4 ms·

I'm attempting to say that the user is given no freedom to choose when and if to install updates. MS keeps on releasing broken updates which render thousands of

I'm attempting to say that the user is given no freedom to choose when and if to install updates. MS keeps on releasing broken updates which render thousands of PCs broken. If you're OK with that then I'm fine. Secondly, it's a myth that Windows must be updated to stay secure. It's such a huge myth it's actually cringe worthy. If you're at home windows updates are needed only to keep your IE/Edge installation secure. That's all. All incoming network ports are blocked on your router by default. And if you're stupid enough to rely on MS Security Essentials then I will stop arguing with you. That's not an AV - that's a huge hole. Unrequired updates are rarely good. > Sorry but the whole article stinks of anti-MS FUD and anyone who attempts to argue against keeping (or features that keep) their PC up to date is ignorant at best. You took just one item on the list to attack without even giving valid sound arguments and now you say the whole article is anti MS FUD. With that I bid farewell to you. You have yet to become a decent debator. P.S. The truth is Windows has had some remote vulnerabilities in regard to fonts rendering and such but they are very difficult to exploit (and I haven't heard of any circulating in the wild exploits). Again in 99% of cases users get infected by downloading shady files from the net or opening unrequested e-mail attachments. Windows updates will NEVER save you from that.

orf 10y ago
Edit: You're comical to the point of absurdity. > The truth is Windows has had some remote vulnerabilities in regard to fonts rendering and such but they are very difficult to exploit (and I haven't heard of any circulating in the wild exploits). You say absurd things like 'Secondly, it's a myth that Windows must be updated to stay secure. It's such a huge myth it's actually cringe worthy.', then in the same comment talk about how actually there are pretty serious remote vulnerabilities that don't require user interaction (or some, like clicking something), but that's OK because "I haven't heard of any circulating in the wild exploits". :') http://www.networkworld.com/article/2969896/microsoft-subnet/microsoft-patches-windows-10-edge-4-critical-holes-2-exploits-in-the-wild.html http://www.networkworld.com/article/2969896/microsoft-subnet... https://googleprojectzero.blogspot.co.uk/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.co.uk/2015/07/one-font-vu... http://wccftech.com/december-patch-tuesday-fixes-zero-day-vulnerabilities/ http://wccftech.com/december-patch-tuesday-fixes-zero-day-vu... http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-leak-uncovers-another-windows-zero-day-ms-releases-patch/ http://blog.trendmicro.com/trendlabs-security-intelligence/h... ----- > You took just one item on the list to attack without even giving valid sound arguments The onus is on you to explain why protecting your machine with security updates is a bad thing. Making up statistics and misunderstanding basic security concepts doesn't count as an argument. > Again in 99% of cases users get infected by downloading shady files from the net or opening unrequested e-mail attachments. Windows updates will NEVER save you from that. That's so stupid it's laughable. Here's one case: the user downloads a malformed .docx file that would cause a buffer overflow in Word and compromise their machine, but instead the horrible Microsoft overlords shoved unneeded security updates down their poor throats and instead Word just displayed a message that the file is corrupted. I bet that user then thinks to themselves "Damn you Microsoft and you're oppressive security update regime! I opened the damn file, I want to be infected!". > I'm attempting to say that the user is given no freedom to choose when and if to install updates. Good, security ones need to be always installed right away. Average Joe doesn't give a flying f* about patch management, he doesn't want to get hit by the latest exploit out in the wild. > MS keeps on releasing broken updates which render thousands of PCs broken. If you're OK with that then I'm fine. Citation needed. Also thousands out of what, 1.25 billion? I'll take those percentages any day, a hell of a lot better than most companies. MS also has an absolutely ridiculous patch testing setup involving tens of thousands of versions of windows across lots of different hardware. But of course that doesn't matter to a zealot. > Secondly, it's a myth that Windows must be updated to stay secure. It's such a huge myth it's actually cringe worthy. That's the crux of it isn't it. Ignorance. How can you type that with a straight face? By all means keep rolling around with an unpatched Windows machine, thinking this is 1999 where the biggest threat is internet worms spreading via open ports and hoping your cheap, exploit-infested router running the cheapest, oldest software they could find is going to help you. > And if you're stupid enough to rely on MS Security Essentials then I will stop arguing with you. That's not an AV - that's a huge hole. Microsoft's efforts with Essentials are commendable, how can you not see that. If you've got 1.25 billion active devices running Windows and even 25% of those don't run any form of antivirus (I'm positive the number is much higher than that) then that's 312,500,000 unprotected machines. Releasing a free antivirus that's effective 90% of the time is a great thing to do for internet security as a whole. But hey, just ignore that and keep lambasting them for whatever bad experiences you had with Windows.
- mynameislegion 10y ago
  > That's the crux of it isn't it. Ignorance. How can you type that with a straight face? By all means keep rolling around with an unpatched Windows machine, thinking this is 1999 where the biggest threat is internet worms spreading via open ports and hoping your cheap, exploit-infested router is going to help you. If you router is infested you've got even a bigger problem - your system then can be trivially exploited because the attacker may inject whatever HTML code he wishes and render your system totally powned. Also remind me when was the last time Windows had readily available exploits against its core open ports. I'm under the impression that you remember that circa 15 years ago there was an exploit for unpatched Windows 2000 which either infected your PC or rebooted it. Again, all I hear is bla bla bla and no valid argumentation. Also, I'm ready to install Windows 7 SP1 64 (that's now a six years old system) without any patches applied and I can give you its IP to break in. I can bet $1000 you won't break in in any amount of time even with all network ports open. So much for "windows updates must be installed in order to survive". Pathetic.
  - orf 10y ago
    > Again, all I hear is bla bla bla and no valid argumentation. All I hear is "bla bla bla who needs security updates" with absolutely nothing of substance to back that point of view up up. Feel free to use the reply button to actually make this point using some actual facts, data or anything other than your apparent superpowers at deflecting exploits with your bare hands. In the meantime I hope you don't do any banking on that machine or even browse the internet. Edit: SP1 was released in 2010, here is a breakdown of Windows 7 CVEs: https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... Since 2011 I count nearly 100 RCE exploits, 40 overflows, 20 memory corruptions and like 150 privilege escalations. I hope you've patched all those, or is blind faith the best protection? Another edit: https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=17153&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=577&sha=47d29bad4e41fa72927e93dbd6b6e2cbeefa4e07 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... 'Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a malformed asynchronous RPC request, aka "Remote Procedure Call Vulnerability." ' Hmm... what's that about open ports being absolutely fine because of... reasons? Do some damn research.

orf 10y ago

Edit: You're comical to the point of absurdity. > The truth is Windows has had some remote vulnerabilities in regard to fonts rendering and such but they are very difficult to exploit (and I haven't heard of any circulating in the wild exploits). You say absurd things like 'Secondly, it's a myth that Windows must be updated to stay secure. It's such a huge myth it's actually cringe worthy.', then in the same comment talk about how actually there are pretty serious remote vulnerabilities that don't require user interaction (or some, like clicking something), but that's OK because "I haven't heard of any circulating in the wild exploits". :') http://www.networkworld.com/article/2969896/microsoft-subnet/microsoft-patches-windows-10-edge-4-critical-holes-2-exploits-in-the-wild.html http://www.networkworld.com/article/2969896/microsoft-subnet... https://googleprojectzero.blogspot.co.uk/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.co.uk/2015/07/one-font-vu... http://wccftech.com/december-patch-tuesday-fixes-zero-day-vulnerabilities/ http://wccftech.com/december-patch-tuesday-fixes-zero-day-vu... http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-leak-uncovers-another-windows-zero-day-ms-releases-patch/ http://blog.trendmicro.com/trendlabs-security-intelligence/h... ----- > You took just one item on the list to attack without even giving valid sound arguments The onus is on you to explain why protecting your machine with security updates is a bad thing. Making up statistics and misunderstanding basic security concepts doesn't count as an argument. > Again in 99% of cases users get infected by downloading shady files from the net or opening unrequested e-mail attachments. Windows updates will NEVER save you from that. That's so stupid it's laughable. Here's one case: the user downloads a malformed .docx file that would cause a buffer overflow in Word and compromise their machine, but instead the horrible Microsoft overlords shoved unneeded security updates down their poor throats and instead Word just displayed a message that the file is corrupted. I bet that user then thinks to themselves "Damn you Microsoft and you're oppressive security update regime! I opened the damn file, I want to be infected!". > I'm attempting to say that the user is given no freedom to choose when and if to install updates. Good, security ones need to be always installed right away. Average Joe doesn't give a flying f* about patch management, he doesn't want to get hit by the latest exploit out in the wild. > MS keeps on releasing broken updates which render thousands of PCs broken. If you're OK with that then I'm fine. Citation needed. Also thousands out of what, 1.25 billion? I'll take those percentages any day, a hell of a lot better than most companies. MS also has an absolutely ridiculous patch testing setup involving tens of thousands of versions of windows across lots of different hardware. But of course that doesn't matter to a zealot. > Secondly, it's a myth that Windows must be updated to stay secure. It's such a huge myth it's actually cringe worthy. That's the crux of it isn't it. Ignorance. How can you type that with a straight face? By all means keep rolling around with an unpatched Windows machine, thinking this is 1999 where the biggest threat is internet worms spreading via open ports and hoping your cheap, exploit-infested router running the cheapest, oldest software they could find is going to help you. > And if you're stupid enough to rely on MS Security Essentials then I will stop arguing with you. That's not an AV - that's a huge hole. Microsoft's efforts with Essentials are commendable, how can you not see that. If you've got 1.25 billion active devices running Windows and even 25% of those don't run any form of antivirus (I'm positive the number is much higher than that) then that's 312,500,000 unprotected machines. Releasing a free antivirus that's effective 90% of the time is a great thing to do for internet security as a whole. But hey, just ignore that and keep lambasting them for whatever bad experiences you had with Windows.

mynameislegion 10y ago
> That's the crux of it isn't it. Ignorance. How can you type that with a straight face? By all means keep rolling around with an unpatched Windows machine, thinking this is 1999 where the biggest threat is internet worms spreading via open ports and hoping your cheap, exploit-infested router is going to help you. If you router is infested you've got even a bigger problem - your system then can be trivially exploited because the attacker may inject whatever HTML code he wishes and render your system totally powned. Also remind me when was the last time Windows had readily available exploits against its core open ports. I'm under the impression that you remember that circa 15 years ago there was an exploit for unpatched Windows 2000 which either infected your PC or rebooted it. Again, all I hear is bla bla bla and no valid argumentation. Also, I'm ready to install Windows 7 SP1 64 (that's now a six years old system) without any patches applied and I can give you its IP to break in. I can bet $1000 you won't break in in any amount of time even with all network ports open. So much for "windows updates must be installed in order to survive". Pathetic.
- orf 10y ago
  > Again, all I hear is bla bla bla and no valid argumentation. All I hear is "bla bla bla who needs security updates" with absolutely nothing of substance to back that point of view up up. Feel free to use the reply button to actually make this point using some actual facts, data or anything other than your apparent superpowers at deflecting exploits with your bare hands. In the meantime I hope you don't do any banking on that machine or even browse the internet. Edit: SP1 was released in 2010, here is a breakdown of Windows 7 CVEs: https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... Since 2011 I count nearly 100 RCE exploits, 40 overflows, 20 memory corruptions and like 150 privilege escalations. I hope you've patched all those, or is blind faith the best protection? Another edit: https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=17153&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=577&sha=47d29bad4e41fa72927e93dbd6b6e2cbeefa4e07 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... 'Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a malformed asynchronous RPC request, aka "Remote Procedure Call Vulnerability." ' Hmm... what's that about open ports being absolutely fine because of... reasons? Do some damn research.