I wouldn't be surprised if this was a "oh we found a bug, lets leave it" backdoor.
Microsoft fixes '19-year-old' bug with emergency patch
31–40 of 47 posts
Re: Microsoft fixes '19-year-old' bug with emergency patch
#32Earlier quoted context omitted.
You shouldn't be running it but a hell of a lot of people and businesses still are. And MS is to blame IMO. The continued extending support, they screwed up with Vista and after making things right with Windows 7 screwed up again (although no where nearly as badly as with Vista) with Windows 8. I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows…
> I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows they really want or need. They don't need security updates? Aren't they connected to the internet?
I've made that point to this person many times but they're pretty specific about the sites they browse to and regularly run anti-virus scans. Not ideal but they seem fine with it and their system runs pretty nice.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#33So if this really goes back that far, I would hate to be anyone using Windows XP.
XP came out before Debian 3.0. At that point, Google hardly existed, iTunes hadn't been released, and the Nokia 3310 was less than a year old - http://en.wikipedia.org/wiki/Nokia_3310 Anyone who is still running Windows XP has this coming.
On the other hand, you could buy a brand new PC with XP on it 2 years ago. PC which could be still working perfectly fine for its intended purpose - so many people don't understand why would they want to spend money on something that works without any problems.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#34Earlier quoted context omitted.
You shouldn't be running it but a hell of a lot of people and businesses still are. And MS is to blame IMO. The continued extending support, they screwed up with Vista and after making things right with Windows 7 screwed up again (although no where nearly as badly as with Vista) with Windows 8. I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows…
> You shouldn't be running it but a hell of a lot of people and businesses still are. I am currently creating an application that has "runs on Windows XP" as part of the requirements list.
I hope they're compensating you some way or other. One of the last things I did at my previous job involved spelunking around some awful ancient VBScript code, boy am I glad I left that place.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#35Earlier quoted context omitted.
You shouldn't be running it but a hell of a lot of people and businesses still are. And MS is to blame IMO. The continued extending support, they screwed up with Vista and after making things right with Windows 7 screwed up again (although no where nearly as badly as with Vista) with Windows 8. I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows…
The pace of change in big orgs mean it takes 2-3 years to implement a change like xp->win 7. When you have 100k employees and regulatory hell and have outsourced every last bit of everything you are pretty fucked.
If you think that's bad, try the NHS in the UK. Its the largest organisation in the world with 1.4M employees (!). They've been rolling windows 7 out for 4 years. It'll be obsolete when they've finished.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#36> Specifically, it related to Microsoft Secure Channel, known as Schannel, Microsoft's software for implementing secure transfer of data. I'm confused... The article says this research relates to the SChannel vulnerability being patched this month and cites IBM Researchers[1] finding it, but the link to the blog post showing the work is towards OLE and not SChannel. Also, Microsoft has mentioned that they found[2] th…
Does IE allow VBscript execution in any html page? Does it happen only when activeX is enable?
Depends on the IE Zone settings. I believe that if you set the a zone to 'Low', a web page can execute a VBSCript code, with or without ActiveX being enabled.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#37Earlier quoted context omitted.
> You shouldn't be running it but a hell of a lot of people and businesses still are. I am currently creating an application that has "runs on Windows XP" as part of the requirements list.
I hope they're compensating you some way or other. One of the last things I did at my previous job involved spelunking around some awful ancient VBScript code, boy am I glad I left that place.
It is not that bad, just that I am constrained to .NET 4.0.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#38Earlier quoted context omitted.
The pace of change in big orgs mean it takes 2-3 years to implement a change like xp->win 7. When you have 100k employees and regulatory hell and have outsourced every last bit of everything you are pretty fucked.
If you think that's bad, try the NHS in the UK. Its the largest organisation in the world with 1.4M employees (!). They've been rolling windows 7 out for 4 years. It'll be obsolete when they've finished.
..."the NHS in the UK. Its the largest organisation in the world with 1.4M employees..."
It's big, but it's not that big, fifth or sixth largest employer in the world according to Wikipedia:
http://en.wikipedia.org/wiki/List_of_largest_employers#Large...
Re: Microsoft fixes '19-year-old' bug with emergency patch
#39Earlier quoted context omitted.
If you think that's bad, try the NHS in the UK. Its the largest organisation in the world with 1.4M employees (!). They've been rolling windows 7 out for 4 years. It'll be obsolete when they've finished.
..."the NHS in the UK. Its the largest organisation in the world with 1.4M employees..." It's big, but it's not that big, fifth or sixth largest employer in the world according to Wikipedia: http://en.wikipedia.org/wiki/List_of_largest_employers#Large...
Ok I'm a bit off there. My data was from 2009 :)
Plus DoD is several branches so that's a bit of a push.
Re: Microsoft fixes '19-year-old' bug with emergency patch
#40So if this really goes back that far, I would hate to be anyone using Windows XP.
MS is still pushing monthly updates to XP users, purportedly to scan for malware. How hard would it be for them to push a patch with a fix for this?
As far as I know they haven't explicitly said they won't. The "affected systems" lists on the recent advisories currently only go back as far as 2003/Vista, but IE6 is listed in some of them so if they are going that far back with IE (6 dropped out of extended support at the same time as XPsp3) there is a chance there is a patch coming for XP too.
Of course they are under no obligation to.
And some might argue that giving people updates so they can continue to use IE6 is as bad as giving an alcoholic a double G&T to help keep withdrawal symptoms at bay...