Criticism of Windows Vista
Encyclopedia
Windows Vista, an operating system
released by Microsoft
in November 2006, has received substantial criticism by reviewers and users. Due to issues with privacy, security, performance, and product activation
, Windows Vista
has been the subject of a number of negative assessments by various groups.
was shown to be vulnerable to a cold boot attack
. According to the researchers, the risk can be mitigated by configuring two-factor authentication
(e.g. a boot PIN
in conjunction with a TPM
), by disabling power standby mode and using hardware that overwrites memory during POST
if the operating system does not shut down cleanly.
(UAC) security technology: Many third-party programs do not follow the principle of least privilege
and therefore need to be run as an administrator
, triggering UAC prompts. For some time, Microsoft has recommended that programs be written to run as a standard user. However, because nearly all users are administrators by default in previous versions of Windows, many developers have incorrectly assumed that their applications will always execute with these privileges, or have not regression tested their code for LUA bugs. Microsoft added file and registry virtualization technology as well as application compatibility shims to reduce the number of these legacy
applications that trigger UAC prompts.
User Account Control can be disabled through the Control Panel; however, this also disables privilege separation features such as Internet Explorer 7
's Protected Mode, which relies on UAC for its operation, and there is a risk of misplacing contents of files, that were previously virtualized, reverting to the original installed versions of these files.
versions of Windows Vista (and of Windows 7 as well) allow only signed
drivers
to be installed in kernel mode
; this feature cannot be easily overridden by system administrator
s.
In order for a driver to be signed, a developer will either have to pay Microsoft for the driver to be tested by Microsoft's WHQL Testing
or, if WHQL testing is not required, to purchase a "Software Publisher Certificate
" with which to sign the driver.
The following criticisms/claims have been made regarding this requirement:
Unsigned drivers could initially be installed through the use of tools included with Vista, as well as some third party utilities such as Atsiv. However Microsoft has closed these workarounds with hotfix KB932596, which is included in Service Pack 1. Microsoft claims that using strict driver handling means more security, while critics note that few if any security attacks have manifest in software drivers, which are almost always written by equipment manufacturers.
and Mark Dowd have developed a technique that bypasses many of the new memory-protection safeguards in Windows Vista, such as address space layout randomization
(ASLR). The result of this is that any already existing buffer overflow bugs that, in Vista, were previously not exploitable due to such features, may now be exploitable. This is not in itself a vulnerability: as Sotirov notes, "What we presented is weaknesses in the protection mechanism. It still requires the system under attack to have a vulnerability. Without the presence of a vulnerability these techniques don’t really [accomplish] anything." The vulnerability Sotirov and Dowd used in their paper as an example was the 2007 animated cursor bug, CVE
-2007-0038.
One security researcher (Dino Dai Zovi) claimed that this means that it is "completely game over" for Vista security. though Sotirov refuted this, saying that "The articles that describe Vista security as 'broken' or 'done for,' with 'unfixable vulnerabilities' are completely inaccurate. One of the suggestions I saw in many of the discussions was that people should just use Windows XP. In fact, in XP a lot of those protections we’re bypassing [such as ASLR] don’t even exist."
(DRM) into the operating system, specifically the Protected Video Path (PVP), which involves technologies such as High-bandwidth Digital Content Protection
(HDCP) and the Image Constraint Token
(ICT). These features have been added to Vista due to an agreement between Microsoft and major Hollywood studios. This will concern, among other things, play-back of protected content on HD DVD
and Blu-ray discs, but it will not be enabled until at least 2010.
The Protected Video Path mandates that encryption must be used whenever content marked as "protected" will travel over a link where it might be intercepted. This is called a User-Accessible Bus (UAB). Additionally, all devices that come into contact with premium content (such as graphics cards) have to be certified by Microsoft. Before playback starts, all the devices involved are checked using a Hardware Functionality Scan (HFS) to verify if they are genuine and have not been tampered with. Devices are required to switch off or artificially degrade the quality of any signal outputs that are not protected by HDCP. Additionally, Microsoft maintains a global revocation list for devices that have been compromised. This list is distributed to PCs over the Internet using normal update mechanisms. The only effect on a revoked driver's functionality is that high-level protected content will not play; all other functionality, including low-definition playback, is retained.
, a computer security expert from the University of Auckland
, New Zealand, has released a whitepaper in which he raises the following concerns against these mechanisms:
Steve Gibson of Gibson Research Corporation has stated during his Security Now! show that he agrees with Peter Gutmann in principle and that what he proposes is a factually accurate description of what is found in the specification from Microsoft.
The Free Software Foundation
conducted a campaign called "BadVista
" against Vista on these grounds.
Ed Bott's criticisms can be summarized as follows:
Technology writer George Ou claims that Gutmann's paper relies on unreliable sources and that Gutmann has never used Windows Vista to test his theories.
Gutmann has responded to both Bott and Ou in a further article., which states that the central thesis of Gutmann's article has not been refuted and the response of Bott is "disinformation".
Microsoft has published a blog entry with "Twenty Questions (and Answers)" on Windows Vista Content Protection, intending to refute some of Gutmann's arguments.
Paul Smith, a Microsoft MVP
, has written a response to Gutmann's paper in which he counters some of his arguments. Specifically, he says:
Microsoft also noted that content protection mechanisms have existed in Windows as far back as Windows Me
.
Much hardware that worked in XP does not work, or works poorly in Vista, due to companies going out of business, lack of interest in supporting old hardware, and changes in driver models. Service Pack 1 for Vista is said to fix many of these problems.
(or SPEC), who later stated that such "results should not be compared to those generated while running Windows XP, even if testing is done with the same hardware configuration." SPEC acknowledges that an apple-to-apples comparison cannot be made in cases such as the one done by Tom's Hardware, calling such studies "invalid comparisons." However, the TomsHardware report conceded that the SPECviewperf tests "suffered heavily from the lack of support for the OpenGL graphics library under Windows Vista". For this reason the report recommended against replacing Windows XP with Vista until manufacturers made these drivers available.
The report also concluded in tests involving real world applications Vista performed considerably slower, noting "We are disappointed that CPU-intensive applications such as video transcoding with XviD (DVD to XviD MPEG4) or the MainConcept H.264 Encoder performed 18% to nearly 24% slower in our standard benchmark scenarios". Other commonly used applications, including Photoshop and WinRAR, also performed worse under Vista.
Many low-to-middle-end machines that come with Windows Vista pre-installed suffer from exceptionally slow performance with the default Vista settings that come pre-loaded, and laptop manufacturers have offered to 'downgrade' laptops to Windows XP—for a price. However, this "price" is unnecessary, as Microsoft allows users of Windows Vista and Windows 7 to freely "downgrade" their software by installing XP and then phoning a Microsoft representative for a new product key. http://www.eweek.com/c/a/Windows/Microsoft-Windows-XP-Users-Can-Keep-Downgrade-Rights-491684/
Nonetheless, one benchmark reported to show that, while improving performance compared to Vista's original release, Service Pack 1 does not increase the level of performance to that of Windows XP. However, that benchmark has been questioned by others within ZDNet. Ed Bott both questions his colleagues' methods and provides benchmarks that refute the results.
s drivers, and higher system requirements for Vista itself.
Some recent benchmarks seem to suggest that, as of mid-2008, Vista SP1 is now on par with Windows XP in terms of game performance. However, game developers' recommended memory requirements on Vista are still higher (usually double) than on XP.
software bloat
. Speaking in 2007 at the University of
Illinois, Microsoft distinguished engineer Eric Traut
said, "A lot of people think of Windows as this large,
bloated operating system, and that's maybe a fair
characterization, I have to admit." He went on to say that,
"at its core, the kernel, and the components that make up
the very core of the operating system, is actually pretty
streamlined."
Former PC World editor Ed Bott has expressed skepticism
about the claims of bloat, noting that almost every single
operating system that Microsoft has ever sold had been
criticized as "bloated" when they first came out; even those
now regarded as the exact opposite, such
as MS-DOS
.
tactic as some computers originally installed with Windows XP could only run Vista Basic, and in some cases they did not run even Vista Basic at a user-acceptable speed. In February 2008 a Seattle judge granted the suit class action
status, permitting all purchasers in the class to participate in the case.
Released documents in the case, as well as a Dell
presentation in March 2007, discussed late changes to Windows Vista which permitted hardware to be certified that would require upgrading in order to use Vista, and that lack of compatible drivers forced hardware vendors to "limp out with issues" when Vista was launched.
This was one of several Vista launch appraisals included in 158 pages of unsealed documents.
, reducing battery life. With the Windows Aero visual effects turned off, battery life is equal to or better than Windows XP systems. "With the release of a new operating system and its new features and higher requirements, higher power consumption is normal", as Richard Shim, an analyst with IDC noted, "when Windows XP came out, that was true, and when Windows 2000 came out, that was true."
Cisco has been reported as saying, "Vista will solve a lot of problems, but for every action, there's a reaction, and unforeseen side-effects and mutations. Networks can become more brittle." According to PC World, "Software compatibility issues, bug worries keep businesses from moving to Microsoft's new OS." Citing "concerns over cost and compatibility", the United States Department of Transportation
prohibited workers from upgrading to Vista. The University of Pittsburgh Medical Center, said the rollout (of Vista) is significantly behind schedule because "several key programs still aren't compatible, including patient scheduling software."
As of July 2007, there were over 2,000 tested applications that were compatible with Vista. Microsoft has published a list of legacy applications that meet their "Works with Windows Vista" software standards as well as a list of applications that meet their more stringent "Certified for Windows Vista" standards. However, as of July 2007, software compatibility problems were still hindering adoption of Vista. Microsoft has released the Application Compatibility Toolkit 5.0 application for migrating Vista-incompatible applications, while virtualization solutions like VirtualBox
, Virtual PC 2007
or those from VMware
can also be used as a last resort to continue running Vista-incompatible applications under legacy versions of Windows.
Microsoft also provides an Upgrade Advisor Tool (.NET must be installed and an Internet connection is required) which can be used on existing XP systems to flag driver and application compatibility issues before upgrading to Vista.
in May 2004, WinFS
in August 2004, Windows PowerShell
in August 2005 (though this was released separately from Vista prior to Vista's release, and is included in Vista's successor, Windows 7), SecurID
Support in May 2006, PC-to-PC Synchronization
in June 2006. The initial "three pillars" in Vista were all radically altered to reach a release date.
At the current exchange rate, United Kingdom consumers could be paying almost double their United States counterparts for the same software.
Since the release of Windows Vista in January 2007 Microsoft has reduced the retail, and upgrade price point of Vista. Originally Vista Ultimate was priced at $399. and Home Premium Vista at $239. These prices have since been reduced to $319 and $199 respectively.
, called Software Protection Platform (SPP). In the initial release of Windows Vista (without Service Pack 1), a major component of this was a reduced-functionality mode, which is entered when it is detected that the user has "failed product activation" or that their copy is "identified as counterfeit or non-genuine." The technology was described in a Microsoft white paper as follows:
This was criticised for being overly draconian, especially given an imperfect false-positive record on behalf of SPP's predecessor, and at least one temporary validation server outage which reportedly flagged many legitimate copies of Vista and XP as "Non-Genuine" when Windows Update would "check in" and fail the "validation" challenge.
SPP was significantly altered in Windows Vista Service Pack 1. Instead of the reduced functionality mode, an installation of Vista left unactivated for 30 days presents the user with a nag screen prompting them to activate the operating system when they log in, changes the desktop to a solid black colour every hour, and periodically warns the user about software counterfeiting with notification balloons. In addition, updates classified as optional are not available to unactivated copies of Vista. Microsoft maintains a technical bulletin providing further details on product activation for Vista.
is still outselling Windows Vista
, especially in business sales. According to HP, Microsoft
is miscounting and inflating Windows Vista sales figures. An HP manager is quoted in APC:
. These extras have been released much more slowly than expected, with only four available as of August 2009, almost three years after Vista was released, which has angered some users who paid extra mainly for the promised add-ons.
Barry Goffe, Director of Windows Vista Ultimate for Microsoft states that they were unexpectedly delayed on releasing several of the extras, but that "Microsoft plans to ship a collection of additional Windows Ultimate Extras that it is confident will delight its passionate Windows Vista Ultimate customers."
Operating system
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
released by Microsoft
Microsoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
in November 2006, has received substantial criticism by reviewers and users. Due to issues with privacy, security, performance, and product activation
Product activation
Product activation is a license validation procedure required by some proprietary computer software programs. In one form, product activation refers to a method invented by Ric Richardson and patented by Uniloc where a software application hashes hardware serial numbers and an ID number specific...
, Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
has been the subject of a number of negative assessments by various groups.
Security
In February 2008, BitlockerBitLocker Drive Encryption
BitLocker Drive Encryption is a full disk encryption feature included with the Ultimate and Enterprise editions of Microsoft's Windows Vista and Windows 7 desktop operating systems, as well as the Windows Server 2008 and Windows Server 2008 R2 server platforms. It is designed to protect data by...
was shown to be vulnerable to a cold boot attack
Cold boot attack
In cryptography, a cold boot attack is a type of side channel attack in which an attacker with physical access to a computer is able to retrieve encryption keys from a running operating system after using a cold reboot to restart the machine from a completely "off" state...
. According to the researchers, the risk can be mitigated by configuring two-factor authentication
Two-factor authentication
Two-factor authentication is an approach to authentication which requires the presentation of two different kinds of evidence that someone is who they say they are. It is a part of the broader family of multi-factor authentication, which is a defense in depth approach to security...
(e.g. a boot PIN
Personal identification number
A personal identification number is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. Typically, the user is required to provide a non-confidential user identifier or token and a confidential PIN to gain access to the system...
in conjunction with a TPM
Trusted Platform Module
In computing, Trusted Platform Module is both the name of a published specification detailing a secure cryptoprocessor that can store cryptographic keys that protect information, as well as the general name of implementations of that specification, often called the "TPM chip" or "TPM Security...
), by disabling power standby mode and using hardware that overwrites memory during POST
Power-on self-test
Power-On Self-Test refers to routines run immediately after power is applied, by nearly all electronic devices. Perhaps the most widely-known usage pertains to computing devices...
if the operating system does not shut down cleanly.
User Account Control
The following concerns have been raised about the new User Account ControlUser Account Control
User Account Control is a technology and security infrastructure introduced with Microsoft's Windows Vista and Windows Server 2008 operating systems, with a more relaxed version also present in Windows 7 and Windows Server 2008 R2...
(UAC) security technology: Many third-party programs do not follow the principle of least privilege
Principle of least privilege
In information security, computer science, and other fields, the principle of least privilege, also known as the principle of minimal privilege or just least privilege, requires that in a particular abstraction layer of a computing environment, every module must be able to access only the...
and therefore need to be run as an administrator
Superuser
On many computer operating systems, the superuser is a special user account used for system administration. Depending on the operating system, the actual name of this account might be: root, administrator or supervisor....
, triggering UAC prompts. For some time, Microsoft has recommended that programs be written to run as a standard user. However, because nearly all users are administrators by default in previous versions of Windows, many developers have incorrectly assumed that their applications will always execute with these privileges, or have not regression tested their code for LUA bugs. Microsoft added file and registry virtualization technology as well as application compatibility shims to reduce the number of these legacy
Legacy system
A legacy system is an old method, technology, computer system, or application program that continues to be used, typically because it still functions for the users' needs, even though newer technology or more efficient methods of performing a task are now available...
applications that trigger UAC prompts.
User Account Control can be disabled through the Control Panel; however, this also disables privilege separation features such as Internet Explorer 7
Internet Explorer 7
Windows Internet Explorer 7 is a web browser released by Microsoft in October 2006. Internet Explorer 7 is part of a long line of versions of Internet Explorer and was the first major update to the browser in more than 5 years...
's Protected Mode, which relies on UAC for its operation, and there is a risk of misplacing contents of files, that were previously virtualized, reverting to the original installed versions of these files.
Password Restore
A password cannot be restored on Windows Vista Starter and Windows Vista Home Basic. This means that if an administrator forgets his/her password on any of these Operating Systems, they will not be able to download items or make major changes to the computer on a limited user account. However, a password can be restored on Windows Vista Home Premium, Windows Vista Business, Windows Vista Ultimate, and on Windows Vista Enterprise using a floppy disc or a USB flash drive. Passwords are restored by inputting the wrong password during log-in, then clicking "Reset Password".Driver signing requirement
64-bit64-bit
64-bit is a word size that defines certain classes of computer architecture, buses, memory and CPUs, and by extension the software that runs on them. 64-bit CPUs have existed in supercomputers since the 1970s and in RISC-based workstations and servers since the early 1990s...
versions of Windows Vista (and of Windows 7 as well) allow only signed
Code signing
Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed by use of a cryptographic hash....
drivers
Device driver
In computing, a device driver or software driver is a computer program allowing higher-level computer programs to interact with a hardware device....
to be installed in kernel mode
Ring (computer security)
In computer science, hierarchical protection domains, often called protection rings, are a mechanism to protect data and functionality from faults and malicious behaviour . This approach is diametrically opposite to that of capability-based security.Computer operating systems provide different...
; this feature cannot be easily overridden by system administrator
System administrator
A system administrator, IT systems administrator, systems administrator, or sysadmin is a person employed to maintain and operate a computer system and/or network...
s.
In order for a driver to be signed, a developer will either have to pay Microsoft for the driver to be tested by Microsoft's WHQL Testing
WHQL Testing
Windows Hardware Quality Labs testing or WHQL Testing is Microsoft's testing process which involves running a series of tests on third-party hardware or software, and then submitting the log files from these tests to Microsoft for review...
or, if WHQL testing is not required, to purchase a "Software Publisher Certificate
Public key certificate
In cryptography, a public key certificate is an electronic document which uses a digital signature to bind a public key with an identity — information such as the name of a person or an organization, their address, and so forth...
" with which to sign the driver.
The following criticisms/claims have been made regarding this requirement:
- that it reduces Vista's compatibility with older hardware
- that it disallows experimentation from the hobbyist community. The required authenticode certificates for signing Vista drivers are expensive and out of reach for small developers, usually about $400–500/year (from VeriSignVeriSignVerisign, Inc. is an American company based in Dulles, Virginia that operates a diverse array of network infrastructure, including two of the Internet's thirteen root nameservers, the authoritative registry for the .com, .net, and .name generic top-level domains and the .cc and .tv country-code...
). - that it might exist not only for security reasons, but also to enforce Digital Rights ManagementDigital rights managementDigital rights management is a class of access control technologies that are used by hardware manufacturers, publishers, copyright holders and individuals with the intent to limit the use of digital content and devices after sale. DRM is any technology that inhibits uses of digital content that...
policies, especially the Protected Video Path .
Unsigned drivers could initially be installed through the use of tools included with Vista, as well as some third party utilities such as Atsiv. However Microsoft has closed these workarounds with hotfix KB932596, which is included in Service Pack 1. Microsoft claims that using strict driver handling means more security, while critics note that few if any security attacks have manifest in software drivers, which are almost always written by equipment manufacturers.
Flaws in memory protection features
Security researchers Alexander SotirovAlexander Sotirov
Alexander Sotirov is a computer security researcher. He has been a researcher at Determina and VMware.He is well known for his discovery of the ANI browser vulnerability as well as the so-called Heap Feng Shui technique for exploiting heap buffer overflows in browsers. In 2008, he presented...
and Mark Dowd have developed a technique that bypasses many of the new memory-protection safeguards in Windows Vista, such as address space layout randomization
Address space layout randomization
Address space layout randomization is a computer security method which involves randomly arranging the positions of key data areas, usually including the base of the executable and position of libraries, heap, and stack, in a process's address space.- Benefits :Address space randomization hinders...
(ASLR). The result of this is that any already existing buffer overflow bugs that, in Vista, were previously not exploitable due to such features, may now be exploitable. This is not in itself a vulnerability: as Sotirov notes, "What we presented is weaknesses in the protection mechanism. It still requires the system under attack to have a vulnerability. Without the presence of a vulnerability these techniques don’t really [accomplish] anything." The vulnerability Sotirov and Dowd used in their paper as an example was the 2007 animated cursor bug, CVE
Common Vulnerabilities and Exposures
The Common Vulnerabilities and Exposures or CVE system provides a reference-method for publicly-known information-security vulnerabilities and exposures. MITRE Corporation maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland...
-2007-0038.
One security researcher (Dino Dai Zovi) claimed that this means that it is "completely game over" for Vista security. though Sotirov refuted this, saying that "The articles that describe Vista security as 'broken' or 'done for,' with 'unfixable vulnerabilities' are completely inaccurate. One of the suggestions I saw in many of the discussions was that people should just use Windows XP. In fact, in XP a lot of those protections we’re bypassing [such as ASLR] don’t even exist."
Digital rights management
Another common criticism concerns the integration of new forms of digital rights managementDigital rights management
Digital rights management is a class of access control technologies that are used by hardware manufacturers, publishers, copyright holders and individuals with the intent to limit the use of digital content and devices after sale. DRM is any technology that inhibits uses of digital content that...
(DRM) into the operating system, specifically the Protected Video Path (PVP), which involves technologies such as High-bandwidth Digital Content Protection
High-Bandwidth Digital Content Protection
High-bandwidth Digital Content Protection is a form of digital copy protection developed by Intel Corporation to prevent copying of digital audio and video content as it travels across connections...
(HDCP) and the Image Constraint Token
Image Constraint Token
The Image Constraint Token is a protocol flag that can cause downsampling of high-definition video content on Blu-ray and HD DVD to slightly-better-than-DVD quality video...
(ICT). These features have been added to Vista due to an agreement between Microsoft and major Hollywood studios. This will concern, among other things, play-back of protected content on HD DVD
HD DVD
HD DVD is a discontinued high-density optical disc format for storing data and high-definition video.Supported principally by Toshiba, HD DVD was envisioned to be the successor to the standard DVD format...
and Blu-ray discs, but it will not be enabled until at least 2010.
The Protected Video Path mandates that encryption must be used whenever content marked as "protected" will travel over a link where it might be intercepted. This is called a User-Accessible Bus (UAB). Additionally, all devices that come into contact with premium content (such as graphics cards) have to be certified by Microsoft. Before playback starts, all the devices involved are checked using a Hardware Functionality Scan (HFS) to verify if they are genuine and have not been tampered with. Devices are required to switch off or artificially degrade the quality of any signal outputs that are not protected by HDCP. Additionally, Microsoft maintains a global revocation list for devices that have been compromised. This list is distributed to PCs over the Internet using normal update mechanisms. The only effect on a revoked driver's functionality is that high-level protected content will not play; all other functionality, including low-definition playback, is retained.
Notable critics
Peter GutmannPeter Gutmann (computer scientist)
Peter Gutmann is a computer scientist in the Department of Computer Science at the University of Auckland, Auckland, New Zealand. He has a Ph.D. in computer science from the University of Auckland. His Ph.D. thesis and a book based on the thesis were about a cryptographic security architecture...
, a computer security expert from the University of Auckland
University of Auckland
The University of Auckland is a university located in Auckland, New Zealand. It is the largest university in the country and the highest ranked in the 2011 QS World University Rankings, having been ranked worldwide...
, New Zealand, has released a whitepaper in which he raises the following concerns against these mechanisms:
- Adding encryption facilities to devices makes them more expensive, a cost that is passed on to the user.
- If outputs are not deemed sufficiently protected by the media industry, then even very expensive equipment can be required to be switched off (for example, S/PDIFS/PDIFS/PDIF is a digital audio interconnect used in consumer audio equipment over relatively short distances. The signal is transmitted over either a coaxial cable with RCA connectors or a fiber optic cable with TOSLINK connectors. S/PDIF interconnects components in home theaters and other digital high...
-based, high-end audio cards). - Some newer high-definition monitors are not HDCP-enabled, even though the manufacturer may claim otherwise.
- The added complexity makes systems less reliable.
- Since non-protected media are not subject to the new restrictions, users may be encouraged to remove the protection in order to view them without restrictions, thus defeating the content protection scheme's initial purpose.
- Protection mechanisms, such as disabling or degrading outputs, may be triggered erroneously or maliciously, motivating denial-of-service attacks.
- Revoking the driver of a device that is in wide use is such a drastic measure that Gutmann doubts Microsoft will ever actually do so. On the other hand, they may be forced to because of their legal obligations to the movie studios.
Steve Gibson of Gibson Research Corporation has stated during his Security Now! show that he agrees with Peter Gutmann in principle and that what he proposes is a factually accurate description of what is found in the specification from Microsoft.
The Free Software Foundation
Free Software Foundation
The Free Software Foundation is a non-profit corporation founded by Richard Stallman on 4 October 1985 to support the free software movement, a copyleft-based movement which aims to promote the universal freedom to create, distribute and modify computer software...
conducted a campaign called "BadVista
BadVista
BadVista was a campaign by the Free Software Foundation to oppose adoption of Microsoft Windows Vista and promote free software alternatives. A follow-up to the Defective by Design campaign against digital rights management technologies, it aimed to encourage the media to make free software part of...
" against Vista on these grounds.
Reaction to criticism
Ed Bott, author of Windows Vista Inside Out, has published a three-part blog which rebuts many of Gutmann's claims.Ed Bott's criticisms can be summarized as follows:
- Gutmann allegedly based his paper on outdated documentation from Microsoft and second-hand web sources.
- Gutmann allegedly quotes selectively from the Microsoft specifications.
- Gutmann allegedly did no experimental work with Vista to prove his theories. Rather, he makes mistaken assumptions and then speculates wildly on their implications.
- Gutmann's paper, while presented as serious research, is really just an opinion piece.
Technology writer George Ou claims that Gutmann's paper relies on unreliable sources and that Gutmann has never used Windows Vista to test his theories.
Gutmann has responded to both Bott and Ou in a further article., which states that the central thesis of Gutmann's article has not been refuted and the response of Bott is "disinformation".
Microsoft has published a blog entry with "Twenty Questions (and Answers)" on Windows Vista Content Protection, intending to refute some of Gutmann's arguments.
Paul Smith, a Microsoft MVP
Microsoft Most Valuable Professional
The Microsoft Most Valuable Professional is the highest award given by Microsoft to those it considers "the best and brightest from technology communities around the world" who "actively share their ... technical expertise with the community and with Microsoft"...
, has written a response to Gutmann's paper in which he counters some of his arguments. Specifically, he says:
- Microsoft is not to blame for these measures. The company has been forced to do this by the movie studios.
- The Protected Video Path will not be used for quite a while. There is said to be an agreement between Microsoft and Sony that Blu-ray discs will not mandate protection until at least 2010, possibly even 2012.
- Vista does not degrade or refuse to play any existing media, CDs or DVDs. The protected data paths are only activated if protected content requires it.
- Users of other operating systems such as LinuxLinuxLinux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
or Mac OS XMac OS XMac OS X is a series of Unix-based operating systems and graphical user interfaces developed, marketed, and sold by Apple Inc. Since 2002, has been included with all new Macintosh computer systems...
will not have official access to this premium content.
Microsoft also noted that content protection mechanisms have existed in Windows as far back as Windows Me
Windows Me
Windows Millennium Edition, or Windows Me , is a graphical operating system released on September 14, 2000 by Microsoft, and was the last operating system released in the Windows 9x series. Support for Windows Me ended on July 11, 2006....
.
Hardware requirements and performance
According to Microsoft, "nearly all PCs on the market today will run Windows Vista" and most PCs sold after 2005 are capable of running Vista.Much hardware that worked in XP does not work, or works poorly in Vista, due to companies going out of business, lack of interest in supporting old hardware, and changes in driver models. Service Pack 1 for Vista is said to fix many of these problems.
Speed
Tom's Hardware published benchmarks in January 2007 that showed that Windows Vista executed typical applications more slowly than Windows XP with the same hardware configuration. A subset of the benchmarks used were provided by Standard Performance Evaluation CorporationStandard Performance Evaluation Corporation
The Standard Performance Evaluation Corporation is a non-profit organization that aims to "produce, establish, maintain and endorse a standardized set" of performance benchmarks for computers....
(or SPEC), who later stated that such "results should not be compared to those generated while running Windows XP, even if testing is done with the same hardware configuration." SPEC acknowledges that an apple-to-apples comparison cannot be made in cases such as the one done by Tom's Hardware, calling such studies "invalid comparisons." However, the TomsHardware report conceded that the SPECviewperf tests "suffered heavily from the lack of support for the OpenGL graphics library under Windows Vista". For this reason the report recommended against replacing Windows XP with Vista until manufacturers made these drivers available.
The report also concluded in tests involving real world applications Vista performed considerably slower, noting "We are disappointed that CPU-intensive applications such as video transcoding with XviD (DVD to XviD MPEG4) or the MainConcept H.264 Encoder performed 18% to nearly 24% slower in our standard benchmark scenarios". Other commonly used applications, including Photoshop and WinRAR, also performed worse under Vista.
Many low-to-middle-end machines that come with Windows Vista pre-installed suffer from exceptionally slow performance with the default Vista settings that come pre-loaded, and laptop manufacturers have offered to 'downgrade' laptops to Windows XP—for a price. However, this "price" is unnecessary, as Microsoft allows users of Windows Vista and Windows 7 to freely "downgrade" their software by installing XP and then phoning a Microsoft representative for a new product key. http://www.eweek.com/c/a/Windows/Microsoft-Windows-XP-Users-Can-Keep-Downgrade-Rights-491684/
File operation performance
When first released in November 2006, Vista performed file operations such as copying and deletion more slowly than other operating systems. Large copies required when migrating from one computer to another seemed difficult or impossible without workarounds such as using the command line. This inability to efficiently perform basic file operations attracted strong criticism. After six months, Microsoft confirmed the existence of these problems by releasing a special performance and reliability update, which was later disseminated through Windows Update, and is included in Service Pack 1.Nonetheless, one benchmark reported to show that, while improving performance compared to Vista's original release, Service Pack 1 does not increase the level of performance to that of Windows XP. However, that benchmark has been questioned by others within ZDNet. Ed Bott both questions his colleagues' methods and provides benchmarks that refute the results.
Game performance
Early in Vista's lifecycle, many games showed a drop in frame rate compared to that experienced in Windows XP. These results were largely the consequence of Vista's immature graphics processing unitGraphics processing unit
A graphics processing unit or GPU is a specialized circuit designed to rapidly manipulate and alter memory in such a way so as to accelerate the building of images in a frame buffer intended for output to a display...
s drivers, and higher system requirements for Vista itself.
Some recent benchmarks seem to suggest that, as of mid-2008, Vista SP1 is now on par with Windows XP in terms of game performance. However, game developers' recommended memory requirements on Vista are still higher (usually double) than on XP.
Software bloat
Concerns have been expressed that Windows Vista may containsoftware bloat
Software bloat
Software bloat is a process whereby successive versions of a computer program include an increasing proportion of unnecessary features that are not used by end users, or generally use more system resources than necessary, while offering little or no benefit to its users.-Causes:Software developers...
. Speaking in 2007 at the University of
Illinois, Microsoft distinguished engineer Eric Traut
Eric Traut
Eric Traut is an American software engineer and software emulation pioneer. Traut graduated from Stanford University in 1992. From 1993 to 1995 he worked for Apple Computer, creating a Mac 68K emulator to be used in PowerPC-based Macintoshes...
said, "A lot of people think of Windows as this large,
bloated operating system, and that's maybe a fair
characterization, I have to admit." He went on to say that,
"at its core, the kernel, and the components that make up
the very core of the operating system, is actually pretty
streamlined."
Former PC World editor Ed Bott has expressed skepticism
about the claims of bloat, noting that almost every single
operating system that Microsoft has ever sold had been
criticized as "bloated" when they first came out; even those
now regarded as the exact opposite, such
as MS-DOS
MS-DOS
MS-DOS is an operating system for x86-based personal computers. It was the most commonly used member of the DOS family of operating systems, and was the main operating system for IBM PC compatible personal computers during the 1980s to the mid 1990s, until it was gradually superseded by operating...
.
Vista capable lawsuit
Two consumers sued Microsoft in United States federal court alleging the "Windows Vista Capable" marketing campaign was a bait and switchBait and switch
Bait-and-switch is a form of fraud, most commonly used in retail sales but also applicable to other contexts. First, customers are "baited" by advertising for a product or service at a low price; second, the customers discover that the advertised good is not available and are "switched" to a...
tactic as some computers originally installed with Windows XP could only run Vista Basic, and in some cases they did not run even Vista Basic at a user-acceptable speed. In February 2008 a Seattle judge granted the suit class action
Class action
In law, a class action, a class suit, or a representative action is a form of lawsuit in which a large group of people collectively bring a claim to court and/or in which a class of defendants is being sued...
status, permitting all purchasers in the class to participate in the case.
Released documents in the case, as well as a Dell
Dell
Dell, Inc. is an American multinational information technology corporation based in 1 Dell Way, Round Rock, Texas, United States, that develops, sells and supports computers and related products and services. Bearing the name of its founder, Michael Dell, the company is one of the largest...
presentation in March 2007, discussed late changes to Windows Vista which permitted hardware to be certified that would require upgrading in order to use Vista, and that lack of compatible drivers forced hardware vendors to "limp out with issues" when Vista was launched.
This was one of several Vista launch appraisals included in 158 pages of unsealed documents.
Laptop battery life
With the new features of Vista, criticism has surfaced concerning the use of battery power in laptops running Vista, which can drain the battery much more rapidly than Windows XPWindows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
, reducing battery life. With the Windows Aero visual effects turned off, battery life is equal to or better than Windows XP systems. "With the release of a new operating system and its new features and higher requirements, higher power consumption is normal", as Richard Shim, an analyst with IDC noted, "when Windows XP came out, that was true, and when Windows 2000 came out, that was true."
Software compatibility
Significant problems have surfaced with other software running under Vista. According to Gartner, "Vista has been dogged by fears, in some cases proven, that many existing applications have to be re-written to operate on the new system."Cisco has been reported as saying, "Vista will solve a lot of problems, but for every action, there's a reaction, and unforeseen side-effects and mutations. Networks can become more brittle." According to PC World, "Software compatibility issues, bug worries keep businesses from moving to Microsoft's new OS." Citing "concerns over cost and compatibility", the United States Department of Transportation
United States Department of Transportation
The United States Department of Transportation is a federal Cabinet department of the United States government concerned with transportation. It was established by an act of Congress on October 15, 1966, and began operation on April 1, 1967...
prohibited workers from upgrading to Vista. The University of Pittsburgh Medical Center, said the rollout (of Vista) is significantly behind schedule because "several key programs still aren't compatible, including patient scheduling software."
As of July 2007, there were over 2,000 tested applications that were compatible with Vista. Microsoft has published a list of legacy applications that meet their "Works with Windows Vista" software standards as well as a list of applications that meet their more stringent "Certified for Windows Vista" standards. However, as of July 2007, software compatibility problems were still hindering adoption of Vista. Microsoft has released the Application Compatibility Toolkit 5.0 application for migrating Vista-incompatible applications, while virtualization solutions like VirtualBox
VirtualBox
Oracle VM VirtualBox is an x86 virtualization software package, originally created by software company Innotek GmbH, purchased by Sun Microsystems, and now developed by Oracle Corporation as part of its family of virtualization products...
, Virtual PC 2007
Microsoft Virtual PC
Windows Virtual PC is a virtualization program for Microsoft Windows. In July 2006 Microsoft released the Windows-hosted version as a free product...
or those from VMware
VMware
VMware, Inc. is a company providing virtualization software founded in 1998 and based in Palo Alto, California, USA. The company was acquired by EMC Corporation in 2004, and operates as a separate software subsidiary ....
can also be used as a last resort to continue running Vista-incompatible applications under legacy versions of Windows.
Microsoft also provides an Upgrade Advisor Tool (.NET must be installed and an Internet connection is required) which can be used on existing XP systems to flag driver and application compatibility issues before upgrading to Vista.
Removal of announced features
Microsoft has also been criticized for removing some heavily discussed features such as Next-Generation Secure Computing BaseNext-Generation Secure Computing Base
The Next-Generation Secure Computing Base , formerly known as Palladium, is a software architecture designed by Microsoft which is expected to implement parts of the controversial "Trusted Computing" concept on future versions of the Microsoft Windows operating system. NGSCB is part of...
in May 2004, WinFS
WinFS
WinFS is the code name for a cancelled data storage and management system project based on relational databases, developed by Microsoft and first demonstrated in 2003 as an advanced storage subsystem for the Microsoft Windows operating system, designed for persistence and management of...
in August 2004, Windows PowerShell
Windows PowerShell
Windows PowerShell is Microsoft's task automation framework, consisting of a command-line shell and associated scripting language built on top of, and integrated with the .NET Framework...
in August 2005 (though this was released separately from Vista prior to Vista's release, and is included in Vista's successor, Windows 7), SecurID
SecurID
SecurID, now known as RSA SecurID, is a mechanism developed by Security Dynamics for performing two-factor authentication for a user to a network resource.- Description :...
Support in May 2006, PC-to-PC Synchronization
Data synchronization
Data synchronization is the process of establishing consistency among data from a source to a target data storage and vice versa and the continuous harmonization of the data over time. It is fundamental to a wide variety of applications, including file synchronization and mobile device...
in June 2006. The initial "three pillars" in Vista were all radically altered to reach a release date.
Pricing
Microsoft's international pricing of Vista has been criticized by many as too expensive. The differences in pricing from one country to another vary significantly, especially considering that copies of Vista can be ordered and shipped worldwide from the United States; this could save between $42 (€26) and $314 (€200). In many cases, the difference in price is significantly greater than was the case for Windows XP. In Malaysia, the pricing for Vista is at around RM799 ($244/€155).At the current exchange rate, United Kingdom consumers could be paying almost double their United States counterparts for the same software.
Since the release of Windows Vista in January 2007 Microsoft has reduced the retail, and upgrade price point of Vista. Originally Vista Ultimate was priced at $399. and Home Premium Vista at $239. These prices have since been reduced to $319 and $199 respectively.
Software Protection Platform
Vista includes an enhanced set of anti-copying technologies, based on Windows XP's Windows Genuine AdvantageWindows Genuine Advantage
Windows Genuine Advantage is an anti-piracy system created by Microsoft that enforces online validation of the licensing of several recent Microsoft Windows operating systems when accessing several services, such as Windows Update, and downloading Windows components from the Microsoft Download...
, called Software Protection Platform (SPP). In the initial release of Windows Vista (without Service Pack 1), a major component of this was a reduced-functionality mode, which is entered when it is detected that the user has "failed product activation" or that their copy is "identified as counterfeit or non-genuine." The technology was described in a Microsoft white paper as follows:
This was criticised for being overly draconian, especially given an imperfect false-positive record on behalf of SPP's predecessor, and at least one temporary validation server outage which reportedly flagged many legitimate copies of Vista and XP as "Non-Genuine" when Windows Update would "check in" and fail the "validation" challenge.
SPP was significantly altered in Windows Vista Service Pack 1. Instead of the reduced functionality mode, an installation of Vista left unactivated for 30 days presents the user with a nag screen prompting them to activate the operating system when they log in, changes the desktop to a solid black colour every hour, and periodically warns the user about software counterfeiting with notification balloons. In addition, updates classified as optional are not available to unactivated copies of Vista. Microsoft maintains a technical bulletin providing further details on product activation for Vista.
Sales figure inflation
According to industry sources, as of late July 2008 Windows XPWindows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
is still outselling Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
, especially in business sales. According to HP, Microsoft
Microsoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
is miscounting and inflating Windows Vista sales figures. An HP manager is quoted in APC:
Windows Ultimate Extras
Windows Vista Ultimate users can download exclusive Windows Ultimate ExtrasWindows Ultimate Extras
Windows Ultimate Extras are optional features offered to users of Windows Vista Ultimate Edition. They are accessible with Windows Update. Ultimate Extras replace the market role of Microsoft Plus!, a product sold for prior consumer releases of Microsoft Windows...
. These extras have been released much more slowly than expected, with only four available as of August 2009, almost three years after Vista was released, which has angered some users who paid extra mainly for the promised add-ons.
Barry Goffe, Director of Windows Vista Ultimate for Microsoft states that they were unexpectedly delayed on releasing several of the extras, but that "Microsoft plans to ship a collection of additional Windows Ultimate Extras that it is confident will delight its passionate Windows Vista Ultimate customers."
See also
- Criticism of MicrosoftCriticism of MicrosoftCriticism of Microsoft has followed various aspects of its products and business practices. Issues with ease of use, stability, and security of the company's software are common targets for critics. In the 2000s, a number of malware attacks have targeted security flaws in Microsoft Windows and...
- Criticism of Microsoft WindowsCriticism of Microsoft WindowsThe various versions of Microsoft's desktop operating system, Windows, have received many criticisms since Microsoft's inception.-Clock management:Windows expects the real-time clock of the computer to run on local time...
- Criticism of Windows XP
- Mojave experiment