Criticism of Windows Vista

For security reasons, 64-bit versions of Windows Vista allow only signed drivers to be installed in kernel mode.[1][2] Because code executing in kernel mode enjoys wide privileges on the system, the signing requirement aims to ensure that only code with known origin execute at this level. In order for a driver to be signed, a developer/software vendor will have to obtain an Authenticode certificate[3] with which to sign the driver. Authenticode certificates can be obtained from certificate authorities trusted by Microsoft. Microsoft trusts the certificate authority to verify the applicant's identity before issuing a certificate. If a driver is not signed using a valid certificate, or if the driver was signed using a certificate which has been revoked by Microsoft or the certificate authority, Windows will refuse to load the driver.

The following criticisms/claims have been made regarding this requirement:

• It disallows experimentation from the hobbyist community.[4] The required Authenticode certificates for signing Vista drivers are expensive and out of reach[5] for small developers, usually about $400–$500/year (from Verisign).

Microsoft allows developers to temporarily or locally disable the signing requirement on systems they control (by hitting F8 during boot) or by signing the drivers with self-issued certificates or by running a kernel debugger.[6]

At one time, a third-party tool called Atsiv[7] existed that would allow any driver, unsigned or signed to be loaded. Atsiv worked by installing a signed "surrogate" driver which could be directed to load any other driver, thus circumventing the driver signing requirement. Since this was in violation of the driver signing requirement, Microsoft closed this workaround with hotfix KB932596,[8] by revoking the certificate with which the surrogate driver was signed.

Security researchers Alexander Sotirov and Mark Dowd have developed a technique that bypasses many of the new memory-protection safeguards in Windows Vista, such as address space layout randomization (ASLR). The result of this is that any already existing buffer overflow bugs that, in Vista, were previously not exploitable due to such features, may now be exploitable.[9][10] This is not in itself a vulnerability: as Sotirov notes, "What we presented is weaknesses in the protection mechanism. It still requires the system under attack to have a vulnerability. Without the presence of a vulnerability these techniques don't really [accomplish] anything."[11] The vulnerability Sotirov and Dowd used in their paper as an example was the 2007 animated cursor bug, CVE-2007-0038.

One security researcher (Dino Dai Zovi) claimed that this means that it is "completely game over" for Vista security[12] though Sotirov refuted this, saying that "The articles that describe Vista security as 'broken' or 'done for,' with 'unfixable vulnerabilities' are completely inaccurate. One of the suggestions I saw in many of the discussions was that people should just use Windows XP. In fact, in XP a lot of those protections we're bypassing [such as ASLR] don't even exist."[11]

Peter Gutmann, a computer security expert from the University of Auckland, New Zealand, has released a whitepaper[15] in which he raises the following concerns against these mechanisms:

• Adding encryption facilities to devices makes them more expensive, a cost that is passed on to the user.
• If outputs are not deemed sufficiently protected by the media industry, then even very expensive equipment can be required to be switched off (for example, S/PDIF-based, high-end audio cards).
• Some newer high-definition monitors are not HDCP-enabled, even though the manufacturer may claim otherwise.
• The added complexity makes systems less reliable.
• Since non-protected media are not subject to the new restrictions, users may be encouraged to remove the protection in order to view them without restrictions, thus defeating the content protection scheme's initial purpose.
• Protection mechanisms, such as disabling or degrading outputs, may be triggered erroneously or maliciously, motivating denial-of-service attacks.
• Revoking the driver of a device that is in wide use is such a drastic measure that Gutmann doubts Microsoft will ever actually do so. On the other hand, they may be forced to because of their legal obligations to the movie studios.

The Free Software Foundation conducted a campaign called "BadVista" against Vista on these grounds.

Ed Bott, author of Windows Vista Inside Out, has published a three-part blog which rebuts many of Gutmann's claims.[16]

Bott's criticisms can be summarized as follows:

• Gutmann based his paper on outdated documentation from Microsoft and second-hand web sources.
• Gutmann quotes selectively from the Microsoft specifications.
• Gutmann did no experimental work with Vista to prove his theories. Rather, he makes mistaken assumptions and then speculates wildly on their implications.
• Gutmann's paper, while presented as serious research, is really just an opinion piece.

Technology writer George Ou states that Gutmann's paper relies on unreliable sources and that Gutmann has never used Windows Vista to test his theories.[17]

Gutmann has responded to both Bott and Ou in a further article,[18] which states that the central thesis of Gutmann's article has not been refuted and the response of Bott is "disinformation".

Microsoft has published a blog entry with "Twenty Questions (and Answers)" on Windows Vista Content Protection which refutes some of Gutmann's arguments.[19]

Microsoft MVP Paul Smith has written a response to Gutmann's paper in which he counters some of his arguments.[20] Specifically, he says:

• Microsoft is not to blame for these measures. The company offered this solution as an alternative to not being able to playback the content at all.
• The Protected Video Path will not be used for quite a while. There is said to be an agreement between Microsoft and Sony that Blu-ray discs will not mandate protection until at least 2010, possibly even 2012.[21]
• Vista does not degrade or refuse to play any existing media, CDs or DVDs. The protected data paths are only activated if protected content requires it.
• Users of other operating systems such as Linux or Mac OS X will not have official access to this premium content.

Microsoft also noted that content protection mechanisms have existed in Windows as far back as Windows ME.[14]

Since mainstream and extended support for Windows Vista has ended on April 10, 2012 and April 11, 2017 respectively, plans to enable the Protected Video Path for Windows Vista is very unlikely.

Tom's Hardware published benchmarks in January 2007 that showed that Windows Vista executed typical applications more slowly than Windows XP with the same hardware configuration.[27] A subset of the benchmarks used were provided by Standard Performance Evaluation Corporation (or SPEC), who later stated that such "results should not be compared to those generated while running Windows XP, even if testing is done with the same hardware configuration." SPEC acknowledges that an apple-to-apples comparison cannot be made in cases such as the one done by Tom's Hardware, calling such studies "invalid comparisons."[28] However, the Tom's Hardware report conceded that the SPECviewperf tests "suffered heavily from the lack of support for the OpenGL graphics library under Windows Vista". For this reason the report recommended against replacing Windows XP with Vista until manufacturers made these drivers available.[29]

The report also concluded in tests involving real world applications Vista performed considerably slower, noting "We are disappointed that CPU-intensive applications such as video transcoding with XviD (DVD to XviD MPEG4) or the MainConcept H.264 Encoder performed 18% to nearly 24% slower in our standard benchmark scenarios". Other commonly used applications, including Photoshop and WinRAR, also performed worse under Vista.[29]

Many low-to-mid-end machines that come with Windows Vista pre-installed suffer from exceptionally slow performance with the default Vista settings that come pre-loaded, and laptop manufacturers have offered to "downgrade" laptops to Windows XP—for a price.[30] However, this "price" is unnecessary, as Microsoft allows users of Windows Vista and Windows 7 to freely "downgrade" their software by installing XP and then phoning a Microsoft representative for a new product key.

When first released in November 2006, Vista performed file operations such as copying and deletion more slowly than other operating systems. Large copies required when migrating from one computer to another seemed difficult or impossible without workarounds such as using the command line. This inability to efficiently perform basic file operations attracted strong criticism.[31] After six months, Microsoft confirmed the existence of these problems by releasing a special performance and reliability update,[32] which was later disseminated through Windows Update, and is included in Service Pack 1.[33]

Nonetheless, one benchmark reported to show that, while improving performance compared to Vista's original release, Service Pack 1 does not increase the level of performance to that of Windows XP.[34] However, that benchmark has been questioned by others within ZDNet. Ed Bott both questions his colleagues' methods and provides benchmarks that refute the results.[35]

Early in Vista's lifecycle, many games showed a drop in frame rate compared to Windows XP.[36][37][38] These results were largely the consequence of Vista's immature drivers for graphics cards, and higher system requirements for Vista itself.[39][40] By the time Service Pack 1 was released in mid-2008, gaming benchmarks showed that Vista was on par with Windows XP.[41] However, games such as Devil May Cry 4, Crysis and Left 4 Dead stated that their memory requirements on Vista were 1.5x–2x higher than XP.[42][43][44]

Concerns were expressed that Windows Vista may contain software bloat. Speaking in 2007 at the University of Illinois, Microsoft distinguished engineer Eric Traut said, "A lot of people think of Windows as this large, bloated operating system, and that's maybe a fair characterization, I have to admit." He went on to say that, "at its core, the kernel, and the components that make up the very core of the operating system, is actually pretty streamlined."[45]

Former PC World editor Ed Bott expressed skepticism about the claims of bloat, noting that almost every single operating system that Microsoft has ever sold had been criticized as "bloated" when they first came out; even those now regarded as the exact opposite, such as MS-DOS.[46]

Two consumers sued Microsoft in United States federal court alleging the "Windows Vista Capable" marketing campaign was a bait-and-switch tactic as some computers with Windows XP pre-installed could only run Vista Basic, sometimes not even running at a user-acceptable speed. In February 2008, a Seattle judge granted the suit class action status, permitting all purchasers in the class to participate in the case.[47][48] Released documents in the case, as well as a Dell presentation in March 2007, discussed late changes to Windows Vista which permitted hardware to be certified that would require upgrading in order to use Vista, and that lack of compatible drivers forced hardware vendors to "limp out with issues" when Vista was launched.[48][49] This was one of several Vista launch appraisals included in 158 pages of unsealed documents.

With the new features of Vista, criticism has surfaced concerning the use of battery power in laptops running Vista, which can drain the battery much more rapidly than Windows XP, reducing battery life.[50] With the Windows Aero visual effects turned off, battery life is equal to or better than Windows XP systems.[51] "With the release of a new operating system and its new features and higher requirements, higher power consumption is normal", as Richard Shim, an analyst with IDC noted, "when Windows XP came out, that was true, and when Windows 2000 came out, that was true."[52]