Why SP2 will fail for Microsoft

Microsoft is pinning its security story on the much-vaunted Windows Service Pack 2. That's a bad gamble on Microsoft's part. Most of what they are relying on is in the new and easier-to-use personal firewall, and that firewall will probably be used by fewer than half of all XP users. They'll simply turn it off.

People hate firewalls. Corporate users blame every software problem with Internet applications on "the company's firewall". They go out of their way to circumvent the corporate firewall whenever they can. When they can't, they complain bitterly about the idiots in the IT department.

Some people buy personal firewalls, but only a few. And, more importantly, many people who buy personal firewalls turn them off after a day or two after discovering that they firewall kills some of their favorite Internet programs. Microsoft is about to find this out, and is about to lose most of the good security they hoped to gain with SP2.

How bad will SP2 hurt things? Just look at Microsoft's own list of what will be broken by their new firewall. A few things to note:

• The list is woefully incomplete. It doesn't list the dozens of popular P2P and instant messaging programs that will no longer work.
• Microsoft isn't being completely honest here. The first sentence of the summary says "...some programs may seem not to work". They seem not to work? Wrong: they really don't work. The firewall broke them.
• Note how cumbersome the procedures are to poke a hole in the firewall for your favorite program. After someone discovers that they can no longer use a program, which do you think they will do: follow the detailed and often-nerdy instructions, or just turn off the firewall?

A few months from now, when few people are using the built-in firewall and Windows security is perceived to be nearly as bad as it is today, expect Microsoft to go into "blame the customer" mode, saying that if everyone just did as Microsoft said, they will be safe. No one will believe them, and their reputation will be worse than ever.

Until Microsoft significantly tightens up the ability for a user to receive and run executable content, they're going to (quite rightfully) get beaten up on security.

Update: Now Microsoft is delaying the release of SP2 because they need more time to perfect the tool that companies can use to prevent employees from downloading SP2. They didn't think of this ahead of time?.