Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 85 posts

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#31

Post by Steve44 »

Carpetsmoker wrote: post #11
baroffoos wrote: post #7

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.

In the real world, there understaffed IT departments, insufficient budgets, time-consuming logistics, and complex systems which are not easily upgraded. Microsoft's options here are either "to hell with it, not my problem, just let the world burn" or taking responsibility and fixing problems which will affect people.

In addition to those reasons generally a computer system is a business tool. If a machine is doing what a company needs then why spend valuable time and money upgrading it to something else that will do exactly the same job.

I do appreciate the problem of security patches, but XP is pretty rock solid as a platform so for many businesses their tool does what they need.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#32

Post by andygates »

DKnoll wrote: post #16
kbumsik wrote: post #10

Earlier quoted context omitted.

Do they really still pay for XP? I thought it went completely EOL some years ago.

Yep, NHS for example.

We had extended support for a couple of years but now it's dead dead deadski.

Like any other large industrial org, there's some bits of million-pound kit with integrated, essential XP. Likewise old essential software where the support has literally retired, running on 2003. We've got roadmaps for replacing it, but they're not instant.

We manage it as best we can. But broadly we're just about to go to 10 on desktops, so we're not as bad as the police!

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#33

Post by chenzhekl »

rincebrain wrote: post #2

Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).

Maybe the market share of Vista is so small, that Microsoft doesn't bother releasing a patch for it. There's no patch for Windows 8, either.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#34

Post by DKnoll »

andygates wrote: post #32
DKnoll wrote: post #16

Earlier quoted context omitted.

Yep, NHS for example.

We had extended support for a couple of years but now it's dead dead deadski. Like any other large industrial org, there's some bits of million-pound kit with integrated, essential XP. Likewise old essential software where the support has literally retired, running on 2003. We've got roadmaps for replacing it, but they're not instant. We manage it as best we can. But broadly we're just about to go to 10 on desktops,…

Glad to hear it. When I worked for a NHS software vendor a couple years ago there were still XP workstations about. I guess it probably varies by the trust as well.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#35

Post by egorfine »

vkou wrote: post #17
baroffoos wrote: post #14

Earlier quoted context omitted.

Budgets will find room for an update when an out of date OS starts causing damage to the business. Patching an ancient OS is enabling the delay of updates with the excuse "Whats the point, it still works"

I've worked at a company where the build server was full of viruses, because devs kept spinning up unpatched XP VMs, who would inevitably get Conficker, and whatever other shit was hanging around on our intranet. Nobody gave a shit about it. And this wasn't some crazy seat-of-the pants startup. It was a mature software company, employing >40 engineers (in that division alone), that had been building, and selling soft…

I have had a VM server like that. About a dozen Windows images each launched from a known good snapshot for the test suite to run. Afterwards VM is killed and reverted back to the snapshot. Viruses? Couldn't care less. The whole lifecycle of the VM was like 40 minutes.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#36

Post by z3t4 »

Carpetsmoker wrote: post #27
baroffoos wrote: post #22

Earlier quoted context omitted.

Those areas are so important that it makes even more sense to get things upgraded. I don't want my health info running on a networked windows xp machine.

Just because a computer is involved in health care means it has access to your "health info". And look, of course it would be better if they upgraded. But "facts on the ground" can make it hard. It's easy to comment on HN, but not everyone involved is a complete idiot. I suspect that it's probably one of those 90/10% things: 90% has already been upgraded year ago, but getting the last 10% upgraded to something newer…

Programs mode for windows XP does not work on Windows 10, not even in compatibility mode, so that's probably one reason why many wont upgrade. They would have to replace all equipment, which probably cost millions, just because the software is old, (but still working).

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#38

Post by KillerDiller »

Carpetsmoker wrote: post #19
baroffoos wrote: post #14

Earlier quoted context omitted.

Budgets will find room for an update when an out of date OS starts causing damage to the business. Patching an ancient OS is enabling the delay of updates with the excuse "Whats the point, it still works"

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

The lack of budget is easily fixed when mature financial planning (which is completely normal for non-IT resources) and internalization of externalities is applied by requiring a working and budgeted lifecycle for every newly established IT system.

Forced internalization of externalities and transparency of risk (by vendors establishing both a firm lifecycle and a patching regime) provide the right incentives to make that happen.

In other words, the world of networked devices is a world of constant change. It must rid itself of those not fit for that change. People can run XP until the sun burns out, they just can't connect it to anything that's not theirs.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#39

Post by ollie87 »

DKnoll wrote: post #16
kbumsik wrote: post #10

Earlier quoted context omitted.

Do they really still pay for XP? I thought it went completely EOL some years ago.

Yep, NHS for example.

NHS Employee here, not seen XP on a NHS machine in a very long time - including in hospital environments.

It's Windows 7 now, I'm now seeing some staff get Windows 10 machines deployed to them.

Post reply on HN