6 ms·

We need a cultural shift in this industry away from thinking it’s OK to run outdated and vulnerable software. “Why should we upgrade? $OLD_VERSION works fine!”

We need a cultural shift in this industry away from thinking it’s OK to run outdated and vulnerable software. “Why should we upgrade? $OLD_VERSION works fine!” Yeah, and driving a car with no seatbelts or airbags works fine too... until it doesn’t.

inferiorhuman 9y ago
Sure that's great, but air bags and seat belts also come with cameras that record your behavior and report back to the auto manufacturer. And ads.
- iClaudiusX 9y ago
  And the install process has a non-negligible chance of bricking your car until you get it towed back to the dealer.
  - snaky 9y ago
    And uninstall process is like "Burnett deleted the new Paint 3D, a system app, which he is entirely entitled to do. He found the system restored it and added a firewall rule allowing it network access."
jenscow 9y ago
But Windows 7 is still being supported (or so they say).
panic 9y ago
Many people running Windows 7 aren't "in this industry" -- they're ordinary people trying to use their computers to do work, or play games, or keep in touch with other people. What our industry needs to do is stop building software full of crap (ads, spyware, bugs) people don't want. If the software is good, people will upgrade.
bobcostas55 9y ago
If 10 wasn't seen as an enormous downgrade people would treat the vulnerability issues more seriously. Just the other day I saw a huge powershell script whose purpose was to remove all the bloatware (which apparently re-installs itself on its own if you uninstall it normally). I don't want to bother with that stuff... And on top of that you have the telemetry, endless horror stories of forced restarts for updates, updates resetting settings and/or degrading performance (which took 5 months to resolve in the case of the Creators Update: https://betanews.com/2017/09/11/windows-10-game-performance-fix/ https://betanews.com/2017/09/11/windows-10-game-performance-...)...7 works like clockwork, with no bullshit.
- gruez 9y ago
  >And on top of that you have the telemetry, endless horror stories of forced restarts for updates, updates resetting settings and/or degrading performance (which took 5 months to resolve in the case of the Creators Update: https://betanews.com/2017/09/11/windows-10-game-performance-... https://betanews.com/2017/09/11/windows-10-game-performance-...)...7 works like clockwork, with no bullshit. And that's why you get LTSB, which have no "feature updates", only security updates for 10 years. Although one disadvantage is that the release schedule is sporadic (there was one in 2015, 2016, and the next one is in 2019). I guess you could also use get the pro edition and choose "defer upgrades", which buys you ~6 months before having to install a feature upgrade.
  - wtallis 9y ago
    > And that's why you get LTSB That's why you wish you could get LTSB, but you can't unless you're a large corporation. For most users, it's not a solution, it's a tease.
    - EvanAnderson 9y ago
      You can get LTSB on an Open Business license. That's a minimum 5 license purchase to open the agreement. I'm not arguing that Windows 10 LTSB is easy to get or economical, but I've put it into a couple pretty small companies. It's definitely not geared toward home users, but it's not just "large corporations" either.
ksk 9y ago
It seems like Microsoft has "learnt" from Chrome and the whole web-apps ecosystem where the users are conscripted into accepting continuous updates. I don't doubt that the average user is better off, but they should be making escape-hatches available for the technical folks who wish to exert a greater level of control over machines they administer.
- AnIdiotOnTheNet 9y ago
  Except that the average user has moved on to phones and tablets. Desktops stick around for office workers, gamers, and content creators. The last two are the kind of people who want control over their computer to improve their experience/workflow, and the first one is supported by IT that wants control over their users' computers to improve their users' experience/workflow. Microsoft has done nothing good for their customers with the bullshit path they've taken since Windows 8.
  - ksk 9y ago
    I am happy with Windows 10, as of now. They have done good, in my opinion. But then again, I usually switch OSs once MS has released a service pack or two, so I can't say if it was as big of a shitshow as people claimed it was in the begining.
    - AnIdiotOnTheNet 9y ago
      It's still a shitshow, believe me. If you can't see it it is only because you don't work with it as often as others. Google "Windows 10 start button stopped working" and spend a good 20 minutes reading forum posts about the problem. What you'll find is typical of Windows 10: there are no good answers for why it happens, the only consistent solution is to reinstall the OS, and it has been a problem for years and still hasn't been fixed. Meanwhile, they did take the time to remove "Control Panel" as an option when right-clicking the start button, and add a feature that begs you to try Edge when you set another browser as default.
      - 9y ago
userbinator 9y ago
Yeah, and driving a car with no seatbelts or airbags works fine too... until it doesn’t. People still ride motorcycles, many times more dangerous, which proves that (IMHO fortunately) safety/security is NOT the only thing that everyone cares about. The general authoritarianism in the comments here, and implication that everyone always and only wants "more secure", while neglecting all the other factors, is a bit unsettling... As the old saying goes, "Those who sacrifice freedom for security deserve neither."
Oxitendwe 9y ago
It is one of the greatest failings of our industry that we are apparently incapable of constructing programs that are in any sense "complete" due to requiring vast amounts of upkeep just to ensure their most basic possible property: that their semantics are defined completely by their source code and not inputs (as is not the case with programs containing remote code execution or escaping bugs like SQL injections, XSS, etc). This constant upkeep not only has an enormous cost in terms of time spent modifying these programs to move them asymptotically closer to a version with clearly defined semantics, but (unlike other classes of bugs which involve incorrect behavior that do not have implications for security) produce an air of mistrust and a general malaise and lack of confidence in all software. One direct implication of this fact, for programs which must be constantly updated to fix their security flaws, is that because the only semblance of trust and security you can obtain in using this software comes from its popularity and reputation (because these things generally mean a large amount of resources can be spent auditing and testing ("many eyes make all bugs shallow"), and because a large userbase means that any bugs found will be more valuable and more difficult to find, and thus less likely to be used against people who are not profitable to be hacked, which is most people), viably forking large projects becomes impossible without a similar or proportional amount of resources to the original project. Without that, having confidence in the new project becomes much more difficult, because you cannot receive an assurance that bugs found in the original project will be fixed in the fork, and because bugs found in the fork might be easier to find (because of less thorough testing, because of fewer resources) and so of less value, and so have a higher chance of ending up in the hands of low-level skiddies who might use them even less responsibly than e.g. the NSA (who has never directly installed ransomware on anyone's computer, that I know of). None of this of course is mentioning the effect this culture of fear and mistrust (and its basis in reality) has on computer users who truly are valuable targets, and must use computers to do their job knowing full well that they are a mire of both intentional and unintentional security vulnerabilities and that somewhere out there exists a string of exploits that can be used to exfiltrate their IP address and send them straight to the gulags. Another cost of this unfortunate facet of computer programming is that for programs which cannot be directly updated (for example, their source code is not available), modifying them so that they are closer to a version with clearly-defined semantics is extremely difficult, involves specialized skills which are not possessed by most programmers, and generally just doesn't happen very often. Although one could also make this an argument in favor of source code availability, in any case this is a very common occurrence. So, I don't think at all that the problem is this culture of foolishly thinking that we actually know how to write programs - the problem is that we can't. The solution then, at least in the long term, is learning how to write complete programs that do not require constant adjustments in order to ensure clearly defined semantics, not to just figure out how to stay afloat better in this horrifying quagmire of shifting quicksand that we've built the foundations of computer software on.

inferiorhuman 9y ago

Sure that's great, but air bags and seat belts also come with cameras that record your behavior and report back to the auto manufacturer. And ads.

iClaudiusX 9y ago
And the install process has a non-negligible chance of bricking your car until you get it towed back to the dealer.
- snaky 9y ago
  And uninstall process is like "Burnett deleted the new Paint 3D, a system app, which he is entirely entitled to do. He found the system restored it and added a firewall rule allowing it network access."

jenscow 9y ago

But Windows 7 is still being supported (or so they say).

panic 9y ago

Many people running Windows 7 aren't "in this industry" -- they're ordinary people trying to use their computers to do work, or play games, or keep in touch with other people. What our industry needs to do is stop building software full of crap (ads, spyware, bugs) people don't want. If the software is good, people will upgrade.

bobcostas55 9y ago

If 10 wasn't seen as an enormous downgrade people would treat the vulnerability issues more seriously. Just the other day I saw a huge powershell script whose purpose was to remove all the bloatware (which apparently re-installs itself on its own if you uninstall it normally). I don't want to bother with that stuff... And on top of that you have the telemetry, endless horror stories of forced restarts for updates, updates resetting settings and/or degrading performance (which took 5 months to resolve in the case of the Creators Update: https://betanews.com/2017/09/11/windows-10-game-performance-fix/ https://betanews.com/2017/09/11/windows-10-game-performance-...)...7 works like clockwork, with no bullshit.

gruez 9y ago
>And on top of that you have the telemetry, endless horror stories of forced restarts for updates, updates resetting settings and/or degrading performance (which took 5 months to resolve in the case of the Creators Update: https://betanews.com/2017/09/11/windows-10-game-performance-... https://betanews.com/2017/09/11/windows-10-game-performance-...)...7 works like clockwork, with no bullshit. And that's why you get LTSB, which have no "feature updates", only security updates for 10 years. Although one disadvantage is that the release schedule is sporadic (there was one in 2015, 2016, and the next one is in 2019). I guess you could also use get the pro edition and choose "defer upgrades", which buys you ~6 months before having to install a feature upgrade.
- wtallis 9y ago
  > And that's why you get LTSB That's why you wish you could get LTSB, but you can't unless you're a large corporation. For most users, it's not a solution, it's a tease.
  - EvanAnderson 9y ago
    You can get LTSB on an Open Business license. That's a minimum 5 license purchase to open the agreement. I'm not arguing that Windows 10 LTSB is easy to get or economical, but I've put it into a couple pretty small companies. It's definitely not geared toward home users, but it's not just "large corporations" either.

ksk 9y ago

It seems like Microsoft has "learnt" from Chrome and the whole web-apps ecosystem where the users are conscripted into accepting continuous updates. I don't doubt that the average user is better off, but they should be making escape-hatches available for the technical folks who wish to exert a greater level of control over machines they administer.

AnIdiotOnTheNet 9y ago
Except that the average user has moved on to phones and tablets. Desktops stick around for office workers, gamers, and content creators. The last two are the kind of people who want control over their computer to improve their experience/workflow, and the first one is supported by IT that wants control over their users' computers to improve their users' experience/workflow. Microsoft has done nothing good for their customers with the bullshit path they've taken since Windows 8.
- ksk 9y ago
  I am happy with Windows 10, as of now. They have done good, in my opinion. But then again, I usually switch OSs once MS has released a service pack or two, so I can't say if it was as big of a shitshow as people claimed it was in the begining.
  - AnIdiotOnTheNet 9y ago
    It's still a shitshow, believe me. If you can't see it it is only because you don't work with it as often as others. Google "Windows 10 start button stopped working" and spend a good 20 minutes reading forum posts about the problem. What you'll find is typical of Windows 10: there are no good answers for why it happens, the only consistent solution is to reinstall the OS, and it has been a problem for years and still hasn't been fixed. Meanwhile, they did take the time to remove "Control Panel" as an option when right-clicking the start button, and add a feature that begs you to try Edge when you set another browser as default.
    - 9y ago

userbinator 9y ago

Yeah, and driving a car with no seatbelts or airbags works fine too... until it doesn’t. People still ride motorcycles, many times more dangerous, which proves that (IMHO fortunately) safety/security is NOT the only thing that everyone cares about. The general authoritarianism in the comments here, and implication that everyone always and only wants "more secure", while neglecting all the other factors, is a bit unsettling... As the old saying goes, "Those who sacrifice freedom for security deserve neither."

Oxitendwe 9y ago

It is one of the greatest failings of our industry that we are apparently incapable of constructing programs that are in any sense "complete" due to requiring vast amounts of upkeep just to ensure their most basic possible property: that their semantics are defined completely by their source code and not inputs (as is not the case with programs containing remote code execution or escaping bugs like SQL injections, XSS, etc). This constant upkeep not only has an enormous cost in terms of time spent modifying these programs to move them asymptotically closer to a version with clearly defined semantics, but (unlike other classes of bugs which involve incorrect behavior that do not have implications for security) produce an air of mistrust and a general malaise and lack of confidence in all software. One direct implication of this fact, for programs which must be constantly updated to fix their security flaws, is that because the only semblance of trust and security you can obtain in using this software comes from its popularity and reputation (because these things generally mean a large amount of resources can be spent auditing and testing ("many eyes make all bugs shallow"), and because a large userbase means that any bugs found will be more valuable and more difficult to find, and thus less likely to be used against people who are not profitable to be hacked, which is most people), viably forking large projects becomes impossible without a similar or proportional amount of resources to the original project. Without that, having confidence in the new project becomes much more difficult, because you cannot receive an assurance that bugs found in the original project will be fixed in the fork, and because bugs found in the fork might be easier to find (because of less thorough testing, because of fewer resources) and so of less value, and so have a higher chance of ending up in the hands of low-level skiddies who might use them even less responsibly than e.g. the NSA (who has never directly installed ransomware on anyone's computer, that I know of). None of this of course is mentioning the effect this culture of fear and mistrust (and its basis in reality) has on computer users who truly are valuable targets, and must use computers to do their job knowing full well that they are a mire of both intentional and unintentional security vulnerabilities and that somewhere out there exists a string of exploits that can be used to exfiltrate their IP address and send them straight to the gulags. Another cost of this unfortunate facet of computer programming is that for programs which cannot be directly updated (for example, their source code is not available), modifying them so that they are closer to a version with clearly-defined semantics is extremely difficult, involves specialized skills which are not possessed by most programmers, and generally just doesn't happen very often. Although one could also make this an argument in favor of source code availability, in any case this is a very common occurrence. So, I don't think at all that the problem is this culture of foolishly thinking that we actually know how to write programs - the problem is that we can't. The solution then, at least in the long term, is learning how to write complete programs that do not require constant adjustments in order to ensure clearly defined semantics, not to just figure out how to stay afloat better in this horrifying quagmire of shifting quicksand that we've built the foundations of computer software on.