Vista SP1 is Complete, Update Available in March

Vista SP1

Windows Vista Service Pack One is ready to ship, Microsoft says. PC manufacturers and consumers can expect the update in March. Microsoft has said that SP1 includes Vista OS improvements including reliability, security and performance. For a first look at those improvements read PC World’s review of beta SP1.

Unlike some of the reports and speculation from last week, Vista SP1 is not officially available today. Microsoft said that it will be available to new volume licensing customers beginning March 1. Existing Vista consumers will have to wait until mid-March, Microsoft says, when the download becomes available through Microsoft’s Windows Update Web site. Windows Vista users who have their systems configured to receive automatic updates will get SP1 automatically delivered in mid-April, Microsoft says.

One small catch is that Microsoft will not offer the update to a small subset of Vista PCs that have been found to have “problematic” device drivers. Those drivers, Microsoft says, were not installed properly initially and when Vista SP1 is installed OS problems ensue. For those systems, “if Windows Update determines that the system has one of the drivers we know to be problematic, then Windows Update will not offer SP1,” according to the Windows Vista Team Blog.

No word on how many systems are impacted by this driver flaw. Microsoft says the fix for those systems is to reinstall the driver in question, however does not indicate what software program(s) create the driver problem.

Also over at the team blog, Mike Nash of the Windows Product Management group gets further into everything SP1 is looking to fix, including software compatibility and security. Many of the updates were made as requested by the consumers with the Customer Experience Improvement Program, Online Crash Analysis, and Windows Error Reporting.

source:pcworld 

Windows Vista Service Pack 1 Leaked

Sp1

As Microsoft is working on the latest update for Windows Vista, also known as Service Pack 1 or SP1, news has it that it has been leaked on to the internet. Vista SP1 is supposed to be released in Feb and it seems just the right time for Microsoft to label the latest builds as RTM or Release to Manufacturing.
Microsoft is just about to release it to the partners and may be someone from the developers was naughty to release it. Or may it was someone from the partners. Anyway, the leak is some kind of a standalone executable and has the build 6001.18000.080126-2040. Another leak has it as 080118_1840, but its a pretty early timestamp (18-01-2008) which suggests that its a fake. These builds are probably escrow and candidate for the final RTM.
If you don’t have patience to wait till release then go ahead!! But it may screw up your OS also I am not sure about this package nay way try it with your own risk

–Visat SP1–

source:winvista

Windows Vista ‘most secure’

Vista

Windows Vista gets high marks for security, from Microsoft at least..

“It’s fair to say that Windows Vista is proving to be the most secure version of the Windows to date,” said Austin Wilson, director in Microsoft’s Windows client group, in a blog post on Wednesday. “Our investments in the SDL [Security Development Lifecycle] and our defense in depth approach to building Windows Vista seem to be paying off.”

Windows Vista also exhibited fewer vulnerabilities than other operating systems over a one year period, according to a report published by Jeff Jones, security strategy director in Microsoft’s Trustworthy Computing group. The report claims that there were 36 vulnerabilities fixed in Windows Vista during its first year, compared to 65 in Windows XP, 360 in Red Hat RHEL4 reduced, 224 in Ubuntu 6.06 LTS reduced, and 116 in Mac OS X 10.4, also known as Tiger.

“Analysis found that researchers found and disclosed significantly fewer vulnerabilities in Windows Vista than either it predecessor product, Windows XP, or other operating systems such as Red Hat Enterprise Linux, Ubuntu, and Apple Mac OS X 10.4,” said Jones in his report.

Eric Schultze, chief technology officer of St. Paul, Minn.-based Shavlik Technologies, considers such metrics to be apples-to-oranges comparisons. “When you start counting vulnerabilities, it’s a matter of defining vulnerabilities,” he said. “For example, if a bulletin is released for Internet Explorer, that’s one patch for IE. Microsoft may have broken it out to say there are five distinct issues fixed in this patch. Is that five vulnerabilities or is that one vulnerability because it’s one patch?”

Setting aside questionable comparisons to other operating systems, Vista’s superiority to its Windows ancestors may not seem particularly surprising or noteworthy. But Wilson makes the case that Vista’s security features like User Account Control and Internet Explorer Protected Mode reduce the risk and severity of security vulnerabilities and give companies more time to deploy patches.

Wilson points out that Windows Vista makes it easier to run standard user accounts rather than administrative accounts, which are more dangerous when compromised. This, he says, diminishes the impact of vulnerabilities.

“Of the 23 security bulletins that have been released for Windows Vista through January 2008, 12 specifically call out a lower impact for those running without administrative privileges: MS07-033, 034, 040, 042, 045, 047, 048, 050, 057, 064, 068, and 069,” explained Wilson. “This is a great illustration of the importance of User Account Control and why we included it in the product. It’s also the reason I personally run as a standard user on every machine I use.”

Wilson also singles out Internet Explorer Protected Mode as a reason that Vista is more secure than XP. Protected Mode in Vista prevents Internet Explorer 7 from altering user or system files, and various settings, without consent from the user. This diminishes the effectiveness of malicious Web sites, if the user is paying attention.

As evidence of the impact of Protected Mode, Wilson cites the MS07-056 security bulletin from October 2007. It was rated “Important” on Windows Vista and “Critical” on Windows XP. He also notes that IE 7 and Vista are blocking almost 1 million phishing attempts every week. One metric where Vista seems to shine is in terms of patch days.

“During Windows XP’s first year, updates were released on 26 separate days,” said Wilson. “Through a combination of the move to a predictable monthly release schedule, and decreased vulnerabilities, Windows Vista had updates released on just nine days in its first year. To the average security professional, this is one of the most relevant metrics: how many times did I have to activate my internal patch management process due to vendor update releases over the course of a year?”

Schulze remains skeptical about Wilson’s claims. “What he states is accurate, but he’s only presenting the numbers that come out in a favorable light,” he said. “He’s not presenting the numbers that come out in an unfavorable light. For example, he claims that there are a certain number of vulnerabilities for which, on Vista, there was lower severity than on Windows XP. But he’s not telling you about the number of patches which were more critical on Vista than on Windows XP.”

Dave Marcus, security research and communications manager of McAfee Avert Labs, gives Wilson credit for some good points but believes it’s still too early to declare victory for Vista. “Wilson put forth a very good argument,” he said. “His stats are valid, but I think he fails to take into account that most businesses have not deployed Vista, nor have most consumers.”

Marcus said that while Vista was superior to Microsoft’s previous operating systems from a security standpoint, many of the security features were only available in 64-bit versions of the operating system and many organizations would be disinclined to purchase new hardware to use those features.

Once Microsoft officially deploys Vista SP1, Marcus expects more corporate Vista deployments and a clearer picture of Vista’s security profile. Like other security vendors, McAfee has predicted a surge in malware in 2008 for Vista as more people install the new operating system.

“Think 2008 will be the year that Vista finally joins the malware party,” said Marcus.

In a phone interview, Wilson countered that Windows Vista already is widely deployed, noting that Microsoft has already shipped 100 million copies of the software. And he expressed skepticism about a surge in malware, given that security researchers have been looking for holes in Vista since the Black Hat Conference in 2006, when Microsoft distributed beta copies of the operating system to help identify security flaws.

“It’s safe to say that the security research community has had a strong focus on Windows Vista,” said Wilson.

But that focus has yet to offer much clarity. “This is a matter of Microsoft bending the statistics for their own purposes,” said Schulze. “We could just as easily create the same number of statistics that puts Windows Vista security in a negative light.”

Source:itnews