7 ms·

> They are unable to upgrade because it would break a lot of legacy software. I believe Windows XP should have been supported for at least 50 years, considering

> They are unable to upgrade because it would break a lot of legacy software. I believe Windows XP should have been supported for at least 50 years, considering how many people still depend on it. It's not Microsoft's fault that people depend on Windows XP. IMHO it's the fault of companies buying hardware and software from manufacturers who are unwilling or unable to upgrade their product to run on newer versions of Windows. To put it another way: the only reason there is a huge demand for COBOL programmers is because banks are too spendthrift to rewrite their software in more modern languages. > IMO, Microsoft has acted irresponsibly, and the decision was only driven by money. Welcome to the world of successful businesses. They don't do things for altruistic reasons, they do it because it makes money. > Imagine if they devoted all of their resources to finding and fixing all of the possible security issues until it's virtually bulletproof, and the price of a zero-day gets to a billion dollars. I think it's a shame that Microsoft constantly releases unnecessary upgrades and tried to get people to keep buying new licenses. A lot to unpack here. 1) I personally don't think it's possible for anyone to design a general purpose OS as complex as Windows that is bug free. Just look up how small the space shuttle software was (IIRC ~600,000 LOC) and how mind bogglingly expensive it was. 2) Businesses could already avoid a lot of this if they didn't view IT as a cost centre and instead as an investment. 3) Yes Windows 10 is a privacy nightmare. But Microsoft has made real strides in OS security since XP. It's wrong to claim that all they've done is put a minimalist theme on the same old OS. From a security perspective they absolutely are not "unnecessary upgrades"

jaxn 9y ago
It is absolutely Microsoft's fault. Many of the existing XP computers a big monolithic systems that have been decentralized so Microsoft could sell more licenses. Think networks of retail stores using hundreds or thousands of PCs for their point-of-sale. Or government agencies like the DMV with locations in every rural county. They put a PC on every not-quite-a-desk.
- aanm1988 9y ago
  and did they say "don't ever upgrade this"?
Joeri 9y ago
From a security standpoint the best thing is to stop adding features and fix security issues as they are found so the system gradually becomes secure. The upgrade treadmill is good for microsoft's revenue stream, but bad for customers who already have a working system. New != better, just different. I guarantee you that w10 has just as many security holes as xp, they just haven't been found yet because it's so new.
- Sindisil 9y ago
  If there is no revenue stream, where do the resources to fix security issues come from?
  - jackvalentine 9y ago
    Aren't the vast majority of Windows revenues from new PC sales and volume licensing? Both would continue if Windows was "perfect" feature-wise and only security updates were provided going forward.
    - dom0 9y ago
      > if Windows was "perfect" feature-wise and only security updates were provided going forward. Therefore the kernel is secure, assuming spherical cows are used in the bubble memory of the return stack.
  - maxerickson 9y ago
    One possibility is from the huge surplus that they collected when they initially sold the software. It seems to ultimately boil down to software becoming more expensive to sell, especially when it will be used in critical situations.
    - quickben 9y ago
      But that's handled by the contract at the point of sale. One Windows XP with N years of support for $ money. Legally, they are covered.
AnthonyMouse 9y ago
> It's not Microsoft's fault that people depend on Windows XP. IMHO it's the fault of companies buying hardware and software from manufacturers who are unwilling or unable to upgrade their product to run on newer versions of Windows. It is Microsoft's fault. A software customer doesn't know that a vendor is going to go out of business or get bought by a competitor that discontinues their product and promotes an incompatible alternative with seven figure transition costs. Microsoft are the ones who worked so hard to make sure that software for Windows isn't compatible with not-Windows, creating all their own alternatives to POSIX, OpenGL, Open Firmware and everything else so that it's as difficult as possible for software compatible with Windows XP to be compatible with any Unix or Linux, leaving the user out in the cold if it also isn't compatible with Vista or later. > To put it another way: the only reason there is a huge demand for COBOL programmers is because banks are too spendthrift to rewrite their software in more modern languages. The reason there is huge demand for COBOL programmers is that it's more reasonable to hire a COBOL programmer than to discard a working system with a multi-million dollar replacement cost. "Just throw away everything you own and start over from nothing" is only rarely cost effective.
- kogepathic 9y ago
  > It is Microsoft's fault. A software customer doesn't know that a vendor is going to go out of business or get bought by a competitor that discontinues their product and promotes an incompatible alternative with seven figure transition costs. It is categorically NOT Microsoft's fault that software vendors are bought or go out of business. It's on the software customer to ensure that they don't get stuck with vendor lock-in. Reverse the situation: A bunch of critical systems which run Linux 2.4 are being compromised by cyber criminals via a kernel exploit. You're going to argue that it's Linus' fault for providing such a great kernel and not supporting it forever? Or that it's Linus' fault vendor XY who hasn't existed since 2 mergers ago chose Linux 2.4 for their product and now aren't around to provide updates for legacy software? > Microsoft are the ones who worked so hard to make sure that software for Windows isn't compatible with not-Windows, creating all their own alternatives to POSIX, OpenGL, Open Firmware and everything else so that it's as difficult as possible for software compatible with Windows XP to be compatible with any Unix or Linux, leaving the user out in the cold if it also isn't compatible with Vista or later. And so does every other operating system on the planet. You cannot take a MacOS binary and run it on Linux. And until very recently you couldn't take a Linux binary and run it on Windows. You could argue that with Linux, the only thing preventing it from running Win32 or MachO binaries is that those operating systems are closed source, but this is the world we live in. If you want a "universal" binary, write it in something like Java. https://xkcd.com/927/ https://xkcd.com/927/ > The reason there is huge demand for COBOL programmers is that it's more reasonable to hire a COBOL programmer than to discard a working system with a multi-million dollar replacement cost. "Just throw away everything you own and start over from nothing" is only rarely cost effective. Yes, and I feel that I addressed this when I said "because banks are too spendthrift to rewrite their software" It's a business decision. Currently it's cheaper for banks to hire COBOL programmers at obscene rates to fix their software. Eventually, there either won't be COBOL programmers, or they'll be too expensive, and the bean counters will dictate it's time to rewrite.
muraiki 9y ago
> To put it another way: the only reason there is a huge demand for COBOL programmers is because banks are too spendthrift to rewrite their software in more modern languages. I heard that medical devices are approved (by whatever regulatory body) to run an _exact_ set of software. As such, even applying a security update invalidates the approval, because it could potentially introduce bugs that place a patient's life at risk.
- keithpeter 9y ago
  Not sure that those systems are connected to the Internet. The software affected in the NHS was mainly in GP surgeries and admin offices to do with scheduling of procedures. Not directly life-threatening in the sense of a machine going wrong but indirectly damaging in the sense of procedures and consultations having to be cancelled, records not being available &c. Looking decades into future I'm wondering: Web applications + fairly basic clients Chromebook style for the scheduling/records stuff.
- azernik 9y ago
  The computers that store patient records (which were compromised) are not medical devices under any regulatory regime I know of. And in any case the compromises were in the UK, which may have different rules on this subject than the FDA.
  - muraiki 9y ago
    Yeah, my point was just that sometimes systems have out of date security for reasons besides penny pinching and laziness. :)
ouid 9y ago
>It's not Microsoft's fault that people depend on Windows XP. When XP was released, Microsoft was unarguably a monopoly. Monopolistic businesses have responsibilities that other, non-monopolistic businesses don't. The law is vague, but the FTC could reasonably force Microsoft to continue to patch security problems in windows XP forever. After all, the defects to which the support period refers existed within that support period, regardless of when they were proven to exist.
Shorel 9y ago
> It's not Microsoft's fault that people depend on Windows XP. It absolutely is. Not releasing the Windows XP successor in 2004 as it was promised to customers and shareholders is their fault. Microsoft only released a successor 6 years after XP release, 3 years later than promised. And it doesn't help Windows Vista was a disaster on its release.
tclancy 9y ago
>banks are too spendthrift Only being a pedant because this came up in /r/soccer today about an hour beforehand. That means the opposite of what you want it to mean.
- kogepathic 9y ago
  > That means the opposite of what you want it to mean. Thanks! I actually didn't know this. Do you have a suggestion of a better term for the behaviour I'm trying to describe? I was trying to be more elegant than "cheap"

jaxn 9y ago

It is absolutely Microsoft's fault. Many of the existing XP computers a big monolithic systems that have been decentralized so Microsoft could sell more licenses. Think networks of retail stores using hundreds or thousands of PCs for their point-of-sale. Or government agencies like the DMV with locations in every rural county. They put a PC on every not-quite-a-desk.

aanm1988 9y ago
and did they say "don't ever upgrade this"?

Joeri 9y ago

From a security standpoint the best thing is to stop adding features and fix security issues as they are found so the system gradually becomes secure. The upgrade treadmill is good for microsoft's revenue stream, but bad for customers who already have a working system. New != better, just different. I guarantee you that w10 has just as many security holes as xp, they just haven't been found yet because it's so new.

Sindisil 9y ago
If there is no revenue stream, where do the resources to fix security issues come from?
- jackvalentine 9y ago
  Aren't the vast majority of Windows revenues from new PC sales and volume licensing? Both would continue if Windows was "perfect" feature-wise and only security updates were provided going forward.
  - dom0 9y ago
    > if Windows was "perfect" feature-wise and only security updates were provided going forward. Therefore the kernel is secure, assuming spherical cows are used in the bubble memory of the return stack.
- maxerickson 9y ago
  One possibility is from the huge surplus that they collected when they initially sold the software. It seems to ultimately boil down to software becoming more expensive to sell, especially when it will be used in critical situations.
  - quickben 9y ago
    But that's handled by the contract at the point of sale. One Windows XP with N years of support for $ money. Legally, they are covered.

AnthonyMouse 9y ago

> It's not Microsoft's fault that people depend on Windows XP. IMHO it's the fault of companies buying hardware and software from manufacturers who are unwilling or unable to upgrade their product to run on newer versions of Windows. It is Microsoft's fault. A software customer doesn't know that a vendor is going to go out of business or get bought by a competitor that discontinues their product and promotes an incompatible alternative with seven figure transition costs. Microsoft are the ones who worked so hard to make sure that software for Windows isn't compatible with not-Windows, creating all their own alternatives to POSIX, OpenGL, Open Firmware and everything else so that it's as difficult as possible for software compatible with Windows XP to be compatible with any Unix or Linux, leaving the user out in the cold if it also isn't compatible with Vista or later. > To put it another way: the only reason there is a huge demand for COBOL programmers is because banks are too spendthrift to rewrite their software in more modern languages. The reason there is huge demand for COBOL programmers is that it's more reasonable to hire a COBOL programmer than to discard a working system with a multi-million dollar replacement cost. "Just throw away everything you own and start over from nothing" is only rarely cost effective.

kogepathic 9y ago
> It is Microsoft's fault. A software customer doesn't know that a vendor is going to go out of business or get bought by a competitor that discontinues their product and promotes an incompatible alternative with seven figure transition costs. It is categorically NOT Microsoft's fault that software vendors are bought or go out of business. It's on the software customer to ensure that they don't get stuck with vendor lock-in. Reverse the situation: A bunch of critical systems which run Linux 2.4 are being compromised by cyber criminals via a kernel exploit. You're going to argue that it's Linus' fault for providing such a great kernel and not supporting it forever? Or that it's Linus' fault vendor XY who hasn't existed since 2 mergers ago chose Linux 2.4 for their product and now aren't around to provide updates for legacy software? > Microsoft are the ones who worked so hard to make sure that software for Windows isn't compatible with not-Windows, creating all their own alternatives to POSIX, OpenGL, Open Firmware and everything else so that it's as difficult as possible for software compatible with Windows XP to be compatible with any Unix or Linux, leaving the user out in the cold if it also isn't compatible with Vista or later. And so does every other operating system on the planet. You cannot take a MacOS binary and run it on Linux. And until very recently you couldn't take a Linux binary and run it on Windows. You could argue that with Linux, the only thing preventing it from running Win32 or MachO binaries is that those operating systems are closed source, but this is the world we live in. If you want a "universal" binary, write it in something like Java. https://xkcd.com/927/ https://xkcd.com/927/ > The reason there is huge demand for COBOL programmers is that it's more reasonable to hire a COBOL programmer than to discard a working system with a multi-million dollar replacement cost. "Just throw away everything you own and start over from nothing" is only rarely cost effective. Yes, and I feel that I addressed this when I said "because banks are too spendthrift to rewrite their software" It's a business decision. Currently it's cheaper for banks to hire COBOL programmers at obscene rates to fix their software. Eventually, there either won't be COBOL programmers, or they'll be too expensive, and the bean counters will dictate it's time to rewrite.

muraiki 9y ago

> To put it another way: the only reason there is a huge demand for COBOL programmers is because banks are too spendthrift to rewrite their software in more modern languages. I heard that medical devices are approved (by whatever regulatory body) to run an _exact_ set of software. As such, even applying a security update invalidates the approval, because it could potentially introduce bugs that place a patient's life at risk.

keithpeter 9y ago
Not sure that those systems are connected to the Internet. The software affected in the NHS was mainly in GP surgeries and admin offices to do with scheduling of procedures. Not directly life-threatening in the sense of a machine going wrong but indirectly damaging in the sense of procedures and consultations having to be cancelled, records not being available &c. Looking decades into future I'm wondering: Web applications + fairly basic clients Chromebook style for the scheduling/records stuff.
azernik 9y ago
The computers that store patient records (which were compromised) are not medical devices under any regulatory regime I know of. And in any case the compromises were in the UK, which may have different rules on this subject than the FDA.
- muraiki 9y ago
  Yeah, my point was just that sometimes systems have out of date security for reasons besides penny pinching and laziness. :)

ouid 9y ago

>It's not Microsoft's fault that people depend on Windows XP. When XP was released, Microsoft was unarguably a monopoly. Monopolistic businesses have responsibilities that other, non-monopolistic businesses don't. The law is vague, but the FTC could reasonably force Microsoft to continue to patch security problems in windows XP forever. After all, the defects to which the support period refers existed within that support period, regardless of when they were proven to exist.

Shorel 9y ago

> It's not Microsoft's fault that people depend on Windows XP. It absolutely is. Not releasing the Windows XP successor in 2004 as it was promised to customers and shareholders is their fault. Microsoft only released a successor 6 years after XP release, 3 years later than promised. And it doesn't help Windows Vista was a disaster on its release.

tclancy 9y ago

>banks are too spendthrift Only being a pedant because this came up in /r/soccer today about an hour beforehand. That means the opposite of what you want it to mean.

kogepathic 9y ago
> That means the opposite of what you want it to mean. Thanks! I actually didn't know this. Do you have a suggestion of a better term for the behaviour I'm trying to describe? I was trying to be more elegant than "cheap"