November 2nd, 2009

Clean install with Windows 7 upgrade media? Get the facts!

Posted by Ed Bott @ 10:13 am

Categories: Windows 7, Windows Vista, Windows XP

Tags: License Agreement, License, PC, Clean Install, Microsoft Windows XP, Media, Microsoft Windows Vista, Windows 7 License Agreement, Microsoft Windows, Microsoft Windows 7

Last week I complained about Microsoft’s shoddy documentation of how its upgrade procedures are supposed to work. I’m delighted to report that I got a tremendous and immediate response from within Microsoft, offering assistance in my testing and also promising to clean up and expand their documentation. I spent most of the weekend working on a table that I’ll publish later this week. I’m also testing various upgrade scenarios to see which ones work and which require a workaround.

Meanwhile, an argument that should have died ages ago has reared its head again. If you purchase a discounted upgrade edition of Windows 7, can you use it to perform a clean installation of the operating system on a PC that doesn’t currently have Windows installed?

The answer is really simple. If you qualify for an upgrade license, then yes, you can use any number of workarounds to install the operating system legally. If you don’t qualify for an upgrade license, then those same workarounds might technically succeed, but your license is not valid. Will you get away with it? Probably. But if you’re running a business, you run the risk that an employee will turn you in to the Business Software Alliance, which could lead to an audit, civil charges, and eventually some stiff penalties.

Let me see if I can help uncomplicate things.

The overwhelming majority of PCs are sold with Windows preinstalled by an Original Equipment Manufacturer (OEM). The rules are in the license agreement that you see when you first turn on that PC. You can find any license agreement for Windows (retail or OEM) at the Microsoft Software License Terms page. If you read the retail and OEM license agreements, you will see that there is absolutely no requirement to install the software in a specific way. Here, for example, are the details from the OEM license agreement for Windows Vista Home Basic/Home Premium/Ultimate. I have used bold type to emphasize key terms.

Read the rest of this entry »

September 29th, 2009

Can you upgrade an old XP PC to Windows 7? Should you?

Posted by Ed Bott @ 6:20 am

Categories: Windows 7, Windows XP

Tags: Sony Corp., PC, Microsoft Windows XP, Microsoft Windows Vista, Laplink Software Inc., Option, Lisa, PCmover, PCmover Program, Microsoft Windows 7

How old is too old? I had a chance to think about this question twice over the weekend. Once while pondering my fifty-somethingth birthday (as of today, I am the same age as Saturday Night Live and The Simpsons combined), and the other while deciding whether to upgrade my friend Lisa’s four-year-old Sony notebook to Windows 7.

The birthday will happen whether I want it or not. But as for that Sony? That took a little more thought. It would have been a no-brainer had this been a two-year-old PC that Lisa had downgraded to XP to avoid the tribulations of Vista. But this machine, once a triumph of Sony hardware engineering, could easily be deemed ready to retire.

After careful consideration, I finally decided to go ahead with the upgrade, taking careful notes and snapping lots of screen shots along the way. The XP-to-7 odyssey was an interesting one, with surprising results and several lessons I can share with anyone contemplating a similar adventure. Along the way I also tried out a new edition of Laplink’s PCmover software, which is specifically designed to ease this sort of migration. I found some surprises there as well.

I’ve divided this report into three parts:

Read the rest of this entry »

August 18th, 2009

XP, Vista, or Windows 7: Which OS is more secure?

Posted by Ed Bott @ 9:01 pm

Categories: Security, Windows 7, Windows Vista, Windows XP

Tags: Operating System, Patch Management, Microsoft Windows Vista, Critical, Security Bulletin MS09-032, Microsoft Windows, Microsoft Windows Vista (Longhorn), Microsoft Windows 7, Microsoft Windows XP, Operating Systems

Over the past couple years, I’ve been regularly checking in to measure whether Windows Vista is living up to its promise of being more secure than its predecessor, Windows XP. (To catch up with previous installments, see October 2007, “One year later, Vista really is more secure,” and July 2008, “21 months later, Vista is still more secure than XP.”)

My metric is a simple but effective one: count the number of Microsoft Security Bulletins rated Critical or Important for different Windows versions over time. In both previous installments, Vista had a significant edge edge over XP, with far fewer updates required. Has Vista maintained its security advantage over the past year? And are there any indications as to how Windows 7 will fare, now that it’s been released to manufacturing?

The answer to both questions is yes.

It’s far too early to make definitive judgments about the relative security of Windows 7, but Microsoft’s shiny new OS had a banner first month. A total of eight Microsoft security bulletins were aimed at various Windows versions. Three of them were rated Critical for both Windows XP and Windows Vista, even with the most recent service packs. Another two security updates were rated Important for Windows XP and Moderate for Windows Vista.

But for all eight of the August 2009 security updates, Windows 7 and Windows Server 2008 R2 were listed under the Non-Affected Software heading. Not a single one of those security holes required patching in the new OS.

That’s the same pattern that Windows Vista established when it was new. And Vista has maintained its safer-than-thou reputation in the past year. I went through every single security bulletin Microsoft published for the past 12 months, from September 2008 through August 2009. The totals?

Windows XP: 22 Critical, 16 Important

Windows Vista: 18 Critical, 11 Important

That’s a 24% reduction in the number of patches rated Critical or Important—the kind that typically involve remote code execution or escalation of privileges. Or, to put it another way, that’s 3.2 patches per month for XP and 2.4 patches for Vista. (And the next time someone complains about the number of patches they have to install for Windows, be sure to show them that number: 2.4 patches per month, delivered automatically on the first Tuesday of each month, isn’t exactly overwhelming.)

So what’s the difference? Security Bulletin MS09-032 is typical:

This security update resolves a privately reported vulnerability that is currently being exploited. The vulnerability in Microsoft Video ActiveX Control could allow remote code execution if a user views a specially crafted Web page with Internet Explorer, instantiating the ActiveX control. This ActiveX control was never intended to be instantiated in Internet Explorer. … 

This security update is rated Critical for all supported editions of Windows XP….

That vulnerability doesn’t exist in Windows Vista or in Windows 7. And both of those newer operating systems have an additional advantage. As the bulletin notes: “Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.” That, of course, is the whole point of the user model that was dissed so thoroughly in Windows Vista. But it seems to be working.

May 3rd, 2009

How many Intel CPUs will fail the XP Mode test in Windows 7?

Posted by Ed Bott @ 11:27 am

Categories: Hardware, Windows 7, Windows XP

Tags:

Some of the most popular PCs on the market today, equipped with fast and powerful dual- and quad-core CPUs, won’t be able to use the vaunted Windows XP Mode in Windows 7.

When Windows Vista launched, Intel and Microsoft both got a black eye over the infamous “Vista Capable” logo. That sticker was slapped on PCs running some of Intel’s most popular graphics chips, even though they wouldn’t run the new Aero graphics. Microsoft is still battling in court with angry customers (and their lawyers) who felt betrayed by that marketing campaign.

Now, three years later, it appears to be time for the “Vista Capable” sequel. How much positive Windows 7 buzz will be wiped out in coming weeks and months when consumers and business buyers discover that a heavily hyped new Windows 7 feature, XP Mode, won’t work on some Intel-based products? The problem is caused by the Byzantine way Intel packages its CPU technology—adding, removing, and tweaking features like bus speed and cache size to hit the widest variety of price points for PC makers.

Read the rest of this entry »

April 27th, 2009

Why all the fuss over XP Mode?

Posted by Ed Bott @ 9:47 am

Categories: Windows 7, Windows XP

Tags: Microsoft Windows 7, XP Mode, Microsoft Windows, Microsoft Windows XP, Operating Systems, Software, Ed Bott

For those who were out enjoying the sunshine over the weekend and not glued to a web browser, you missed at least one interesting Windows 7 development. Friday, Microsoft announced that it plans to release an add-on for Windows 7 called Windows XP Mode. It’s aimed primarily at business customers who are deferring their OS upgrades because they have old applications that require Windows XP and won’t run on the Vista\Win7 platform. When Windows 7 is released, they’ll able to download and install an add-on program that runs a customized version (some might call it “light”) of Windows Virtual PC in so-called seamless mode. The no-cost download will include a preconfigured copy of Windows XP SP3 licensed for use on business editions of Windows 7.

Here’s what it looks like. That’s IE6 on XP, running in a window alongside IE8 on Windows 7. Normally, you can only have one version of Internet Explorer installed on Windows at any one time, and you can’t install IE6 or IE7 at all on Windows 7.

You can read Mary Jo Foley’s report here, get a closer look at an early pre-beta release of the feature from Rafael Rivera and Paul Thurrott, and then read Jason Perlow’s epic “I told you so,”, which uses a headline type size normally associated with natural disasters and declarations of war.

XP Mode is a nice addition for corporate customers who want to be able to run a line-of-business application on client PCs without actually revising the program code. Of course, they can already do this today. This solution sounds very similar to Microsoft Enterprise Desktop Virtualization (MED-V), which is available for enterprise customers (released earlier this year), minus the management tools and intrastructure requiermetns. Small businesses can use third-party software to host virtual machines. In fact, I’m running Sun’s free Virtual Box in seamless mode on the Windows 7 RC, with a licensed copy of Windows XP SP3 in it. As you can see, it’s nearly identical to what you see in XP Mode .

It’s not quite as elegant as what Microsoft is promising (having the XP taskbar sitting atop the Windows 7 taskbar is pretty ugly, in fact). But it works just fine, and a corporate IT shop could easily deploy this as a solution today, on Vista or Windows 7.

So why is XP Mode a big deal? It’s not the technology, it’s the licensing. For Windows Vista, Microsoft allows customers running Enterprise edition under a volume license to run up to four virtual machines with the same Windows license (downgrade rights mean the VM can run an earlier version of Windows like XP Professional). Everyone else (yes, I’m looking at the entire small business sector here), you need to buy a separate XP license to run in that VM. That’s a lot of money to pay just to run one incompatible app.

For Windows 7, Microsoft has removed that objection. If you buy Windows 7 Professional, you get the right to download and use a licensed copy of XP, neatly packaged in a VHD and ready to run in the XP Mode environment. I haven’t tested it myself (”too early for beta,” I’m told), but it sounds like the integration with Windows 7 is slick. (Those who are interested in the gory technical details, go read Rafael Rivera’s breakdown in Windows XP Mode Internals). If you only want to run a single XP VM on Windows, this sounds like it will be a lot easier than using a full-featured virtualization package like Virtual Box or VMWare.

XP Mode will cover the needs of most customers; those who want to run multiple VMs or host an OS other than XP will want to consider higher-end virtualization software, like VMWare Workstation, Virtual Box, and the new version of Windows Virtual PC. It looks like Microsoft is about to catch up with its competitors (finally) on features like USB support and “seamless mode.”

Strictly speaking, it doesn’t seem accurate to call this a feature of Windows 7. Microsoft says that the XP Mode bits will not be included as part of the Windows 7 RTM package. Instead, XP Mode will be “available either through pre-installation by your PC manufacturer or via a no cost download.” That’s a smart decision. The VHD uses up a large chunk of disk space, and most customers won’t need it. It also buys extra time for development, in much the same way that Hyper-V lagged the initial release of Windows Server 2008.

Don’t get me wrong, I think delivering XP Mode is a smart idea on Microsoft’s part. The real news is that it actually provides a licensed copy of XP SP3 and distributes it in a prepackaged VHD format. That removes the cost of the extra license and the hassle of setting up virtualization software. It’s another in a long line of objections that are neatly handled by Windows 7.

April 7th, 2009

There's nothing new about Windows downgrade rights

Posted by Ed Bott @ 10:21 am

Categories: Licensing, Windows 7, Windows Vista, Windows XP

Tags: Microsoft Windows XP Professional, Microsoft Windows Vista, Microsoft Corp., Section 14, Microsoft Windows, Operating Systems, Microsoft Windows XP, Software, Ed Bott

I’ve been laughing out loud for days now as I read the astonishing number of comments and reactions to the revelation that Microsoft is going to allow some customers who buy Windows 7 on a new PC to exercise “downgrade rights” and replace their shiny new OS with Windows XP. The implication is that this somehow represents a surrender on Microsoft’s part to the operating system that won’t die, Windows XP.

Sorry, folks, this isn’t news. It’s the way business versions of Windows have been licensed for as long as I can remember. Many businesses run on proprietary software that might or might not work with a new operating system, so business customers who buy a new PC with a Windows license can choose to replace the installed copy of Windows with an older version.

You can see the current version of this clause if you look at the OEM license for Windows Vista Business or Ultimate. Section 14 reads as follows:

14. DOWNGRADE. Instead of using the software, you may use one of the following earlier versions:

• Microsoft Windows XP Professional,
• Microsoft Windows Professional x64 Edition, or
• Microsoft Windows XP Tablet PC Edition.

This agreement applies to your use of the earlier versions. Neither the manufacturer or installer, nor Microsoft is obligated to supply earlier versions to you. You must obtain the earlier version separately. At any time, you may replace an earlier version with this version of the software.

Ah, I can hear you saying now, “But this is different! With Windows 7, Microsoft is going to give its customers the option to skip Vista and go all the way back to XP. That proves that Windows Vista sucks!”

Uh, OK. By that logic, XP sucks 50% more than Vista. If you bought Windows XP Professional on a new PC, your downgrade rights included the option to replace it with any of three previous Windows editions: Windows 2000 Professional, Windows NT Workstation version 4.0, or Windows 98 (Second Edition). Thank goodness we didn’t have blogs back in 2001, or they would have gone completely nuts over Section 1, paragraph 6 of the Windows XP Professional license terms:

Use of Previous Version Of Software. In lieu of installing and using Microsoft Windows XP Professional SOFTWARE, you may install, use, access, display and run ONE of the following versions: Microsoft Windows 2000 Professional, Microsoft Windows NT Workstation version 4.0 or Microsoft Windows 98 (Second Edition) (”Downgrade Software”) on the COMPUTER, provided (1) you agree that Downgrade Software support will NOT be provided hereunder by Manufacturer, MS or Microsoft Corporation, their affiliates or subsidiaries: (2) you agree that neither Manufacturer, MS nor Microsoft Corporation will provide you with the Downgrade Software or media; (3) you may not loan, rent, lease, lend or otherwise transfer the CD or back-up copy of Microsoft Windows XP Professional to another end user, except as otherwise provided in the transfer provisions of this EULA….

If you’re a corporate customer with a Windows Vista Business or Enterprise license acquired through a volume licensing program, you have the right to install just about any business edition of Windows. A Microsoft-issued downgrade rights chart (Word format) lists your options:

[C]ustomers licensed for use of Windows Vista Enterprise are licensed for Windows Vista Business, and it can be downgraded to the Windows XP Professional, Windows 2000 Professional, Windows NT® 4.0, Windows NT 3.51, Windows 98, or Windows 95 operating system. You would not, however, be able to downgrade to Windows Vista Home Basic or Windows Vista Home Premium, Microsoft Windows XP Home Edition, or Microsoft Windows Millennium as those are different products and not considered previous versions of Windows Vista Business.

The exact license terms for Windows 7 Professional and Ultimate have yet to be released, but when they are, yuo can expect to see wording that looks very much like the terms I listed above.

In other words, there’s nothing new here, folks.

December 1st, 2008

With Vista SP2, Microsoft is back on track

Posted by Ed Bott @ 5:05 pm

Categories: Microsoft, Windows Vista, Windows XP

Tags: Service Pack 2, Microsoft Windows Vista, Service Pack, Microsoft Corp., Microsoft Windows, Microsoft Windows XP Service Pack 2, Microsoft Windows Vista (Longhorn), Microsoft Windows XP, Operating Systems, Software

Update 2-December: An alert reader points out that the original version of the graphics for this post used an incorrect date for the release of Windows Vista Service Pack 1. I have corrected the graphics to reflect the correct release date and interval between RTM and the estimated arrival of SP2.

From the other side of the world comes a report that Windows Vista Service Pack 2 will be released to manufacturing in April 2009, roughly a year 14 months after SP1. The Malaysian website TechARP has a pretty good track record with this sort of prediction, and my sources tell me that schedule sounds about right.

Meanwhile, here in the U.S.A., some people are inferring more Vista doom and gloom from this schedule. My buddy Dwight Silverman at the Houston Chronicle says “SP2 is being rushed out the door” to keep up Vista’s momentum. Eweek’s Channel Insider calls SP2 a “last-ditch attempt to drum up sales for [the] beleaguered [Vista] operating system.” The Register says “Microsoft seems to be in a hurry with this release.”

They all need to dust off their Windows history books to see that the reality is exactly the opposite. If Vista SP2 does make its official appearance in April, it will mark a return to normal development and release cycles for Microsoft, which lost its way badly with Windows XP.

I’ve got the proof, in easy-to-read chart format. Here’s a timeline of every Windows service pack Microsoft has delivered since the release of Windows NT 4.0 in July 1996. Each color-coded bar represents the number of days between each service pack and its predecessor (RTM, in the case of SP1 releases). See any patterns?

Read the rest of this entry »

October 3rd, 2008

Slimming down the bloated iTunes installer

Posted by Ed Bott @ 6:49 am

Categories: Apple, Windows Vista, Windows XP

Tags: Apple iPod, Apple QuickTime, Apple Inc., Apple iTunes, Bonjour, MobileMe, Apple Software Update, Digital Music, Digital Media, Personal Technology

[Updated 27-Sep-2009: Apple has now released iTunes 9. I have updated this post accordingly.]

[Updated 3-Oct 11:30AM PDT: After I did the original research for this piece, Apple released iTunes 8.0.1. I have been unable to find a set of release notes or a changelog for this versions, but I have updated filenames referenced in this post to reflect the new version number.]

How do you supersize a simple music manager? Ask Apple. The Windows version of iTunes 8, released earlier this month and quickly patched after it caused an outbreak of blue-screen crashes, is a 64MB download. (For the sake of comparison, Windows Media Player 11 for Windows XP is just over 24 MB.) The full iTunes 8 installation takes up nearly 200MB of space on a Windows PC.

As it turns out, the iTunes installer has been bulking up for the past year or two. Don’t be fooled by the filename: iTunes801Setup.exe, the most recent version as of this writing, includes much more than the iTunes client. Without any disclosure and without your consent, the iTunes 8 setup program installs kernel-mode drivers, multiple system services, and at least one add-in. It takes a supersize helping of chutzpah to create an ad that criticizes Windows for its “bloat” and then deliver an upgrade with as much unnecessary junk as this one. Update: The iTunes 9 installer is even larger and includes one more component, as I document below.

The last time I wrote about this, several commenters defended Apple by insisting that every component in that full install was necessary, and that trying to carve away any of those bits will degrade Apple’s awesome end-to-end experience. I’ve looked at the iTunes installer on multiple Windows machines and am convinced that those Apple defenders are wrong. If you’re like most people, you don’t need any of that additional junk. In this post, I’ll explain how you can figure out which parts of the package you need, and then show you how to wrestle control of iTunes back.

Read the rest of this entry »

September 21st, 2008

How long will Microsoft support XP and Vista?

Posted by Ed Bott @ 6:00 pm

Categories: Microsoft, Windows 7, Windows Vista, Windows XP

Tags: Microsoft Windows XP, Microsoft Windows Vista, Microsoft Corp., Security Update, Microsoft Windows Vista (Longhorn), Microsoft Windows, Operating Systems, Software, Ed Bott

In the Talkback section to another post, a reader asks a question about when Microsoft plans to drop support for Windows Vista. I hear variations on this one all the time, so I figured it’s worth covering here:

If MS is pushing up Win 7, what is going to happen to all the Vista users? Are they going to get screwed by a short term OS? It seems that MS is stuck between a rock and a hard place on this one. If Vista becomes a speed bump, then the Vista users will be angry. If they don’t then all the people who hate Vista will be angry. While in total numbers Vista users are small in number now it still is a large number of people.

I might quibble with the characterization that the total number of Vista users is small. Even if you discount Microsoft’s numbers by 50%, you still have 100 million people using Vista today. That’s a huge number by almost any standard and is only small when you compare it to the billion or so Windows machines in existence. So, are those millions and millions of customers out in the cold when Windows 7 comes out?

In a word, no. Microsoft has a well-documented support lifecycle for its software products. It’s part of the agreement that the company makes with everyone who installs Windows, especially business customers who want some assurance that they’ll be able to get updates and support for operating systems and applications even if they choose not to upgrade to the latest and greatest. Here are the high points and how they relate to Windows Vista.

The lifecycle includes two main phases:

• The Mainstream Support phase includes security updates, non-security hotfixes, no-charge incident support, paid support, warranty claims, design changes and feature requests, and access to online resources such as the Knowledge Base and Microsoft Help and Support.
• In the Extended Support phase, Microsoft continues to provide security updates, paid support, and online information. Customers who want hotfix support can purchase an extended agreement within 90 days of the end of the Mainstream Support phase.

After the Extended Support phase ends, you can continue to use online self-help resources, but all other support has to be provided through third parties or through custom support agreements such as those enjoyed by some large corporate customers.

So how do these support options map for you? That depends on whether you’re using a business or consumer product.

• For Business and Developer products (which includes Business, Ultimate, and Enterprise editions of Vista), the Mainstream Support phase runs for a minimum of five years or two years after the release of the next edition of the product, whichever is later. Assuming that Windows 7 ships in 2009 or 2010, that means Vista will enjoy mainstream support until at least November 30, 2011. The Extended Support phase runs for an additional five years, so you can count on security updates for Vista until at least November 30, 2016.
• For Consumer products (which includes Vista Home Basic and Home Premium), Microsoft provides Mainstream Support only. Because the launch of the consumer version of Vista was two months later than the business launch, the support lifecycle provides for full support until at least January 30, 2012, or two years after the release of Windows 7, whichever is later.

Good news for consumers is that security updates apply to all Windows versions, so any Vista security updates made available via Windows Update should be delivered to consumers and businesses alike, even during the Extended Support phase. So your copy of Vista Home Premium will continue to receive security updates for at least eight more years.

And what about XP? When Vista came out, conspiracy theorists were quick to predict that Microsoft would abandon it and force customers to switch to Vista. I debunked that notion shortly before Vista shipped. A few months later, in January 2007, Microsoft officially expanded its support terms for XP, covering home editions under the Extended Support phase (see “XP gets a new lease on life”  for details). So, if you use any XP edition, you’re covered through April 2014.

By that time, of course, Windows 8 will probably have been released, which means that Microsoft will be actively supporting four separate desktop editions of Windows.

August 11th, 2008

Alarmed about Vista security? Black Hat researcher Alexander Sotirov speaks out

Posted by Ed Bott @ 5:57 pm

Categories: Internet Explorer, Security, Windows Vista, Windows XP

Tags: Black Hat, Paper, Microsoft Windows XP, Vulnerability, Microsoft Windows Vista, Microsoft Corp., Web Browser, Exploitation, Microsoft Windows, Microsoft Windows Vista (Longhorn)

Earlier today I published a lengthy blog post questioning some of the sensationalist conclusions raised in press coverage of a paper presented by Alexander Sotirov and Mark Dowd at last week’s Black Hat Conference in Las Vegas. (See Windows security rendered useless? Uh, not exactly…) As I noted in that post:

It’s a fascinating paper, rich in technical detail and hewing to the Black Hat tradition of providing clues that others can follow to discover, exploit, and ultimately fix vulnerabilities in widely used computer code. …Unfortunately, most people who read about Sotirov and Dowd’s work didn’t bother to read the technical paper. Instead, they relied on quick summaries [that were] wildly inaccurate and hopelessly sensationalized.

This afternoon, I received the following e-mail from Alex Sotirov and am reprinting it with his permission:

Thanks for your blog post about our research. I was horrified by the lack of understanding displayed by the tech press when they covered the paper Mark and I presented at BlackHat. You rightly point out that the sky is not falling and the flaws are not unfixable. In fact, the next versions of Flash and Java will contain specific measures that limit the impact of the techniques we presented. We expect Microsoft to follow suit as well.

Exploitation is a cat and mouse game. The paper we presented puts the offensive side at a slight advantage, but it won’t take long for the defenses to catch up. Our intention was always to nudge the software vendors into improving their defenses and I hope we will succeed.

I just got off the phone with Alex, who took time out of his busy schedule to answer a few follow-up questions:

What was the atmosphere like at Black Hat? How was your paper received by people in the audience?

Positive. A lot of people in the audience seemed to really like the paper. A lot of them came up and asked more questions afterward. Everybody who talked to me said it was pretty impressive.

Did you get any reaction from Microsoft?

Microsoft had contacted us before Black Hat. We had some conference calls and sent them an early draft a few weeks ago. In fact, they put us in touch with the people who designed the [memory protection] defenses [in Windows Vista] and sent us a few minor corrections. It was a very positive experience working with Microsoft. Our research is helping them learn where they need to focus their resources and where they need to improve. We did not take any of the vendors by surprise. Also through Microsoft, both Adobe and Sun were notified about the paper. We haven’t spoken to them directly, but the Microsoft people have, I believe.

Is there any exploit code or proof of concept code available yet for the techniques you describe?

Well, we only gave the paper last week, so I doubt that anyone is using any of these techniques right now. What we presented is weaknesses in the protection mechanism. It still requires the attacker to have a vulnerability. Without the presence of a vulnerability these techniques don’t really [accomplish] anything. We used the ANI cursor vulnerability that had been patched. We chose this example because it worked on XP and Vista, but the example we used would not work [in the real world] because this issue was patched already.

Do you have any advice for Windows users today? Should they be alarmed?

As long as they follow standard security practices — use antivirus products and other typical things that are good standard policy — they shouldn’t have anything to worry about. Our research is to some extent academic. The articles that describe Vista security as “broken” or “done for,” with “unfixable vulnerabilities” are completely inaccurate. One of the suggestions I saw in many of the discussions was that people should just use Windows XP. In fact, in XP a lot of those protections we’re bypassing don’t even exist. XP is even less secure than Vista in this respect. [What we established is that the security advantage of Vista over XP is not as great as [previously] thought. Vista is still very good at preventing vulnerabilities.

Your research focuses on weaknesses in browsers. Does the movement to doing more in the browser mean the danger is increasing?

Browsers are used more widely than they were five years ago. A lot more businesses rely on browsers now to do [everyday work]. Businesses could have blocked access to the web five years ago, but with widespread use of the web as an interface, the importance of the browser has increased. It’s a lot harder to tell people they cannot use a browser. The possibility of a vulnerability in the browser affects their security.

One last question. Your paper was entitled “How to Impress Girls with Browser Memory Protection Bypasses.” In a blog post, your partner Mark Dowd said you were going to be conducting “ongoing research” on this subject in Las Vegas. Did you really flood your hot tub at Caesars Palace?

Uh… [pause] Yeah.

Thanks for your time.

You’re welcome.