10 ms·

Uh, except Microsoft had already patched the vulnerability, just not for XP that was still being run. Of course you can punish them and force them to support a

Uh, except Microsoft had already patched the vulnerability, just not for XP that was still being run. Of course you can punish them and force them to support all legacy OSes forever, until that strangles the life out of them at which point large institutions still have to run the old OS because they have too much investment in computer controlled hardware with no forward migration. Now they are locked into an insecure technology stack with no vendor to take responsibility and no source code to even take on the problem themselves. There's plenty of blame to go around to be sure, but giving the NSA a pass for developing zero days is batshit insane. These guys are playing god instead of helping make infrastructure more secure overall, and it will not end well, even if they outcompete the Chinese or whatever other bogeyman they cook up to justify their power grab.

ouid 9y ago
how much do you think it would cost Microsoft to support XP forever?
- nevir 9y ago
  There's a big argument for only releasing evergreen style software, and giving the middle finger to IT orgs that want more control
  - goatherders 9y ago
    This. There are lots of groups to blame, but corporate IT departments are high on the list.
  - Consultant32452 9y ago
    What does "evergreen style software" mean? A quick search didn't return an obvious answer.
    - Sammi 9y ago
      Software that continually updates itself automatically. It's what Chrome popularized.
      - ascagnel_ 9y ago
        I think MS wanted this in Win10 (hence the big push on the consumer side by giving it away for free). The problem is that plenty of people, even people who should know better, don't want to upgrade something they think is "working well" for an advantage they can't see.
  - deleted 9y ago
    [deleted]
- deleted 9y ago
  [deleted]
- threeseed 9y ago
  Allowing XP to exist forever is not a good thing for security either. There are security architectures in place within Windows 10 for example that do significantly improve security. At some point companies need to cough up the money and upgrade their technology.
  - ouid 9y ago
    Is there some philosophical principle under which you believe that companies must "cough up money" for services that they have already ostensibly paid for? That sounds remarkably like extortion. If Windows XP is proven to be untenably insecure, anyone who bought it should receive a refund.
    - mikekchar 9y ago
      Assuming we class XP as a defective product, at what point do we stop requiring recalls? If there is a safety defect in a 2001 model car, will it be required to have a recall? Given that MS even made a patch (which is generally equivalent to a recall), I'm not sure that your suggestion will be given that much credence. I mean, if we say that XP is an unsafe product, the government could stop them from selling it and to remove it from the shelves, but MS stopped selling the product in 2008 (nearly 10 years ago) and has repeated urged its customers to stop using it because it is insecure. This is all that the government generally requires in this situation as far as I can tell. Edit: grammar
    - retox 9y ago
      I think the discovery of new types of exploits could be considered akin to wear-and-tear of physical things you buy. At the point of sale the software was safe, but over time problems were discovered. When you buy a house you have a whole battery of inspections performed to make sure that you're buying somewhere safe, but over time the small things that got overlooked (like a small crack in a roof joint) or were considered safe at the point of sale become worn, or are discovered to be unsafe (locks susceptible to bumplocking for instance). It's a tenuous analogy to be sure, but I don't think it's reasonable to think that Microsoft should refund people who bought XP. Are there any Linux distributions that back port all fixes to version 0.1?
- deleted 9y ago
  [deleted]
- lysp 9y ago
  Microsoft still are supporting XP. Just not for the the general public. Organisations with high value software that relies on XP still receive ongoing support from Microsoft (such as the US Navy and anyone else who wants to pay big bucks for it). The difference is none of these patches usually make it to the public. For Microsoft to patch this current issue, there would have already been a pre-existing team working on XP patches, the only difference is this one was released publicly due to it's impact. http://bgr.com/2015/06/24/windows-xp-support-us-navy-millions/ http://bgr.com/2015/06/24/windows-xp-support-us-navy-million...
thomastjeffery 9y ago
This is why free software is necessary. Proprietary software makes you rely on a company to fix everything. It's like driving a car without being able to replace a flat tire.
- deleted 9y ago
  [deleted]
- Robin_Message 9y ago
  Maybe the law should say 'security patches or open source'?
  - chopin 9y ago
    The law should simply put liability on the software, if it is not open source.
  - thomastjeffery 9y ago
    Why do you want the law involved? What we have is a cultural issue, not a legal issue.
- pjmlp 9y ago
  The CVE database or Open SSL, are good examples how much safer open source actually is.
  - pksadiq 9y ago
    > ... are good examples how much safer open source actually is. Sorry, open source never equals free software (most of the time). Though what you said may be true for both. And some day, we will surely know why free software is better than open source. It's only a matter of time. But by the time, it will be late, and out of control.
    - pjmlp 9y ago
      Free software can be closed source, which is why companies love MIT style licenses.
developer2 9y ago
>> large institutions still have to run the old OS because they have too much investment in computer controlled hardware with no forward migration. Now they are locked into an insecure technology stack with no vendor to take responsibility Any company that locks themselves into a specific operating system, and then declines investing to upgrade with each new release is entirely at fault. I can imagine the executives at these companies complaining about how their one-time outsourced application made overseas cannot possibly be migrated. Even if built locally, clearly no money was budgeted to maintain the software or infrastructure. These companies get what is coming to them when their only priority is the current quarter's bottom line, with no planning for how the company will manage to keep operations up and running in the next quarter, let alone the years ahead. You specifically mention lock-in due to "computer controlled hardware". The idea that companies build the core of their business on hardware that can be controlled with Windows XP but not Windows 7 or Windows 10 is laughable. How is that even possible? The backwards compatibility Microsoft provides means it's nearly impossible for any application to become unusable within a decade - or even longer. The application will need to be maintained with minor changes to make use of modified APIs, or to transition from 32 to 64 bit architecture, etc. - but the amount of work needed is nowhere near infeasible. It only becomes difficult if you spend many years ignoring required upgrades, and then try to perform a single massive upgrade covering half a dozen missed release cycles all at once. Even hardware ports going out of fashion (example: serial ports) is not the end of the world. Compatibility between the latest operating system and old port standards will always be possible, as those that need such things make it happen. No sympathy for any company still running Windows XP. None whatsoever. It sucks when it's government that is affected, whereby taxpayers' dollars take the hit for the fallout. Still not a shocking, unexpected result. In fact, this is precisely the expected result.
youdontknowtho 9y ago
See, but you're making practical sense about the real world. That's not going to fly with people using this as an opportunity to push their favorite narrative. I agree with the point on the NSA. there were surgeries cancelled in the UK. This materially impacted the lives of our allies. How is that supposed to work? Luckily we've got a set of level heads running every branch of government these days...
bigbugbag 9y ago
Why would you pay to change something that works fine ? And pay more to have your software redone, and pay more to have the employees retrained. Microsoft wants more money and push newer revisions of the same crap instead of actually improving the existing one. Until win10 that is, win10 is now the only windows version and offers more spying, a worse UI and UX while also including ads.

ouid 9y ago

how much do you think it would cost Microsoft to support XP forever?

nevir 9y ago
There's a big argument for only releasing evergreen style software, and giving the middle finger to IT orgs that want more control
- goatherders 9y ago
  This. There are lots of groups to blame, but corporate IT departments are high on the list.
- Consultant32452 9y ago
  What does "evergreen style software" mean? A quick search didn't return an obvious answer.
  - Sammi 9y ago
    Software that continually updates itself automatically. It's what Chrome popularized.
    - ascagnel_ 9y ago
      I think MS wanted this in Win10 (hence the big push on the consumer side by giving it away for free). The problem is that plenty of people, even people who should know better, don't want to upgrade something they think is "working well" for an advantage they can't see.
- deleted 9y ago
  [deleted]
deleted 9y ago
[deleted]
threeseed 9y ago
Allowing XP to exist forever is not a good thing for security either. There are security architectures in place within Windows 10 for example that do significantly improve security. At some point companies need to cough up the money and upgrade their technology.
- ouid 9y ago
  Is there some philosophical principle under which you believe that companies must "cough up money" for services that they have already ostensibly paid for? That sounds remarkably like extortion. If Windows XP is proven to be untenably insecure, anyone who bought it should receive a refund.
  - mikekchar 9y ago
    Assuming we class XP as a defective product, at what point do we stop requiring recalls? If there is a safety defect in a 2001 model car, will it be required to have a recall? Given that MS even made a patch (which is generally equivalent to a recall), I'm not sure that your suggestion will be given that much credence. I mean, if we say that XP is an unsafe product, the government could stop them from selling it and to remove it from the shelves, but MS stopped selling the product in 2008 (nearly 10 years ago) and has repeated urged its customers to stop using it because it is insecure. This is all that the government generally requires in this situation as far as I can tell. Edit: grammar
  - retox 9y ago
    I think the discovery of new types of exploits could be considered akin to wear-and-tear of physical things you buy. At the point of sale the software was safe, but over time problems were discovered. When you buy a house you have a whole battery of inspections performed to make sure that you're buying somewhere safe, but over time the small things that got overlooked (like a small crack in a roof joint) or were considered safe at the point of sale become worn, or are discovered to be unsafe (locks susceptible to bumplocking for instance). It's a tenuous analogy to be sure, but I don't think it's reasonable to think that Microsoft should refund people who bought XP. Are there any Linux distributions that back port all fixes to version 0.1?
deleted 9y ago
[deleted]
lysp 9y ago
Microsoft still are supporting XP. Just not for the the general public. Organisations with high value software that relies on XP still receive ongoing support from Microsoft (such as the US Navy and anyone else who wants to pay big bucks for it). The difference is none of these patches usually make it to the public. For Microsoft to patch this current issue, there would have already been a pre-existing team working on XP patches, the only difference is this one was released publicly due to it's impact. http://bgr.com/2015/06/24/windows-xp-support-us-navy-millions/ http://bgr.com/2015/06/24/windows-xp-support-us-navy-million...

thomastjeffery 9y ago

This is why free software is necessary. Proprietary software makes you rely on a company to fix everything. It's like driving a car without being able to replace a flat tire.

deleted 9y ago
[deleted]
Robin_Message 9y ago
Maybe the law should say 'security patches or open source'?
- chopin 9y ago
  The law should simply put liability on the software, if it is not open source.
- thomastjeffery 9y ago
  Why do you want the law involved? What we have is a cultural issue, not a legal issue.
pjmlp 9y ago
The CVE database or Open SSL, are good examples how much safer open source actually is.
- pksadiq 9y ago
  > ... are good examples how much safer open source actually is. Sorry, open source never equals free software (most of the time). Though what you said may be true for both. And some day, we will surely know why free software is better than open source. It's only a matter of time. But by the time, it will be late, and out of control.
  - pjmlp 9y ago
    Free software can be closed source, which is why companies love MIT style licenses.

developer2 9y ago

>> large institutions still have to run the old OS because they have too much investment in computer controlled hardware with no forward migration. Now they are locked into an insecure technology stack with no vendor to take responsibility Any company that locks themselves into a specific operating system, and then declines investing to upgrade with each new release is entirely at fault. I can imagine the executives at these companies complaining about how their one-time outsourced application made overseas cannot possibly be migrated. Even if built locally, clearly no money was budgeted to maintain the software or infrastructure. These companies get what is coming to them when their only priority is the current quarter's bottom line, with no planning for how the company will manage to keep operations up and running in the next quarter, let alone the years ahead. You specifically mention lock-in due to "computer controlled hardware". The idea that companies build the core of their business on hardware that can be controlled with Windows XP but not Windows 7 or Windows 10 is laughable. How is that even possible? The backwards compatibility Microsoft provides means it's nearly impossible for any application to become unusable within a decade - or even longer. The application will need to be maintained with minor changes to make use of modified APIs, or to transition from 32 to 64 bit architecture, etc. - but the amount of work needed is nowhere near infeasible. It only becomes difficult if you spend many years ignoring required upgrades, and then try to perform a single massive upgrade covering half a dozen missed release cycles all at once. Even hardware ports going out of fashion (example: serial ports) is not the end of the world. Compatibility between the latest operating system and old port standards will always be possible, as those that need such things make it happen. No sympathy for any company still running Windows XP. None whatsoever. It sucks when it's government that is affected, whereby taxpayers' dollars take the hit for the fallout. Still not a shocking, unexpected result. In fact, this is precisely the expected result.

youdontknowtho 9y ago

See, but you're making practical sense about the real world. That's not going to fly with people using this as an opportunity to push their favorite narrative. I agree with the point on the NSA. there were surgeries cancelled in the UK. This materially impacted the lives of our allies. How is that supposed to work? Luckily we've got a set of level heads running every branch of government these days...

bigbugbag 9y ago

Why would you pay to change something that works fine ? And pay more to have your software redone, and pay more to have the employees retrained. Microsoft wants more money and push newer revisions of the same crap instead of actually improving the existing one. Until win10 that is, win10 is now the only windows version and offers more spying, a worse UI and UX while also including ads.