Can XP SP2 Protect Your Users?
Modify your applications so they run smoothly with Windows XP SP2, and better understand the issues that are motivating these changes in the OS.
You need to modify your applications to make sure they run smoothly with the new security restrictions of Windows XP Service Pack 2 (SP2). You might better understand the issues that are motivating these changes in the OS if you spent more time with unsuspecting end users like my 13-year-old niece Rachel. Recently, her Windows XP Home Edition booted but wouldn't display the Start button or desktop, and Explorer.exe wouldn't run at all. She suspected a virus but insisted the antivirus program was running "all the time, honest." Rachel was savvy enough to use Task Manager to run Internet Explorer and The Sims, but had to call me when her new cable ISP's support desk wouldn't troubleshoot her setup until Windows was running normally.
Ad-Aware uncovered plenty of spyware on her PC (she has a penchant for downloading games and music). A virus scan with updated definitions explained the persistent Windows Installer dialog box and repeated attempts to dial the Internet: It harbored two viruses and four trojans.
I opted for fdisk and a clean installation including SP2, Windows XP's big security update. However, I wondered if I'd have needed to do all this if SP2 had been installed already. Would Windows Firewall have prevented invasion, or would it have created a false sense of security? After all, Rachel was unknowingly inviting Trojan horses into her OS while downloading free games.
These days, Windows has so much stability that kids don't know what a "blue screen of death" is, but rogue programs can still take over. Whatever Microsoft's record on security is, hackers target the biggest player because it guarantees publicity and the bragging rights they crave. Besides, no matter how well you protect Fort Knox, a large enough army of well-armed, invisible attackers will find a weakness if given enough time. I suppose the Slashdot crew could argue that Microsoft, with all its billions, could develop a clairvoyance API to reveal the exploits the bad guys are conjuring up.
It irks me that Microsoft doesn't ship more pre-patched software, especially on its MSDN Subscriber Downloads site. We shouldn't have to install Windows XP original (complete with known defects) and immediately reinstall it with recompiled SP2 bits. We should be starting with Windows XP SP2. Dear Microsoft: Don't promise secure computing while letting me run a system with known vulnerabilities for even a second.
Microsoft's actions (or lack thereof) have caused many of us to eschew the use of ActiveX controls in IE and SP2. I now block all ActiveX controls. And that's saying somethingI once was a finalist in a Microsoft "Activate the Internet" contest where incorporating dynamic ActiveX objects in Web pages was the entry requirement.
I'm waiting to see how Rachel and her computer fare with XP SP2's enhanced security. I doubt she can resist adding a Web site to the trusted sites zone to get a free game. Now that I think of it, I'd better do a cold reset on my Windows Powered Smartphone. While I was cleaning her PC, she was having a lot of fun with a strange new game on that device.
About the Author
Ken Cox is a Canadian .NET programming writer and the author of "ASP.NET 3.5 for Dummies" (Wiley).