PalmTree, on Jul 31 2004, 12:28 AM, said:
I know it is not updated, nor will it be updated in the final version of sp2, but shouldn't IIS 5.1 have been upgraded to IIS 6, which is available for Windows Server 2003?
I know Windows XP is not a server OS, but if they are looking to make a more secure product, it makes sense to upgrade IIS.
No. That's why they make you buy windows 2003, webserver edition. The IIS in XP isn't meant as a "full featured" webserver, XP not being a server OS. IIS 5.1 has lots of limitations, some of which can be removed by tweaking around a bit. Also, lots of people think you could just upgrade it to IIS 6, but it's anything but that. They had to change things deep inside the OS to make IIS 6 happen, so you'd have to replace a major part of the system architechture (and all of it's various dependancies, so change most of XP's code to 2003's), which is not really feasible (and they still want more $$$ from you buying 2003).
So again, XP is more intended as a home/workstation setup and not as a server (which is also why only MSSQL *developper ed* installs on XP) , so they don't see a need to upgrade IIS... Anyways. I'm sure you get the point. It doesn't actually make much sense after all. The major security concern (by FAR) for the average end user/home user is having them use a firewall, a decent and updated antivirus, and stop them from being fooled so easily into opening nasty email attachments (and we wonder why 80% of spam comes from "zombie" PCs?). IIS security would hardly change anything to that big picture, especially since a very small portion of home users use IIS, also because a big portion of people with webservers run apache instead, and finally because most people that are more seriously into web stuff end up using a dedicated (or semi-dedicated) box with IIS (which could be IIS 6, locked down), for security, new features, testing and all...