Reading a couple of posts on The Old New Thing (Raymond Chen's blog) made me realize that compatibility issues, except for being a general headache, have a lot of nontrivial repercussions. Take this example of a network interoperability issue: Samba, the standard Linux implementation of an SMB server, supports a feature called fast directory queries. Apparently the feature had been (until recently) broken, and because Windows XP never made use of the feature this was a non-issue until internal tests with Vista brought it to light.

A naïve developer would, at this point, assume that Microsoft would let the responsible party know that they have a bug and move on. Things are obviously not that simple, but for reasons you wouldn't expect: exactly because Samba is such a widespread product, any user encountering the bug (assuming he/she'd even notice something was wrong - the bug in question is not easy to spot) for the first time would automatically assume a bug in Windows Vista (a fairly reasonable assumption considering you could never hit that bug with older versions of Windows). Worse still, although the bug was fixed quickly there is no guarantee that the fix will actually be installed on the problematic devices. For starters, there is a chain of responsibility which starts with the administrator of the offensive device and ends in the product vendor; this means that in some cases the vendor will not install the bugfix by default and will void the support contract if a "vigilante" administrator installs it locally. Second, Samba is often used in embedded devices (such as network attached storage [NAS] devices) which may or may not be firmware-upgradable by the user.

Regardless of the solution Microsoft decides on (Raymond is actively seeking ideas - if you have any, make sure to drop a comment), some of the proposed solutions have even subtler repercussions that need to be considered. For example, one of the proposed solutions is to detect and maintain a list of "bad" servers for which fast queries will be disabled. Apparently this is a potential security hazard, because a malicious user can make use of this feature to launch denial of service-like attacks on the client (it's not obvious how this can be done, so Raymond elaborates on this point in a follow-up).

One of the disadvantages of working on relatively low-profile software is that you hardly ever get to tackle security issues such as these, so you only get food-for-thought by reading articles and blogs. But I guess that's what the blogosphere is for in the first place, no?