This article is part
of a series on |
New features
Overview |
Other articles
Editions |
|
Windows Vista, an operating system released by Microsoft in November 2006, has received substantial criticism by reviewers and users. Due to issues with privacy, security, performance, and product activation, Windows Vista has been the subject of a number of negative assessments by various groups.
Contents |
In February 2008, Bitlocker was shown to be vulnerable to a cold boot attack.[1] According to the researchers, the risk can be mitigated by configuring two-factor authentication (e.g. a boot PIN in conjunction with a TPM), by disabling power standby mode and using hardware that overwrites memory during POST if the operating system does not shut down cleanly.
The following concerns have been raised about the new User Account Control (UAC) security technology: Many third-party programs do not follow the principle of least privilege and therefore need to be run as an administrator, triggering UAC prompts. For some time, Microsoft has recommended that programs be written to run as a standard user. However, because nearly all users are administrators by default in previous versions of Windows, many developers have incorrectly assumed that their applications will always execute with these privileges, or have not regression tested their code for LUA bugs.[2] Microsoft added file and registry virtualization technology as well as application compatibility shims to reduce the number of these legacy applications that trigger UAC prompts.[3]
User Account Control can be disabled through the Control Panel; however, this also disables privilege separation features such as Internet Explorer 7's Protected Mode, which relies on UAC for its operation, and there is a risk of misplacing contents of files, that were previously virtualized, reverting to the original installed versions of these files.
A password cannot be restored on Windows Vista Starter and Windows Vista Home Basic. This means that if an administrator forgets his/her password on any of these Operating Systems, they will not be able to download items or make major changes to the computer on a limited user account. However, a password can be restored on Windows Vista Home Premium, Windows Vista Business, Windows Vista Ultimate, and on Windows Vista Enterprise using a floppy disc or a USB flash drive. Passwords are restored by inputting the wrong password during log-in, then clicking "Reset Password".
64-bit versions of Windows Vista (and of Windows 7 as well) allow only signed drivers to be installed in kernel mode; this feature cannot be easily overridden by system administrators.[4][5]
In order for a driver to be signed, a developer will either have to pay Microsoft for the driver to be tested by Microsoft's WHQL Testing[6] or, if WHQL testing is not required, to purchase a "Software Publisher Certificate"[7] with which to sign the driver.
The following criticisms/claims have been made regarding this requirement:
Unsigned drivers could initially be installed through the use of tools included with Vista,[11] as well as some third party utilities such as Atsiv.[12] However Microsoft has closed these workarounds with hotfix KB932596,[13] which is included in Service Pack 1. Microsoft claims that using strict driver handling means more security, while critics note that few if any security attacks have manifest in software drivers, which are almost always written by equipment manufacturers.
Security researchers Alexander Sotirov and Mark Dowd have developed a technique that bypasses many of the new memory-protection safeguards in Windows Vista, such as address space layout randomization (ASLR). The result of this is that any already existing buffer overflow bugs that, in Vista, were previously not exploitable due to such features, may now be exploitable.[14][15] This is not in itself a vulnerability: as Sotirov notes, "What we presented is weaknesses in the protection mechanism. It still requires the system under attack to have a vulnerability. Without the presence of a vulnerability these techniques don’t really [accomplish] anything."[16] The vulnerability Sotirov and Dowd used in their paper as an example was the 2007 animated cursor bug, CVE-2007-0038.
One security researcher (Dino Dai Zovi) claimed that this means that it is "completely game over" for Vista security.[17] though Sotirov refuted this, saying that "The articles that describe Vista security as 'broken' or 'done for,' with 'unfixable vulnerabilities' are completely inaccurate. One of the suggestions I saw in many of the discussions was that people should just use Windows XP. In fact, in XP a lot of those protections we’re bypassing [such as ASLR] don’t even exist."[16]
Another common criticism concerns the integration of new forms of digital rights management (DRM) into the operating system, specifically the Protected Video Path (PVP), which involves technologies such as High-bandwidth Digital Content Protection (HDCP) and the Image Constraint Token (ICT). These features have been added to Vista due to an agreement between Microsoft and major Hollywood studios.[18] This will concern, among other things, play-back of protected content on HD DVD and Blu-ray discs, but it will not be enabled until at least 2010.
The Protected Video Path mandates that encryption must be used whenever content marked as "protected" will travel over a link where it might be intercepted. This is called a User-Accessible Bus (UAB). Additionally, all devices that come into contact with premium content (such as graphics cards) have to be certified by Microsoft.[18] Before playback starts, all the devices involved are checked using a Hardware Functionality Scan (HFS) to verify if they are genuine and have not been tampered with. Devices are required to switch off or artificially degrade the quality of any signal outputs that are not protected by HDCP. Additionally, Microsoft maintains a global revocation list for devices that have been compromised. This list is distributed to PCs over the Internet using normal update mechanisms. The only effect on a revoked driver's functionality is that high-level protected content will not play; all other functionality, including low-definition playback, is retained.[18][19]
Peter Gutmann, a computer security expert from the University of Auckland, New Zealand, has released a whitepaper[20] in which he raises the following concerns against these mechanisms:
Steve Gibson of Gibson Research Corporation has stated during his Security Now! show that he agrees with Peter Gutmann in principle and that what he proposes is a factually accurate description of what is found in the specification from Microsoft.[21]
The Free Software Foundation conducted a campaign called "BadVista" against Vista on these grounds.
Ed Bott, author of Windows Vista Inside Out, has published a three-part blog which rebuts many of Gutmann's claims.[22]
Ed Bott's criticisms can be summarized as follows:
Technology writer George Ou claims that Gutmann's paper relies on unreliable sources and that Gutmann has never used Windows Vista to test his theories.[23]
Gutmann has responded to both Bott and Ou in a further article.,[24] which states that the central thesis of Gutmann's article has not been refuted and the response of Bott is "disinformation".
Microsoft has published a blog entry with "Twenty Questions (and Answers)" on Windows Vista Content Protection, intending to refute some of Gutmann's arguments.[25]
Paul Smith, a Microsoft MVP, has written a response to Gutmann's paper in which he counters some of his arguments.[26] Specifically, he says:
Microsoft also noted that content protection mechanisms have existed in Windows as far back as Windows Me.[19]
According to Microsoft, "nearly all PCs on the market today will run Windows Vista" and most PCs sold after 2005 are capable of running Vista.[28][29][30]
Much hardware that worked in XP does not work, or works poorly in Vista, due to companies going out of business, lack of interest in supporting old hardware, and changes in driver models.[31] Service Pack 1 for Vista is said to fix many of these problems.[32]
Tom's Hardware published benchmarks in January 2007 that showed that Windows Vista executed typical applications more slowly than Windows XP with the same hardware configuration.[33] A subset of the benchmarks used were provided by Standard Performance Evaluation Corporation (or SPEC), who later stated that such "results should not be compared to those generated while running Windows XP, even if testing is done with the same hardware configuration." SPEC acknowledges that an apple-to-apples comparison cannot be made in cases such as the one done by Tom's Hardware, calling such studies "invalid comparisons."[34] However, the TomsHardware report conceded that the SPECviewperf tests "suffered heavily from the lack of support for the OpenGL graphics library under Windows Vista". For this reason the report recommended against replacing Windows XP with Vista until manufacturers made these drivers available.[35]
The report also concluded in tests involving real world applications Vista performed considerably slower, noting "We are disappointed that CPU-intensive applications such as video transcoding with XviD (DVD to XviD MPEG4) or the MainConcept H.264 Encoder performed 18% to nearly 24% slower in our standard benchmark scenarios". Other commonly used applications, including Photoshop and WinRAR, also performed worse under Vista.[35]
Many low-to-middle-end machines that come with Windows Vista pre-installed suffer from exceptionally slow performance with the default Vista settings that come pre-loaded, and laptop manufacturers have offered to 'downgrade' laptops to Windows XP—for a price.[36] However, this "price" is unnecessary, as Microsoft allows users of Windows Vista and Windows 7 to freely "downgrade" their software by installing XP and then phoning a Microsoft representative for a new product key. [1]
When first released in November 2006, Vista performed file operations such as copying and deletion more slowly than other operating systems. Large copies required when migrating from one computer to another seemed difficult or impossible without workarounds such as using the command line. This inability to efficiently perform basic file operations attracted strong criticism.[37] After six months, Microsoft confirmed the existence of these problems by releasing a special performance and reliability update,[38] which was later disseminated through Windows Update, and is included in Service Pack 1.[39]
Nonetheless, one benchmark reported to show that, while improving performance compared to Vista's original release, Service Pack 1 does not increase the level of performance to that of Windows XP.[40] However, that benchmark has been questioned by others within ZDNet. Ed Bott both questions his colleagues' methods and provides benchmarks that refute the results.[41]
Early in Vista's lifecycle, many games showed a drop in frame rate compared to that experienced in Windows XP.[42][43][44] These results were largely the consequence of Vista's immature graphics processing units drivers, and higher system requirements for Vista itself.[45][46] Some recent benchmarks seem to suggest that, as of mid-2008, Vista SP1 is now on par with Windows XP in terms of game performance.[47] However, game developers' recommended memory requirements on Vista are still higher (usually double) than on XP.[48][49][50]
Concerns have been expressed that Windows Vista may contain software bloat. Speaking in 2007 at the University of Illinois, Microsoft distinguished engineer Eric Traut said, "A lot of people think of Windows as this large, bloated operating system, and that's maybe a fair characterization, I have to admit." He went on to say that, "at its core, the kernel, and the components that make up the very core of the operating system, is actually pretty streamlined."[51]
Former PC World editor Ed Bott has expressed skepticism about the claims of bloat, noting that almost every single operating system that Microsoft has ever sold had been criticized as "bloated" when they first came out; even those now regarded as the exact opposite, such as MS-DOS.[52]
Two consumers sued Microsoft in United States federal court alleging the "Windows Vista Capable" marketing campaign was a bait and switch tactic as some computers originally installed with Windows XP could only run Vista Basic, and in some cases they did not run even Vista Basic at a user-acceptable speed. In February 2008 a Seattle judge granted the suit class action status, permitting all purchasers in the class to participate in the case.[53][54] Released documents in the case, as well as a Dell presentation in March 2007, discussed late changes to Windows Vista which permitted hardware to be certified that would require upgrading in order to use Vista, and that lack of compatible drivers forced hardware vendors to "limp out with issues" when Vista was launched.[54][55] This was one of several Vista launch appraisals included in 158 pages of unsealed documents.
With the new features of Vista, criticism has surfaced concerning the use of battery power in laptops running Vista, which can drain the battery much more rapidly than Windows XP, reducing battery life.[56] With the Windows Aero visual effects turned off, battery life is equal to or better than Windows XP systems.[57] "With the release of a new operating system and its new features and higher requirements, higher power consumption is normal", as Richard Shim, an analyst with IDC noted, "when Windows XP came out, that was true, and when Windows 2000 came out, that was true."[58]
Significant problems have surfaced with other software running under Vista. According to Gartner, "Vista has been dogged by fears, in some cases proven, that many existing applications have to be re-written to operate on the new system."[59] Cisco has been reported as saying, "Vista will solve a lot of problems, but for every action, there's a reaction, and unforeseen side-effects and mutations. Networks can become more brittle."[60] According to PC World, "Software compatibility issues, bug worries keep businesses from moving to Microsoft's new OS."[61] Citing "concerns over cost and compatibility", the United States Department of Transportation prohibited workers from upgrading to Vista.[62] The University of Pittsburgh Medical Center, said the rollout (of Vista) is significantly behind schedule because "several key programs still aren't compatible, including patient scheduling software."[63]
As of July 2007, there were over 2,000 tested applications[64] that were compatible with Vista. Microsoft has published a list of legacy applications that meet their "Works with Windows Vista" software standards[65] as well as a list of applications that meet their more stringent "Certified for Windows Vista" standards.[66] However, as of July 2007, software compatibility problems were still hindering adoption of Vista.[67] Microsoft has released the Application Compatibility Toolkit 5.0 application for migrating Vista-incompatible applications, while virtualization solutions like VirtualBox, Virtual PC 2007 or those from VMware can also be used as a last resort to continue running Vista-incompatible applications under legacy versions of Windows.
Microsoft also provides an Upgrade Advisor Tool (.NET must be installed and an Internet connection is required) which can be used on existing XP systems to flag driver and application compatibility issues before upgrading to Vista.[68]
Microsoft has also been criticized for removing some heavily discussed features such as Next-Generation Secure Computing Base in May 2004, WinFS in August 2004, Windows PowerShell in August 2005 (though this was released separately from Vista prior to Vista's release, and is included in Vista's successor, Windows 7), SecurID Support in May 2006, PC-to-PC Synchronization in June 2006.[69] The initial "three pillars" in Vista were all radically altered to reach a release date.[70]
Microsoft's international pricing of Vista has been criticized by many as too expensive.[71][72][73] The differences in pricing from one country to another vary significantly, especially considering that copies of Vista can be ordered and shipped worldwide from the United States; this could save between $42 (€26) and $314 (€200). In many cases, the difference in price is significantly greater than was the case for Windows XP. In Malaysia, the pricing for Vista is at around RM799 ($244/€155).[74] At the current exchange rate, United Kingdom consumers could be paying almost double their United States counterparts for the same software.[75]
“ | Microsoft has come under fire from British consumers about the price it is charging for Vista, the latest version of Windows.
British (and French) customers will pay double the US price. The upgrade from Windows XP to Vista Home Basic will cost £100 (€126), while American users will pay only £51 ($100, €64).[76] |
” |
Since the release of Windows Vista in January 2007 Microsoft has reduced the retail, and upgrade price point of Vista. Originally Vista Ultimate was priced at $399. and Home Premium Vista at $239. These prices have since been reduced to $319 and $199 respectively.[77]
Vista includes an enhanced set of anti-copying technologies, based on Windows XP's Windows Genuine Advantage, called Software Protection Platform (SPP).[78] In the initial release of Windows Vista (without Service Pack 1), a major component of this was a reduced-functionality mode, which is entered when it is detected that the user has "failed product activation" or that their copy is "identified as counterfeit or non-genuine."[79] The technology was described in a Microsoft white paper as follows:
“ | The default Web browser will be started and the user will be presented with an option to purchase a new product key. There is no start menu, no desktop icons, and the desktop background is changed to black. [...] After one hour, the system will log the user out without warning.[80] | ” |
This was criticised for being overly draconian,[81][82] especially given an imperfect false-positive record on behalf of SPP's predecessor,[83] and at least one temporary validation server outage which reportedly flagged many legitimate copies of Vista and XP as "Non-Genuine" when Windows Update would "check in" and fail the "validation" challenge.[84][85]
SPP was significantly altered in Windows Vista Service Pack 1. Instead of the reduced functionality mode, an installation of Vista left unactivated for 30 days presents the user with a nag screen prompting them to activate the operating system when they log in, changes the desktop to a solid black colour every hour, and periodically warns the user about software counterfeiting with notification balloons. In addition, updates classified as optional are not available to unactivated copies of Vista.[86] Microsoft maintains a technical bulletin providing further details on product activation for Vista.[87]
According to industry sources, as of late July 2008 Windows XP is still outselling Windows Vista, especially in business sales. According to HP, Microsoft is miscounting and inflating Windows Vista sales figures.[88][89] An HP manager is quoted in APC:
“ |
"From the 30th of June [2008], we have no longer been able to ship a PC with a XP license", said Jane Bradburn, Market Development Manager, Commercial Notebooks for HP Australia. "However, what we have been able to do with Microsoft is ship PCs with a Vista Business license but with XP pre-loaded. That is still the majority of business computers we are selling today." |
” |
Windows Vista Ultimate users can download exclusive Windows Ultimate Extras. These extras have been released much more slowly than expected, with only four available as of August 2009, almost three years after Vista was released, which has angered some users who paid extra mainly for the promised add-ons.[90][91][92] Barry Goffe, Director of Windows Vista Ultimate for Microsoft states that they were unexpectedly delayed on releasing several of the extras, but that "Microsoft plans to ship a collection of additional Windows Ultimate Extras that it is confident will delight its passionate Windows Vista Ultimate customers."[93]
|