When Microsoft updated Windows XP with Service Pack 2 (SP2) in August 2004, for the first time Windows included a firewall that was switched on by default. In Windows Vista, the firewall will be capable of blocking both outgoing and incoming traffic but Microsoft has not explained why the outgoing function will, by default, be inactive.
According to Microsoft, Vista is able to protect against incoming attacks but users will have to "selectively configure the firewall" to stop unauthorised applications from connecting to the Internet.
Michael Warrilow, director of Sydney-based security consultancy Hydrasight, told ZDNet Australia that one reason could be that predicting the behaviour of applications is very difficult.
"The firewall is to protect against inbound attacks -- instead of protecting the rest of the world from you. Also, the behaviour of applications is more difficult to predict for outbound traffic," he said.
One company that is rather pleased about Microsoft's decision is Zone Labs, which is probably best known for its ZoneAlarm firewall application.
During a short visit to Sydney last week, the general manager of Zone Labs, Laura Yecies, told ZDNet Australia that Vista's firewall is better than the one supplied with Windows XP but it will lack some key features that come as standard on the free version of ZoneAlarm.
"It is not final but [the Vista firewall] certainly doesn't have the behavioural capabilities [of ZoneAlarm]... It does have the outbound [blocking] capability but that is off by default," said Yecies.
Zone Labs is looking forward to Vista's arrival because it is likely to further boost sales of the company's firewall products, which is what Yecies said happened when Microsoft launched SP2 for Windows XP.
"There was a lot of attention for SP2, which put more attention on firewalls and most [press coverage] said that SP2 is better -- but really they made the point that you need a good firewall and if you are looking for a good firewall then ZoneAlarm is even better -- so we had an increase in sales," said Yecies.
Overall, Yecies believes that Zone Labs customers will be better off once Microsoft launches Vista because that will increase the overall level of security: "I am glad they are making their system better. My customers will be more secure if the average Microsoft customer has better security on their system -- because they will be less likely to be a bot."
Years behind the specialists?
ZoneLabs is two or three years ahead of Microsoft in terms of firewall technology, according to Yecies, which is a statement not disputed by Hydrasight's Warrilow.
"A whole lot of the IT industries' business model is to stay one step ahead of Microsoft or they are out of the game. They need to keep ahead or people will go with Microsoft," said Warrilow.
Yecies said that when Vista is released, Microsoft will still be at least a couple of years behind: "It is impossible to predict with certainty but what we are seeing in the beta [of Vista] is the firewall is again better -- but [Microsoft] will be about where we were two, maybe three years ago".
SwathingScientist 
Linkedin 
RSS Feeds 
Newsletters 
Alerts
Horses for courses...
While I can understand the confusion and frustration of people who do not understand the action of a firewall, and therefore cannot predict or recognise the effect of their presence, they are there for a purpose.
Zone Alarm is a product that does what it is designed to do - block traffic that is not authorised - and it does it extremely well. The safest approach is always to block everything, unless it is explicitly permitted. ZoneAlarm does this by default (although this aggressive approach can be "turned down").
If you don't need a product that does this, or you are confused by the behaviour or effects of such a product, don't blame the product.
To state that ZA is worse than anything MS puts out smacks of ignorance or stupidity - or possibly, commercially oriented bias.
Microsoft's Windows XP SP2 has a very simple firewall product. It has no SPI, and doesn't provide any mechanism to control outgoing traffic. There have been suggestions that some "throttling" exists in SP2, in order to restrict the propagation rate of worms, but there is no configurable outgoing connection management.
And I do not work for Zone Labs, nor do I benefit (or suffer) in any way from changes in the number of sales of their products.
Windows Firewall/Internet Connection Firewall does have "SPI"
You simply do not know what you are talking about.
From Microsoft's own documentation:
http://msdn.microsoft.com/security/productinfo/xpsp2/networkprotection/firewall.aspx
"Windows Firewall is a stateful filtering firewall for Windows XP and Windows Server 2003."
http://support.microsoft.com/?scid=kb;EN-US;841249
"Windows Firewall is a host-based, stateful, filtering firewall that discards unsolicited incoming traffic through TCP/IP version 4 (IPv4) connections and through TCP/IP version 6 (IPv6) connections."
http://www.microsoft.com/technet/itsolutions/network/evaluate/technol/tcpipfund/tcpipfund_ch13.mspx#EINAC
"Windows Firewall is a stateful host firewall for IPv4 and IPv6 traffic in Windows XP with Service Pack 2 (SP2) and in Windows Server 2003 with Service Pack 1 (SP1)."
An external source:
http://www.answers.com/main/ntquery;jsessionid=16klpl7fid2tl?tname=windows-firewall&curtab=1512_1&hl=stateful&hl=firewall&sbid=lc05a
"It provides a stateful inspection of packets which accepts only responses to requests originated by the user."
Furthermore, there arent "suggestions" that there is "some throttling of outgoing connection", its a fact. The number of simultaneous imcomplete outbound TCP connections attempts has been limited in SP2. However, this has absolutely nothing to do with the Windows Firewall, but rather is a change to the TCP/IP stack:
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx#E5AAE
I suggest that in the future you (like the article author) inform yourself first, and express yourself last.