Microsoft cosies up to security developers

Microsoft is readying updates to its programming tools that will be released in tandem with Windows XP Service Pack 2, a security-oriented release of Windows due later this year.

The company is building service packs for its Visual Studio.Net 2003 development tool and the .Net Framework - the software plumbing, or "runtime," needed to run web services applications on Windows, a Microsoft executive said. The changes, which are designed to guide developers on how to use the latest security features, are slated for release around the middle of the year, which is when Microsoft plans to ship Windows XP Service Pack 2.

We're going to aim to have the release of [Windows XP Service Pack 2 and the tools service packs] as close as possible. Ideally, they'll come out together," said Tony Goodhew, product manager in Microsoft's developer edition.

The tools service packs will help developers determine whether existing applications need changes to run on the upcoming update to Windows XP. It is also meant to encourage developers to exploit the planned security features, Goodhew said.

In conjunction with the updated tools, Microsoft is offering free web-based training and documentation on its developer website, which describes the implications for developers of the security changes due in Windows XP Service Pack 2. This is the first time the company has offered free training around a service pack, the company said.

Microsoft Chairman Bill Gates last week detailed a number of changes due in Windows XP Service Pack 2 to make desktop PCs applications, such as the Internet Explorer web browser and Outlook email program, more secure. The company has enhanced its firewall and made changes in how Windows interacts with a computer's memory to prevent "buffer overruns," a commonly used technique by malicious code.

Goodhew said that providing service packs for Visual Studio.Net and the .Net Framework is important to adding security to Windows desktop applications across the board, not only those written by Microsoft.

"We realise that security is a developer issue. It's not just us - it's an industry-wide thing. We want to be good citizens in making our own software more secure and [also] assist our customers –developers - to write more secure applications," he said.

As the operating system, browser and email get more secure, hackers will turn their attention to other applications, Goodhew said. For example, the Slammer worm, which caused widespread disruption last year, exploited a vulnerability in Microsoft's SQL Server database, which runs on server computers, he said.

Martin LaMonica writes for CNET News.com