Dr. Dobb's Journal July, 2004
SP2 is currently available in English, German, and Japanese versions; the English network-based installer (which includes the entire updated code) is 270 MB (comparable in size to Windows XP itself). Alternately, there's a 1-MB installer front-end that downloads only the modules you need, but we only tested the full network installer. As of this writing, the RC1 web site (http://www.microsoft.com/technet/prodtechnol/ winxppro/sp2preview.mspx) includes user instructions and a 156-page "Changes to Functionality in Microsoft XP Service Pack 2" written for developers. There's also a lot of Microsoft evangelizing for changing how programs are written, with the goal of making the OS less susceptible to attacks. Finally, there are notes on the new group policy elements and lockdown options, which I urge sysadmins and developers to study.
Installing SP2 RC1 is pretty automatic, much like installing any other large Service Pack, except that this version isn't cumulative as the final will probably be. We first installed every post-Service Pack 1 update, then rebooted. (Per the RC1 site, we also installed the handwriting recognition update on Lisabetta the Tablet PC, another 252 MB.) The RC1 installation was slow on Lisabetta (Crusoe chip), but only took about 15 minutes on Sable. After a reboot, the system showed a "please wait" screen, then completed the installation. The first sign that this is a different OS is a screen that asks if you want to turn on Automatic Updates. After that you will see a yellow Microsoft shield in the system tray. The first time you see it, the system sets about downloading another nine updates and asks for a reboot. Then there's another update and reboot, and you're done.
The Automatic Update features in SP2 are much improved; you can schedule update installation and reboot at, say, 3 a.m., instead of "When I remember." Not yet up to the public promise of "No More Reboots in Longhorn" made at last year's Professional Developer's Conference, but progress anyway, and to be fair we had subsequent updates that didn't need rebooting at all.
Updates come from the Windows Update Service (WUS) web site, which has quite a different look from the old Windowsupdate.Microsoft.com site all conscientious sysadmins should know by heart. WUS also offers updates for Microsoft Office, plus SQL Server and Exchange. Some database and mail-server administrators might wish they had not made the last two available to the average sysadmin, since installing patches on servers is more ticklish.
SP2's changes touch nearly all of the OS. Clearly we haven't done enough testing to be certain, but most look useful. Some are conveniences, like automatically re-connecting to a Wi-Fi network when you get in range. The vast majority are security related.
In memory protection, one big change for the future of Windows XP is the "No Execute" (NX) program attribute, which prohibits properly identified data from being executed as code. NX is supported by the 64-bit AMD architecture while running in 32-bit mode, and presumably will be in Intel's upcoming Nocona AMD-compatible chips. Moreover, Intel's Bill Siu, VP/GM of the Desktop Platforms Group, has said that NX will be present in "client" CPUs after June 2004, which may mean it is being added to the next stepping of Prescott, which also contains the final version of the 64-bit extensions. The NX bit will be enabled for desktops, but the 64-bit extensions won't. It's also possible that NX is in currently shipping chips and Intel will authorize a BIOS update to turn it on.
NX lessens the chances that some malware exploits will work; for instance, that a buffer overflow could write somewhere it should not. The result is a definite distinction between code and data. Some programming languages (Lisp, for instance) do not want any such segregation: Self modification of code is not a bug, but a feature. For the primary OS, though, allowing modification of the program code is undesirable. SP2 puts these features under tight control, but Microsoft has left an escape hatch for programs not playing by these rules, namely a control panel where you can designate applications as such.
Confusingly, NX is also called "Data Execution Prevention," and is managed in Control Panel/System/Advanced/Performance (button)/Data Execution Prevention tab. The controls on this tab are grayed out if "your computer's processor does not support Data Execution Prevention software." It was grayed out on both test systems.
Other important system protection updates: SP2 improves the protection for other parts of XP, such as the Remote Procedure Call (RPC) service, the Universal Plug and Play library, and File and Print Sharing. By default, the latter two now only work on the local IP subnet, which should restrict unwanted browsing and may cut down on infections. RPC now has a RestrictRemoteClients registry key (on by default), which disallows nearly all remote anonymous access to RPC. Blaster (and other DCOM RPC worms) uses this exploit, so restricting RPC to more legitimate uses is admirable.
SP2 supports Physical Address Extension (PAE) explicitly. In fact, it's required for NX support. It looks like PAE will be a stepping-stone toward true 64-bit computing on AMD, not merely a dead-end hack after all.
SP2 shows that Microsoft has taken some short cuts along the way. By design, SP2's Kernel Memory Manager ignores any physical address above 4 GB. (In our previous PAE tests, we were able to access the full 4.5 GB in the xW8000, and I have little doubt we could have accessed more.) Limiting available RAM to 4 GB makes device-driver compatibility a whole lot easier to ensure: 4 GB is 32 bits, so 32-bit device drivers should work without modification.
Still, this is progress. Currently, XP SP1, like Windows 2000, has a limit of 3 GB of RAM, so SP2 accesses an extra GB in Athlon systems. That doesn't mean applications can take advantage of that extra RAM, not without programming changes, but it does mean Microsoft is nudging the world in the 64-bit-compatible direction.
I've railed against spyware, hijackware, and other sundry forms of malware since I discovered Roberta's computer had 43 unwanted processes and hundreds of nosy registry keys, so the security changes in Internet Explorer (IE) are extremely welcome. First and foremost, IE now has a built-in pop-up blocker, displaying a discreet "pop-ups were blocked" message in a horizontal bar at the top of the window. It uses the same alerting system for pop-up file downloads. When you decide to download a file, particularly an .EXE, much more information about it is now displayed, including the software publisher (if known) and the dangers of downloading unknown files.
SP2 also provides an add-on manager for IE, directly analogous to the Netscape plug-in manager. On our test systems, the add-on manager shows exactly the software you'd expect, such as Acrobat Reader's helper file, Shockwave, and Flash. Since these systems had just been checked with Ad-Aware, there were no unwelcome discoveries, but it is nice to have a single control panel (Internet Explorer, Tools/Manage Add-ons) that shows which add-ons are active, installed, and/or instantiated by another add-on.
Not all software that interacts with the browser obeys the add-on rules, so this feature probably won't immediately allow you to identify and delete spyware. I expect spyware writers will also change tactics, again, to evade detection, which is why it's important to update Ad-Aware frequently. The Crash Detection add-on (new with SP2) is directly analogous to XP's Online Crash Analyzer, sending compatibility reports to Microsoft. SP2 also provides a set of new administrative or group policies for allowing/disallowing add-ons, which may prove useful for companies trying to lock down their browsers.
XP SP1 has the Internet Connection Firewall; SP2 replaces it with the Windows Firewall. Many prognosticators have wondered aloud what applications would be broken by the Windows Firewall. Our own tests showed: EverQuest worked without a single squawk or complaint; perhaps it was a development team favorite? Starting Star Wars Galaxies pops up a warning with no "real" publisher listed, but after manual approval, it ran fine. SP2 also adds a boot-time static firewall, so your computer is protected as soon as it can be attacked. So far, very commendable. SP2 turns off some network features, most notably responding to ICMP requests (that's a ping to you and me). We'll see how that one plays.
By far, the most annoying bug we've found on SP2 RC1 is screen updates. Sable has an ATI Radeon 9800 video card, which was running the Catalyst 3.8 driver. The problem: When a window isn't the focus (that is, it's behind another one), it doesn't get updated correctly. We started Ad-Aware 6, then opened an Internet Explorer window. When Ad-Aware made its "I'm finished" noise, we switched back—and Ad-Aware was invisible. You couldn't interact with it, other than to close it. Repeated attempts to bring up that window give fleeting glimpses of window-opening effects, but nothing more—the window itself never appears.
We tried updating to the latest driver, Catalyst 4.3, and rebooted. We learned several things: That ATI now has "VPU Recover," which restarts the 3D processor if it hangs; that the new IE can have problems with some file downloads, fixed with a restart; that the newest ATI driver preserves your existing screen resolution. We did not, however, fix the screen update problem, which also happens between IE windows, and between IE and Word. This is a serious bug.
The other real squirming bug we found was in Lisabetta, the Tablet PC. Early in the days of Tablet, she had a problem recognizing when an Ethernet cable was plugged in. MediaSense was broken. This got fixed in one or another OS update. It's now back, and can be reliably invoked in SP2 RC1. The work-around is to disable and reenable the port.
Finally, SP2 RC 1 dramatically increases the latency for network access to systems that have it installed. I have SP2 RC1 on the machine I am writing this on, but I send my columns out through another machine that doesn't have Sp2. When I use my LAN to access this machine so I can attach the Word document to the e-mail, it takes 10 or 15 seconds before any directory change is confirmed; prior to SP2 this was nearly instantaneous. This may have something to do with the security checking features. It's not a fatal flaw, but it is annoying.
SP2 RC1 comes with built-in Bluetooth support, but our tests with the Sony Ericsson T610 Bluetooth phone haven't been particularly successful. As Dan Spisak said, "The test required that we pull information from depths that most mortal users will never have: Namely, my Mac." Specifically, the cell phone is acting as a regular dial-up modem, but uses a magic command string that connects to a node on the network. ("**9**3#", to be exact.) So far, in our testing, DNS lookups just aren't working on this setup.
In addition, RC1 has a severe bug in allocating the virtual COM ports the Bluetooth stack uses to communicate to serial devices. When installing either the T610 phone or the Belkin Bluetooth GPS Receiver, RC1 will allocate a new COM: port every time. Even if you delete the excess COM7:, RC1 doesn't reuse it. Instead, it allocates ever higher ports. We're up to COM18: now, and there is no way to force it back to COM1:. The Belkin Bluetooth GPS Receiver doesn't use ports higher than COM9:. Oops. We'll check out the Bluetooth features soon, and hope they're more bug-free in Release Candidate 2. This isn't Belkin's fault, and we'll try their GPS on another Bluetooth enabled device not saddled with SP2 RC1.
Use it, but not on a mission-critical machine. For instance, we have Service Pack 2 installed on the machine I am writing this with, but not on the mail and communications machine.
It's highly likely that many bugs will be fixed without comment, slipstreamed in as they're discovered and squashed. Many will remain, and the fixes will generate more. If XP is important to you, get your hands dirty with Windows XP Service Pack 2 Release Candidate 1, and report your problems. We're going to have to live with this until Longhorn, and we don't know how long that will be in coming.
The book of the month is Silverlock, by John Myers. Published by the New England Science Fiction Association Press (http://www.nesfa.org/press/), this is a loving reproduction of a book that has long been a favorite of mine. It is about a character who wanders into the Commonwealth of letters, but doesn't realize where he is. Other characters include Don Quixote, Beowulf, Queen Semiramis, Heracles, the Duke of Bilgewater, and Sam Houston; as I said, an odd book. This edition has a number of features, including a short introduction I did to an earlier commercial edition; maps; short prefaces by both Poul and Karen Anderson; and some guides to the literary works referenced in the story.
A second book of the month is Starswarm by yours truly, Jerry Pournelle. This is a handsome new mass-market edition with an illustrative cover, part of Tor's new "Starscape Juvenile" series (http://www.tor.com/sampleStarswarm.html). If you missed this when it came out a few years ago, now's your chance.
The games of the month: Battlefield Viet Nam and Unreal Tournament 2004. That latter is for both PC and Mac. Both of these are first person shooters, which means I am taking the recommendation from connoisseurs of that genre: I am never quick enough to be very good at that sort of game even if I did enjoy the original Doom.
The computer book of the month is Thomas Cormen et. al., Introduction to Algorithms Second Edition (MIT Press; http://mitpress.mit.edu/algorithms/). This is something between a textbook and a reference work, although I know of no better reference books. I recommended the first edition a dozen or so years ago, and this is an improvement: If you're involved in computer science, you need to read and understand this book.
DDJ