3 ms·

Some users will always cling to older tech. Some users like the simpler interfaces. Some hate UI design changes (like Australis in Firefox). I don't underst

Some users will always cling to older tech. Some users like the simpler interfaces. Some hate UI design changes (like Australis in Firefox). I don't understand it myself. Especially when a user makes a decision to put themselves at risk security-wise as this user is by using an unmaintained browser that isn't tracking security issues any longer.

userbinator 11y ago
If they didn't change the user-facing parts and just fixed the security issues, I think a lot more users would upgrade. What's the actual risk though? I have a feeling these users are also the more experienced and cautious ones, the ones with JS off by default, the ones who aren't going to be as easily tricked by social engineering, and that already removes 99% of the attack area.
- bastawhiz 11y ago
  Someone finds a zero day html parser vulnerability and takes over your computer by putting the malicious markup in a banner ad. More experienced users are not safer in any way if they're using unpatched and unsupported software.
- pmontra 11y ago
  An example of a vulnerability of an even older version of Opera for Windows, that let an attacker totally own the client computer: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1349 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-13... "Large values in the HTTP Content-Length header can cause Opera to crash. Certain specific values can cause a memory corruption, which in some cases can allow arbitrary code to be injected and executed. In most cases Opera will just crash. To inject code, additional techniques will have to be employed." More details in the pages linked to the URL I provided.
  - JohnTHaller 11y ago
    And overflows in the image handlers which crop up every now and then. Anyone that thinks they are secure using an outdated and insecure browser by disabling JavaScript doesn't understand security's complexities when dealing with something like a browser.
- tamana 11y ago
  My dad hates upgrading software because they mess with the UI and remove features he likes. He is not security conscious and is subject to attack. The vendors take shortcuts, and force UX on usera because they don't want to bother back porting security fixes or making security code separable from UX feature code

userbinator 11y ago

If they didn't change the user-facing parts and just fixed the security issues, I think a lot more users would upgrade. What's the actual risk though? I have a feeling these users are also the more experienced and cautious ones, the ones with JS off by default, the ones who aren't going to be as easily tricked by social engineering, and that already removes 99% of the attack area.

bastawhiz 11y ago
Someone finds a zero day html parser vulnerability and takes over your computer by putting the malicious markup in a banner ad. More experienced users are not safer in any way if they're using unpatched and unsupported software.
pmontra 11y ago
An example of a vulnerability of an even older version of Opera for Windows, that let an attacker totally own the client computer: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1349 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-13... "Large values in the HTTP Content-Length header can cause Opera to crash. Certain specific values can cause a memory corruption, which in some cases can allow arbitrary code to be injected and executed. In most cases Opera will just crash. To inject code, additional techniques will have to be employed." More details in the pages linked to the URL I provided.
- JohnTHaller 11y ago
  And overflows in the image handlers which crop up every now and then. Anyone that thinks they are secure using an outdated and insecure browser by disabling JavaScript doesn't understand security's complexities when dealing with something like a browser.
tamana 11y ago
My dad hates upgrading software because they mess with the UI and remove features he likes. He is not security conscious and is subject to attack. The vendors take shortcuts, and force UX on usera because they don't want to bother back porting security fixes or making security code separable from UX feature code