Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#71

Post by la_barba »

Carpetsmoker wrote: post #25
selestify wrote: post #21

Earlier quoted context omitted.

Is it really Microsoft's responsibility to keep patching XP forever?

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

Well, you almost had a point, but then you lost me. You are conflating two things, they sold you "a license" not "a license with free unlimited labour".

It sounds like what you're saying is that a company has no "right" to determine whether they wish to distribute a product of their labor using a copyright license of their choice. Under your system, they would be forced to give up this right and open source the product, or provide free unlimited updates. Sounds rather harsh on smaller software companies that don't make billions of dollars!

> but I do think people should have the freedom to fix software they bought ("right to repair").

People have been patching binaries themselves for the past several decades. AFAIK they haven't sued a user. But yes, it would be nice if this was codified in law that an end-user can patch a binary on their machine.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#72

Post by AdmiralAsshat »

bArray wrote: post #44
dmix wrote: post #5

Earlier quoted context omitted.

It makes sense not to mention Vista in a headline consider the very low usage rates. If anyone should not expect security update news via popular news outlets its Window's Vista users. There are plenty of niche channels for niche product releases.

On a side note, I think that Vista wasn't necessarily unpopular, it just had a good upgrade path/incentive for users (unlike XP to Vista).

No, it was quite unpopular, period. See: https://xkcd.com/528/

There was the popular perception at the time that every other version of Windows was good, while the in-betweens sucked. Vista followed that expectation perfectly, as did Windows 8.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#73

Post by auiya »

MagicPropmaker wrote: post #58

Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.

Apple makes all their OS releases free to their users, so there's much lower numbers of 15+ year old Apple OS's existing in the wild to begin with. If you'd said you don't see Apple releasing patches for 15+ year old computers, I'd be more inclined to agree.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#74

Post by walterbell »

Silhouette wrote: post #64
zip1234 wrote: post #55

Earlier quoted context omitted.

Except part of an OS is security. Just like you wouldn't keep an old skeleton key on the front door of your business because of the risk of someone breaking in, you may feel it isn't worth the risk to use an old OS that has an obsolete security model.

The flip side of this is that there has to be an acceptable newer replacement with a better security model. For a lot of Windows 7 users, Microsoft have yet to offer that. (I imagine this is going to cause quite a stir if Microsoft try to stick to their published EOL date for Windows 7 next year, given that still nearly half of Windows users are using it.)

They could create a premium, telemetry-free version of LTSB/LTSC for the several hundred million Windows 7 users who are waiting for the market to provide an upgrade path which supports modern hardware.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#75

Post by zeusk »

auiya wrote: post #73
MagicPropmaker wrote: post #58

Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.

Apple makes all their OS releases free to their users, so there's much lower numbers of 15+ year old Apple OS's existing in the wild to begin with. If you'd said you don't see Apple releasing patches for 15+ year old computers , I'd be more inclined to agree.

Heh, because Apple prefers to arbitrarily leave out support for their older systems on newer OS releases.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#76

Post by tunap »

rincebrain wrote: post #49
bArray wrote: post #44

Earlier quoted context omitted.

On a side note, I think that Vista wasn't necessarily unpopular, it just had a good upgrade path/incentive for users (unlike XP to Vista).

My perception for a long time has been that Vista, from a technical perspective, was leaps and bounds above XP, but the end user experience was sometimes lacking; 7 didn't provide drastic technical improvements so much as offering a much-polished Vista.

Windows 7 should have been called Vista SP7. That is what I called 7's hasty premier after Vista's lackluster debut.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#77

Post by Carpetsmoker »

la_barba wrote: post #71
Carpetsmoker wrote: post #25

Earlier quoted context omitted.

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

Well, you almost had a point, but then you lost me. You are conflating two things, they sold you "a license" not "a license with free unlimited labour". It sounds like what you're saying is that a company has no "right" to determine whether they wish to distribute a product of their labor using a copyright license of their choice. Under your system, they would be forced to give up this right and open source the produ…

There's another way of saying it: the software has a defect, and not only does the vendor refuse to fix the defect, it also prevents me from fixing it.

With physical hardware people would be up in arms about it, but for software it's considered "normal". I don't think it should.

I'm not asking for "free unlimited labour", I just want software that 1) works and 2) doesn't need replacing at the cost of millions of dollars every few years. I don't think that's an especially ridiculous thing to ask for.

You don't need to "open source" the code in the sense of "put it on GitHub"; you can give people more limited access to the code (or just parts of the code).

Microsoft also sells maintenance contracts for Windows XP, but also to large bulk customers to the tune of millions of dollars. It could choose to sell it to anyone for $2/month or whatever price is realistic.

Either way, there are more options than "free unlimited labour" and "open source it".

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#78

Post by Carpetsmoker »

Wowfunhappy wrote: post #60
Carpetsmoker wrote: post #25

Earlier quoted context omitted.

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

> I'm not massively in to "Free Software" or the "four essential freedoms", but I do think people should have the freedom to fix software they bought ("right to repair"). Doesn't the first part of your sentence contradict the second? The only way it would be possible to patch software yourself is if you had the source code. (I suppose you could reverse engineer the binary, but that's not practical, and besides, you c…

The four freedoms go far beyond just the ability to fix stuff. It also includes the ability to redistribute copies and modified versions.

I think there are more options than just "open source it all" and "keep it all proprietary". You could, for example, only provide the source code (or parts of the source) under a NDA contract when requested and merge "community fixes" upstream, or something. I don't know what would work well in practice (not many businesses have experimented with it) but I'm fairly confident a model can be though of that works well yet isn't "open source" in the sense that we understand it today.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#79

Post by Carpetsmoker »

VBprogrammer wrote: post #70
yzssi wrote: post #29

Earlier quoted context omitted.

If they want to stop being responsible they can release the source code so others can write patches.

If they did this how long before Windows XP Mint was released? More seriously, how much of their code could they release without giving away much of their next operating system. Certainly by the fact that this bug effects versions of the OS going back 15 years we can be relatively certain that the code contained between them has a lot of identical parts.

"Release the source code" does not necessarily equal "allowing people to make derivative products from it". You could release it under a strict "only to be used to fix defects"-license.

It wouldn't be "open source" or "free software" as we understand it today, but I don't mind, and it's a lot better than what we have now.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#80

Post by la_barba »

Carpetsmoker wrote: post #77
la_barba wrote: post #71

Earlier quoted context omitted.

Well, you almost had a point, but then you lost me. You are conflating two things, they sold you "a license" not "a license with free unlimited labour". It sounds like what you're saying is that a company has no "right" to determine whether they wish to distribute a product of their labor using a copyright license of their choice. Under your system, they would be forced to give up this right and open source the produ…

There's another way of saying it: the software has a defect, and not only does the vendor refuse to fix the defect, it also prevents me from fixing it. With physical hardware people would be up in arms about it, but for software it's considered "normal". I don't think it should. I'm not asking for "free unlimited labour", I just want software that 1) works and 2) doesn't need replacing at the cost of millions of doll…

>I'm not asking for "free unlimited labour", I just want software that 1) works and 2) doesn't need replacing at the cost of millions of dollars every few years. I don't think that's an especially ridiculous thing to ask for. You don't need to "open source" the code in the sense of "put it on GitHub"; you can give people more limited access to the code (or just parts of the code).

The problem is equating "you can" with "must be forced to".

>There's another way of saying it: the software has a defect, and not only does the vendor refuse to fix the defect, it also prevents me from fixing it.

>With physical hardware people would be up in arms about it, but for software it's considered "normal". I don't think it should.

That's quite an exaggeration. You can't realistically fix bugs in CPU chips, or USB micro-controllers or bluetooth radios or cellphone antenna radio chips. "So then Intel should open up their CPU design" and/or "But I should be able to" is not really an argument, because anyone could say the opposite and be on equal grounds.

So now, the only principal argument that I can see us having is "should freedoms have limits" or "what freedoms are essential", and we would probably agree on most things, but it seems to me that we just come out at different positions on a spectrum.

>Microsoft also sells maintenance contracts for Windows XP, but also to large bulk customers to the tune of millions of dollars. It could choose to sell it to anyone for $2/month or whatever price is realistic.

Okay, but that is a business decision that was made because a lucrative customer demanded it as a requirement before purchase. I don't see the connection. Both parties entered into a voluntary contract... well for the most part.

On the other extreme, you are free to hire a software developer, and get software made which you can choose to release under an open source license.

Personally I happen to think that data interoperability is more crucial than the software itself. All software does in the end is just manipulate data. Its possible to have a rich variety of software when the data interchange format is standardized and protected from monopolistic abuse. The foremost example being the internet packet protocols.

Post reply on HN