5 ms·

> "And what happens if some of the software or equipment used with that system is not compatible with Windows 10?" It is irresponsible for a firm or government

> "And what happens if some of the software or equipment used with that system is not compatible with Windows 10?" It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. > "You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product." What defect are you referring to exactly? That Microsoft years ago couldn't predict every way that cybersecurity attacks happened to their OS? Or that users of versions of Microsoft software still under support contracts (including firms and governments) did not run software update tools for a patch released in mid-March? It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. Later versions of OSs include not only different architectures to fix cybersecurity flaws but take into account changes in the Intel hardware that help to combat cybersecurity attacks.

Silhouette 9y ago
It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. We're talking about things like medical equipment, often in regulated fields. There may be no such contract available, and even if there is, upgrading to a totally new OS may or may not be acceptable. The idea that you should throw out millions of pounds of high-tech medical scanner every few years because a hundred buck OS that it was supplied with couldn't be kept secure is laughable. What defect are you referring to exactly? They supplied an OS that was not secure. The rest is just rationalisation and apologies. It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place. Perhaps the problem here was that such systems should never have been built on such an insecure platform and then connected to a network, but that too is on the device manufacturer and not the hospital. There are basic standards of fitness for purpose that are reasonably expected with such devices, even without more specific regulation. Particularly in this sort of field, those devices should then be supported for their entire working lives, not some arbitrarily shortened version of their working lives dictated by one software development organisation.
- davidf18 9y ago
  Firms that implement software using software from a vendor (eg, Microsoft) have to follow the manufacturers instructions. If they feel they cannot do that, then they should use a different OS vendor (not Microsoft). That goes for proper, documented uses of the API but also for not using unsupported versions of the OS. When people purchase equipment, there are equipment contracts. Medical equipment, depending on the type, needs to follow FDA approval guidelines. Clearly, not piece of equipment should allowed to be running in a hospital based on an unsupported version of an operating system. That is simply irresponsible. Each newer version of Microsoft OS implements security features not in earlier versions. In some cases, there are changes to the Intel hardware for additional security that later versions of the OS take advantage of. Again, firms and governments should not be using unsupported versions of hardware or software. > "It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place." The longevity is mostly the supported API across different versions of the OS, and not the OS itself. Each version of Microsoft OS comes out with additional security features and vendors who use Microsoft OS (or any OS) need to plan for upgrading their application software that uses the OS and purchasers of application software should insist on it.
  - Silhouette 9y ago
    Clearly, not piece of equipment should allowed to be running in a hospital based on an unsupported version of an operating system. That is simply irresponsible. You keep writing things like that, as if the only practical alternative in many cases was not turning the equipment off altogether. Each newer version of Microsoft OS implements security features not in earlier versions. And more spyware, too. What should a hospital do if Microsoft decides to instruct them to update to a new version of Windows that will automatically upload all of the data on the local hard drives to a Microsoft-cloud-hosted backup system, complete with all the legally protected sensitive personal information? Again, this issue can't just be as simple as suppliers getting to move the goalposts however they want after the sale. The longevity is mostly the supported API across different versions of the OS, and not the OS itself. Then why are so many healthcare providers who were caught last week saying they couldn't upgrade from Windows XP because some essential functionality of other software or equipment no longer worked on Windows 10?

Silhouette 9y ago

It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. We're talking about things like medical equipment, often in regulated fields. There may be no such contract available, and even if there is, upgrading to a totally new OS may or may not be acceptable. The idea that you should throw out millions of pounds of high-tech medical scanner every few years because a hundred buck OS that it was supplied with couldn't be kept secure is laughable. What defect are you referring to exactly? They supplied an OS that was not secure. The rest is just rationalisation and apologies. It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place. Perhaps the problem here was that such systems should never have been built on such an insecure platform and then connected to a network, but that too is on the device manufacturer and not the hospital. There are basic standards of fitness for purpose that are reasonably expected with such devices, even without more specific regulation. Particularly in this sort of field, those devices should then be supported for their entire working lives, not some arbitrarily shortened version of their working lives dictated by one software development organisation.

davidf18 9y ago
Firms that implement software using software from a vendor (eg, Microsoft) have to follow the manufacturers instructions. If they feel they cannot do that, then they should use a different OS vendor (not Microsoft). That goes for proper, documented uses of the API but also for not using unsupported versions of the OS. When people purchase equipment, there are equipment contracts. Medical equipment, depending on the type, needs to follow FDA approval guidelines. Clearly, not piece of equipment should allowed to be running in a hospital based on an unsupported version of an operating system. That is simply irresponsible. Each newer version of Microsoft OS implements security features not in earlier versions. In some cases, there are changes to the Intel hardware for additional security that later versions of the OS take advantage of. Again, firms and governments should not be using unsupported versions of hardware or software. > "It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place." The longevity is mostly the supported API across different versions of the OS, and not the OS itself. Each version of Microsoft OS comes out with additional security features and vendors who use Microsoft OS (or any OS) need to plan for upgrading their application software that uses the OS and purchasers of application software should insist on it.
- Silhouette 9y ago
  Clearly, not piece of equipment should allowed to be running in a hospital based on an unsupported version of an operating system. That is simply irresponsible. You keep writing things like that, as if the only practical alternative in many cases was not turning the equipment off altogether. Each newer version of Microsoft OS implements security features not in earlier versions. And more spyware, too. What should a hospital do if Microsoft decides to instruct them to update to a new version of Windows that will automatically upload all of the data on the local hard drives to a Microsoft-cloud-hosted backup system, complete with all the legally protected sensitive personal information? Again, this issue can't just be as simple as suppliers getting to move the goalposts however they want after the sale. The longevity is mostly the supported API across different versions of the OS, and not the OS itself. Then why are so many healthcare providers who were caught last week saying they couldn't upgrade from Windows XP because some essential functionality of other software or equipment no longer worked on Windows 10?