eWeek Microsoft Watch
Advertisement
Advertisement
September 23, 2004 5:26 PM

Microsoft Changes Its Tune on Porting SP2 Fixes



Microsoft has been reticent to commit publicly to how, when and if it would make the browser-specific security fixes that it delivered as part of Windows XP Service Pack 2 available to users of older versions of Windows.

But this week, Redmond software vendor issued a definitive statement regarding its back-porting intentions. The decision: No SP2 fixes —
not even ones like the SP2 pop-up blocker or the ActiveX-control blocker —
will be offered for users of older versions of Windows and Internet Explorer (IE).

Microsoft's message is if you want any of these features, you must upgrade to Windows XP and/or Windows XP Tablet Edition running SP2. Next year, Microsoft also will make the appropriate SP2 security fixes, including some of the IE ones, available to Windows Server 2003 users via Service Pack 1.

Microsoft never publicly committed to providing any of the SP2 fixes for users of older versions of Windows or Internet Explorer. But company officials privately told a select group of developers earlier this year of plans to port some of the IE-specific fixes to the version of IE 6 for Windows 2000 (Service Pack 5 update). It also told some partners that it was "considering strongly" the idea of making the IE-specific SP2 fixes available for Windows NT, Windows 98, Windows 98 Second Edition and Windows Millennium Edition.

When asked of these plans, a Microsoft spokesman provided the following statement: "We never committed to back porting technologies. Our commitment has been to provide the greatest possible level of security to all our customers. We will continue to do this for IE and for previous versions of Windows.

"Trying to retrofit older technologies (which were never designed with current environment in mind) with current advancements creates a set of challenges that make it difficult for customers to deploy and doesn't provide a level of security that we feel confident in providing to our customers. Based on these conclusions, Microsoft's resources are focused on keeping customers current with latest security updates and developing new products that will make them safer and more productive," the spokesman added.

Some Microsoft customers see the company's refusal to back-port SP2 security fixes to older versions of Windows and IE as little more than Microsoft's attempt to force users to upgrade to Windows XP. Quite a number of enterprises are still running older versions of Windows, especially Windows 2000, on the desktop.

Microsoft's decision not to port SP2 fixes to Windows 2000, in particular, doesn't sit well with Michael Cherry, senior analyst with the Kirkland, Wash.-based "Directions on Microsoft" research outfit.

"I don't really think they have any requirement to make any fixes or changes available on the old 9.X code base of Windows 98 and Windows ME," Cherry said. But "the one version of Windows that I have a problem with is Windows 2000, which I believe is still in mainstream support."

"There may be technical reasons why adopting the changes in IE to Windows 2000 is difficult, but Microsoft should be able to overcome this. After all, they own the code for both products," Cherry added.

"What I would really like to see is clarification (from Microsoft)…Is it 'no" to Windows 9.x on all accounts? Is it 'no' to the new features in XP SP2? Both of these are reasonable and justifiable. Is it 'no' to IE improvements, even though IE 6 runs on Windows 2000? Is it 'no' to improvements that could be part of Windows 2000 in a future SP before it leaves mainstream support? Or is it that the definition of mainstream support is misunderstood?" Cherry asked rhetorically.

TrackBack

TrackBack

http://www.microsoft-watch.com/cgi-bin/mte/mt-tb.cgi/6791

Comments (4)

Keith Risler :

It is legitimate to ask a more direct question: Does the IE browser's update status really matter security-wise per se, if the future MS computing model is to be built on .NET web-tethered pay-frequently apps?

Browsers in this context matter little if future MS computing simply requires use of an XP SP2+ "integrated" functionality.

It seems to me this is the more significant question re the evolvution of IE. What may matter more than "security" is that if MS makes the use of .NET style apps dependent on an up-to-date integrated "Explorer", then the market will in fact be even more strongly driven to XP and then to Longhorn than the present thesis might imply.

Security may be the vocal cover, but lock-out come Longhorn could be the real outcome, all quite ironically a function of an "integrated" Explorer tied to Windows as the predicate for future computing.

It is quite brilliant, really; not only does the .NET future insert a requirement for Windows to be used for real uses to be exploited (pontification to the contrary), but it also now seems to be rolling the browser into the mix. Before we were compelled to buy Windows; now we shall have to buy Windows and IE, i.e., Windows XP and then Longhorn.

In this context much of the side-chatter about how Firefox may potentially eat at IE's share is beside the point, because in the future it isn't going to be the browser where the Maginot line is drawn; rather, it will be in the form of web-centric computing that incidentally needs Windows and incidentally the browser in that specific Windows, i.e., XP and then Longhorn.

Case in point: I noticed the other day that my Inspiron 1150 laptop, which has XP Home on it, includes a curious parallel browser called MSN Explorer. It is a conduit to free goodies and to what appear to be some extra-fee web services.

I sense this Evolved Explorer-as-predicate to future features model is what MS is trying out on XP with MSN Explorer. The docs say that Explorer 5.5 or later is needed to run MSN Explorer, but then since this whole deal isn't built into Win2K or Win98, this in effect means that only users of XP's Explorer version will be using it as deployed on the Inspiron. It is not copyable off of XP Home, either.

Now, when the day comes that IE as offered in XP SP2 or later is required for the MSN Explorer, well then, the upgrade jig will be up, and we shall all be singing "Redmond" when asked then where we want to go that day, and the days thereafter. That is rather more pressure than just a desire for an IE security fix.

Wayne Facer :

I've noted this problem in many of Microsoft's programs since XP. I've started to offer Mozilla or Firefox as an alternative to IE. If Microsoft will not fix these older versions, then I have no choice but to go to alternative browsers where security has been addressed. Atleast these browsers will work with all of my windows platforms that I've serving. This includes some windows 98 systems which cannot be upgraded for another year or so.

WindozeDoctor :

It would seem to me that the U.S. Government should step in and require Microsoft to support those older OS's due to safety issues. Don't the auto manufacturers have to issue safety recalls on models older than the current one?

theog2 :

Microsoft is shooting itself in the foot. The idea of “forcing” a person to upgrade for security reasons on a supposedly free product is ridiculous. I love Microsoft and the products they product, but lately their actions have me scratching my head in disbelief. Don’t they see FireFox coming up behind them? Yes they currently have 75% of the market, but how long can they sustain that margin acting like they are the only game in town? I understand that people need to pay for certain items, but only allow updates to a webbrowser to certain is a bit ridiculous.

On the flip side: Then again, is IE already “tied” into Windows XP so much that there is really no easy way to make an update for older versions. Also, really, people really should update… win 98 and ME are ancient history. Should MS update these products forever?

Post a Comment

 
 
RSS Syndication

Advertisement
Advertisement
Microsoft Watch     Contact Us | Advertise | Site Map
Ziff Davis Enterprise