MS and Sophos incompatible over Win 7 XP Mode
No eye-gouging, no fish-hooking
A row has broken out between Sophos and Microsoft over the alleged patching and management difficulties posed by Windows 7's XP Mode.
The technology allows XP applications to run in a virtualised environment within Windows 7. This offers backward compatibility with applications but comes at the expense of security, according to Richard Jacobs, Sophos chief technology officer.
By creating an easy migration path from XP to Windows 7, bypassing Vista, Microsoft is creating a potential security disaster, Jacobs argues.
XP mode is an independent Windows instance, that shares the odd folder and device with the host Windows 7 installation. What it doesn't share is processes and memory. So it doesn't share security settings, security software, patches etc. It does not inherit any security from the host.
When you use XP mode, you need to patch the copy of XP as well as the host Windows 7. You need to manage settings separately, configure two personal firewalls and install and manage two copies of anti-malware software.
Jacobs said that the problem is made worse because users don't know how to manage virtual machines on a desktop and because of the lack of tools from Microsoft to handle this process. He concludes that XP Mode "risks undoing much of the progress that Microsoft has made on the security front in the last few years".
The argument provoked a robust response from Roger Halbheer, Microsoft's chief security advisor for EMEA. Halbheer describes XP Mode as a temporary mechanism that allows customers to enjoy the better security benefits of the latest Operating Systems while ensuring application compatibility. He describes it as a pragmatic option, and far better than leaving users with only a forklift upgrade option.
Halbheer concludes: "Which risk is higher? Leaving our customers on an eight to ten year old operating system for another few years, or helping them to migrate to a modern one, accepting the drawback with XP Mode?"
Sophos's Jacobs retorts that simply arguing Windows 7 is more secure than XP, but user still need XP compatibility fails to tackle cost of ownership questions raised by he technology.
"The problem is not with the idea of XP mode, but with the lack of management and the lack of clarity about the costs that users will incur," Jacobs said. "I don’t know many IT departments that will be happy to double their workload and costs in the name of security. They’re much more likely to stick with native XP and sacrifice any of the other benefits that Windows 7 might have delivered."
Microsoft developer James O'Neill responded angrily to Jacobs, saying he has got his facts wrong - especially about the lack of management tools. Larger shops should be using Microsoft Enterprise Desktop virtualization (MEDV) software, he said, adding that standalone XP mode uses is only for small shops. "Windows XP Mode is specifically designed to help small businesses move to Windows 7," O'Neill writes.
"XP mode is just standard virtualization software and a pre-configured VM. You can treat the VM as something to be patched via Windows update or WSUS just like a physical PC.
"You install anti-virus software on it like a physical PC. To manage the VM you use the big brother of XPmode." ®
Why oh why?!
Another commenter wrote: "These are exactly the same issues that Apple had with "Classic" mode when Mac OS X was introduced."
Yes, correct but that was an entire OS redesign. OSX has since gone through 5 major revisions and runs on at least two different chip sets. Software purchased for OSX 1.1 still works on OSX 1.5. Why can't Microsoft manage the same thing?
In the mid 80s, Commodore released the Amiga home computer with OS 1.3. Apart from software that used undocumented features of the OS (or which ignored the guidelines) it all worked on version 3.5 of their OS. There were MANY changes in the interim... (as well as the company going bust and being bought over)
MS have millions of times the cash to throw at the problem than Commodore/Amiga did, so why is the newest version of their OS not compatible with existing software?
(Does the same thing happen with Linux? When you get an updated kernel do you need to recompile all the code?)
My take on this is that MS have cocked up and subsequently realised it (and in a world first, they've admitted it). To rectify the original cockups they've added XP support and - surprise - cocked that up too!
What won't work?
Anybody know, or can point to a list of stuff that *won't* work with W7?
I am also not going to pay to buy any software over again, not even the upgrade fee.
Err... especially the software I didn't actually pay for in the first place
1) XP mode only runs on professional and ultimate editions, home users can go back to sleep.
2)The intention of XP mode is to make it easier for those companies who depend on very old apps that don't run on vista. They can upgrade to Win7 and still run them in XP mode despite support for XP ending soon.
3) nearly all the apps most of us use now will run fine in on the normal Windows 7 without XP mode.
4) You only need extra AV software if your virtual PC is roaming out on the public Internet. (something that admin in the target market could prevent) . Even if you get use it without protection and get infected it will only be the virtual PC instance that is infected not windows 7. You can choose to make some directories shared between the two but then those directories will be protected by the main AV program.
5) Using XP mode is optional. You don't have to use it or install it.
6) If Linux is your god please go worship elsewhere, we have already heard how it solves every problem in the universe.