Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 85 posts

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#61

Post by bArray »

n4r9 wrote: post #48
bArray wrote: post #44

Earlier quoted context omitted.

On a side note, I think that Vista wasn't necessarily unpopular, it just had a good upgrade path/incentive for users (unlike XP to Vista).

It was one of the least popular versions of Windows, no? Certainly its market share never exceeded XP's.

I think Vista was the least popular as you say, but I think that was because the upgrade path/incentive wasn't there.

The upgrade from XP to Vista meant a lot of software stopped working, especially from a driver perspective. If you're using some niche software that "just works (tm)", why change? Especially if it costs a lot of money to upgrade or your system isn't networked. The UK tried to upgrade its XP running backbone years ago, failed - and still got billet £10+ billion.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#62

Post by basch »

pjc50 wrote: post #52
baroffoos wrote: post #7

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.

At this stage, anyone still using XP is doing so because they have no other choice: either it's intrinsically tied to low-end hardware, or to some piece of critical software, and it's too expensive or time-consuming to replace. Often this includes "embedded" PCs in scientific equipment and the like.

or they dont know or care. "it runs my spreadsheet fine"

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#63

Post by Notre1 »

justin66 wrote: post #59
MagicPropmaker wrote: post #58

Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.

Neither did Microsoft, as far as I can tell: https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

There are XP patches. I wonder if that CVE page is autogenerated and doesn't include out-of-support operating systems.

https://support.microsoft.com/en-us/help/4500705/customer-gu...

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#64

Post by Silhouette »

zip1234 wrote: post #55
Carpetsmoker wrote: post #25

Earlier quoted context omitted.

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

Except part of an OS is security. Just like you wouldn't keep an old skeleton key on the front door of your business because of the risk of someone breaking in, you may feel it isn't worth the risk to use an old OS that has an obsolete security model.

The flip side of this is that there has to be an acceptable newer replacement with a better security model. For a lot of Windows 7 users, Microsoft have yet to offer that. (I imagine this is going to cause quite a stir if Microsoft try to stick to their published EOL date for Windows 7 next year, given that still nearly half of Windows users are using it.)

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#65

Post by vkou »

egorfine wrote: post #35
vkou wrote: post #17

Earlier quoted context omitted.

I've worked at a company where the build server was full of viruses, because devs kept spinning up unpatched XP VMs, who would inevitably get Conficker, and whatever other shit was hanging around on our intranet. Nobody gave a shit about it. And this wasn't some crazy seat-of-the pants startup. It was a mature software company, employing >40 engineers (in that division alone), that had been building, and selling soft…

I have had a VM server like that. About a dozen Windows images each launched from a known good snapshot for the test suite to run. Afterwards VM is killed and reverted back to the snapshot. Viruses? Couldn't care less. The whole lifecycle of the VM was like 40 minutes.

40 minutes of an unpatched computer on that network was 35 minutes too long.

We'd also develop inside VMs. That is, we'd install Visual Studio, our product, Seapine source control...

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#66

Post by [deleted] »

basch wrote: post #62
pjc50 wrote: post #52

Earlier quoted context omitted.

At this stage, anyone still using XP is doing so because they have no other choice: either it's intrinsically tied to low-end hardware, or to some piece of critical software, and it's too expensive or time-consuming to replace. Often this includes "embedded" PCs in scientific equipment and the like.

or they dont know or care. "it runs my spreadsheet fine"

[deleted]

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#67

Post by cf141q5325 »

zip1234 wrote: post #55
Carpetsmoker wrote: post #25

Earlier quoted context omitted.

Hot take: but yes, it is. They sold the software and they are preventing anyone else from patching XP. I think that by doing so they have responsibility. If they don't want it then that's okay: just allow other people to patch XP. The situation where I'm not able (or even legally allowed!) to patch my own computer system is pretty ridiculous. I'm not massively in to "Free Software" or the "four essential freedoms", b…

Except part of an OS is security. Just like you wouldn't keep an old skeleton key on the front door of your business because of the risk of someone breaking in, you may feel it isn't worth the risk to use an old OS that has an obsolete security model.

The security as new functionality is not really an issue to keep PCs running relatively safe. The argument that ECC is a new functionality and not a security patch comes to mind. That was a fair argument and people still had RSA. The underlying security breaking is not really an issue today as far as I see it.

The actual deal breaker are bugs who can be exploited and need to be fixed. And while its unfair to expect bug free software, fixing them is not new functionality.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#68

Post by walls »

pjc50 wrote: post #52
baroffoos wrote: post #7

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.

At this stage, anyone still using XP is doing so because they have no other choice: either it's intrinsically tied to low-end hardware, or to some piece of critical software, and it's too expensive or time-consuming to replace. Often this includes "embedded" PCs in scientific equipment and the like.

We said this about IE6, but once major sites started dropping support, usage dropped to almost nothing fairly quickly.

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#69

Post by la_barba »

baroffoos wrote: post #14
Carpetsmoker wrote: post #11

Earlier quoted context omitted.

In the real world, there understaffed IT departments, insufficient budgets, time-consuming logistics, and complex systems which are not easily upgraded. Microsoft's options here are either "to hell with it, not my problem, just let the world burn" or taking responsibility and fixing problems which will affect people.

Budgets will find room for an update when an out of date OS starts causing damage to the business. Patching an ancient OS is enabling the delay of updates with the excuse "Whats the point, it still works"

> "Whats the point, it still works"

And you're claiming that, it working, is not a legitimate reason to keep using it?

Re: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

#70

Post by VBprogrammer »

yzssi wrote: post #29
selestify wrote: post #21

Earlier quoted context omitted.

Is it really Microsoft's responsibility to keep patching XP forever?

If they want to stop being responsible they can release the source code so others can write patches.

If they did this how long before Windows XP Mint was released?

More seriously, how much of their code could they release without giving away much of their next operating system. Certainly by the fact that this bug effects versions of the OS going back 15 years we can be relatively certain that the code contained between them has a lot of identical parts.

Post reply on HN