3rd party software? The only thing MS does is bundle them together, but I believe that AMD or Intel et al are the ones who actually WRITE the device drivers. And if the performance of a new driver sucks, I'd chock that up to being a shitty driver, versus a shitty Service Pack...
    • CPU driver? CPU driver? What on earth is a CPU driver?

      I mean, a driver is something that tells your computer how to talk to some piece of hwardware - say a modem. It maps from a common API (say, the windows API) to the specific API of the device (say, use Int21 with ax=3 to hang up the phone).

      Are you saying there's a windows API to the CPU? Something like HWND add(HWN ax, HWN bx) ?
      That makes no sense at all.

      Someone please explain this to me.

      • Re:CPU Driver Problem? (Score:5, Informative)

        by Kenja ( 541830 ) on Friday September 03, 2004 @06:07PM (#10154098)
        A CPU driver in this case referes to a system driver that enables the OS to set the clock speed of the CPU for power saving modes.

    • Dell responsibility (Score:5, Insightful)

      by Flexagon ( 740643 ) on Friday September 03, 2004 @07:55PM (#10154756)

      As an OEM that sells systems bundled with XP, Dell, I believe, is obligated to support systems whose users apply service packs to the OEM-installed OS. There was some flak about this some time ago when some OEMs simply referred their customers to Microsoft, and I believe that they were reminded that they picked up this obligation as one consequence of their OEM arrangement. This support site page [dell.com] gives the particulars for Dell. In my experience, Dell acts like any other Windows sysadm: they wait until their own internal testing is done before they add it to the list of supported service packs, so that they can simultaneously publish a list of any issues (such as required driver updates). Until then, you take your chances (which have been minimal for me, though I tend to stay in the Latitude line, even for home systems) and rely on the forums. My reading is that Dell isn't done with its testing, and the particular spokesperson is only half right: not supported until their testing is complete and it appears on the above page.

  • Why I didn't bother... (Score:5, Interesting)

    by gordgekko ( 574109 ) on Friday September 03, 2004 @05:57PM (#10154019) Homepage
    This is why I didn't bother. My XP Pro with SP1 is protected with a firewall, updated virus scanner and Spybot S&D's innoculator. Running Firefox and Thunderbird and anti-spam software doesn't hurt as well.

    I might add that the free/OSS I have protecting my machine weighs in considerably less in terms of combined file size then does SP2.

    • Re:Why I didn't bother... (Score:5, Funny)

      by Carnildo ( 712617 ) on Friday September 03, 2004 @06:01PM (#10154055) Homepage Journal
      Why I didn't bother:

      I'm dual-booting 98SE and Gentoo Linux. '98 predates all the security holes, and Linux doesn't have any worth mentioning.
    • My XP Pro is protected like yours as well. But I did do the upgrade and didn't suffer many negative effects. I had to turn off the firewall and a few unneeded services that were activated but all in all it wasn't a particularly traumatic experience.

      The biggest problem I had was trying to actually get the update through Windows Update. I did set Windows Update to automatically download it (but not install) but that didn't work for 3 whole days after SP2 had been released. So I tried to use Windows Update m

  • This just sucks (Score:2, Informative)

    by ATAMAH ( 578546 )
    Things that i have been disabling as a rule, just like a "normal" procedure after a windows install - are still out there active on default and still need to be disabled. As the article says they are simply not required for home machine (in a vast majority of cases anyway). So what is this major security improvement they speak of if basic things that have been attacked for so long are left open?

  • So basically: (Score:2, Insightful)

    by Sheetrock ( 152993 )
    SP2 doesn't patch every possible security flaw for now and forever?

    Because I wasn't expecting that it would, but apparently somebody is. Unrealistic expectations also lead to insecure implementation.

    • Re:So basically: (Score:5, Insightful)

      by dirvish ( 574948 ) <dirvish&foundnews,com> on Friday September 03, 2004 @06:02PM (#10154067) Homepage Journal
      Every currently known security flaw would be a good start. Eh?

    • Re:So basically: (Score:5, Insightful)

      by wobblie ( 191824 ) on Friday September 03, 2004 @06:04PM (#10154078)
      RTFA. The main gripe is that it doesn't follow braindead simple best security practices (e.g., not leaving services listening on the public net) , not that it doesn't fix all the holes.

      Many of microsofts security problems could be fixed by just following best practices, and the built in firewall doesn't do shit.

      • Re:So basically: (Score:5, Insightful)

        by GigsVT ( 208848 ) on Friday September 03, 2004 @06:13PM (#10154133) Journal
        MS really is in a bind here.

        If they were to close off all those ports, they would risk all the clueless sysadmins screaming on MS forums that SP2 breaks everything, even basic windows sharing facilities.

        I think the main point here is that MS has tried to appeal to people by saying that it's easy to be a sysadmin, that anyone can set up a network and run it. Real sysadmins all over the place freaked out, with good reason. They were accused of being set in their ways, etc, etc.

        Now all those things that the skillful have said would happen, have happened. Rampant security problems, etc.
        • I think the main point here is that MS has tried to appeal to people by saying that it's easy to be a sysadmin, that anyone can set up a network and run it.

          Ahh, but it is easy to be a sysadmin and setup a network in the Windows world. Good network? probably not. Secure network? probably not. However, it's going to be good enough for people to get their work done.
          I once saw a small company with a terrible network. The configuration was an abomination and security was lax. Everyone in the company drove an S

      • Re:So basically: (Score:5, Insightful)

        by mythosaz ( 572040 ) on Friday September 03, 2004 @06:35PM (#10154306)
        Ports 135-139 are turned off by default on NON-DOMAIN installs for XP2 at the firewall.

        Ports 135-139 are enabled by defailt when joining a domain.

        Windows Firewall is managable by DOMAIN POLICY.

        Complaining that they're enabled by default is moronic.

      • Re:So basically: (Score:3, Insightful)

        by eV_x ( 180493 )
        "the built in firewall doesn't do shit"

        If Microsoft had delievered a completely robust, all encompassing firewall product bundled in SP2, would you then gripe and bitch that was unfair and anticompetitive?

        Damned if you do, damned if you don't. It's not strong enough or you're being unfair and bundling.

        Whatever, either way, saying "doesn't do shit" is pure BS - it DOES do "shit", it just doesn't do everything YOU want it to do (or what you read that others want it to do).

  • I don't get it (Score:4, Insightful)

    by WD_40 ( 156877 ) on Friday September 03, 2004 @05:58PM (#10154027) Homepage
    I don't get why Microsoft insists on leaving so many services enabled by default. So many of them the average home user will not need, and like the reporter from The Reg said, if a sys admin needs those services, it will be trivial for him to enable them.

    • Re:I don't get it (Score:5, Insightful)

      by Marxist Hacker 42 ( 638312 ) * <seebert42@gmail.com> on Friday September 03, 2004 @06:02PM (#10154065) Homepage Journal
      To some extent the Reg Reporter was just FUDing- if you truly turned off everything that article said to turn off, you'd lose a lot of functionality.

      Having said that- I was surprised by his port scan of a SP2 machine, since my own tests at ODOT showed NetBios inaccessible after SP2 install, killing the ability for SMS to see the machine (one of the reasons that I'm NOT allowed to do testing on the real network for SP2).

      • Re:I don't get it (Score:4, Informative)

        by Cthefuture ( 665326 ) on Friday September 03, 2004 @08:38PM (#10154917)
        I agree. I don't think he knows what he is talking about. He said services are "listening" and that may be true but the firewall is blocking everything by default.

        Today I built a fresh XP machine with SP2. I just scanned that machine with nmap and it showed absolutely nothing open except the VNC port that I specifically configured. The machine doesn't even return pings. I'd say that's a pretty tight default setup.

  • Whoa! (Score:3, Funny)

    by Jugalator ( 259273 ) on Friday September 03, 2004 @05:58PM (#10154033) Journal
    These news sure struck like lightning from a clear sky!

    *phew*

    I think I must sit down to recover from the shock.

  • From an Inspiron 9100 owner... (Score:5, Interesting)

    by SoCalChris ( 573049 ) on Friday September 03, 2004 @06:00PM (#10154044) Journal
    I haven't had ANY decrease in performance. I have had a lot more stability with wireless networking now though.

    • Fellow inspiron owner (Score:5, Insightful)

      by gad_zuki! ( 70830 ) on Friday September 03, 2004 @07:02PM (#10154467)
      My inspiron is acting fine too. A little snappier too.

      >So did Slashdotters call this one?

      No. They really didn't. Of course SP2 was going to cause *some* problems, but poo-pooing everything MS in a knee-jerk fashion doesn't help anyone and probably is keeping people from installing it, which is a real shame because:

      1. Firewall on by default. Power users can easily shut it off. How many Slashdot posts do we have that wish MS did this, but when they do suddenly MS is doing wrong. Yes an admin can shut it off even with an activeX control. Such is the life of running as admin.

      2. Nag screens for anti-virus and updates. Much needed.

      3. Better wireless interface. The old one wasn't so hot and this is a welcome upgrade.

      4. "Drive by installs" are not going to be as common as IE requires an extra step to install/download stuff and blocks pop-ups natively and by default. Man, how many slashdoot posts did we have about "MS should do something about pop-ups and click installs!" Well, they did. Sure, they didnt remove activeX altogether, but no one was expecting that.

      5. NX support for AMD 64. Wow.

      > Finally, Microsoft warns that installing SP2 on a spyware-infested PC is a bad idea.

      No shit. Installing ANYTHING on a spyware infested PC will cause all sorts of problems. Fighting spyware is what SP2 is trying to do. Give it time or at least introduce your friends and co-workers to a little thing called Ad Aware, especially if they'll never switch to FireFox. Face it, many people will never switch and will go to their deathbeds using bundled software.

      >So did Slashdotters call this one?

      Granted, if you take the negative approach to life 24/7 you will be right every so often or at least subjectively, but I feel these are much needed changes and will help technophobes better use their machines. MS can do things right. Yeah, break out the smelling salts...
    • Although I don't have a dell, I noticed the same thing. My wireless connections now work the first time all the time. SP2 improves power management as well. My laptop now comes out of sleep mode every single time in a couple seconds. Pre-SP2 half the time it would reboot or just sit there with a blank screen until I hit the power button.

  • Easy Windows (Score:3, Insightful)

    by jals ( 667347 ) on Friday September 03, 2004 @06:00PM (#10154045)
    You Could say that if you disable and enable everything mentioned there, configure your machine so it is secure, you should be OK. But the problem with that is Windows is meant to be the option for the user who doesn't want to be dealing with configuration and settings to get their computer working.

  • not to be a jerk, but... (Score:3, Interesting)

    by Trailer Trash ( 60756 ) on Friday September 03, 2004 @06:00PM (#10154046) Homepage

    David Berlind writes that Service Pack 2 deserved the scrutiny it got- and charges that it failed to live up to Gates' Trusted Computing Initiative.

    Okay, Mr. Berlind, did you actually fall for that and now you're surprised?

  • Spyware infestation (Score:5, Informative)

    by ogewo ( 652234 ) on Friday September 03, 2004 @06:00PM (#10154048)
    If for some reason you DID load SP2 on a spyware infested computer and it is no longer booting just boot with the "Last known good configuration" option in the F8 boot menu. Uninstall SP2 (you may have to use XP system restore before doing this), remove spyware, reinstall SP2.

  • Firewall is on by default (Score:5, Interesting)

    by sparks ( 7204 ) <acrawford@laetabil[ ]com ['is.' in gap]> on Friday September 03, 2004 @06:01PM (#10154056) Homepage
    Yes, perhaps there are things that could have been done better in SP2, but the simple act of filtering inbound connections is a massive step forward in security for Windows users.

    I say it's a "massive step forward" because there are literally MILLIONS of windows machines which are never updated, don't run any firewall software, and which are directly connected to broadband ISPs. The people running these boxes truthfully don't know what they're doing in these matters.

    Right now, those poeple have NOTHING. Now at least they will have something, albeit limited. This is a major improvement. Even the old XP internet connection firewall, if it had only been enabled by default, would have prevented Blaster from ever happening.

    Of course there are some questionable exceptions in the new firewall default configuration, and no doubt the next generation of worms will take advantage of those - but at least the bar has been raised a little higher.

    • Re:Firewall is on by default (Score:5, Insightful)

      by Psiren ( 6145 ) on Friday September 03, 2004 @06:15PM (#10154148)
      I say it's a "massive step forward" because there are literally MILLIONS of windows machines which are never updated, don't run any firewall software, and which are directly connected to broadband ISPs. The people running these boxes truthfully don't know what they're doing in these matters.

      So if these machines are not updated, and the owners don't know what they're doing, what makes you think they'll install SP2?

  • Spy ware and SP1 (Score:5, Informative)

    by Solidblu ( 241490 ) on Friday September 03, 2004 @06:01PM (#10154059) Homepage
    "Microsoft warns that installing SP2 on a spyware-infested PC is a bad idea."

    One word. DUH. If you even install sP1 on a spyware infested computer it can render it unbootable. I've run into atleast 10 machines this week that have had this same problem. I work at a university which is forcing students to install service pack 1. there are a lot of machines that can't even take the service pack because of the spyware the installs just hang or destroy the install on the computer. I feel bad for the students because they have to either format or pay to get thier comptuer fixed. It not thier fault or the universities fault. who would have thought forcing college students to update thier microsoft patches would be a bad idea.

    • Re:Spy ware and SP1 (Score:3, Insightful)

      by evilviper ( 135110 )
      It not thier fault or the universities fault.

      Perhaps not the first time you notice the problem, but after that, it's the university's fault. It's very easy to tell people to install and run adaware before installing the update...

    • Blame (Score:3, Interesting)

      by glass_window ( 207262 )
      And it isn't the stupid^^^dents fault for getting spyware onto their computer in the first place, let alone ensuring it gets removed when it is? It's not like it's a regular thing to have on a well-kept computer. I have a laptop runing XP that has yet to see anything that doesn't belong on it (except MS messenger, but that was before I even got ahold of it, didn't take long to remove it). My wife has a win95 box that is basically on an open broadband connection and as long as it's not left on, I might fi

  • all in the spirit....and its manifestation... (Score:3, Interesting)

    by 3seas ( 184403 ) on Friday September 03, 2004 @06:06PM (#10154089) Homepage Journal
    .... The MS mindset of making people need them has resulted in a widely integrated manifestation of the user frustration function in their software.

    Its this same manifestation of the application of doing things in software to "make people need them" that is causing all the security problems.

    This security problem is not fixable by this mindset that cause it.

    Its like an alcoholic or drug abuser, their mind is geard towards supporting the continuation of its vise. What I call a "self supporting dependancy". And under such conditions, as those who have admitted it and sough help, you have to have external help in order to be lead out of the blindness of the self supporting mindset.

    Whos helping MS??? If anyone can?

  • ZDNet, huh... (Score:3, Insightful)

    by Chris Mattern ( 191822 ) on Friday September 03, 2004 @06:07PM (#10154093)
    > [Performance] decreases as much as from 2.6ghz down to 300mhz.

    I'm not going to place any faith in benchmarks generated by someone who thinks performance is measured in clock speed.

    Chris Mattern

  • Classic, just classic. (Score:3, Funny)

    by A_Non_Moose ( 413034 ) on Friday September 03, 2004 @06:07PM (#10154099) Homepage Journal
    FTA,
    We look to ZDNet as a beacon of light in IT journalism.

    (pauses)

    BWAAAHAHAHAHAHAHA!

    All I can say to this person, is 'look out for the oncoming train...prolly complete with windows logo and named "longhorn".'

    IT journalism, brought to you from the same folks of Military Intelligence.

  • Hrmm... (Score:5, Funny)

    by Zygote-IC- ( 512412 ) on Friday September 03, 2004 @06:07PM (#10154104) Homepage
    Finally, Microsoft warns that installing SP2 on a spyware-infested PC is a bad idea.

    So basically, you don't want to install it on any computer running a Microsoft operating system that has been using a Microsoft browser or a Microsoft e-mail client.

    Huh..I think I'm starting to see a pattern.

  • Stop bitching (Score:4, Insightful)

    by maelstrom ( 638 ) on Friday September 03, 2004 @06:11PM (#10154120) Homepage Journal
    Microsoft at least got some things right in SP2. Personally I usually run Linux. If you don't like it stop fucking whining and install Linux.

  • Interesting... (Score:5, Informative)

    by pc486 ( 86611 ) on Friday September 03, 2004 @06:11PM (#10154127) Homepage
    "DHCP Client, automatic. Unnecessary on most home machines. Should be disabled by default."

    Now, I'm no fan of Microsoft (Windows free for over 5 years now), but this is insane. Evey home user I have ever helped needs a DHCP client so that their computer can get an IP off the university LAN or off their brand-spankin'-new broadband router. To disable the DHCP client means to turn off the interweb for the majority of users. Greene went a little over the top it seems.

    • Re:Interesting... (Score:5, Insightful)

      by eV_x ( 180493 ) on Friday September 03, 2004 @06:47PM (#10154388)
      Agreed.

      Suggesting that we turn off DHCP with a comment like "Unnecessary on most home machines" shows that someone is not in touch with the rest of the world.

      Maybe in L33Td0M you only run static IPs so you can connect by typing in l33T IP addresses instead of machine names, but the rest of the world doesn't know an IP address to save them.

      Comments like that show you have no clue, because the world is not full of command prompt users.

    • Reverse FUD (Score:5, Informative)

      by Nintendork ( 411169 ) on Friday September 03, 2004 @06:48PM (#10154393) Homepage
      Not to mention that the author completely overlooked the default configuration of the open ports. A lot of them are only open to the local subnet, which for 99.9% of the people is a home or small business LAN. Anything coming in from beyond the router is dropped. Smart move. A LOT of people would have been pissed off if their home file sharing stopped working after installing SP2 and they would have just disabled the firewall. In a corporate environment, administrators can lock down all the clients froma central point using group policy. The default configuration combined with powerful administration tools is probably the most secure way they could have done it.

      -Lucas

    • Re:Interesting... (Score:3, Insightful)

      by EMR ( 13768 )
      And he also goes as far as saying you need to disable the DNS Client.. If you disable that you aren't getting any where on the 'net unless you go by IP address. Sounds like he's talking about an XP computer that is unplugged from the network.. and if that is so, there's no need for any networking services, and no worry about security issues except for viruses from floppies.. but who uses those anymore.

      • Re:Interesting... (Score:3, Interesting)

        by value_added ( 719364 )
        Someone can correct me if I'm wrong, but I believe that unless you're participating in an AD domain, you can indeed disable the DNS client service and still be able to resolve names. You'll lose caching of course, so name resolution will be a bit slower.

  • 2.6ghz down to 300mhz (Score:3, Funny)

    by upsidedown_duck ( 788782 ) on Friday September 03, 2004 @06:15PM (#10154151)

    Security by obesity.

  • What crap (Score:5, Insightful)

    by rabtech ( 223758 ) on Friday September 03, 2004 @06:31PM (#10154285) Homepage
    The writer of the article is full of it and obviously knows nothing about Windows.

    He claims that WebClient, DCOM, TCP/IP NetBIOS Helper, Secondary Logon, Remote Desktop Help Session Manager, Remote Access Connection Manager, DNS Client are all on or set to manual and should be disabled. Thanks, but I'd like to be able to use WebDAV, COM/DCOM, share files with a roommate/family member, use remote desktop from work, VPN into work in the first place, and resolve DNS hostnames thanks.

    I might also add that he rails on Microsoft not taking advantage of multiuser capability properly then recommends that Secondary Logon be disabled for home users! Without it, Windows can't popup when you try to install a program or run Control Panel and ask for an admin password to proceed... which makes using a non-admin account a pain in the ass.

    He also whines about these network drivers being installed:
    Client for Microsoft Networks, File and Print Sharing, and the QoS Packet Scheduler

    But perhaps he assumes everyone has one and only one PC in their home and has no wish to share files between them (yeah right). Oh, and you'd like to take advantage of QoS for VOIP or bandwidth throttling? Forget it if the driver isn't available.

    With "genius" insights like these I certainly wouldn't trust this yahoo to install a toaster oven, let alone an operating system.

  • I can't believe this got published (Score:3, Interesting)

    by JebusIsLord ( 566856 ) on Friday September 03, 2004 @06:35PM (#10154308)
    Among this guy's rediculous suggestions, he says users at home have no need for DNS and DHCP client services to be running. How in holy hell are people supposed to get on the net??

    I can't believe they published this bullshit.

  • Opinion Represented as Fact with a \. Slant... (Score:5, Informative)

    by mythosaz ( 572040 ) on Friday September 03, 2004 @06:41PM (#10154354)
    This is normal. This is another in a long line of articles that does little more than say:

    L0LZ@Micro$0ft!111!!11oneeleven1!! because your firewall choices and services defaults aren't what I would have picked.

    There's still service bloat in XP. There's little doubt about that, but suggesting that you turn off DHCP when 51% of us use broadband? I mean, DHCP only has an effect for people that actually, you know - HAVE A FRICKIN NETWORK CABLE PLUGGED INTO THEM! Can we make an assumption that a pretty fair percentage of people who have network cables plugged into their computer use DHCP? Good lord almighty.

    Also, he complains because the service type on most services is set to... ...get this... ...MANUAL. Manual is another word for "not on unless I need it," which is a nice long way of saying "OFF" -- you damned chowderheads.

    Sure, XPSP2 isn't perfect, but articles like this, these "If I had made it, I'd have made it stupid!" articles - they're just drivel.

  • Ok, so... (Score:5, Interesting)

    by jd ( 1658 ) <imipakNO@SPAMyahoo.com> on Friday September 03, 2004 @06:44PM (#10154371) Homepage Journal
    The fix is broken on computers that have already been compromised. Which is probably a fair number of them. This bothers me.


    Think about it, for a moment. The firewall is blocking internally-generated connections. Which is fair enough. (Though silently dropping would likely have been safer.) However, to lock the machine up, the TCP stack has got to be taking the error as cause to retransmit the packet.


    Why am I so certain that this is what's happening? Because Windows has had some degree of preemption for a while. It's not great, but it works. Sort-of. Lock-ups should be next to impossible on a totally pre-emptive OS, as the locked-up program would simply be interrupted. It'd slow the machine down, slightly, but it wouldn't be fatal.


    What we're getting here, though, looks like something fouling up big-time in a non-blockable part of Windows. Odds are pretty good that it's the network code. My suspicion is that the TCP stack and firewall are in an unbreakable infinite loop, with the error generated by the firewall causing the TCP code to resend the packet, ad infinitum.


    A lot of people have argued that Microsoft isn't to blame for other people's crappy code. Which is fair enough. But they are very much to blame for their own crappy code. If you're going to have non-blockable code (a VERY bad idea!) then you've got to be damn sure that there are no scenarios in which that code will put itself into a spin-dry cycle.


    It seems as though Microsoft merely added firewall code, with absolutely no thought as to the possible impact it could have on the rest of Windows.


    Further, if my suspicion is correct (and I'm pretty confident it is), then it should be possible to crash any Windows box remotely. Simply generate a packet that Windows cannot reply to. By forcing the TCP stack and the firewall to fight it out, you'd paralyze the machine.


    The correct way to handle this kind of situation is to recognise when a connection is administratively prohibited or impossible, and to not keep retrying. You'd then escape out of the non-blockable code, and pre-emption would allow you to continue as normal.


    If you want slightly "smarter" behaviour, then if a process repeatedly keeps retrying a connection or activity that is prohibited, every time it gets woken back up, it should drop in priority, be slept a reasonably long time (in the hope the problem can be cleared by then) or get kicked off the system. ("Three strikes and you're out." logic.)


    It should absolutely not be possible for any user process, no matter how badly written, to create a situation in which an uninterruptable infinite loop can develop. Either there needs to be some mechanism to interrupt any loop that might be infinite, OR there needs to be a mechanism for recognising when a loop is running unacceptably long.


    It's no use Microsoft whining that customers should clean their computers first. That would be like McAffee arguing that you should clean your computer of viruses before running their software. And how are you supposed to do that, if you've no software installed for detecting and/or cleaning the damn things in the first place?


    The only way you can know (for certain) that there's nothing trying to access an unauthorised port is by blocking the ports and seeing what happens when you try to use the computer as normal. And the only way you can then do anything about it is if the computer can cope with that situation in a controlled manner.

  • Busy Work (Score:3, Insightful)

    by Ridgelift ( 228977 ) on Friday September 03, 2004 @07:11PM (#10154540)
    I find it amusing that Windows requires so much babysitting. OS Patching, anti-virus signature updating, anti-spyware scanning, rinse & repeat. And after awhile when entropy has taken too much of a toll on the machine, it's time to back everything up, erase the computer and reinstall the operating system.

    It's a computer for crying out loud! Why can't the process be automated so users can do other things?

  • Bogus write up by the register (Score:3, Interesting)

    by Zebra_X ( 13249 ) on Friday September 03, 2004 @07:20PM (#10154602)
    The register generally has very whitty and sharp commentary surrounding many facets of the computing industry. Their review of SP2 however, lacked a reasonable level of objectivity.

    The first section of the article goes on to explain how a number of services are left on that "shouldn't be". This is for the most part a subjective rant about services that have traditionally been a source of system compromise. The "Hate On Microsoft" stick was made apparent when the author went so far as to proclaim that the DHCP client service and DNS client service should be off by default, "DHCP Client, automatic. Unnecessary on most home machines. Should be disabled by default. "DNS Client, automatic. Unnecessary on most home machines. Should be disabled by default." that wouldn't be a very useful computer would it? How about hitting up google for an answer to "Why can't I check my mail, browse the web, or do ANYTHING online?" - oh, wait...

    Among some of the old favorites that were left on, file and print services made the list. That would be pretty bogus if the system's firewall wasn't turned on by default:

    "The new "Windows Firewall" packet filter is turned on by default, finally. However, an exception for Remote Assistance connections is enabled, which is preposterous, although file and printer sharing, and UPnP, are blocked by the firewall as they should be."

    Since it's firewalled, it's a non-issue. In fact, most of the article is written as if the system's firewall is not installed. Remote assistance is referenced in almost all of the help documents it would be a pretty bad user experience if you wanted help - but couldn't get it. As far as I can tell there has been no exploit based on this service since the introduction of XP.

    Generally speaking unused services should be turned off. The only reasonable way to address this would have been yet another wizard that would ask the user how they use the computer and set services setting accordingly. However, the question of "Is sp2 remotely exploitable out of the box? More to the point is it secure from a network perspective, now and into the future?" The answer to that question is generally yes. Unless there is a nasty buffer overflow of some kind in the firewall (one hasn't been found, not to say it won't) an SP2 box is pretty safe on the network.

    Wasn't that the point of SP2?

    When evaluating the effectiveness of SP2 the net result needs to be evaluated. Many critics have evaluated the implementation. A lot of people might NOT AGREE with File sharing, RPC, Remote Assistance, or any number of the other services being on by default for that matter, but does it matter from an exploitability perspective? Only if that port is available for remote exploitation -- which is not the case.

    Network issues aside, IE and the shell both do a good job of throwing up warning dialogs when the user is about to run an executable. There is also the "Data Execution Prevention" feature that detects when "data" is trying to execute as a program, though for it to work well the hardware has to support non-executable memory regions. Only time will tell how well those measures aid in stopping the propagation of worms.

  • New PC + SP2 =Broken Pgm (ECDC5) - Dell shines it. (Score:3, Informative)

    by jwold ( 124863 ) * on Friday September 03, 2004 @07:25PM (#10154620)
    If you still use Roxio Easy CD Creator 5.x, you will not get to use DirectCD for UDF Packet writing to save directly to CD after SP2 is installed. This program comes with every new Dell Optiplex we bought this year. These Computers are supposed to be Supported [dell.com] with SP2. But 2 calls into Dell T.S. resulted in a "Sorry, too bad" response. They recommend Windows native CD burning, but that ain't UDF.
    (We have a need to make saving to CD as simple as a floppy for some elderly folks.)
    This one isn't listed on Microsoft's list of SP2 incompatible [microsoft.com] programs [microsoft.com].
    Nor is anything mentioned on Roxio's site except people complaining. Roxio is up to version 7 now so you know they say to upgrade, but Dell still ships old v.5 out with new PCs. Go figure

  • On the contrary (Score:3, Insightful)

    by SilentChris ( 452960 ) on Friday September 03, 2004 @07:26PM (#10154624) Homepage
    For the machines we tested at work, the firewall actually blocked more than was necessary. We were surprised to find the admin share totally invisible even though the computers were on a domain.

    Methinks something is borked with this anaylsis. A lot of these services aren't accessible on the boxes I've tested with (both on and off domains).

  • Security Vs. App Compatibility (Score:3, Insightful)

    by Commykilla ( 107585 ) on Friday September 03, 2004 @07:31PM (#10154649) Homepage
    There are two sets of articles on XP SP2:

    1 -- "XP SP2 BREAKS TONS OF APPS!!"

    Essentially, Windows is *too* secure and now breaks tons of programs -- so don't install it!

    2 -- "XP SP2 IS TOTALLY INSECURE!!"

    Too many Windows services are on, which means lots of apps -- including harmful ones -- are still able to run, which means XP SP2 is totally insecure -- so don't install it!

    You can't have life both ways. Yes, added security will break *some* apps, but most will still work. Yes, it's not as secure as, say, a OpenBSD installation where you turn on one service at a time -- but end-users aren't expected to go through turning on service by service and tweak firewall settings every time they install a new app!!

    By the way, for corporate deployments, most of that stuff (services, firewall, etc) can be administrated through Group Policy, anyway, so the default settings apply much more to home users than corporate ones who can pick and choose what services, firewall settings, etc to allow on their Windows PCs.

  • Windows XP SP2 treats "password" as a special case (Score:4, Interesting)

    by Spoing ( 152917 ) on Friday September 03, 2004 @07:33PM (#10154658) Homepage
    This is a defect I noticed a few hours ago;

    1. Boot up the system and go into an account with admin-level access.
    2. Give that admin-level account a password of "password".
    3. Leave the system alone till the screensaver kicks in or intentionally 'switch users'.
    4. At the login screen, select the admin-level account. It will ask for a password now.
    5. Enter in "password" for the password.
    6. The login dialog reports that "password" is an incorrect password.
    7. (Consider getting out that Knoppix linux boot CD and resetting the password to null. Skip that idea for now.)
    8. Select one of the non-admin, not password protected, user accounts to switch to.
    9. The non-admin account comes up fine.
    10. From the non-admin acount, switch users and select the admin-level account.
    11. Enter in "password" for the password.
    12. The login dialog accepts "password" and switches to the admin-level desktop.

    This is odd. Now, repeat the steps again *after* switching the password from "password" to "test". The results? The login dialog does not report that "test" is an invalid password.

    While I am not doing any more debugging of XP for Microsoft (a detail or two might not be 100% correct), what I have seen is enough to make me wince. Microsoft did not test this one well enough.

    Note: It may be necessary to have a program running in the admin account to trip up this bug.

  • DNS Client, automatic. Unnecessary on most home machines. Should be disabled by default.

    He's too kind.

    They should call it the "DNS on crack" service.

    The only reason I can see for it existing is for sites where DNS is non-existent or badly broken, so that names pulled out of WINS, browsing, or by casting entrails or yarrow sticks can be used to let some applications run that would otherwise freak out. The problem is that when you do have working DNS it will, occasionally, freak out and return randomly wrong information.

    Unless you're at a small business using a misconfigured Windows-based external firewall AND you're not willing to spring for an Active Directory server, turn this baby off and disable it. You'll be glad you did.

  • Comment removed (Score:3, Informative)

    by account_deleted ( 4530225 ) on Friday September 03, 2004 @08:03PM (#10154785)
    Comment removed based on user account deletion

  • A cursory inspection of the article yields (Score:5, Insightful)

    by ribond ( 149811 ) on Friday September 03, 2004 @08:42PM (#10154932) Journal
    This reads a bit like the Republican take on Kerry's record. It's so like accuracy that it can be deceiving. Here's what I saw from just a glance...

    Automatic Update is off by default...

    ...it's a true statement, but their comment goes on to say it should be off... so what is wrong with having it off and prompting users to change state if they want to?

    NetMeeting Remote Desktop Sharing, manual. Unnecessary on most home machines. Should be disabled by default.

    The service is not enabled... it is in a state where applications that rely on it can start it if its necessary, but that would be performed by the user. Have it not enabled is not a security risk....

    Remote Desktop Help Session Manager, manual. Unnecessary on most home machines. Should be disabled by default.

    I love this service. I love that it is not enabled by default, but must (as above) be initiated by the user. Again, there is nothing wrong having this service in a state where the user can enable it without confusion...

    Secondary Logon, automatic (enables starting processes under alternate credentials). Unnecessary on most home machines. Should be disabled by default.

    This service is what allows fast-user-switching (multiple console logons w/out logging out). It is an integral part of the XP ui and absolutely should be enabled.

    The chief weakness of a single-user system is that whoever sits at the keyboard is the administrator, or root in UNIX parlance, capable of taking any action he pleases. He can install programs and delete files or wipe out whole directories; he can alter system settings with the same privileges as the owner.

    Newsflash -- Windows is not *nix, its user base is not a *nix user base, etc... Excuse the cliche, but "Mom" is not going to login as a "user" then launch setup apps in root/admin context -- this is just not something that "mom" can wrap her head around.

    the user decides whether or not to allow provider X or Web site Y to run code on his machine, based on pure guesswork and vague impressions.

    For example, Internet Explorer allows a user to choose websites from which potentially dangerous content like JavaScript and ActiveX controls will be trusted. Content from 'untrusted' websites can be assigned reduced privileges.

    This approach is wrongheaded from the start.

    I'm calling bullshit on this one. Pick -- the end user should be smart enough to work in the user context until he/she needs admin access, then they should go use it for that specific context, etc... but they shouldn't know if they trust a site or not? And by default there is nothing in the "trusted" sites list, so the user is going to be prompted for each download attempt. If they don't like the "zones" idea that's fine, but complaining about the implementaion is different from that implementation being unsafe.

    "Empty Temporary Internet Files folder when browser is closed" is not selected. (We would leave it enabled.)
    "Installation of desktop items" gets a prompt, and is enabled for trusted sites. (We would require a prompt at all sites.)
    The pop-up blocker is enabled, but disabled for trusted sites. (We would leave it enabled.)

    More of the same. We get it, you don't like the "zones" thing. There is no difference between what the review wants and what IE already does in this case. There are no trusted sites by default and the user is going to have to go out of his/her way to get some there. If you like reading some activex riddled crap page you should be able to view the site without being bothered every 2 seconds. You have that right.
    As a matter of fact, can you imagine the user experience if these setting

  • This article is just dead wrong. (Score:3, Interesting)

    by jabels ( 758273 ) on Friday September 03, 2004 @09:06PM (#10155053)
    * NetBIOS name service, port 137. This is the WINS (Windows Internet Naming Service) server for a NetBIOS network, and unnecessary on home machines.
    This service is off by default in SP2. Believe me on this one, NetBIOS name is a primary source of information for my job, and it's going away slowly as we roll out SP2.
    * Error Reporting is on by default. However, there is no reason why a machine should phone home every time it encounters an error. This is better left disabled.
    No, this is not better left disabled. Ask the mozilla team how "useless" crash reports are. Automatic crash reporting can very quickly tell a software vendor where crash trends are occurring.
    * Automatic Update is off by default. Microsoft would very much like everyone to enable it, and now urges users to do so every time Windows Update is run manually; but it is never a good idea to let a third party decide what software should be installed on your machine, or when. This service should remain off, and users should update Windows manually, though regularly, paying attention to the various update options and their relevance to one's system.
    Wasn't this the selling point of SP2? In every SP2 I've seen, this is on by default. This was the same idiotic argument trotted out when XP was first released, and we all saw how effective manual updates are. Remember Blaster? Someone should take this idiot out and shoot him... with a rusty gun. If you don't want software installed automatically, fine. Turn of automatic updates. Bu the idiotic masses MUST have it!

    If the past year has proven nothing else, it's that we can't afford to let the Windows masses to have control over their own machines. The paranoid rants of a few slashdotters gave us Blaster, and I really don't think they can be forgiven for that.

  • FUD?? (Score:4, Insightful)

    by mindflow ( 557496 ) on Saturday September 04, 2004 @01:27AM (#10156083)
    I for one think XP service pack 2 is a good thing. Now really, why is the security issues in service pack 2 so blown up, all earlier service packs has had security issues too?? Service pack 2 is about to make serious changes to the web, simply becaus popup's are blocked. Even Joe Average will have a popup blocker in 6 months time. It makes me wonder if there could be some anti-popup-blocker people spreading a whole lot of FUD about this package? The days of popups might have come to an end, and some people might not like that.

  • Port 445 (Score:3, Interesting)

    by Vlad_the_Inhaler ( 32958 ) on Saturday September 04, 2004 @04:17AM (#10156467)
    The thing that amazes me is that Port 445 has apparently been left open. Switching over to my Firewall screen shows that I block a 445 scan every 10 seconds on average. It is not just one or two IP-Addresses which try it, each Source Address will try 3 times and then move on.
    Two machines a minute are saying 'Hello' on 445, 95% of my scans are on that Port and it has been left open. Sheesh.

    The other unblocked Port where I often saw scans is 135, but the frequency there has dropped almost to zero recently.

Slashdot Top Deals

A committee takes root and grows, it flowers, wilts and dies, scattering the seed from which other committees will bloom. -- Parkinson

Close