The Gazette-WinXP1

While everyone appreciates the efforts of engineers and others to fashion more user friendly products, there is a not so fine line which when crossed, clearly indicates that those same engineers have a low opinion of our fundamental capabilities as sentient beings. By contrast, generally speaking, I hold our abilities to conceive and carry out constructive tasks in high regard. That's just my opinion, but evidence of this can be gleaned by carefully observing various examples of the results of productive behavior: The Great Pyramid of Khufu, Beethoven's Piano Concerto No. 5, the Declaration of Independence, Michelangelo's David and Pamela Anderson's protuberances to name but a few magnificent examples. Perhaps we should pass the word on to Microsoft so they may reconsider their basic approach to how they think we will interact with their new operating system, Windows XP.

Windows XP is the dumbing down of Windows. They've removed many of our choices in setting up our working environment, and proportionately increased their ability to invade our privacy and possibly even compromised our safety in the process. Not only is Microsoft clearly unimpressed with our computer manipulating and decision making abilities, it is equally clear that they think that we don't know enough to be concerned about our privacy.

No one likes to be treated like an idiot, and almost everyone has at least something that they would probably prefer to keep away from public view residing somewhere in their computer. Even if they don't, perhaps they just value their privacy on principle. This article makes no judgments as to why you might prefer to keep the contents of your hard drive private. It is simply assumed that you would prefer to keep that which you might reasonably expect to be private away from the scrutiny of others, and additionally that people prefer to be given reasonable choices in determining how their working environments are configured.

WINDOWS XP - MICROSOFT'S HOLY GRAIL
Windows XP is the company's most ambitious project to date. That simple fact should not be taken lightly when assessing this operating system for personal use. Microsoft is capable of impressive feats of software engineering, and Windows XP, based on Windows 2000, is a graphic example of that ability. XP was designed to meld the high power Windows NT line of business oriented operating systems, Windows 2000 being the most recent version of that family, and the older, backward compatible Windows 9x family of end user/gaming oriented operating systems into one unified product offering the advantages of both. Time and consumer reaction will ultimately tell if Microsoft has been successful in their endeavor.

WINDOWS FOR DUMMIES
XP is not unpleasant to look at, with a carefully choreographed color scheme and big bulbous icons and window frames, all designed to make the casual home user more at ease with an operating system that has more of its underlying framework in common with its Windows NT lineage than its Windows 9x heritage. However, the version I'm referring to here, the version I used to develop this article is Windows XP Professional, not the Home version. At first I was puzzled that Microsoft had dressed up the Professional version in colors more suited to the play room at Circus Circus Casino in Las Vegas. But the more time I spend with XP Pro, the more obvious it becomes that Microsoft feels its professional customers are unable to make educated choices about their operating system. Microsoft left the bubble gum interface out of the Server and Advanced Server editions of XP, why not the Professional version as well?

LET'S START AT THE BEGINNING: CHOICES FOR CONFIGURATION ARE GONE FROM THE INSTALLATION ROUTINE
Windows XP's graphical installer is prettier than those of previous versions of Windows and it offers a tool I've not seen in previous upgrade versions either. It allows you to check your existing Windows installation for program incompatibilities. Very handy if you're planning to upgrade, but I wanted to give Windows XP every opportunity to stand on its own merit with a clean installation to its own partition. Handy tool for those wishing to upgrade though.

The installation proceeds just like a prettier version of Windows 2000, allowing you to choose the partition and partition type. I was pleased to see that the installer for Windows XP retains the tools for partitioning and formatting available in Windows 2000. Odd that Microsoft would elect to leave this feature in the installer in light of what they decided to leave out.

One of the critical features offered in every other 32-bit version of Windows with which I have experience starting with plain old Windows 95, is absent from the XP installer. That is the ability to choose the "Custom" installation option. This option allows the average user to check or uncheck items from a laundry list of optional Windows components. Such items as Dial Up Networking, Paint, Screensavers, Wallpapers and many other peripheral components could be added or removed right at installation so that the user could tailor the environment for his or her needs. With all the added features available in Windows XP, and the fact that the tested version is aimed at "Professional" caliber users, it is beyond me why Microsoft elected to leave this out.

As mentioned above, I performed a clean installation, not an upgrade, so it is possible that the Custom installation option is available exclusively to those upgrading their operating system. It is also possible that Microsoft will elect to include this option in the release version of XP. It remains a mystery as to why it was not included in the version I tested though.

WINDOWS PRODUCT ACTIVATION NOT REALLY A PROBLEM, BUT STILL ...
Anyone who has any interest in computers and related technologies has probably heard of the new Windows Product Activation feature, so this aspect of XP should come as either little or no surprise. WPA is an anti piracy scheme that basically takes a snapshot of your computer's hardware and treats it like a fingerprint for your copy of XP. If your copy of XP is installed on other computers illegally, the "fingerprint" won't match, and after fourteen days, will cease to function. Sounds scary, and while I was put off by this scheme at first, the more I read and learned about it, the less I was bothered by it. Windows Product Activation simply isn't the inconvenience that most people, including me, seemed to think it was when they first heard about it. Of course, corporate customers that buy any of the several types of volume licenses available will be exempt from Windows Product Activation.

Recently published stories reveal that an Internet start-up performed a comprehensive study and subsequently published a white paper providing technical insight into the inner workings of Windows Product Activation. The study's conclusion agreed with Microsoft's assertions that typical hardware modifications will not require re-activation, and that end user privacy is protected. However, this does not address concerns that users may have years from now when they undertake a wholesale upgrade to their computers. How many users might be inconvenienced because they have misplaced critical information needed to complete a re-activation? Additionally, how long will Microsoft support the operating system and the attendant WPA scheme? The problem I see with WPA is that there is at least the real potential that legitimate paying customers might be seriously inconvenienced by it at some point. Though that doesn't sit well, when all is said and done, regardless of how distasteful it may be to be treated as though you were a potential software pirate, Microsoft does have the right to take reasonable measures to protect their copyrights, but there must be a better way.

A PROBLEM - THE ONE HALF FIREWALL
The firewall software included with Windows XP, called Internet Connection Firewall or ICF for short, is by default OFF when a clean installation of the operating system is completed, and there is no prompt or warning from Windows to alert the user that they are unprotected. I have seen several reports that users were surprised by this, as I was, and I've even heard one reliable report that ICF was on, so there is some confusion on this matter. However, most of the reports I've seen indicate that ICF is by default off, which is understandable considering the potential difficulties with configuring a network that firewall software can present. However, considering the immensity of nefarious activity taking place on the Internet these days, and the number of users that have vulnerable "always on" connections (cable access), I think the lack of the option to turn this feature on during installation is a problem.

Let me clarify my point before I go on. In my estimation, it would be not be a problem to have the firewall off by default in XP if, and this is a big if, the user were prompted to turn it on when configuring an Internet or network connection, or if it were easily accessible right there in the Start menu along with all those other programs and features of Windows, so that the average user would be able to find it and turn it on without having to look through reams of ReadMe and Help files to learn how to do this. After all, XP's Backup program is readily available right from the Start menu, along with the Command Prompt, the Program Compatibility Wizard, the Character Map tool, Disk Cleanup, Disk Defragmenter, the Files and Settings Transfer Wizard, Scheduled Tasks, System Information and System Restore not to mention all the Administrative Tools if you have that feature enabled. Why not Internet Connection Firewall as well?

In fact, it seems so obvious to me that the firewall should be more readily available that I question the motivation for not placing it somewhere in the Start menu as a selection. But never mind my paranoid tendencies, here are the seven steps required to turn it on:

Click Start
Click Control Panel (or Settings/Control Panel if you have the Classic Start menu enabled)
Launch the Network Connections applet
Click the Local Area Connection item (Your set up may be different. I'm set up for cable access.)
Under the General tab, click the Properties button
Click the Advanced tab
Check the box for the Internet Connection Firewall

That's all there is to turning on the firewall, and granted that once the average user knows where it is and how to use it, it's very easy to turn on and off. As I've said, my main concern is that new users will have no idea that they are unprotected. Furthermore, what the user may not realize is that while it does a very good job of keeping your computer stealthy and protected from Internet probing, it does nothing to protect you from that which has found its way onto your hard drive and seeks to call out. In other words, it's a one way door that works very well at not letting intruders in, but gives you no control over those programs that try to act as a server from your computer--and there are several programs that do just that, including Windows XP itself. It is only half of a firewall. It is my contention that Windows XP's ICF feature will do more harm by giving users a false sense of security than good with its half-baked protection. Any software firewall worth it's salt monitors both inbound and outbound traffic.

In preparation for this article, I tested two commonly available software firewalls in the XP environment: ZoneAlarm version 2.6.231 and Tiny Personal Firewall version 2.0.14, neither of which specifically lists Windows XP as being a compatible platform. Unfortunately, I could find no reputable firewall that listed XP as one of their compatible operating systems, so I resorted to these two firewalls because they have the best reputation "on the street" as it were.

ZoneAlarm, by far the most popular, easiest to use, and arguably the most effective software firewall on the market, was my first choice. ZA has rightfully earned a reputation as the premium personal firewall available. The level of protection is unsurpassed and it is freeware. (There is a "Pro" version available for business users that sports some additional features, but no additional protection.) Hugely popular, Zone Labs' ZoneAlarm is generally credited with pioneering the market for high quality freeware software firewalls and has a solid reputation in the field.

Oddly, ZoneAlarm didn't work for me in Windows XP. But the way it didn't work is what is most puzzling. ZoneAlarm installed without a hitch. It also worked perfectly for an entire day, during which I rebooted numerous times just to make sure that ZA would keep working. ZoneAlarm alerted me to several incoming (these tests were conducted at the height of the Code Red scourge that afflicted the Internet in early August, 2001) and several outgoing attempts to connect during the time before it "broke", so I feel comfortable that it was doing its job.

The next morning, when I started up Windows XP, ZA failed to work and nothing I did would fix it. At boot up I received a message that ZoneAlarm's True Vector service could not be started, crippling ZA. The ZA icon in the System Tray showed a brilliant yellow "X" through the icon to clearly indicate that it was not working as it should. I re-installed ZA over itself and it would once again work for about one day. But nothing I did, clean install or re-install, kept ZA working for more than about 24 hours--the pattern was always the same. That's an odd way for ZA to "break" and unfortunately, at this writing, it appears that there is only one explanation for this phenomenon.

The Register is an electronic news media that focuses mainly on computer and technology news. They recently published a report that at the last minute, Microsoft have included something called Driver Blocking into RC2. According to The Register, "at the eleventh hour, Microsoft has turned on "Driver Blocking", and RC2 refuses to install a host of third party applications including Black Ice, Zone Alarm and AOL. Users will need to upgrade their applications to Windows XP-compliant versions." I don't know exactly how Driver Blocking works, and I don't know for certain that it is directly responsible for the problem I've described, but I do know that ZoneAlarm wouldn't work properly in my installation of Windows XP RC2 Professional.

By contrast, the less popular but almost as effective Tiny Personal Firewall worked in XP almost perfectly. I did have one instance where it failed to load correctly at boot up, but a reboot fixed the problem and it has not occurred again since. TPF has presented me with numerous warnings about attempts to connect, both from the Internet and from inside my computer, out to the Internet, just as ZoneAlarm did before it broke.

The attempts to connect to my computer from outside, from the Internet, are not alarming. Both normal traffic and stray packets as well as Code Red infected servers and hackers scanning for infected "bots" will all cause these warnings. As I have taken steps to protect my computer, I am unconcerned. However, of greater concern are the programs that already reside in my computer that are trying to "dial out". Most of these are innocuous, and I admit that it is at least possible that none of these present a threat to my privacy. But some attempts to dial out are too mysterious, and without further explanation by Microsoft or someone else, I don't intend to let them connect if I can help it.

The setup I settled on had both the included Internet Connection Firewall and Tiny Personal Firewall running simultaneously. There was no appreciable hit on resources and I see no reason not to run both. I suffered no conflicts or problems. I feel fairly comfortable with this set up, but I do wish ZoneAlarm worked on my RC2 installation.

Finally, if you are setting up a software firewall in Windows XP (as well as Windows 2000), you need not worry about Generic Host Process for Win32 Services dialing out. It needs to in order for Internet Explorer to work, and unless Microsoft is far more cunning than I think they are, it is benign.

MAKE A CHOICE ABOUT AUTOMATIC UPDATES
We all have personal preferences in life, and as a rule, my preference is for personal responsibility. I would rather click the icon on my Start menu occasionally and go check for updates for my operating system when I choose to do so, rather than when Windows decides to do it for me. That's just me. If you feel differently, please ignore this section. If you are interested in this, read on.

By default, Windows XP is configured to automatically check in with Microsoft at regular intervals to see if there are updates available. What Microsoft has effectively done with XP, is add the old Windows Update Notification service which would check for updates and alert the user when one or more became available. With Windows 2000 or Windows 9x you had the choice of installing this service from the Windows Update site. Unfortunately, it can occasionally cause some problems. I don't know if this is the case in Windows XP, maybe they've worked out the bugs, but you should at least be aware that the service is there and that you have some choices about how this service is configured, so you may want to check this out.

Click Start
Click Control Panel (or Settings/Control Panel if you have the Classic Start menu enabled)
Launch the System applet
Click the Automatic Updates tab

As you can see, you may make a choice in the Notification Settings box whether you wish to have updates downloaded automatically (the default setting), if you'd prefer to be notified before downloading updates, or to have this service disabled. Whichever way you set it, you will (supposedly) be notified before any updates are installed.