Computer Question: Security, Windows XP vs Windows 7 Ultimate

July 5, 2011

[Yosemitest]

I'm thinking about buying an IMac, and due to my military friends and other reasons,
I might want a copy of Windows XP or Windows 7 on it with Parallels Desktop 6 for Mac
to go between the Windows Operating System and the Snow Leopard or OS X Lion .

I realize that the Apple/Mac Operating System has very few security problems, and that I'd be inviting all those security problems into my MAC by running windows in it.


QUESTION: Is Windows 7 Ultimate worth the extra cost to buy a full version copy, over Windows XP SP3 full version?
I'm experienced with Windows XP, but I'm NOT experienced with Windows 7.

Also, if I'm going to run Windows XP or Windows 7 in an IMac, what firewall/security system should I buy?

Sincerely, Yosemitest

[Yosemitest]

Age of peripherals, printer 1999, and an old lazer printer goes back to 1994.
Programs probably go back to a Punch design program I rarely use that is 1999.
Being on a retired military budget, money's tight, and total cost of the move to IMac is a factor.
BUT I'm determined to make the move to IMac and slowly get rid of Microsoft.

[Johnny B.]

Here is a dirty little secret....Win XP SP, which I use, is available for free from several download sites. It has stood the test of time and hacking and keeps on going strong.

Win 7, in many of its apparitions, is also available, for free, at these sites.

Nice. That way the viruses com pre-installed.

Aside from the questionable safety of downloading Windows from some random download site, there is the fact that this is is stealing.

If you are unwilling or unable to afford to buy a legal copy of your operating system, I would recommend switching to Linux, which works fine for most purposes, and is a legal and ethical choice.

[conservativeimage]

Solution: buy a separate net book to do your internet work and leave your sensitive system disconnected from the web at all times.

[2 Kool 2 Be 4-Gotten]

Not to mention the fact that MS is likely to be able to detect this sort of piracy and lock you out from using the illegal product.

[Yosemitest]

Thank you for your links and input.
I've read some of those articles about MAC security before.
I guess it comes down to the fact that 90% of computers are PCs and 10% are MACs, and fewer hackers are targeting MACs.
But I'm commited to make the change to MAC.

Now for your comments about Win 7, they are credible and I'll give them some thought.

[Johnny B.]

Not to mention the fact that MS is likely to be able to detect this sort of piracy and lock you out from using the illegal product.

That brings up a good point. Even if you have a legitimate copy of Windows, there are significant limitations on how and when you can install it on a new machine (real or virtual).

I have a stack of legitimate Windows install disks which can no longer be used because I have installed too many times (I tend to wipe and reinstall often as part of my work as a software developer).

[Leroy S. Mort]

Windows 7 is garbage

Hyperbole seems to run fine on your system.

[quesera]

Definitely Win 7 for a new system.

However for an older system Win XP is by far the best choice.

[4ROMANY]

If you want to spend a LOT of time googling for help for OS issues stay away from Linux (ubuntu, red hat, and the dozen other linux variant). I love linux - and it’s gotten a lot easier to use - but unless all you do is print/surf/email stay away from it. I would go with windows 7 - keep your AV up to date you should be fine. My company is the largest utility in the US (or will soon be) - all new pcs have Win7 - and existing ones will soon be upgraded....If you go with Apple you.will.pay.to.much for everything - software, hardware - Apple writes the OS and sales the hardware - very little competition.

[4ROMANY]

Double ditto’s on what 2kools has to say...For the majority of “normal” non-geek people Win7 is the best choice. I don’t like Windows - for my personal computers I use linux - but for my wife - and my work - it’s a windows world. There’s a time to tilt at the wind mills - and there is a time not to. I fought like heck to keep OS/2 on my work PC long after the corporate direction was DOS/Windows....though I did hold out long enough to be allowed to go to Windows NT 3.X....yes....I’m that old...

[Yosemitest]

"You don't need virus-scanning software for Mac (although that might change in the future). If you're not using the Windows VM to access the Internet (web browsing and email), you can probably get by without virus-scanning software on the Windows side as well"

From what I've read, you need security appropriate for Windows on the "Parallels Desktop 6 for Mac" side due to malware that attacks Microsoft.
Any suggestions?
I'm currently using Online Armor++.
Check it out at Giveaway of the Day - Online Armor.

[Yosemitest]

The Apple hardware is bought. I' committed to the change.
The next decision is which windows OS to put on it, and what security program to run with it.

[Johnny B.]

From what I've read, you need security appropriate for Windows on the "Parallels Desktop 6 for Mac" side due to malware that attacks Microsoft.

That depends on how you're using the Windows VM. If you are accessing the Internet from the Windows VM, then you need the same protection you would need with a native machine. For example, I only use my Windows VM to run Office and some software development tools, so I'm not doing the types of things that can lead to virus infections.

I don't know about Armor++, so I can't express an opinion. I tell people to avoid Norton (bloated and buggy), and I've heard good things about Avast.

[Yosemitest]

Interesting.
I don't think about NOT accessing the internet from the Windows side, and only using the Snow Leopard side.
But you can leave Snow Leopard open and open the Parallels program to get to Windows, and bounce back and forth between the two.
If you're open on the Snow Leopard side and you have Windows open and minimized, wouldn't any virus attack see the Windows file?

[Slings and Arrows]

Obviously Microsoft needs to release a FR accelerator patch.

Thanks for the info.

[Johnny B.]

If you're open on the Snow Leopard side and you have Windows open and minimized, wouldn't any virus attack see the Windows file?

Your Windows VM can't get infected by what you're doing on the Mac host computer, and vise versa. (Actually, it is theoretically possible that someone could write a Mac virus that hunted down the Windows VM and infect it, but AFAIK no one has ever developed such software).

They really act like completely separate computers. The only significant difference is that the Mac host computer may (depending on how the network is configured) act as an additional firewall between the Windows VM and the Internet.

[tacticalogic]

If you’re running W7, and need to run older (XP) sofware, you can download a free XP VM image from MS that will run as a VM under Windows 7. You don’t have to dual boot.

[Oceander]

If you’re committed to making the change to MAC, then I say go for it. I personally don’t care for the MAC, but I will candidly say that most of that is probably due to unfamiliarity rather than anything inherent in the MAC system. As such, my views are just that - my subjective views - and thus have little bearing on your situation.

I also know that unfamiliarity affects people switching from WinXP - or WinVista - to Win7, because I just bought my wife a new laptop with Win7 and it took me a while to figure out where things were.

As for Win7 versus WinXP: there the unfamiliarity aspect definitely kicks in. Win7 is as alien, if you will, to WinXP as Mac OS X is, in many respects. That being said, as much as Microsoft’s OS engineers deserve to be roundly kicked in the pants on a regular basis, even they manage to learn from experience, and they have learned a thing or two from the security holes in WinXP.

Also, in terms of performance (i.e., speed, which is what most folks look for), I would keep in mind that a lot of what slows an OS down are the hardware drivers, and Microsoft has only some control over what goes into coding a driver. Also, here, unfamiliarity can cause problems; the APIs and driver hooks for WinXP are well-known (comparatively) and the writers of driver software are comfortable with writing for XP and have honed most of the inefficiencies out of their code. The same does not apply to Win7, which has made a lot of changes that affect drivers and driver code writers. That means that there will be a lot more inefficiency in the driver software until the code writers get more comfortable with the new APIs and the new relationship of drivers to OS in the Win7 code base.

Also, WinXP was much more tolerant of poorly written driver code than Win7, or even Vista, is. That means that WinXP is less likely to have a fit over a poorly written driver and therefore won’t appear to lock up when Win7 and Vista would lock up. However, that flexibility is a two-edged sword, because the same “flexibility” that allows WinXP to tolerate poorly written drivers is an open invitation for malware writers to write exploits that use that “flexibility” to get into the system.

It is not purely coincidental that one of the major ways of taking over a system is to shim your own driver in between two legitimate drivers in the driver stack (basically, there are several layers of code between the user experience - the user interface - and the cold, hard physical stuff, and there generally has to be a driver - a translator if you will - between each layer). So long as your ersatz driver passes the usual traffic up and down the driver stack, it can do lots of other things that you really don’t want it to be doing. In addition, it can mess with the traffic passing up and down the driver stack; without a secure auditing system, that messing around is almost impossible to detect (even with an auditing system it can be hard to detect).

Thus, precisely because WinXP is more “flexible” and will tolerate a lot more misbehaviour from drivers, it is much easier to insert a driver into WinXP that can engage in a lot of evil activity that WinXP will simply ignore as being just more driver misbehaviour.

Putting those two together, it is entirely possible that if you just take, e.g., the printer you have that worked fine on WinXP and plug it into a Win7 box, that printer will give Win7 indigestion until you get the correct, updated drivers from the manufacturer - unfortunately, many hardware makers don’t make their updated drivers automatically available, so you have to go looking for them, and even worse, many of them won’t support even not-so-old equipment and won’t, for example, write a new Win7 driver to accomodate a three-year-old piece of equipment. While that is truly annoying, it is more the fault of the hardware maker than it is of Microsoft.

Lastly, if you do have access to a good sandbox or virtual machine software, that could very well give you the environment you need to run a virtual install of WinXP as needed (Win7 might not sandbox as easily until the virtual machine writers get up to speed on it). Provided you’re running a good, robust virtual machine, I rather seriously doubt if anything you might catch with the XP install would carry over to your native MAC installation.

It is theoretically possible to write stuff like that - there are malware writers out there who are good enough that their code can determine if it’s running in a virtual environment - typically used to reverse-engineer the malware - and to alter its behaviour accordingly; however, as a practical reality you are almost certainly never going to run into something like that. It would require a malware writer who was good enough to write code that could detect that it’s being run on a virtual machine and be able to break out of that machine, and who wrote code to specifically attack a MAC OS X system running that virtual machine.

If you think that your odds of getting attacked by malware with that combination of features are high, then you’d probably be better off investing your money in lottery tickets, because the odds of winning the lottery are better than being attacked by malware with that combination of features.

At any rate, my apologies for the much-too-long saga. I would say again that if you’re committed to going the MAC route, you should go for it whole-hog - no half-measures: read up on it, get to know what it’s strong points and weaknesses are, learn how to use it securely, and learn as much as you can about what makes it tick. Think of it this way, it’s analogous to deciding to switch from an automatic transmission to a stick-shift: there’s no real point in doing that unless you’re willing to learn things like down-shifting.

[Yosemitest]

Thanks for the answer.
I'm getting tired and got to get 40 winks.
Pardon me if I don't respond quickly. Besides, I'm making too making typos.

[Yosemitest]

Your saga wasn't too long, and I can follow most of it.
But I'm tired and need to get some rest. I think I can understand slipping a code driver between two similar spelled drivers.
I understand XP's being tolerant of loosely written drivers and Win7 being tighter written.
I use Online Armor++ to tighten up XP with it's file options to "Run Safer" and "Untrust" a file. It will give more information about what file is trying to run another file by name, and ask you to approve or block it.

" it’s analogous to deciding to switch from an automatic transmission to a stick-shift:
there’s no real point in doing that
unless you’re willing to learn things like down-shifting."

Most stick shifts, can be push started when things give you minor headaches, say a dead battery, or a cranky carburetor.
It's better to learn how to drive a stick shift first, say an "H" pattern on the steering column, then move to a floor stick shift vehicle, and lastly an automatic.
That way, when push comes to shove, you can survive.
But to teach someone to drive a stick shift, that's only been driving an automatic for a few years .... is almost impossible, and will likely get them into a vehicle crash.
And let's not even talk about a starter button nest to the emergency brake petal on the floor ...