Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#21

Post by selestify »

Carpetsmoker wrote: post #19
baroffoos wrote: post #14

Earlier quoted context omitted.

Budgets will find room for an update when an out of date OS starts causing damage to the business. Patching an ancient OS is enabling the delay of updates with the excuse "Whats the point, it still works"

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Is it really Microsoft's responsibility to keep patching XP forever?

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#22

Post by baroffoos »

Carpetsmoker wrote: post #19
baroffoos wrote: post #14

Earlier quoted context omitted.

Budgets will find room for an update when an out of date OS starts causing damage to the business. Patching an ancient OS is enabling the delay of updates with the excuse "Whats the point, it still works"

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Those areas are so important that it makes even more sense to get things upgraded. I don't want my health info running on a networked windows xp machine.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#23

Post by semi-extrinsic »

jlarocco wrote: post #8
saagarjha wrote: post #6

Earlier quoted context omitted.

Reader is a discontinued product that nobody can use. Patching it makes no sense.

That was a joke, but it's why the OP was so ironic. Google has absolutely terrible support. You can't even use their products when they discontinue them, and they discontinue them all the time. Maybe I should have used Nest for my example, which people actually paid for, put in their houses, and now can't use any more. Last release of XP was 11 years ago. Extended support ended 5 years ago. Yet people who want to use…

The difference is probably in part caused by the markets for Google vs. Microsoft products that we are discussing.

If Google shafts a private person they might get angry and buy Apple next time, and Google loses a few hundred bucks. But if Microsoft shafts the XP machine in a hospital that runs their old MRI machine or whatever, that's a potential PR crisis and possibly a million-dollar lawsuit.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#24

Post by dang »

jlarocco wrote: post #4
rincebrain wrote: post #2

Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).

That's an incredibly ironic complaint coming from a Google employee. Let me know next time you guys patch Google Reader.

That crosses into personal attack and you can't do that here, regardless of how strongly you feel about someone or their employer. Please don't do that here.

https://news.ycombinator.com/newsguidelines.html

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#25

Post by Carpetsmoker »

selestify wrote: post #21
Carpetsmoker wrote: post #19

Earlier quoted context omitted.

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Is it really Microsoft's responsibility to keep patching XP forever?

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP.

The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", but I do think people should have the freedom to fix software they bought ("right to repair").

I know how it works, I don't "buy" Windows, I buy a license to allow using it. I think is legal shenanigans and doesn't (or rather, shouldn't) really matter.

The entire thing is just a colossal waste of resources. Many organisations would be perfectly happy with XP, because a basic stable OS without too much fancy stuff is all they need, and XP offers that. It's not an "upgrade", it's just "replacing a working system with another working system".

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#26

Post by jakear »

selestify wrote: post #21
Carpetsmoker wrote: post #19

Earlier quoted context omitted.

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Is it really Microsoft's responsibility to keep patching XP forever?

It may not be their responsibility, so to speak, but if they choose to do it to help maintain their “we’re the best solution for enterprise customers, look we still release security patches years after EOL, that’s how much we care about reliability, blah blah blah” stance, who’s to say they shouldn’t do it?

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#27

Post by Carpetsmoker »

baroffoos wrote: post #22
Carpetsmoker wrote: post #19

Earlier quoted context omitted.

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Those areas are so important that it makes even more sense to get things upgraded. I don't want my health info running on a networked windows xp machine.

Just because a computer is involved in health care means it has access to your "health info".

And look, of course it would be better if they upgraded. But "facts on the ground" can make it hard. It's easy to comment on HN, but not everyone involved is a complete idiot. I suspect that it's probably one of those 90/10% things: 90% has already been upgraded year ago, but getting the last 10% upgraded to something newer is 90% of the effort.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#28

Post by sagebird »

baroffoos wrote: post #15
sagebird wrote: post #12

Earlier quoted context omitted.

I would not be shocked if Windows XP had less vulnerabilities than Windows 10. Also, who cares? How would your behavior change if you learned one was more or less vulnerable than the other?

If I was managing systems that were EOL many years ago and an active risk of being exploited my behavior change would be either to update them or disconnect them from the outside world.

What if you managed a non-EOL OS, like Windows 10, but you had inside information that there were multiple active ongoing exploits? You might say you would disconnect them from the internet. But I think it comes down to blame. No one would blame you if Win10 computers were connected to the internet and were exploited. But people _would_ blame you if they were XP. I think this pretty much explains how people think about these choices.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#29

Post by yzssi »

selestify wrote: post #21
Carpetsmoker wrote: post #19

Earlier quoted context omitted.

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Is it really Microsoft's responsibility to keep patching XP forever?

If they want to stop being responsible they can release the source code so others can write patches.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#30

Post by m_mueller »

baroffoos wrote: post #7

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.

Microsofts rather friendly attitude to downwards compatibility & longterm support, is IMO one of their strongest competitive advantages for Windows and Office. Not following this philosophy for their mobile platforms has also lead to their downfall there.
Post reply on HN