Windows XP patched to avert new outbreaks from three more NSA exploits

[LAwLz]

2 hours ago, mynameisjuan said:

It will not be a major outbreak with how small the amount of XP machines are left.

Did you even read the article? This is an exploit that affects all versions of Windows, not just XP. Unpatched XP machines could be used to spread the malware to for example Windows 7, 8.1 and 10 computers. This is something affecting all versions of Windows, and the more vurnerable computers are out there the easier time it will have to spread.

Again, it's just like with vaccines.

 

 

2 hours ago, mynameisjuan said:

 Is it nice that microsoft did it? Yeah. Should they though, no.

I think they should, and clearly Microsoft thinks so too.

If you want people to be vulnerable then go ahead and think that if you want, but I will think that you're stupid and don't fully grasp what you're talking about. Saying that security updates should be withheld from users, for the sole purpose of trying to force them to upgrade despite some of them having legitimate reasons for not updating, is not only morally and ethically wrong, but also completely illogical.

 

2 hours ago, mynameisjuan said:

Its not even really about this patch. Updates to XP machines have stopped while microsoft deployed specific patches for two big malware attacks. It doesnt mean the rest of the system is secure from all forms of security holes found since XP was unsupported.

I know. I already addressed this back when someone tried to argue that people who were on the fence of upgrading would somehow think it would be OK to stay on Windows XP now that it has gotten two updates, out of like 100.

 

2 hours ago, mynameisjuan said:

People really should not be on XP no matter what, especially businesses. People are still vulnerable and there are still large businesses with XP machines with access to the internet and private information. 

In the perfect world nobody would be on Windows XP anymore, but we do not live in this whimsical fairy tale. We live in the real world and therefore we need to make the best out of this situation. 7% of all computers won't just change OS tomorrow, so the best we can do is try an minimize the potential damage by releasing a patch. The patch will not only protect the XP users directly, but also help protect users of currently supported OSes indirectly (through less spreading potential).

 

2 hours ago, mynameisjuan said:

but on my after being in IT for big corporations and seeing how important security is, I put security first.

You put security first, and therefore you think it is wrong for Microsoft to release security patches... Do you understand how illogical the things you are saying are?

You don't give a damn about security since you are arguing that Microsoft should withhold security patches from users. If you cared about security, then you would be applauding Microsoft for this, because this is making everyone (including Windows 10 users) more safe.

 

2 hours ago, mynameisjuan said:

This patch gives a false impression to people who think "oh its fine microsoft will fix it anyway" even though they have been told even through popups on XP that it will not be supported.

No it won't... This argument is bullshit because people who are still using Windows XP went 3 years without any updates. If they were OK with no updates for 3 years then they were clearly OK with running without security updates. It's not like they were on the fence thinking "maybe I should update... It's been 3 years since I last got a security update", and then they get these two and all of a sudden they completely change their minds.

 

2 hours ago, mynameisjuan said:

XP is a ticking time bomb and this patch added 10 secs to the timer, not stopping the clock.

And according to you Microsoft should not even have extended the timer by 10 seconds. They should just have watched as the bomb blew up and killed people, some of which may have been able to get to safety if they just had those 10 extra seconds.

 

28 minutes ago, mynameisjuan said:

Oh you mean physical material. My bad. That's more up to the vendor updating their equipment that the company but the company can get on them to get it done. Equipment running machinery that have no outside connection(lan or usb, basically cannot receive and send data) then it should be fine. 

"It's up to X to do it" does not mean jack shit. Yeah sure, it should be up to this machine's manufacture to make sure their 20 year old robot is supported by an OS released last year, but if they won't release an update then you're stuck. Or maybe the company no longer exists (for one of several reasons). Maybe the hardware the robot uses isn't even supported by newer OSes.

[Dabombinable]

To those wanting Windows XP to "die. Try telling that to businesses for example that can't run their CNC lathe under anything after Windows XP and can't fit a newer one into their budget

[ARikozuM]

While I agree with Microsoft's stance on updating XP, I feel that they should put a "please upgrade for security's sake" clause. 

[Jito463]

1 hour ago, AnonymousGuy said:

I mean material as in physical objects, not data.  A lot of industrial equipment basically has a desktop box running Windows doing the hardware control and datalogging stuff for a tool.

58 minutes ago, mynameisjuan said:

Oh you mean physical material. My bad. That's more up to the vendor updating their equipment that the company but the company can get on them to get it done. Equipment running machinery that have no outside connection(lan or usb, basically cannot receive and send data) then it should be fine. 

 

One of our customers runs a carpentry shop, and their industrial carpentry machine is controlled by a Windows XP box straight from the manufacturer.  A while back, their machine was locking up and absolutely had to be replaced (bad caps, bad HDD, etc).  The manufacturer (an Italian company) was going to sell them a "brand new" Windows XP controller PC for the low, low price of $12,000.  We built him one for well under 1/10th of that, including the configuration of his software.

 

There are legitimate cases where the use of XP is (unfortunately) out of the control of the business.

[Jito463]

7 minutes ago, Dabombinable said:

To those wanting Windows XP to "die. Try telling that to businesses for example that can't run their CNC lathe under anything after Windows XP and can't fit a newer one into their budget

Heh, you posted that while I was typing up my post.  That's exactly the situation I was referring to.

[Dabombinable]

9 minutes ago, Jito463 said:

Heh, you posted that while I was typing up my post.  That's exactly the situation I was referring to.

For me its public schools. For the most part are flat out trying to get enough money to maintain everything (some even have to make do with buildings that leak and have severe defects for years before they get enough funding) and as a result there are a lot of other far more important things to spend money on over a CNC lathe which while frequently used isn't key to the health and safety of students (last time I was at my old one, 1 building leaked badly, several "demountables" had mold and mildew, and 1 had a top level that wasn't actually safe to be in due to skimping on parts of it).

11 minutes ago, Jito463 said:

 

One of our customers runs a carpentry shop, and their industrial carpentry machine is controlled by a Windows XP box straight from the manufacturer.  A while back, their machine was locking up and absolutely had to be replaced (bad caps, bad HDD, etc).  The manufacturer (an Italian company) was going to sell them a "brand new" Windows XP controller PC for the low, low price of $12,000.  We built him one for well under 1/10th of that, including the configuration of his software.

 

There are legitimate cases where the use of XP is (unfortunately) out of the control of the business.

I've actually been given quite a few ex business machines with bad caps (PSU+motherboard) and dead HDD. I got them working for the most part, but some poor sod was having to use Windows 98 right up until 2013 for accounting, when the programs work perfectly under all newer versions of Windows (which at the very least aren't less stable than 98).

[Doobeedoo]

While it's great, I guess the reason is that it can be a severe security hole since many business machines rely on it like ATMs and such automat ones everywhere.

Also military pays MS for extra extended support heh.

 

But yeah, would be great if everyone can simply just hop on latest, W10, would be way better.

[JoeCoke]

8 hours ago, hey_yo_ said:

I know right. I'm a bit concerned that some ATM terminals are still rocking Windows XP under. Terrifying!

I don't get why shit like ATM machines are even running Windows in the first place. You'd think they'd run Linux.

[mr moose]

55 minutes ago, Dabombinable said:

To those wanting Windows XP to "die. Try telling that to businesses for example that can't run their CNC lathe under anything after Windows XP and can't fit a newer one into their budget

 

Exactly, there are too many people on this forum who don't understand business or that even recognise how complex a lot of it is at he very least.  In my experience (30+ years in various industries) I have yet to see a company that can just upgrade a working tool without upsetting entire ecosystems. Everything is linked and that is why you generally see companies build entire new factories rather than updating old ones (I am talking specifically about industries that have critical software requirements).    

 

These exploits are very serious (GFC serious) , weighing up what to support is as much about damage mitigation as it is about corporate PR and client service.

 

 

[dfsdfgfkjsefoiqzemnd]

9 hours ago, hey_yo_ said:

Do you see Apple still releasing patches for an old iPhone 3GS or a 2008 polycarbonate MacBook running Mac OS X Snow Leopard at the latest? No.

Of course Apple won't.  There's like 70 or 80 of those things still in working condition.  The market share of XP is currently around 5%, which translates to roughly 40 million PCs (based on the estimated total of around 2 billion active PCs).  A lot of those are running critical infrastructure and machines and can not be upgraded at a reasonable cost. 

 

If you think that's bad, back in 2015 a French airport had to shut down due to a problem with a Windows 3.11 machine.  Yes, 3.11

[Droidbot]

8 minutes ago, Captain Chaos said:

If you think that's bad, back in 2015 a French airport had to shut down due to a problem with a Windows 3.11 machine.  Yes, 3.11

And two people in the country knew how to use it, and one was retired and the other one was on holiday. 

 

Ó fúck

[SansVarnic]

There are still major corporations and government entities that pay MS to continue to support XP for reasons.

 

[Beskamir]

Just let it die and then force updates on your users so that another windows xp situation can never be created.

[leadeater]

11 hours ago, LAwLz said:

This is a good thing. Why are people comparing that they are releasing patches which could prevent malware outbreaks? Even if you think Windows XP is old and should be abandoned, the fact is they machines are still out there running XP. Those machines won't get updated just because Microsoft stop giving out updates, that has already been proven. So why keep patches which are already developed to themselves. 

 

It's like having the cure for AIDS, but keeping it secret because "people need to learn to have safe sex. They won't learn if I give them the cure". 

That's all well and good but they need to upgrade and there isn't any excuse. Hardware dependency, well the throw that out too.

 

Most companies are perfectly capable of keeping the fleet cars update to date and safe and that isn't any cheaper, nothing more than priorities and in an era where data and digital information is so critically important it's time it gets treated that way.

 

It's like not bothering to find a cure for AIDS because the current medication is working well enough and people are living long lives even with HIV.

 

Edit:

P.S. I do agree with them releasing the patches, I don't agree with going "Oh well it is what it is and it's a very complex issue".

[Zodiark1593]

35 minutes ago, ElfFriend said:

Just let it die and then force updates on your users so that another windows xp situation can never be created.

I say Microsoft should release the Windows XP source code, the users can patch (and exploit) whatever they want.

[ARikozuM]

When did AIDS and PC updates become a viable analogy? 

[Zodiark1593]

Just now, ARikozuM said:

When did AIDS and PC updates become a viable analogy? 

 

One should be deeply thankful that nature hasn't come out with a biological ransomware that encrypts the contents of the brain without paying someone or something.

[leadeater]

1 minute ago, ARikozuM said:

When did AIDS and PC updates become a viable analogy? 

I dunno, when did continuing to use outdated operating systems become a valid excuse  . Tbh not really read much of this thread at all but there isn't any valid reasoning to use something so out of date, none at all. Hardware and software dependencies can all be solved with updating those too or finding new suppliers of those requirements, nothing but too much effort or money excuses. I've never heard a court accept either of those excuses for health and safety violations.

 

Quite often it only costs so much or is now so difficult to do because the upgrading was left so late.

[captain_to_fire]

Just now, Zodiark1593 said:

 

One should be deeply thankful that nature hasn't come out with a biological ransomware that encrypts the contents of the brain without paying someone or something.

Actually there are conditions similar to a biological ransomware, but it has no ransom to pay unfortunately. Examples of which are Creutzfeldt-Jakob disease, an incurable neurodegenerative disease caused by an infectious protein called "prion".

2 minutes ago, leadeater said:

I dunno, when did continuing to use outdated operating systems become a valid excuse  . Bth not really read much of this thread at all but there isn't any valid reasoning to use something so out of date, none at all. Hardware and software dependencies can all be solved with updating those too or finding new suppliers of those requirements, nothing but too much effort to money excuses.

 

Quite often it only costs so much or is now so difficult to do because the upgrading was left so late.

Exactly. Small businesses actually may spend even more on maintaining an old equipment that requires an antiquated OS. The maintenance alone can cost so much money. Same goes for wireless carriers when they decide to shutdown 2G (even 3G in some) and repurposing the spectrum used by these older wireless technologies to 4G or even 5G. Maintaining older technologies can cost wireless carriers more money and can stifle innovation. In fact, Microsoft doing this isn't doing their business model any favors. 

 

People should face the fact that businesses are made to earn money and not for charity. Windows XP is old and people should just suck it up when it's time to give it up and Microsoft should stay true to their word back in April 2014 that Windows XP is no longer supported and won't receive any updates. Microsoft is just delaying the inevitable and will slow the adoption of their new operating system. Windows 10 has its fair share of quirks but in comparison to Windows XP. I'd take Windows 10 anytime.

[SansVarnic]

3 minutes ago, leadeater said:

I dunno, when did continuing to use outdated operating systems become a valid excuse  . Tbh not really read much of this thread at all but there isn't any valid reasoning to use something so out of date, none at all. Hardware and software dependencies can all be solved with updating those too or finding new suppliers of those requirements, nothing but too much effort or money excuses. I've never heard a court accept either of those excuses for health and safety violations.

 

Quite often it only costs so much or is now so difficult to do because the upgrading was left so late.

Unfortunately there is one excuse that I can go along with here is for example the US Navy pays to keep XP on the up & up, reason being is the software is hard wired with the hardware, granted the systems can be upgraded software & firmware wise but the hardware is pretty difficult to upgrade, the amount of money and down time required to gut an replace hardware in a naval ship is enormous and that would just be a task for a frigate let alone a carrier. I agree the systems should upgraded for security but I can say from experience the US military pretty much changes the Windows OS in a way that it is not the same as the civilian version we see. I got a chance to see a little in to how this is done and it is a different OS.

[leadeater]

Just now, SansVarnic said:

Unfortunately there is one excuse that I can go along with here is for example the US Navy pays to keep XP on the up & up, reason being is the software is hard wired with the hardware, granted the systems can be upgraded software & firmware wise but the hardware is pretty difficult to upgrade, the amount of money and down time required to gut an replace hardware in a naval ship is enormous and that would just be a task for a frigate let alone a carrier. I agree the systems should upgraded for security but I can say from experience the US military pretty much changes the Windows OS in a way that it is not the same as the civilian version we see. I got a chance to see a little in to how this is done and it is a different OS.

It's still a little baffling to see how much old tech is used in the US military when you see how large their budget is compared to everything else, everywhere in the world not just the portion of the US budget.

 

I can cut some slack for things like that when you look at how old the ships actually are and the designed service life and the technology that existed back when it was first constructed etc.

 

Just really sick of doing these "replacement projects" for operating systems because it's now an emergency to do so and becomes the responsibility of the IT department instead of the service owner and we have to spend ages tracking down support information. The amount of times we go looking and the software/hardware company no longer exists but the last version before they close supported the newer operating system is frustrating, if the service owner had bothered to stay up to date this wouldn't be as big of a problem or at least not mine.

 

Trades industry has to be the WORST for using antiquated old shit forever.

[ARikozuM]

18 minutes ago, Zodiark1593 said:

One should be deeply thankful that nature hasn't come out with a biological ransomware that encrypts the contents of the brain without paying someone or something.

I think you're forgetting about psychiatrists.

 

8 minutes ago, hey_yo_ said:

Actually there are conditions similar to a biological ransomware, but it has no ransom to pay unfortunately. Examples of which are Creutzfeldt-Jakob disease, an incurable neurodegenerative disease caused by an infectious protein called "prion"..

One could draw the analogy with prions to WannaCry since both involve encryptions of sorts. 

20 minutes ago, leadeater said:

Quite often it only costs so much or is now so difficult to do because the upgrading was left so late.

My question would be "why not upgrade a few terminals and see how they do?". It seems easier to move a few people, even if VM's must be used for backwards compatibility, and find a worthwhile replacement while doing so. They can keep their old machines, but for the money that some of these corporations make, downtime, training, and upgrading should be inexpensive in the long-term. 

[leadeater]

5 minutes ago, ARikozuM said:

My question would be "why not upgrade a few terminals and see how they do?". It seems easier to move a few people, even if VM's must be used for backwards compatibility, and find a worthwhile replacement while doing so. They can keep their old machines, but for the money that some of these corporations make, downtime, training, and upgrading should be inexpensive in the long-term. 

Most of the really old stuff are typically control computers for hardware etc. Take an example of a hospital that has to run an XP/Server 2003 computer because it has a special fax card in it and it's critical for the distribution for med lab tests internally and externally.

 

No drivers exist for any newer OS and it doesn't work even if you try. The software that is used only supports that card, their card. That company who makes the cards and software no longer exists.

 

Edit:

Oh and I also forgot the fax card is clocked to the CPU and won't support anything above 266Mhz.

 

P.S. This is a real thing btw

[Jito463]

29 minutes ago, Zodiark1593 said:

 

One should be deeply thankful that nature hasn't come out with a biological ransomware that encrypts the contents of the brain without paying someone or something.

There's plenty of people who wouldn't lose enough to justify paying.

[ARikozuM]

2 minutes ago, leadeater said:

Most of the really old stuff are typically control computers for hardware etc. Take an example of a hospital that has to run an XP/Server 2003 computer because it has a special fax card in it's and it critical for the distribution for med lab tests internally and externally.

 

No drivers exist for any newer OS and it doesn't work even if you try. The software that is used only supports that card, their card.

Again, there's no need to upgrade everything. You can have special machines that run a singular purpose, as you've proposed, but for every computer in a building to be on the antiquated OS can be catastrophic should a malicious user be in the vicinity. You don't need every endpoint to be the same system in every case.