R.I.P. Windows XP SP2

Computerworld - Microsoft on Tuesday officially retired Windows XP Service Pack 2 (SP2), the company's most significant service pack, several security experts said.

"Windows XP SP2 was a game changer," said Wolfgang Kandek, chief technology officer of Qualys, a California-based security risk and compliance management provider.

"SP2 was a major, major course correction by Microsoft," added John Pescatore, an analyst who covers security for Gartner Research. "It was the first time that Microsoft could tout Windows as being secure."

Microsoft set Tuesday as the end of support for Windows XP SP2, and used the day to deliver its final security patch. To receive any further fixes, security or otherwise, users must run XP SP3 or upgrade to a newer operating system, such as Vista or Windows 7.

"Customers who have not migrated from [SP2] are encouraged to upgrade immediately, either to Service Pack 3 or to Windows 7," said Jerry Bryant, a general manager with the Microsoft Security Response Center (MSRC), in an e-mail today.

The end of support for XP SP2 also marks the end of an era, security experts said today as they gave, if not eulogies, then best wishes and a retirement gold watch to the service pack.

"Compared to SP2, every other service pack has been just housekeeping," said Kandek. "Windows 7 SP1, which just went into beta, is just another SP."

When it launched in August 2004, XP SP2 was characterized by almost everyone as a departure from the norm because it wasn't only a collection of previous-released patches and hotfixes -- the precedent -- but also included new features, most notably in the security arena.

"It was the first service pack where Microsoft flat out said, 'There's a whole bunch of improvements here, and we're mixing them in with fixes," said Pescatore. "It's taken a lot of attention away from the [succeeding] service packs. Compared to XP SP2, recent service packs are not that big of deal."

XP SP2 received kudos for deploying Windows' first on-by-default firewall, a security-status dashboard, and the first-ever attempt at blocking attacks using DEP, or Data Execution Prevention.

It was also the first operating system released after Microsoft declared it would beef up Windows security, a reaction to just-as-public massive attacks by network worms, especially 2003's SQL Slammer.