9 ms·

Although it is probably good for the companies still using windows XP to receive those updates, I do not think updating windows xp was such a smart move because

Although it is probably good for the companies still using windows XP to receive those updates, I do not think updating windows xp was such a smart move because now those companies do not need to update once again and keep running outdated windows machines. If Microsoft did not provide this update for older OSes, I believe more people would update because they simply had to. Smaller hacks might not be enough for the manager of those machines to allocate resources to update, but this hack might have been just fatale enough for them to update those machines. And we should all expect to see such a hack again. This is not a one in a century thing. Such costly hacks could easily happen a few times a year.

sschueller 9y ago
I think the issue here is that Microsoft has a patch already for those special support contracts and holding it back may become some pr issue.
- deleted 9y ago
  [deleted]
- irl_ 9y ago
  What about all the other patches they're holding back? This can't be the only security issue they've only selectively distributed patches for.
  - my123 9y ago
    Yes, they hold back a lot of fixes. It's exceptional, a lot of unfixed flaws are still there. :)
  - easilyBored 9y ago
    They'd be no incentive to upgrade otherwise. XP is 16 years old! Microsoft is in a tough spot, this was a worldwide problem so they had no choice. They should make the support contracts for old version quadruple in price for every year and offer incentives to upgrades. Better for them, more revenue and less bad press for MSFT.
- hsivonen 9y ago
  The XP SP3 update was signed on 2017-02-11.
  - dogma1138 9y ago
    Now that's a PR problem.
davidgerard 9y ago
It's pretty clear that this completely 100% predictable and predicted attack - open source and free software people have only been talking about the incredibly obvious dangers of a proprietary IT monoculture for 20 years now - is such a damaging "welp, Stallman was right again" moment that Microsoft didn't really have much choice.
- Silhouette 9y ago
  This has almost nothing to do with proprietary vs. open source. A patch for the vulnerability exploited here had been available for months. The real problem is that organisations had devices sufficiently connected to be vulnerable that had not the patch applied. That leads to questions about software update policies within those organisations, and that in turn leads to some quite difficult questions about regulated medical devices and how they are supplied and maintained.
  - syshum 9y ago
    >>A patch for the vulnerability exploited here had been available for months. Not for XP/2003. That patch was not generally available months ago
    - belltaco 9y ago
      I don't think Linux distributions from 2001 are receiving security updates today. The only thing going for a free(as in beer) OS is that upgrades are free, but the main reason that so many corporate systems are still on XP is compatibility, not the cost of the upgrade license which is peanuts for large orgs affected by this. And Linux distros from 2001 would still have the exact same problem. Consider the fact that Windows has the best backward compatibility in the business, while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux.
      - syshum 9y ago
        due to the nature of Linux being a Monolithic Kernel and open source, there tends to be less issue with backward compatibility issues with Linux making it easier to update systems that today companies refuse to update windows on because it is not compatible with older hardware/software Infact Linux often has the reverse problem in that hardware support for new technology often lags behind because hardware vendors focus on Windows first. >Consider the fact that Windows has the best backward compatibility in the business, That is a complete and utter myth. Windows has terrible backwards compatibility, and changes to the Windows Driver model, and other changes require drivers and software to be completely rewritten between generations of windows. >while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux. Where do you get this? Drivers are included in the Linux Kernel, it is impossible for a driver to "break" across minor version of Linux, if a driver breaks the kernel fails and is not released.
lumberjack 9y ago
Some companies have no choice but to run old systems. For example in the labs I use there are plenty of equipment hooked up to PCs running Windows 95 and Windows 98. The equipment works fine. The proprietary software for the controller and the logging software is old and there is no version that works on newer systems. The only option is to buy a whole new kit which is a stupid waste of money. So we just use these stand alone Win 95/98 computers instead.
- humanrebar 9y ago
  > The only option is to buy a whole new kit which is a stupid waste of money. ...and running unsecured operating systems is what? Let's say your front doors stopped locking one day. Is it a waste of money to solve the problem, even if that meant replacing the entire door?
  - JunkDNA 9y ago
    In a lab that does clinical work, replacing a single instrument could mean having to re-validate all the tests the lab does, update protocols, get inspections from regulatory bodies, etc... it requires people to spend large amounts of time not doing their "regular" jobs.
    - Bost 9y ago
      And all that thanks to Microsoft. What a lovely company!
    - humanrebar 9y ago
      Designing a system that is secure is part of the job. Accurately estimating the total cost of ownership is also part of the job. Ultimately project management and ownership is responsible, but they won't be interested if we don't make our expectations clear. Downvoting these sort of opinions is just saying it's too expensive to secure some things. To me that means we can't afford to computerize some things in the first place, at least not with the chosen tech stacks.
  - astrobe_ 9y ago
krylon 9y ago
At work, our automation people have one or two customers with industrial plants where the PCs connected to the PLCs still run XP, because they use some very specific piece of hardware whose vendor went out of business, so there are no device drivers for more recent versions of Windows. (Hell, I've been at one plant where PC side of the automation still ran on NT 4.0! The customer is reluctant to replace that machine because the interface to the plant automation is a freaking ISA card, and it has become rather difficult to procure a motherboard with an ISA slot.) It's easy to tell people to update, but in some cases it's just not that simple. (OTOH, the plants I know about are not connected to the Internet.) And don't get me wrong, I totally agree that it would be better in so many different ways if these machines were upgraded. But some users basically have no choice.
- raverbashing 9y ago
  Ok. Then it is not plugged to a network. Or uses a separate network
  - r3bl 9y ago
    Agreed. Still not bulletproof (see Stuxnet, which transferred to PLCs over USB sticks), but you're good against classical malware (as in, not developed by a state actor).
  - krylon 9y ago
    I sadly suspect if a large corporation with a very small ethics department or a state actor wanted to subvert these networks, they would have very little trouble doing so. Another comment mentioned Stuxnet which proves that point rather well. Fortunately, these plants I am talking about are food plants (yoghurt, pudding, and such), so the risk of some foreign government wanting to shut down that plant is rather low. ;-) And the risk of becoming infected by drive-by malware is contained by not letting these machines talk to the Internet. (There is one connection to the regular corporate network, which does have Internet access, to tell the ERP system how much of each ingredient is left so the Purchasing department will order new ingredients on time. But in my benevolent imagination that connection is one teeeny-tiny hole through a humongous firewall.)
codedokode 9y ago
Upgrading from XP gives no benefits (for me), the PC would only work slower (and will get telemetry spyware). I wish Microsoft stopped developing new OS with useless (for me) features and instead fixed bugs in older systems. The only good thing that was added in Windows 7 was a search field in start menu. And builtin firewall became able to filter outgoing connections. But it is not worth bothering with upgrading the system.
- r3bl 9y ago
  How about having an up-to-date browser? Firefox stopped supporting XP with v52, and Chrome with v50. There were some problems with opening Let's Encrypt-encrypted websites on one of these browsers since they've stopped supporting it, can't remember which one.
nathan_f77 9y ago
Alternatively, Microsoft should continue to support Windows XP as long as there are a large number of critical systems that rely on it. They are unable to upgrade because it would break a lot of legacy software. I believe Windows XP should have been supported for at least 50 years, considering how many people still depend on it. IMO, Microsoft has acted irresponsibly, and the decision was only driven by money. Sure, 2001 was a long time ago, but so what? What's wrong with a PC that runs the same OS for 100 years? Sometimes things work fine just the way they are. For all intents and purposes, most machines running Windows XP are fast enough. Office workers aren't running some insane virtual reality system, they're responding to emails and entering data into some Visual Basic application. I understand that newer versions of Windows do have stronger security, so it is better if people can upgrade to a more secure version of Windows. But it would have been better if those security features were somehow back-ported. But seriously, can the current version of Windows please be considered "finished"? Why not spend the next 50 years just maintaining Windows 10, just the way it is? Imagine if they devoted all of their resources to finding and fixing all of the possible security issues until it's virtually bulletproof, and the price of a zero-day gets to a billion dollars. I think it's a shame that Microsoft constantly releases unnecessary upgrades and tried to get people to keep buying new licenses.
- melling 9y ago
  The world will change more in the next 50 years than it did in the last 100. Do you really think it's a good idea to stop all progress on a major OS?
  - deleted 9y ago
    [deleted]
  - _red 9y ago
    I think you must differentiate between a general purpose OS and a single-purpose OS. Why isn't XP good enough to run a map kiosk in a mall? Or flight arrivals screen in the airport? Face it, the needs of many single-use applications where solved decades ago...the need to constantly undergo the endless forced upgrade cycle waste a tremendous amount of human effort.
Spooky23 9y ago
Microsoft still sold XP recently. XPe is still supported. It's unconscionable that they sat on this.
- my123 9y ago
  XPe POSReady patches are usable on normal XP without a lot of work.
devwastaken 9y ago
"once again"? There's been thousands of reasons why already, this is just one piece of malware in the giant field. These companies don't care, and in many cases it doesn't make sense to care because the device isn't even capable of direct internet access and is just embedded XP.
- RndPwn 9y ago
  how would these offline devices get patched?
  - devwastaken 9y ago
    They're not offline, theyre just not directly connected. Instead, they're on an in-house network which relays the info back over VPN, or can only be connected to specific addresses over VPN.
PhasmaFelis 9y ago
When hardware vendors leave their customers in the lurch to force them to replace perfectly good equipment, we call it "planned obsolescence" and deplore it. When software vendors do it, it's business as usual.
King-Aaron 9y ago
> I believe more people would update because they simply had to. In an ideal world, sure. However many organisations run older machines because of large-scale investment in now-defunct technology, which they can't afford to re-invest.

sschueller 9y ago

I think the issue here is that Microsoft has a patch already for those special support contracts and holding it back may become some pr issue.

deleted 9y ago
[deleted]
irl_ 9y ago
What about all the other patches they're holding back? This can't be the only security issue they've only selectively distributed patches for.
- my123 9y ago
  Yes, they hold back a lot of fixes. It's exceptional, a lot of unfixed flaws are still there. :)
- easilyBored 9y ago
  They'd be no incentive to upgrade otherwise. XP is 16 years old! Microsoft is in a tough spot, this was a worldwide problem so they had no choice. They should make the support contracts for old version quadruple in price for every year and offer incentives to upgrades. Better for them, more revenue and less bad press for MSFT.
hsivonen 9y ago
The XP SP3 update was signed on 2017-02-11.
- dogma1138 9y ago
  Now that's a PR problem.

davidgerard 9y ago

It's pretty clear that this completely 100% predictable and predicted attack - open source and free software people have only been talking about the incredibly obvious dangers of a proprietary IT monoculture for 20 years now - is such a damaging "welp, Stallman was right again" moment that Microsoft didn't really have much choice.

Silhouette 9y ago
This has almost nothing to do with proprietary vs. open source. A patch for the vulnerability exploited here had been available for months. The real problem is that organisations had devices sufficiently connected to be vulnerable that had not the patch applied. That leads to questions about software update policies within those organisations, and that in turn leads to some quite difficult questions about regulated medical devices and how they are supplied and maintained.
- syshum 9y ago
  >>A patch for the vulnerability exploited here had been available for months. Not for XP/2003. That patch was not generally available months ago
  - belltaco 9y ago
    I don't think Linux distributions from 2001 are receiving security updates today. The only thing going for a free(as in beer) OS is that upgrades are free, but the main reason that so many corporate systems are still on XP is compatibility, not the cost of the upgrade license which is peanuts for large orgs affected by this. And Linux distros from 2001 would still have the exact same problem. Consider the fact that Windows has the best backward compatibility in the business, while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux.
    - syshum 9y ago
      due to the nature of Linux being a Monolithic Kernel and open source, there tends to be less issue with backward compatibility issues with Linux making it easier to update systems that today companies refuse to update windows on because it is not compatible with older hardware/software Infact Linux often has the reverse problem in that hardware support for new technology often lags behind because hardware vendors focus on Windows first. >Consider the fact that Windows has the best backward compatibility in the business, That is a complete and utter myth. Windows has terrible backwards compatibility, and changes to the Windows Driver model, and other changes require drivers and software to be completely rewritten between generations of windows. >while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux. Where do you get this? Drivers are included in the Linux Kernel, it is impossible for a driver to "break" across minor version of Linux, if a driver breaks the kernel fails and is not released.

lumberjack 9y ago

Some companies have no choice but to run old systems. For example in the labs I use there are plenty of equipment hooked up to PCs running Windows 95 and Windows 98. The equipment works fine. The proprietary software for the controller and the logging software is old and there is no version that works on newer systems. The only option is to buy a whole new kit which is a stupid waste of money. So we just use these stand alone Win 95/98 computers instead.

humanrebar 9y ago
> The only option is to buy a whole new kit which is a stupid waste of money. ...and running unsecured operating systems is what? Let's say your front doors stopped locking one day. Is it a waste of money to solve the problem, even if that meant replacing the entire door?
- JunkDNA 9y ago
  In a lab that does clinical work, replacing a single instrument could mean having to re-validate all the tests the lab does, update protocols, get inspections from regulatory bodies, etc... it requires people to spend large amounts of time not doing their "regular" jobs.
  - Bost 9y ago
    And all that thanks to Microsoft. What a lovely company!
  - humanrebar 9y ago
    Designing a system that is secure is part of the job. Accurately estimating the total cost of ownership is also part of the job. Ultimately project management and ownership is responsible, but they won't be interested if we don't make our expectations clear. Downvoting these sort of opinions is just saying it's too expensive to secure some things. To me that means we can't afford to computerize some things in the first place, at least not with the chosen tech stacks.
- astrobe_ 9y ago

krylon 9y ago

At work, our automation people have one or two customers with industrial plants where the PCs connected to the PLCs still run XP, because they use some very specific piece of hardware whose vendor went out of business, so there are no device drivers for more recent versions of Windows. (Hell, I've been at one plant where PC side of the automation still ran on NT 4.0! The customer is reluctant to replace that machine because the interface to the plant automation is a freaking ISA card, and it has become rather difficult to procure a motherboard with an ISA slot.) It's easy to tell people to update, but in some cases it's just not that simple. (OTOH, the plants I know about are not connected to the Internet.) And don't get me wrong, I totally agree that it would be better in so many different ways if these machines were upgraded. But some users basically have no choice.

raverbashing 9y ago
Ok. Then it is not plugged to a network. Or uses a separate network
- r3bl 9y ago
  Agreed. Still not bulletproof (see Stuxnet, which transferred to PLCs over USB sticks), but you're good against classical malware (as in, not developed by a state actor).
- krylon 9y ago
  I sadly suspect if a large corporation with a very small ethics department or a state actor wanted to subvert these networks, they would have very little trouble doing so. Another comment mentioned Stuxnet which proves that point rather well. Fortunately, these plants I am talking about are food plants (yoghurt, pudding, and such), so the risk of some foreign government wanting to shut down that plant is rather low. ;-) And the risk of becoming infected by drive-by malware is contained by not letting these machines talk to the Internet. (There is one connection to the regular corporate network, which does have Internet access, to tell the ERP system how much of each ingredient is left so the Purchasing department will order new ingredients on time. But in my benevolent imagination that connection is one teeeny-tiny hole through a humongous firewall.)

codedokode 9y ago

Upgrading from XP gives no benefits (for me), the PC would only work slower (and will get telemetry spyware). I wish Microsoft stopped developing new OS with useless (for me) features and instead fixed bugs in older systems. The only good thing that was added in Windows 7 was a search field in start menu. And builtin firewall became able to filter outgoing connections. But it is not worth bothering with upgrading the system.

r3bl 9y ago
How about having an up-to-date browser? Firefox stopped supporting XP with v52, and Chrome with v50. There were some problems with opening Let's Encrypt-encrypted websites on one of these browsers since they've stopped supporting it, can't remember which one.

nathan_f77 9y ago

Alternatively, Microsoft should continue to support Windows XP as long as there are a large number of critical systems that rely on it. They are unable to upgrade because it would break a lot of legacy software. I believe Windows XP should have been supported for at least 50 years, considering how many people still depend on it. IMO, Microsoft has acted irresponsibly, and the decision was only driven by money. Sure, 2001 was a long time ago, but so what? What's wrong with a PC that runs the same OS for 100 years? Sometimes things work fine just the way they are. For all intents and purposes, most machines running Windows XP are fast enough. Office workers aren't running some insane virtual reality system, they're responding to emails and entering data into some Visual Basic application. I understand that newer versions of Windows do have stronger security, so it is better if people can upgrade to a more secure version of Windows. But it would have been better if those security features were somehow back-ported. But seriously, can the current version of Windows please be considered "finished"? Why not spend the next 50 years just maintaining Windows 10, just the way it is? Imagine if they devoted all of their resources to finding and fixing all of the possible security issues until it's virtually bulletproof, and the price of a zero-day gets to a billion dollars. I think it's a shame that Microsoft constantly releases unnecessary upgrades and tried to get people to keep buying new licenses.

melling 9y ago
The world will change more in the next 50 years than it did in the last 100. Do you really think it's a good idea to stop all progress on a major OS?
- deleted 9y ago
  [deleted]
- _red 9y ago
  I think you must differentiate between a general purpose OS and a single-purpose OS. Why isn't XP good enough to run a map kiosk in a mall? Or flight arrivals screen in the airport? Face it, the needs of many single-use applications where solved decades ago...the need to constantly undergo the endless forced upgrade cycle waste a tremendous amount of human effort.

Spooky23 9y ago

Microsoft still sold XP recently. XPe is still supported. It's unconscionable that they sat on this.

my123 9y ago
XPe POSReady patches are usable on normal XP without a lot of work.

devwastaken 9y ago

"once again"? There's been thousands of reasons why already, this is just one piece of malware in the giant field. These companies don't care, and in many cases it doesn't make sense to care because the device isn't even capable of direct internet access and is just embedded XP.

RndPwn 9y ago
how would these offline devices get patched?
- devwastaken 9y ago
  They're not offline, theyre just not directly connected. Instead, they're on an in-house network which relays the info back over VPN, or can only be connected to specific addresses over VPN.

PhasmaFelis 9y ago

When hardware vendors leave their customers in the lurch to force them to replace perfectly good equipment, we call it "planned obsolescence" and deplore it. When software vendors do it, it's business as usual.

King-Aaron 9y ago

> I believe more people would update because they simply had to. In an ideal world, sure. However many organisations run older machines because of large-scale investment in now-defunct technology, which they can't afford to re-invest.