Microsoft: Windows XP SP2 Will be Disruptive

[Bombardier]

Worried that the full release of its Windows XP Service Pack 2 (SP2) will break and disrupt existing applications, Microsoft (Quote, Chart) has created an online training course for developers to explain the intricacies of the security-centric OS update.

The launch of a training course is an unusual move for the software giant, which has changed many Windows XP defaults to tighten security and to simplify the software update process. "[sP2] is more than a normal roll-up of bug fixes. It is also being used to deliver a significant upgrade to enhance Windows XP security," the company said on its Microsoft Software Developer Network (MSDN) portal.

The service pack, now in beta, will make significant changes to deal with increased network protection, memory protection, improved e-mail security and enhanced browsing security but these changes will lead to major disruption unless developers tweak their applications, the company explained.

Enterprise developers are urged to pay attention to the changes in network protection. Specifically, Windows Firewall, the RPC Interface and DCOM Security enhancements has been modified in SP2 and unless developers prepare for these changes, there will be disruptions.

For instance, the Internet Connection Firewall (ICF) will be turned on by default to reject unsolicited inbound connections through TCP/IP version 4 (IPv4). In a detailed explanation, Microsoft made it clear that IT administrators and users must make specific changes to allow applications to open certain ports.

"Windows Firewall includes an explicit setting in the firewall to enable the automatic opening and closing of ports for RPC for each profile. Thus, applications and services do not have to open specific ports in order to use RPC for inbound connections. By default, however, RPC will be blocked by Windows Firewall. This means that an application or service needs to allow the RPC ports in Windows Firewall during the installation process," the company explained, noting that some older applications may need to be manually configured.

With SP2, Microsoft is also introducing Execution Protection to protect memory space from misuse. The company explained that Execution Protection would prevent code execution from data pages such as the default heap, various stacks, and memory pools. But, Microsoft warns, some application behaviors are expected to be "incompatible with execution protection."

"Applications which perform dynamic code generation (such as Just-In-Time code generation) that do not explicitly mark generated code with Execute permission might have compatibility issues with execution protection." The company is supplying specific instructions and code samples to explain the implications of the changes for application developers.

Developer implications for changes in e-mail security and enhanced browsing have also been posted as part of the course manual.

As previously reported, the enhanced browsing changes includes a major overhaul to the Internet Explorer browser. Specific changes include a new add-on management and crash detection tool and several modifications to the browser's default security settings.

http://www.internetnews.com/dev-news/article.php/3322381

[slum_goddess]

crash detection tool

wait...the bluescreen o' death isn't enough? we need a tool for this? what am i missing?