Windows XP patched to avert new outbreaks from three more NSA exploits

[wrath]

I agree they shouldn't have patched since now people won't learn and the story continues...

[LAwLz]

1 hour ago, sof006 said:

Okay so they change the hardware, no good clinging onto the past.

It's not that simple in a lot of scenarios.

 

 

1 hour ago, mynameisjuan said:

It is never impossible, too time consuming means they are just lazy and cost will always be a thing in IT. There is no excuse not to upgrade these machines. 

No, "too time consuming" does not mean lazy. Are you going to say scientists are just "too lazy" to have found a cure for cancer yet?

The legalistic of replacing some medical equipment is a massive undertaking which costs a small fortune and takes a long time. What you have to remember is that for every dollar you spend on something, you are not spending a dollar on something else.

 

 

1 hour ago, hey_yo_ said:

That's like saying the Google Nexus One is a great phone (which it was a great phone during its time), therefore Google should keep it officially updated until now. 

If Google had already developed and tested the patches for the Nexus One then sure, why keep them to themselves?

Microsoft does not win anything from keeping these patches to themselves. If they release the patches then they might avoid another disaster like WannaCry, and they are seen as a good company for releasing some patches even after support has ended.

 

 

1 hour ago, mynameisjuan said:

Businesses should be the priority to get off XP as they tend to hold on to sensitive data.

That's a generalization. A lot of XP machines do not hold sensitive data.

[waterjug]

i mean windows xp still runs on over 7% of all computers... just throwing that out there...

[captain_to_fire]

Just now, wii8cookies said:

i mean windows xp still runs on over 7% of all computers... just throwing that out there...

Actually it's less than 6% at the moment. I'd be happy if Microsoft just let XP die because it's not even the world's most used desktop OS at the moment. 

https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0 

 

5 minutes ago, LAwLz said:

Microsoft does not win anything from keeping these patches to themselves. If they release the patches then they might avoid another disaster like WannaCry, and they are seen as a good company for releasing some patches even after support has ended.

Microsoft doesn't have to because XP is less than 6% of desktop OS worldwide. Just because you see a lot doesn't mean it applies to everyone. If PCs all over the world gets infected by a stronger ransomware variant, XP is just a small dent. 

[LAwLz]

10 minutes ago, wrath said:

I agree they shouldn't have patched since now people won't learn and the story continues...

OK let's stop and think logical for one minute here.

 

Why do you think that people "won't learn" now that Microsoft has released a patch? Do you honestly believe that there are people out there who has been completely without patches for around 3 years now, who were on the edge of switching, but now because two exploits (out of many many more) has been patched they will just do a 180 and keep using XP?

 

Remember, this is not Microsoft backing down and releasing patches for Windows XP again.

This is Microsoft, 3 years after they stopped releasing updates, patching two extremely large issues which could spread to people using OSes which are still supported.

The more people that are patched, the fewer computers can spread malware. It's like with vaccination. The malware needs vulnerable computers to survive, so the more that are immune the harder it will be for it to spread.

 

Besides, what do you think people "need to learn"? That running an outdated OS is a bad idea? No shit. They already know that, just like I know drinking soda is not good for me. Do I still do it? Yes. Would I think it was good news that Coca Cola changed their recipe to be less harmful to me? Absolute! But not you. You would say "what? Coca Cola is making cola which is less detrimental to peoples' health? Boo! I want people to be unhealthy! I want them to suffer so that they 'learn their lesson'!"

 

Sorry, but I want computers to be secure. Right now you are championing against security, but through some amazing mental gymnastics you somehow think that more vulnerable computers = good.

[LAwLz]

Just now, hey_yo_ said:

Microsoft doesn't have to because XP is less than 6% of desktop OS worldwide. Just because you see a lot doesn't mean it applies to everyone. If PCs all over the world gets infected by a stronger ransomware variant, XP is just a small dent. 

I don't think you understand how malware spreads (or disease for that matter).

More vulnerable computers = easier to spread.

 

Not sure how much you understand about vaccination, but this is very similar to that. People who are allergic or for other reasons can not get vaccination shots greatly benefit from everyone else getting vaccinated. That's because the illness needs to spread in order to infect the allergic person. The more people who are vaccinated, the less at risk the allergic person is because fewer people carry the disease.

Do you see the parallels here?

 

The more vulnerable computers are out in the wild (regardless of OS), the more likely the malware is to spread.

By releasing this patch, Microsoft is trying to prevent another outbreak.

 

Like I said to that other person. You think that you are championing security, but in reality you are talking about wanting as many people to get infected by this malware as possible. That's bad. If you care about security then you should want as many computers to get patched as possible. Not just because the patch directly protects people, but also because every computer that gets patched lowers the risk of other computers getting infected.

 

Remember, it's been 3 years since XP stopped getting patches, and people still run it. These people were not on the edge of switching to 7, 8.1 or 10 and now that two security issues (out of what, like 100?) has been patched they will just scratch all their migration plans.

[Sauron]

Despite the obvious problems with issuing a one-off update to xp, there are hospitals with medical equipment that only works with windows xp. That equipment may have cost hundreds of thousands if not millions of $ and governments are not always as keen on spending money on health as they are on military and other garbage. Preventing stuff like WCry from infecting hospital machines could potentially save lives, and since these exploits are now public knowledge ignoring xp might be considered criminal negligence. It's easy to point at Apple and say "see, they don't support 16 year old discontinued products anymore" when apple has never had a presence in the mission critical life saving apparatus market.

[NvidiaIntelAMDLoveTriangle]

2 hours ago, hey_yo_ said:

That's like saying the Google Nexus One is a great phone (which it was a great phone during its time), therefore Google should keep it officially updated until now. 

2 hours ago, mynameisjuan said:

Poor way of seeing security flaws? Businesses should be the priority to get off XP as they tend to hold on to sensitive data.

 

This is not an argument of if XP is a good OS or not, its about security. 

You see this is the problem with the mentality of some people that corporations have embedded in consumers brains.

That in order use the latest feature, you have to buy the latest and greatest thing. It's just buy the new one, buy the new one, buy the new one.

When in reality the latest feature can be easily implemented in the old thing. It's just that they don't want to do that, because they want you to buy the new one.

In this we're talking about software. Which they purposely implemented artificial locks in order to justify the new thing.

There's no reason why Google shouldn't still support the Nexus One, software wise. It's not ancient technology.

The same with Microsoft, there's no reason for them not to continue to support XP. Is it old? Yes. Is it really ancient? No.

But they dropped it because they want to sell their Vista OS.

Not because XP couldn't actually support the newer hardware.

I guarantee you if the 64bit version of XP would've had support for DirectX10 and newer, then XP would still be used today the popular OS.

But Microsoft didn't want to spend the money and man hours to implement support for it. Because they just want everyone to buy the newest and greatest.

 

I'm not saying that technology should stagnate, but when it comes to software sometimes there's no need to advance. Especially if the newer piece of software was just made to sell the next product. Often the newer software is not better. And sometimes even less secure then the old one.

 

 

 

 

[mynameisjuan]

1 hour ago, LAwLz said:

No, "too time consuming" does not mean lazy. Are you going to say scientists are just "too lazy" to have found a cure for cancer yet?

The legalistic of replacing some medical equipment is a massive undertaking which costs a small fortune and takes a long time. What you have to remember is that for every dollar you spend on something, you are not spending a dollar on something else.

Thats not what I am talking about or even remotely close. The analogy about the cure for cancer makes no sense what so ever, I am talking about IT departments refusing to upgrade due to time, not ones that are actively upgrading or in the process of. You will be surprised at the amount of companies that just dont want to upgrade because they are just lazy, "its too much hardware to move, I tried getting the software to work on 7 this one time for 10 mins and failed it will never work, we have to re-inventory and manage more licenses and make new images"...That is the shit I am talking about which is very common in businesses. I understand how money for businesses work, but when you live in the world today, tech is priority for the most part. Spending money now to avoid 10 fold the amount after a fine for a breach or breach of PCI compliance is most the time more important.

[mynameisjuan]

20 minutes ago, NvidiaIntelAMDLoveTriangle said:

You see this is the problem with the mentality of some people that corporations have embedded in consumers brains.

That in order use the latest feature, you have to buy the latest and greatest thing. It's just buy the new one, buy the new one, buy the new one.

When in reality the latest feature can be easily implemented in the old thing. It's just that they don't want to do that, because they want you to buy the new one.

In this we're talking about software. Which they purposely implemented artificial locks in order to justify the new thing.

There's no reason why Google shouldn't still support the Nexus One, software wise. It's not ancient technology.

The same with Microsoft, there's no reason for them not to continue to support XP. Is it old? Yes. Is it really ancient? No.

But they dropped it because they want to sell their Vista OS.

Not because XP couldn't actually support the newer hardware.

I guarantee you if the 64bit version of XP would've had support for DirectX10 and newer, then XP would still be used today the popular OS.

But Microsoft didn't want to spend the money and man hours to implement support for it. Because they just want everyone to buy the newest and greatest.

 

I'm not saying that technology should stagnate, but when it comes to software sometimes there's no need to advance. Especially if the newer piece of software was just made to sell the next product. Often the newer software is not better. And sometimes even less secure then the old one.

 

 

 

 

 

You obviously do not understand the reason microsoft ended support for XP. Its not a marketing thing, all OSes do the samething with a period of time for support. As windows 7,8,8.1 and 10 were released they got better code, more efficiency..etc..and to continue to focus on those platforms they ended support with XP as supporting an OS is costly especially when better OSes that handle security better are available. This wasnt to force people to buy a new version, this was so they didnt have to worry about a OS that was dying and had actual limitations based on the code, its the reason they had to develop the others from scratch. 

 

And I cant believe you think there is no need to advance software. Where do you think we would be today if back in 3.1 people were like "this is all I need. It gets everything done, why would I need anything new" 

[LAwLz]

3 minutes ago, mynameisjuan said:

Thats not what I am talking about or even remotely close. The analogy about the cure for cancer makes no sense what so ever, I am talking about IT departments refusing to upgrade due to time, not ones that are actively upgrading or in the process of. You will be surprised at the amount of companies that just dont want to upgrade because they are just lazy, "its too much hardware to move, I tried getting the software to work on 7 this one time for 10 mins and failed it will never work, we have to re-inventory and manage more licenses and make new images"...That is the shit I am talking about which is very common in businesses. I understand how money for businesses work, but when you live in the world today, tech is priority for the most part. Spending money now to avoid 10 fold the amount after a fine for a breach or breach of PCI compliance is most the time more important.

Well like I said, you're generalizing.

Just because that might happen on some companies does not mean it happens on all of them that silly rely on Windows XP for some things. So saying that we should deny everyone support just because you have encountered some which you don't think deserve it is a really bad idea.

But I still don't think you're making much sense.

 

"It's too much hardware to move" - This might be a legitimate issue. If you got 10,000 employees and all needs upgrading you can't just order 10,000 laptops. It will be a long process. And believe me, there is no company today which aren't migrating to some degree. It's not like companies are ordering computers running XP. Windows XP's marketshare is going down, not up, so people are moving away from it.

 

"I tried getting the software to work on 7 this one time for 10 mins and failed it will never work" - I am pretty sure that's just hyperbole, but maybe that person has more important things to do? Not sure what company you worked at but where I work we don't exactly have people twiddling with their thumbs all day. There is a backlog of things that needs to be done, so things has to be prioritized. Replacing a potentially unimportant machine just because there might be a minor security issue with it in the future won't get a high priority.

It entirely depends on what machine it is.

[NvidiaIntelAMDLoveTriangle]

3 minutes ago, mynameisjuan said:

 

You obviously do not understand the reason microsoft ended support for XP. Its not a marketing thing, all OSes do the samething with a period of time for support. As windows 7,8,8.1 and 10 were released they got better code, more efficiency..etc..and to continue to focus on those platforms they ended support with XP as supporting an OS is costly especially when better OSes that handle security better are available. This wasnt to force people to buy a new version, this was so they didnt have to worry about a OS that was dying and had actual limitations based on the code, its the reason they had to develop the others from scratch. 

 

And I cant believe you think there is no need to advance software. Where do you think we would be today if back in 3.1 people were like "this is all I need. It gets everything done, why would I need anything new" 

Wrong, Microsoft's move was done to sell their new stuff. It's a cycle that corporations want people to believe. That in order to use whatever piece of hardware came out, you must also have the latest software to go along with it. Which sometimes it's true. But sometimes it isn't. And for the most part, it isn't.

 

As for the last part, let me rephrase that a bit since I forgot. I'm not saying that software shouldn't advance as well. Of course it should.

Thing is sometimes there's no need to create a new piece of software, when the old is capable of accomplishing the task just as well. It just requires a bit of work in order for it to work.

But they don't do it because there isn't as much money from it, as there is from selling a new piece of software.

 

[Fetzie]

1 hour ago, hey_yo_ said:

Actually it's less than 6% at the moment. I'd be happy if Microsoft just let XP die because it's not even the world's most used desktop OS at the moment. 

https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0 

 

Microsoft doesn't have to because XP is less than 6% of desktop OS worldwide. Just because you see a lot doesn't mean it applies to everyone. If PCs all over the world gets infected by a stronger ransomware variant, XP is just a small dent. 

By that logic, Apple and the gnu/Linux distributions should stop issuing updates too, because their total market share is even lower.

[mynameisjuan]

4 minutes ago, LAwLz said:

Well like I said, you're generalizing.

Just because that might happen on some companies does not mean it happens on all of them that silly rely on Windows XP for some things. So saying that we should deny everyone support just because you have encountered some which you don't think deserve it is a really bad idea.

But I still don't think you're making much sense.

 

"It's too much hardware to move" - This might be a legitimate issue. If you got 10,000 employees and all needs upgrading you can't just order 10,000 laptops. It will be a long process. And believe me, there is no company today which aren't migrating to some degree. It's not like companies are ordering computers running XP. Windows XP's marketshare is going down, not up, so people are moving away from it.

 

"I tried getting the software to work on 7 this one time for 10 mins and failed it will never work" - I am pretty sure that's just hyperbole, but maybe that person has more important things to do? Not sure what company you worked at but where I work we don't exactly have people twiddling with their thumbs all day. There is a backlog of things that needs to be done, so things has to be prioritized. Replacing a potentially unimportant machine just because there might be a minor security issue with it in the future won't get a high priority.

It entirely depends on what machine it is.

I am saying they should be denied support because Microsoft came out years before say "hey, after this date we are not supporting it". I dont know why people like you think microsoft needs to support an OS it gave years notice, I mean thats just selfishness.

 

Once again you are still not understanding any of my points. I said how many times about active upgrades. If they are upgrading 10,000 laptops and it takes time, I dont fucking care, the point is they are ACTIVELY working on it. Those are not the people I am calling out. And even then, I had my 8 people receive 7,000 PCs, image them all in 1 week, had them all fully deployed in 2 weeks. A total of 4 weeks (1 week to actually ship and unpack all of it). I think with years notice they could of easily done the upgrades. I dont know about you but to say hardware it too much work is not a thing, its just being lazy. 

 

I could care less what that person has better to do. You are in fucking IT where you job is to literally support and maintain the pcs, this includes updates and upgrades. My coworkers and my self we always busy but I managed to find time to get homegrown software to work on 7 that was only available to XP, took a few hours but its what was needed. The company I was in was always under audit and it had  to be done. And what you refer to as an unimportant machine can cause way more headaches in the future if its not taken care of now. We all have backlogs of hundreds of task, boo hoo. 

 

Government and hospital equipment run off XP but that is a SOFTWARE limitation. You dont have to replace the equipment to fix and secure it. If you cannot fix it your self you get in direct contact with the manufacture. At that high of level for priority they will work to get those machines update. There is no excuse for not upgrading.  

[SpaceGhostC2C]

4 hours ago, hey_yo_ said:

No one is stopping these institutions to use Windows XP. However, Microsoft is not obliged to keep an antiquated 32-bit OS patched. 

They are not. They are also not obliged to not release a patch. They are basically free to do as they please, and so they did.

 

 

More generally, some people just seem to love to tell others what to do: what to upgrade, when to upgrade, what to support, which patches to release, and even what is and isn't worth for everyone else. The truth is, Microsoft know who is using XP and who isn't, what are the likely consequences of not patching, both for the users and for Microsoft's reputation, what the cost of patching is... And ultimately decided that it was in their best interest to release this patch.

The rest is useless rants about what "should be".

[Hunter259]

I love how no one has said 16bit support. There are still thousands of companies, and this includes the US government, that use equipment that need 16bit support. Nothing newer than XP will work. "But why not just rebuild the program morons". Because the companies that made it went under years ago and why fix what already works. Some of this stuff is worth millions of dollars. This isn't laziness. The reason XP is still so used is because it's damn expensive/impossible to replace.

[LAwLz]

28 minutes ago, mynameisjuan said:

I am saying they should be denied support because Microsoft came out years before say "hey, after this date we are not supporting it". I dont know why people like you think microsoft needs to support an OS it gave years notice, I mean thats just selfishness.

I am in no way saying that Microsoft NEEDS to support XP. But what I am saying is that you should not tell them to stop releasing updates if they feel like it is necessary to do so in order to prevent a major outbreak of malware.

What you're saying: "I want people to get infected with malware because I think they have made poor choices and deserve to be punished for it".

What I'm saying: "What a nice gesture of Microsoft to do more than necessary, just so that users can be safer".

 

31 minutes ago, mynameisjuan said:

Those are not the people I am calling out.

Except you are. You said that Microsoft should not release the upgrade at all. That means you want to put both the "lazy" and the people who are actively trying to update their systems in danger.

 

 

Anyway, I don't think this conversation is going anywhere. I think what you are advocating is ethically and morally wrong, and that you have tunnel vision.

"I've done it once so therefore all companies can do it just as easily!"

[tlink]

5 hours ago, hey_yo_ said:

I know right. I'm a bit concerned that some ATM terminals are still rocking Windows XP under. Terrifying!

there is this elevator near me that runs windows xp, it makes the exact windows xp critical error sound every time it stops at a level. its terrifying.

[mynameisjuan]

35 minutes ago, LAwLz said:

I am in no way saying that Microsoft NEEDS to support XP. But what I am saying is that you should not tell them to stop releasing updates if they feel like it is necessary to do so in order to prevent a major outbreak of malware.

What you're saying: "I want people to get infected with malware because I think they have made poor choices and deserve to be punished for it".

What I'm saying: "What a nice gesture of Microsoft to do more than necessary, just so that users can be safer".

 

 

It will not be a major outbreak with how small the amount of XP machines are left. Is it nice that microsoft did it? Yeah. Should they though, no. Its not even really about this patch. Updates to XP machines have stopped while microsoft deployed specific patches for two big malware attacks. It doesnt mean the rest of the system is secure from all forms of security holes found since XP was unsupported. People really should not be on XP no matter what, especially businesses. People are still vulnerable and there are still large businesses with XP machines with access to the internet and private information. 

 

35 minutes ago, LAwLz said:

 

Except you are. You said that Microsoft should not release the upgrade at all. That means you want to put both the "lazy" and the people who are actively trying to update their systems in danger.

 

 

Anyway, I don't think this conversation is going anywhere. I think what you are advocating is ethically and morally wrong, and that you have tunnel vision.

"I've done it once so therefore all companies can do it just as easily!"

 

It doesnt take years to actively move to another OS. There was plenty of time between microsoft announcing the end date and the actually end date. Its also been 3 years since it was supported so if they still in this transition period then they obviously are not trying. 

 

We will argue, but that is the point of opinions. I see your points and why you think its morally right but on my after being in IT for big corporations and seeing how important security is, I put security first. If focusing on protecting not only the businesses data but also yours or mine is morally wrong, then I dont know what else to say. This patch gives a false impression to people who think "oh its fine microsoft will fix it anyway" even though they have been told even through popups on XP that it will not be supported. XP is a ticking time bomb and this patch added 10 secs to the timer, not stopping the clock. I do not expect it to be easy for everyone, but no one should be saying its impossible. 

[AnonymousGuy]

1 hour ago, mynameisjuan said:

 

It doesnt take years to actively move to another OS. There was plenty of time between microsoft announcing the end date and the actually end date. Its also been 3 years since it was supported so if they still in this transition period then they obviously are not trying. 

 

When you have a tool (hundreds of tools) that's handling millions of dollars worth of material every day and it's running on XP, you're not going to take it down and risk fucking it up to "upgrade".  Especially when the tool isn't connected to the internet and only at risk from LAN threats.

[mynameisjuan]

1 minute ago, AnonymousGuy said:

When you have a tool (hundreds of tools) that's handling millions of dollars worth of material every day and it's running on XP, you're not going to take it down and risk fucking it up to "upgrade".  Especially when the tool isn't connected to the internet and only at risk from LAN threats.

If its handling millions of dollars worth of data, one pc on that LAN is connected to the internet somehow. Not sure what tool would pass data of that kind on LAN machines only. 

[AnonymousGuy]

Just now, mynameisjuan said:

If its handling millions of dollars worth of data, one pc on that LAN is connected to the internet somehow. Not sure what tool would pass data of that kind on LAN machines only. 

I mean material as in physical objects, not data.  A lot of industrial equipment basically has a desktop box running Windows doing the hardware control and datalogging stuff for a tool.

[mynameisjuan]

11 minutes ago, AnonymousGuy said:

I mean material as in physical objects, not data.  A lot of industrial equipment basically has a desktop box running Windows doing the hardware control and datalogging stuff for a tool.

Oh you mean physical material. My bad. That's more up to the vendor updating their equipment that the company but the company can get on them to get it done. Equipment running machinery that have no outside connection(lan or usb, basically cannot receive and send data) then it should be fine. 

[bcguru9384]

unsupported means no free phone assistence or rma options and upto manufacturer for any interactions with device.

they have time they fix. if community provides fix they may pass fix along

but true dedicated team to platform is no longer a part of company as those team members now on other projects

so lets say thanks microsoft for still thinking of winxp as stated in above post

apple says unsupported it means 0help 0updates(including security)

? what is google support policy on old devices/OS ?

[Delicieuxz]

7 hours ago, sof006 said:

Okay so they change the hardware, no good clinging onto the past.

What is the past in this case? If the system is fully serving its needed purpose presently, then it is the present. Do you really think businesses, banks, hospitals are using old hardware and Windows XP out of nostalgia? It's because their needs are being served, and because they don't want interruption of their operations, and because upgrading their systems can require a massive investment in money and time that they don't have, or which can be used for better things, like new medical equipment that saves lives. Withholding a patch to force people to update their systems would be an example of forced obsolescence.