Windows XP patched to avert new outbreaks from three more NSA exploits

[leadeater]

1 minute ago, ARikozuM said:

Again, there's no need to upgrade everything. You can have special machines that run a singular purpose, as you've proposed, but for every computer in a building to be on the antiquated OS can be catastrophic should a malicious user be in the vicinity. You don't need every endpoint to be the same system in every case. 

Oh yes I agree with that, just like I don't agree that continuing to run that old shitty server should be accepted either. But that is just one example of the insane mess you have to clean up when you finally get round to upgrading something that old.

 

Help future you, upgrade often not never.

[SansVarnic]

27 minutes ago, leadeater said:

It's still a little baffling to see how much old tech is used in the US military when you see how large their budget is compared to everything else, everywhere in the world not just the portion of the US budget.

 

I can cut some slack for things like that when you look at how old the ships actually are and the designed service life and the technology that existed back when it was first constructed etc.

 

Just really sick of doing these "replacement projects" for operating systems because it's now an emergency to do so and becomes the responsibility of the IT department instead of the service owner and we have to spend ages tracking down support information. The amount of times we go looking and the software/hardware company no longer exists but the last version before they close supported the newer operating system is frustrating, if the service owner had bothered to stay up to date this wouldn't be as big of a problem or at least not mine.

 

Trades industry has to be the WORST for using antiquated old shit forever.

Yeah but anything large scale like ships and aircraft are designed to a life expectancy of 20-50 years so the systems are only expected to be replaced maybe twice or thrice. *shrugs*

 

edit*

Outside of the military where corporate infrastructure is concerned I believe a rolling upgrade would suit best. That way systems are always being upgraded but not in a massive shift but a slow continuous path to keep things stable. 

Edited June 15, 2017 by SansVarnic

[Mooshi]

MS should have a limit of 5 years support per OS for businesses so they can actually stop being cheapasses recycling hardware that employees can barely use.

[dfsdfgfkjsefoiqzemnd]

1 hour ago, Zodiark1593 said:

I say Microsoft should release the Windows XP source code, the users can patch (and exploit) whatever they want.

While I do agree with that idea, I also know that it's never going to happen because it would affect Win10 sales. 

[PlayStation 2]

Anything about updating to newer operating systems aside, many many MANY PCs, especially in the US government, use PCs that still have Windows XP for one reason or another. I don't see why you should complain about MS patching a major security hole.

[Zodiark1593]

38 minutes ago, ARikozuM said:

Again, there's no need to upgrade everything. You can have special machines that run a singular purpose, as you've proposed, but for every computer in a building to be on the antiquated OS can be catastrophic should a malicious user be in the vicinity. You don't need every endpoint to be the same system in every case. 

And here we have the voice of reason. General purpose office machines should be upgraded, or at least, not using XP. Expensive equipment that is reliant upon XP, probably not a very cost effective option to replace the entire thing. 

[ArduinoBen]

It might confuse people, but Microsoft are being really nice people here.  Obviously NOBODY should be running a ten year old OS, but they are helping those people.  But, I'm really suprised those XP users aren't on Windows 10 yet.     Overall, It's just really a nice thing to do, they don't have too, and it might make the amuter computer users not understand that XP is unsupported making them look bad because they'll think Microft should've pathced that in the first place.  But, let's not forget Microsoft actually patched WannaCry around 4 months before the big outbreaks, but then again, people still on XP in 2017 probably won't download patches for their OS.....   (and probably don't know how to)

[themctipers]

12 hours ago, hey_yo_ said:

Actually it's less than 6% at the moment. I'd be happy if Microsoft just let XP die because it's not even the worlde's most used desktop OS at the moment. 

https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0 

us

 

Microsoft doesn't have to because XP is less than 6% of desktop OS worldwide. Just because you see a lot doesn't mean it applies to everyone. If PCs all over the world gets infected by a stronger ransomware variant, XP is just a small dent. 

windows 8 has a lower market share than windows xp.

 

actually i used windows 8 for a year on my desktop and for 2 years on my laptop  

[Jito463]

56 minutes ago, ArduinoBen said:

Obviously NOBODY should be running a ten year old OS

15 years, not 10.  XP came out in 2002.  Even XP Pro x64 edition, which came out in 2005, is 12 years old.

[mr moose]

3 hours ago, leadeater said:

That's all well and good but they need to upgrade and there isn't any excuse. Hardware dependency, well the throw that out too.

 

Most companies are perfectly capable of keeping the fleet cars update to date and safe and that isn't any cheaper, nothing more than priorities and in an era where data and digital information is so critically important it's time it gets treated that way.

 

It's like not bothering to find a cure for AIDS because the current medication is working well enough and people are living long lives even with HIV.

 

Edit:

P.S. I do agree with them releasing the patches, I don't agree with going "Oh well it is what it is and it's a very complex issue".

 

In industries where fleet cars and fleet IT can be hired that is fine, that is why a lot of schools have the latest versions of windows and so on. But many companies like banking, where legacy is crucial, a lot of the tools are not on hire.  Migrating service critical software for example is not an easy task, they can't just install a new version of their software over the weekend.  Imagine a bank trying to migrate all the payments services, account integration software, bpay and billing integration, employment payroll, tax reconciliation, insurance, automated payments, point of sales, ATM, Internet banking interface services and so on to a new software package.  The headaches and costs should something go wrong are not worth the risk, which is why some opt to pay MS to maintain support for XP. 

 

In fact the cost for suncorp bank, who is doing this, is somewhere near $330M and is staged over multiple years:

https://www.itnews.com.au/news/suncorp-suffers-setback-in-core-banking-overhaul-450482

 

I wouldn't mind betting this upgrade has been part of a long term plan for a decade or so now.

 

Also as far as manufacturing is concerned,  a lot of companies would go bankrupt if they tried to replace their production line machinery every time the OS went out of date.  We are talking literally Millions of dollars worth of tools, and that's before we consider that some of the production equipment is so big it is almost an integral part of the buildings (paper mills and power stations for example).  

 

I personally think it is amazing that XP is actually only at 5.6% given  how many obstacles there are for business. 

 

 

[leadeater]

1 hour ago, mr moose said:

 

In industries where fleet cars and fleet IT can be hired that is fine, that is why a lot of schools have the latest versions of windows and so on. But many companies like banking, where legacy is crucial, a lot of the tools are not on hire.  Migrating service critical software for example is not an easy task, they can't just install a new version of their software over the weekend.  Imagine a bank trying to migrate all the payments services, account integration software, bpay and billing integration, employment payroll, tax reconciliation, insurance, automated payments, point of sales, ATM, Internet banking interface services and so on to a new software package.  The headaches and costs should something go wrong are not worth the risk, which is why some opt to pay MS to maintain support for XP. 

 

In fact the cost for suncorp bank, who is doing this, is somewhere near $330M and is staged over multiple years:

https://www.itnews.com.au/news/suncorp-suffers-setback-in-core-banking-overhaul-450482

 

I wouldn't mind betting this upgrade has been part of a long term plan for a decade or so now.

 

Also as far as manufacturing is concerned,  a lot of companies would go bankrupt if they tried to replace their production line machinery every time the OS went out of date.  We are talking literally Millions of dollars worth of tools, and that's before we consider that some of the production equipment is so big it is almost an integral part of the buildings (paper mills and power stations for example).  

 

I personally think it is amazing that XP is actually only at 5.6% given  how many obstacles there are for business. 

 

 

What I meant was companies that have their own fleet cars, we have a very large number of cars which all get serviced and replaced at great cost and we have to do that for legal and compliance reasons. That is our incentive and because it is there systems are in place to deal with it and external companies are aware of it so can deal with it too.

 

Also I'm not saying go out and replace milling machines, milk vats and all sorts of controllers like that in full or even at all. Most of those are controlled by archaic software that can be updated, there is very few software out their than can only run on XP because it cannot be made to work on Vista onward. Yes there are key components that are in use that don't exist but you can update those functions to be complaint with newer operating systems.

 

If for any reason there is a hardware controller that just can't be made to talk with something newer those parts can typically be replaced, not the whole machine.

 

Our yearly operational (capital budget is different) IT budget is around $140 million NZD and we have complex HR, financial, student management (35,000 students) and research computer systems none of these challenges are foreign to me but I also know the reasons 99% of systems get run in to the ground and never updated is due to poor IT governance and is self inflected.

 

I also have a parent who has been working in a hospital IT department for the last 25 years and I'm fully aware of the challenges they face, most again all self inflected due to lack of importance placed on keeping IT systems up to date.

 

If it became a legal requirement to stay up to date it would get done, I can guarantee it would just like everything that is legally required so gets that attention and funding required to make it so.

 

I'm not saying the issues we have both mentioned don't exist I'm saying they shouldn't exist and can be done.

 

Edit:

Not all blame is directly on the company with the old system either, sometimes the vendor doesn't have updated software/hardware. It's a collective issue that'll only change when there is a large collective demand to make it happen. You can't update to a software version that doesn't exist and it often doesn't exist because there isn't a large enough demand for it justifying the expenditure to update it.

[mr moose]

8 minutes ago, leadeater said:

What I meant was companies that have their own fleet cars, we have a very large number of cars which all get serviced and replaced at great cost and we have to do that for legal and compliance reasons. That is our incentive and because it is there systems are in place to deal with it and external companies are aware of it so can deal with it too.

 

Also I'm not saying go out and replace milling machines, milk vats and all sorts of controllers like that in full or even at all. Most of those are controlled by archaic software that can be updated, there is very few software out their than can only run on XP because it cannot be made to work on Vista onward. Yes there are key components that are in use that don't exist but you can update those functions to be complaint with newer operating systems.

 

If for any reason there is a hardware controller that just can't be made to talk with something newer those parts can typically be replaced.

 

Our yearly IT budget is around $140 million NZD and we have complex HR, financial, student management (35,000 students) and research computer systems none of these challenges are foreign to me but I also know the reasons 99% of systems get run in to the ground and never updated is due to poor IT governance and is self inflected.

 

I also have a parent who has been working in a hospital IT department for the last 25 years and I'm fully aware of the challenges they face, most again all self inflected due to lack of importance placed on keeping IT systems up to date.

 

If it became a legal requirement to stay up to date it would get done, I can guarantee it would just like everything that is legally required so gets that attention and funding required to make it so.

 

I'm not saying the issues we have both mentioned don't exist I'm saying they shouldn't exist and can be done.

But again upgrading a car does not prevent the driver of the car from doing their job.  In this case using cars as an example, it would be more accurate if the only upgrade option was a hatch back and you needed delivery vans.  Business need an OS that their hardware/software run on.  If it was easy to replace a controller/software and upgrade their OS, then they would do that instead of paying to maintain an archaic OS.  As it shows in the link I provided, your yearly IT budget is half the cost of migrating one banks IT to newer software.   This in and of itself should adequately explain to people why it doesn't "just happen", clearly it is happening, just not very fast and for good reason.

 

  

[leadeater]

54 minutes ago, mr moose said:

But again upgrading a car does not prevent the driver of the car from doing their job.  In this case using cars as an example, it would be more accurate if the only upgrade option was a hatch back and you needed delivery vans.  Business need an OS that their hardware/software run on.  If it was easy to replace a controller/software and upgrade their OS, then they would do that instead of paying to maintain an archaic OS.  As it shows in the link I provided, your yearly IT budget is half the cost of migrating one banks IT to newer software.   This in and of itself should adequately explain to people why it doesn't "just happen", clearly it is happening, just not very fast and for good reason.

Our capital budget is many many times more than operational budget but why does budget size even matter. Small business, big business they all have their own problems.

 

Car upgrades are done just like IT upgrades, you don't take the car away before the new one arrives...

 

It doesn't just happen but it doesn't happen either if you don't try and that is the point. If you think it's not a case of not trying well then sorry but doing nothing is a systemic problem and it isn't something that IT department can fix alone.

 

Edit:

Also I think you didn't address the incentive issue, what is the incentive to upgrade the software or hardware? Businesses are profit driven so it's no surprise upgrades don't happen unless there is a reason to in their eyes, it often doesn't matter how many times an IT department screams you need to upgrade if they don't actually take the recommendation seriously.

[LAwLz]

5 hours ago, leadeater said:

I don't agree with going "Oh well it is what it is and it's a very complex issue".

That's not at all what I was saying.

These are the points I have (tried) to make all throughout the thread:

1) It's a good thing that Microsoft is releasing this update because it means more people will be safe. The update for XP benefits everyone, not just XP users.

2) This update will not make people stay on XP longer. The machines running XP today are either scheduled to be replaced, or have no plans to be replaced, and this patch will not change that.

3) You can not claim to be for security while simultaneously saying Microsoft should withhold security updates which have already been developed and tested.

4) Not all companies look the same. Just because you were able to migrate fairly painlessly at one company does not mean it can be done everywhere.

5) XP is slowly being phased out. It's just that for time and money reasons it is going slower at some places than others. In a lot of cases, it is NOT because "people are just lazy".

[leadeater]

Just now, LAwLz said:

That's not at all what I was saying.

These are the points I have (tried) to make all throughout the thread:

1) It's a good thing that Microsoft is releasing this update because it means more people will be safe. The update for XP benefits everyone, not just XP users.

2) This update will not make people stay on XP longer. The machines running XP today are either scheduled to be replaced, or have no plans to be replaced, and this patch will not change that.

3) You can not claim to be for security while simultaneously saying Microsoft should withhold security updates which have already been developed and tested.

4) Not all companies look the same. Just because you were able to migrate fairly painlessly at one company does not mean it can be done everywhere.

5) XP is slowly being phased out. It's just that for time and money reasons it is going slower at some places than others. In a lot of cases, it is NOT because "people are just lazy".

Sorry, I was making more of a general statement with that than trying to imply that's what you were meaning/saying.

[mr moose]

2 hours ago, leadeater said:

Our capital budget is many many times more than operational budget but why does budget size even matter. Small business, big business they all have their own problems.

 

Car upgrades are done just like IT upgrades, you don't take the car away before the new one arrives...

 

 

Because if you spend all your budget +some updating your Critical tools then you have nothing left to bank roll the rest of your business. 

 

Also the car analogy still doesn't work.  It's not just replacing the OS or tools with a tried and tested product (like would happen when you change cars), it's replacing with a different system that can't be tested until it is implemented.   For a factory running a multi million dollar production line,  every minute it is offline due to teething issues is big money.  That is why suncorp didn't just implement the upgrades over a weekend, but several years slowly integrating and migrating service by service.

 

 

2 hours ago, leadeater said:

Edit:

Also I think you didn't address the incentive issue, what is the incentive to upgrade the software or hardware? Businesses are profit driven so it's no surprise upgrades don't happen unless there is a reason to in their eyes, it often doesn't matter how many times an IT department screams you need to upgrade if they don't actually take the recommendation seriously.

 

I didn't address it because I don't think it is the biggest reason companies haven't moved, XP seems to only be used nowadays by manufacturing, banking/POS and healthcare.  The three main situations that require specific proprietary software that is both mission critical 24/7 and largely multi faceted.  Everyone else has migrated to win 7/10.

[leadeater]

Just now, mr moose said:

Because if you spend all your budget +some updating your Critical tools then you have nothing left to bank roll the rest of your business. 

 

Also the car analogy still doesn't work.  It's not just replacing the OS or tools with a tried and tested product (like would happen when you change cars), it's replacing with a different system that can't be tested until it is implemented.   For a factory running a multi million dollar production line,  every minute it is offline due to teething issues is big money.  That is why suncorp didn't just implement the upgrades over a weekend, but several years slowly integrating and migrating service by service.

 

 

 

I didn't address it because I don't think it is the biggest reason companies haven't moved, XP seems to only be used nowadays by manufacturing, banking/POS and healthcare.  The three main situations that require specific proprietary software that is both mission critical 24/7 and largely multi faceted.  Everyone else has migrated to win 7/10.

In a lot of cases though software isn't tied to the OS and the OS can be upgraded, fear of issues is one of the largest impediments to progress. Not that the fear of issues is unfounded but it doesn't also mean doing nothing and waiting the longest possible time between upgrades or aligning software upgrades and OS upgrade together is the best solution.

 

OS and application dependency is used in a lot of cases where it isn't true, at least with technologies like containers/docker that is much harder to argue.

 

We're in the middle of a student management system upgrade right now which has been about a 3 year project so far and by the time it's truly complete will be probably 5 years. This hasn't stopped us upgrading the OS of many of the current servers that host the current software. The current software also happens to be in-house built and is completely custom for us, the new one is an "off the shelf" vendor product.

 

Also the car analogy wasn't originally used as an analogy, it was a statement that cost alone is a poor reason not to upgrade when you can point to many many examples in a business where it isn't a problem. Way back at my original point this is nothing more than priorities and in an era where data and digital information is so important adjustments need to be made and that change is happening too slowly and there is a ton of evidence showing it.

[leadeater]

17 minutes ago, mr moose said:

Because if you spend all your budget +some updating your Critical tools then you have nothing left to bank roll the rest of your business. 

I think you misunderstood what I was saying, projects like the one you referenced come out of capital expenditure budgets. Operational budgets are for running and maintaining the systems in place, support contracts, software licenses etc."Keeping the lights on".

 

One of the problems with not keeping pace with regular upgrades and having the systems in place to smoothly complete them is it becomes a bigger and bigger task as time moves on moving it from a maintenance issue to a project issue which pushes it in to a different funding line with different rules in place increasing the cost to complete the work.

[Urishima]

20 hours ago, Abdul201588 said:

Some people need as they have hardware that is supported only by XP. 

If you don't airgap any XP/NT/whateverelseancientshit runing hardware, then I have no sympathy if that shit blows up in your face.

[mr moose]

40 minutes ago, leadeater said:

In a lot of cases though software isn't tied to the OS and the OS can be upgraded, fear of issues is one of the largest impediments to progress. Not that the fear of issues is unfounded but it doesn't also mean doing nothing and waiting the longest possible time between upgrades or aligning software upgrades and OS upgrade together is the best solution.

 

OS and application dependency is used in a lot of cases where it isn't true, at least with technologies like containers/docker that is much harder to argue.

 

We're in the middle of a student management system upgrade right now which has been about a 3 year project so far and by the time it's truly complete will be probably 5 years. This hasn't stopped us upgrading the OS of many of the current servers that host the current software. The current software also happens to be in-house built and is completely custom for us, the new one is an "off the shelf" vendor product.

 

Also the car analogy wasn't originally used as an analogy, it was a statement that cost alone is a poor reason not to upgrade when you can point to many many examples in a business where it isn't a problem. Way back at my original point this is nothing more than priorities and in an era where data and digital information is so important adjustments need to be made and that change is happening too slowly and there is a ton of evidence showing it.

I think you might not understand, Much of what is left cannot simply be upgraded.  ATM's are largely embedded systems which bring their own issues and the ATM industry is recommending jumping straight into linux or android .     

https://www.theinquirer.net/inquirer/news/2411588/atm-industry-endorses-windows-10-but-future-cash-machines-could-run-android-or-linux

 

There are (or at least was) quite a number of software products that did not work on anything after XP. I had issues with burning software when I upgraded. I have heard straight from the camels mouth that Many mid size CNC and printing machines require parallel ports (won't work of emulators).

 

No offense but I don;t know that student management software is quite as critical as health records/ct scan results and the credit card transactions of an entire nation.  I am sure there are cost cutting activities at play, but it's not just about the money, logistics is a big player here too. 

 

Again with the car thing, companies are upgrading and moving away from XP as it is down to 5.6%, but whats left has genuine reasons to take longer.  Many CNC machines have embedded OS, they can't just be upgraded. 

 

 

 

 

[Dabombinable]

9 minutes ago, mr moose said:

Many CNC machines have embedded OS, they can't just be upgraded. 

Or rely on legacy interface and drivers that aren't compatible with newer versions of Windows (sometimes due to lack of VXD driver support)

[mr moose]

Just now, Dabombinable said:

Or rely on legacy interface and drivers that aren't compatible with newer versions of Windows (sometimes due to lack of VXD driver support)

Yes, my father in laws old sign writing software only works on 95 and the vinyl cutter requires 95 drivers and a parallel port.   While he could upgrade everything, it is literally upgrading everything.  He may as well start a new business.  Although I do recgonise he is not the poster child of this situation, it is just another example.

[Droidbot]

Just now, mr moose said:

Yes, my father in laws old sign writing software only works on 95 and the vinyl cutter requires 95 drivers and a parallel port.   While he could upgrade everything, it is literally upgrading everything.  He may as well start a new business.  Although I do recgonise he is not the poster child of this situation, it is just another example.

As I said before - these devices are fine. Just isolate them - stick them on a seperate VLAN with no internet connection, etc. 

 

No need to worry about outside threats when the machine isn't outside, eh? 

[leadeater]

17 minutes ago, mr moose said:

There are (or at least was) quite a number of software products that did not work on anything after XP. I had issues with burning software when I upgraded. I have heard straight from the camels mouth that Many mid size CNC and printing machines require parallel ports (won't work of emulators).

That's both an issue of the software vendor not updating their software, not something a business can control, and not enough demand for them to do it, something an business can control but only as a collective. Parallel ports work perfectly fine on operating systems after XP it's just that a lot of hardware stopped including them. There are USB to parallel adapters that do work just have to do the required research to find them. Got a friend who is an electrical engineer who hit this exact issue.

 

17 minutes ago, mr moose said:

No offense but I don;t know that student management software is quite as critical as health records/ct scan results and the credit card transactions of an entire nation.  I am sure there are cost cutting activities at play, but it's not just about the money, logistics is a big player here too.

A student management system for a university is very complex and has their own set of government regulations that need to be followed. Complexity isn't importance and I wouldn't write off what we do as lesser to a bank or a hospital. Not only do we train many nurses and doctors we operate the very same equipment and are licensed to carry out procedures as well for training purposes, we also have one of the worlds most respected veterinary surgeries.

 

I don't really want to debate the medical industry as I already said previously that is something I know very well and could talk about in much more length than I'd ever really like to.

 

17 minutes ago, mr moose said:

Again with the car thing, companies are upgrading and moving away from XP as it is down to 5.6%, but whats left has genuine reasons to take longer.  Many CNC machines have embedded OS, they can't just be upgraded. 

And that's where I disagree, a lot of them are not genuine reasons they just sound like that until you dig deeper and understand much of it is nothing more than giving it a very low priority.

 

Take the earlier example I gave of the fax server of medical lab test records, that system could have been replaced so many times so much sooner and yet it wasn't. It's not even that expensive and now analogue fax is so outdated it's very hard to replace it and the software isn't IP fax compatible, self inflected issue right there.

[LAwLz]

25 minutes ago, Droidbot said:

As I said before - these devices are fine. Just isolate them - stick them on a seperate VLAN with no internet connection, etc. 

 

No need to worry about outside threats when the machine isn't outside, eh? 

You still have to worry about inside threats.