Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#51

Post by rincebrain »

chenzhekl wrote: post #33
rincebrain wrote: post #2

Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).

Maybe the market share of Vista is so small, that Microsoft doesn't bother releasing a patch for it. There's no patch for Windows 8, either.

8 and 10 aren't vulnerable, according to their writeup about it.

As someone commented above, there's a footnote about how Vista users can use the Server 2008 patch, I was more amused that in an apparently-complete enumeration of versions in a table, they just...left it off.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#52

Post by pjc50 »

baroffoos wrote: post #7

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.

At this stage, anyone still using XP is doing so because they have no other choice: either it's intrinsically tied to low-end hardware, or to some piece of critical software, and it's too expensive or time-consuming to replace. Often this includes "embedded" PCs in scientific equipment and the like.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#53

Post by kazkada »

baroffoos wrote: post #22
Carpetsmoker wrote: post #19

Earlier quoted context omitted.

There are reasons there is no budget. A budget doesn't magically appear. Take health care, education, or police services for example. Do you really want to take away resources from providing the stuff that's actually needed just for some artificial easily preventable crisis? The entire situation is ridiculous really. So what that XP is "ancient"? For many purposes it works just fine. The only reason this situation ex…

Those areas are so important that it makes even more sense to get things upgraded. I don't want my health info running on a networked windows xp machine.

It is possible to isolate those legacy systems with additional rules in network equipment. Then those systems can operate until they physically breaks down with no possibility of repair. In my opinion, getting rid of an MRI just because it happens to be running on Windows XP is inconceivable.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#54

Post by russfink »

z3t4 wrote: post #36
Carpetsmoker wrote: post #27

Earlier quoted context omitted.

Just because a computer is involved in health care means it has access to your "health info". And look, of course it would be better if they upgraded. But "facts on the ground" can make it hard. It's easy to comment on HN, but not everyone involved is a complete idiot. I suspect that it's probably one of those 90/10% things: 90% has already been upgraded year ago, but getting the last 10% upgraded to something newer…

Programs mode for windows XP does not work on Windows 10, not even in compatibility mode, so that's probably one reason why many wont upgrade. They would have to replace all equipment, which probably cost millions, just because the software is old, (but still working).

This. There are embedded systems running XP including sonograms, dental xray units, and the like. Not to mention dedicated patient scheduling systems. Many turn key systems that have no easy upgrade path.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#55

Post by zip1234 »

Carpetsmoker wrote: post #25
selestify wrote: post #21

Earlier quoted context omitted.

Is it really Microsoft's responsibility to keep patching XP forever?

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

Except part of an OS is security. Just like you wouldn't keep an old skeleton key on the front door of your business because of the risk of someone breaking in, you may feel it isn't worth the risk to use an old OS that has an obsolete security model.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#57

Post by gruez »

cf141q5325 wrote: post #42

Its especially unfortunate since KB4474419, the sha2 update for Windows Seven, defacto disabled updates for quite a few people with dualboot or encrypted system partitions in mid March.

>encrypted system partitions

Does this include bitlocker? Or is this an issue with third party boot loaders so bitlocker is fine but truecrypt is not?

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#60

Post by Wowfunhappy »

Carpetsmoker wrote: post #25
selestify wrote: post #21

Earlier quoted context omitted.

Is it really Microsoft's responsibility to keep patching XP forever?

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

> I'm not massively in to "Free Software" or the "four essential freedoms", but I do think people should have the freedom to fix software they bought ("right to repair").

Doesn't the first part of your sentence contradict the second? The only way it would be possible to patch software yourself is if you had the source code.

(I suppose you could reverse engineer the binary, but that's not practical, and besides, you could do that today if you wanted to.)

Post reply on HN