6 ms·

Microsoft Offers Windows 7 Extended Update Support to SMBs

53 points by miles 7y ago

Jonnax 7y ago
"ESUs ranges from $25 per device for Windows Enterprise users in the first year to $100 per device in the third. For per-user users, the ESU price ranges from $50 per device in the first year to $200 per device in the third year." Not outrageously expensive. I imagine quite a few businesses will pay.
- Silhouette 7y ago
  I imagine quite a few businesses will pay. We'll certainly be at least reading up on this. Small business environment, running 7 Pro on most of our desktops, zero interest in Windows 10, zero interest in getting involved with enterprise-level administrative mess, but still stuck on Windows for at least some of those machines because of a few business-critical software packages and therefore still interested in getting security updates for those machines. That said, given Microsoft's recent track record, half of me is expecting the other shoe to drop here. In particular, if it turns out that the updates offered are like the full monthly roll-ups and bundle in things like ambiguous telemetry and other user-hostile changes, our interest will immediately drop to zero in this as well. That sort of junk is part of the reason we're avoiding 10 in the first place.
  - gerdesj 7y ago
    "because of a few business-critical software packages" What are they?
    - EvanAnderson 7y ago
      Not the OP, but my Customers are stuck on Windows because of ERP and accounting systems, line-of-business applications (logistics, quality assurance/statistics, food labeling, specialty POS), applications to drive speciality hardware devices (scientific instruments, PLC programming, industrial machines), and, of course, user familarity and general desire for the Microsoft Office applications (and Outlook I particular).
      - gerdesj 7y ago
        We wrote our own ERP and accounting system. OK we partnered up with someone who did it for his factory (he's an accountant by trade and a FOSS lover) and hired a programmer to continue development. We are a small company (~GBP1.5M pa) but we have some fairly complex needs. I'm the only full time Linux user in the firm but as the MD I get by quite happily with Arch on my desktop and laptop, Libre Office and Evolution instead of MS apps - we use Exchange exclusively btw and Evo has a very stable EWS connector and supports Kerberos. Add winbind and I am "domain joined". I use an auto mounter that makes the Windows server shares appear under my home directory as needed. I have CUPS which is also Kerberized. My machine is quite often used by the staff as a handy set of utilities on the end of PuTTY, which supports GSSAPI for SSO. I own an IT company and also find entrenched tastes hard to combat. Oh well, Rome wasn't built in a day. The main trouble is MSDN and NFR makes cost/benefit hard to fly as an argument. Just like the drugs industry, the pushers get their drugs/apps for free!
    - Silhouette 7y ago
      It depends on our current engagement. We often deal with clients who use specialist equipment and/or software themselves, and we need compatibility. A lot of this is moving to online or embedded systems now as well, so the problem becomes less of a problem with time, but it's not a non-issue yet. Also, a lot of creative software doesn't have a Linux version, and in some cases it only runs on either Windows or Mac but not the other, so there is a lack of flexibility there. Again compatibility is a concern, but also the blunt truth is that most of the Linux-friendly FOSS packages simply aren't as good, and even where they could be, they would typically need a significant migration project.
  - marpstar 7y ago
    Genuinely curious: what's your long term strategy if Microsoft doesn't address your concerns? Desktop Linux?
    - Silhouette 7y ago
      As much as possible, we avoid fixed long-term strategies, or perhaps it's more accurate to say we avoid commitments far into the future. One of the advantages of running smaller businesses in the tech industry is that everything is customised anyway, at least for each individual, and sometimes for a specific engagement. We can therefore adapt to problems or opportunities more quickly than bigger organisations that need centralised IT, standardised equipment bought in volume from preferred suppliers, standardised preinstalled images, and all that. One very clear strategy we do have is to avoid lock-in in any form at almost any cost. All of our important data is held in standardised formats as much as possible. Whatever we're doing on the desktop or mobile devices, we run very standard Linux servers behind it. We limit our dependencies on any external suppliers and online services, other than a few trusted ones for things like off-site back-ups, and where it's a practical necessity for something like communications and payment processing. So the short answer to your question is that if Microsoft doesn't address our concerns, we're done with Windows, and presumably our future laptops and workstations will be Mac or Linux systems. The slightly longer answer is that in some cases a degree of lock-in has been unavoidable because the only suitable software is Windows-based, and that's why both the possibility we're discussing here and alternatives like virtualisation are interesting. We want to make sure we're in the clear legally and we're not doing anything silly in terms of security, but ultimately we need these systems for at least as long as any related engagements continue, so if we have to run Windows 7 with no updates and take other precautions to secure it as much as possible, we will.
  - mxuribe 7y ago
    If windows 10 is not a desired option, what is the next step? As another poster noted, is desktop linux a serious consideration? I'm genuinely curious when enterprises take this approach - which admittedly i believe is fully rational - because it feels like MS sort of causes business to paint themselves into a corner. Ok, maybe that's not a fair portrayal, but nevertheless it creates a tough environment.
    - Silhouette 7y ago
      Yes, desktop Linux and Apple gear are the main contenders in our case. I work in a world of relatively small businesses, which among other things means all of our IT equipment tends to be customised to the specific hardware and software needs of each individual using it. We have no "standard desktop" image, nor would it make any sense for us to have one. Right now, in the office where I'm writing this, we have multiple Windows 7 boxes, some Linux gear, both Apple and Android mobile devices, and a variety of specialist kit applicable to our current engagements. Only the Windows 7 boxes are of immediate concern, because of the imminent EOS date combined with each of them running at least one piece of expensive and Windows-only software that we can't trivially replace on the most plausible alternative platforms. So either we keep Windows 7 for a while longer, or we have to at least invest time and potentially significant money in some sort of migration exercise to another package running on another platform in those cases, assuming at least one suitable alternative package is available.
      - mxuribe 7y ago
        I really appreciate what you've shared! Beyond your other comments, i think by not having a "standard desktop image" seems to have made your group that much more flexible; so kudos for that! Also, I'm wishing the best for you and your business, and if you should move to linux I'm keeping my fingers crossed even more! (The more diversity in operating systems, all the better for everyone! Though, i'll admit that i'm greatly biased in favor of linux :-) Best of luck!
  - slacka 7y ago
    I hope you are not the IT decision maker. It seems all of your knowledge of Windows is based from experience with their Home edition. Unlike Home/Pro Edition, telemetry in Windows 10 Enterprise can be disabled with a single group policy option.[1] With GPO = Secure not more data is sent to MS than your Windows 7. You also have full control updates through the group policy(Also found in Pro). Windows 10 Enterprise is the true successor or Windows 7/8 Pro. If telemetry is really such a big deal to you, I'm surprised you didn't spend 2 min. on Google to learn this. I've seen in deployed in several small businesses that care are concerned with privacy/telemetry implications. [1] https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://docs.microsoft.com/en-us/windows/privacy/configure-w...
    - technion 7y ago
      If an IT decision maker researches this, the first thing they'll find is Microsoft's description here[0], which describes Windows Professional Edition as being designed for the SMB. It goes onto describe Enterprise as for "medium and large" businesses, a language they use elsewhere to describe business with 5,000 desktops or more. I get the view this isn't the space the above poster is in. If you buy a business computer, it will come with Windows Professional Edition - it's pointed out in this link that Enterprise Edition is only available to a Volume Licensing customer (noting there are purchase costs beyond what people are used to paying). I don't disagree with you in principle that a conscious person should look in this direction, but Enterprise is beyond the reach of many users. It's beyond the reach of a home user, it's beyond the reach of a business small enough that it doesn't want to buy into a bulk program and it's beyond the reach of a large enterprise that feels they've already spend enough on Microsoft licensing by buying "Professional" systems. They noted they had "zero interest in getting involved with enterprise-level", I have no reason to believe two minutes on Google would change anything for them. [0] https://blogs.windows.com/windowsexperience/2015/05/13/introducing-windows-10-editions/#gKtrdwWscfCqDytx.97 https://blogs.windows.com/windowsexperience/2015/05/13/intro...
    - tinus_hn 7y ago
      If by turn off you mean turn off some of it, yes.
Causality1 7y ago
There's some key part of this equation I'm missing. The premise is that Microsoft wants to focus on Windows 10 but developing security fixes for Windows 7 isn't any cheaper now than it was when Windows 7 was 90% of the userbase, therefore Microsoft wants to stop developing W7 security fixes. But they'll let you pay them to keep developing security fixes for your devices and only your devices. If W7 security fix development is so expensive, how can these fees cover it? Once the fixes exist, why couldn't they be applied to everyone else's Windows 7 PCs? Would it take only a single person with access to the new post-sunset security fixes to distribute them to the rest of the internet in a form of piracy?
- Silhouette 7y ago
  Assuming this is a genuine offer from Microsoft, the strategy could be as simple as assuming there are going to be very many small businesses reluctant to move from 7 to 10 by January because of the well-documented concerns about 10, but still wanting to keep a responsible level of security updates applied on their machines. Businesses in that position seem unlikely to resort to dubious sources for their security updates. It's just not worth the risk, or frankly even the time, assuming the costs for getting the updates legitimately as quoted in the article are accurate.
- xen2xen1 7y ago
  My read was that they would be getting money on a regular basis for Windows 7 this way. MS is pushing for Windows as SaaS hard, this pushes Windows 7 towards SaaS, aka the subscription model. For them it's the best of both worlds. Some stubborn places keep Win7, MS gets regular money from them, and then some day when they actually move to Windows 10 they keep selling them their "managment" features they're selling now. If not, they still replace the Windows Store $ and advertizing $ they get from Windows 10. Where's the downside for them? And in reality, they keep doing patches for YEARS anyway for big customers (US NAVY?) anyway, why not monetize it AND give a clear path to all future things they want to ell you? And all the while saying "You have to leave Windows 7" and washing their hands of lots of things, like WHQL for drivers, software testing, etc...
icebraining 7y ago
Seems like there's a company offering those patches to individuals: https://blog.0patch.com/2019/09/keeping-windows-7-and-windows-server.html https://blog.0patch.com/2019/09/keeping-windows-7-and-window... As a Windows 7 user myself (on a personal computer) for whom upgrading seems clearly net negative, I'm tempted. Has anyone here used their stuff?
- batiudrami 7y ago
  The minor hassle involved in making Windows 10 a far superior option to Windows 7 can be completed in about the same amount of time as it would take to manually install one of these third party "security" updates. It's just turning off a bunch of ad tracking settings if you're bothered by them, and uninstalling a bit of preloaded rubbish and you aren't relying on a third party to inspect code and port patches as best they are able.
  - SmellyGeekBoy 7y ago
    This is assuming that the ads and tracking are the things holding people back. Windows 10 has plenty of other issues compared to 7 - UI sluggishness and visual glitches being one that I've experienced.
    - Krasnol 7y ago
      From my experience it isn't even true for "just" the ads and tracking. Considering that you have to redo it again after a major patch to be sure it gets even worse.
  - icebraining 7y ago
    Yeah, I don't doubt I can disable most of that crap by this time, I just don't really see anything to gain from the upgrade, except for the official security fixes. I use Win10 on my work laptop, and I read a few reviews, and I'm left quite indifferent to it.
userbinator 7y ago
I often wonder how much of a practical threat the exploits which updates fix really are; it seems like the majority of them are either local privilege escalation or exploit a listening service, all of which won't much affect the typical situation of a single-user PC behind a NAT with no forwarded ports and a user who won't be downloading and running random binaries from strangers (a bad idea regardless of how many updates you install...) Fortunately, the truly scary scenario of an attacker taking control over the Internet of a machine that is just left on and with no action needed on the part of the user seems quite rare; in fact, something like that would be very memorable, yet I don't remember any in at least the decade. The closest to that would be Heartbleed, and that wasn't specific to Windows. IMHO Microsoft really alienated users starting with Win8's horrible UI changes, and the incessant "telemetry" spyware that grew profusely in the versions after that certainly did not help at all to restore any trust. Using security updates as an excuse to bundle other unwanted changes is also aggravating.
- infosack 7y ago
  > it seems like the majority of them are either local privilege escalation or exploit a listening service, all of which won't much affect the typical situation of a single-user PC behind a NAT with no forwarded ports and a user who won't be downloading and running random binaries from strangers Browser exploit chains often end up attacking the kernel or local services as part of escaping the sandbox, so it's important to patch these vulnerabilities. > Fortunately, the truly scary scenario of an attacker taking control over the Internet of a machine that is just left on and with no action needed on the part of the user seems quite rare; in fact, something like that would be very memorable, yet I don't remember any in at least the decade. EternalBlue, which exploited a vulnerability in SMB, is probably the most prominent example in recent times. BlueKeep, an RDP exploit, was another serious threat from earlier this year.
  - userbinator 7y ago
    Yes, browser exploits are always worrisome, which is partly the reason I have JS off by default. RDP and SMB aren't exploitable from the Internet if you're behind a NAT
EvanAnderson 7y ago
Putting on my MSFT stockholder hat for a moment: I'm glad to see that they're capitalizing on this market. I don't know how significant the revenue stream will be, but it's better than leaving money on the table.

53 points by miles 7y ago

"ESUs ranges from $25 per device for Windows Enterprise users in the first year to $100 per device in the third. For per-user users, the ESU price ranges from $50 per device in the first year to $200 per device in the third year." Not outrageously expensive. I imagine quite a few businesses will pay.

Silhouette 7y ago
I imagine quite a few businesses will pay. We'll certainly be at least reading up on this. Small business environment, running 7 Pro on most of our desktops, zero interest in Windows 10, zero interest in getting involved with enterprise-level administrative mess, but still stuck on Windows for at least some of those machines because of a few business-critical software packages and therefore still interested in getting security updates for those machines. That said, given Microsoft's recent track record, half of me is expecting the other shoe to drop here. In particular, if it turns out that the updates offered are like the full monthly roll-ups and bundle in things like ambiguous telemetry and other user-hostile changes, our interest will immediately drop to zero in this as well. That sort of junk is part of the reason we're avoiding 10 in the first place.
- gerdesj 7y ago
  "because of a few business-critical software packages" What are they?
  - EvanAnderson 7y ago
    Not the OP, but my Customers are stuck on Windows because of ERP and accounting systems, line-of-business applications (logistics, quality assurance/statistics, food labeling, specialty POS), applications to drive speciality hardware devices (scientific instruments, PLC programming, industrial machines), and, of course, user familarity and general desire for the Microsoft Office applications (and Outlook I particular).
    - gerdesj 7y ago
      We wrote our own ERP and accounting system. OK we partnered up with someone who did it for his factory (he's an accountant by trade and a FOSS lover) and hired a programmer to continue development. We are a small company (~GBP1.5M pa) but we have some fairly complex needs. I'm the only full time Linux user in the firm but as the MD I get by quite happily with Arch on my desktop and laptop, Libre Office and Evolution instead of MS apps - we use Exchange exclusively btw and Evo has a very stable EWS connector and supports Kerberos. Add winbind and I am "domain joined". I use an auto mounter that makes the Windows server shares appear under my home directory as needed. I have CUPS which is also Kerberized. My machine is quite often used by the staff as a handy set of utilities on the end of PuTTY, which supports GSSAPI for SSO. I own an IT company and also find entrenched tastes hard to combat. Oh well, Rome wasn't built in a day. The main trouble is MSDN and NFR makes cost/benefit hard to fly as an argument. Just like the drugs industry, the pushers get their drugs/apps for free!
  - Silhouette 7y ago
    It depends on our current engagement. We often deal with clients who use specialist equipment and/or software themselves, and we need compatibility. A lot of this is moving to online or embedded systems now as well, so the problem becomes less of a problem with time, but it's not a non-issue yet. Also, a lot of creative software doesn't have a Linux version, and in some cases it only runs on either Windows or Mac but not the other, so there is a lack of flexibility there. Again compatibility is a concern, but also the blunt truth is that most of the Linux-friendly FOSS packages simply aren't as good, and even where they could be, they would typically need a significant migration project.
- marpstar 7y ago
  Genuinely curious: what's your long term strategy if Microsoft doesn't address your concerns? Desktop Linux?
  - Silhouette 7y ago
    As much as possible, we avoid fixed long-term strategies, or perhaps it's more accurate to say we avoid commitments far into the future. One of the advantages of running smaller businesses in the tech industry is that everything is customised anyway, at least for each individual, and sometimes for a specific engagement. We can therefore adapt to problems or opportunities more quickly than bigger organisations that need centralised IT, standardised equipment bought in volume from preferred suppliers, standardised preinstalled images, and all that. One very clear strategy we do have is to avoid lock-in in any form at almost any cost. All of our important data is held in standardised formats as much as possible. Whatever we're doing on the desktop or mobile devices, we run very standard Linux servers behind it. We limit our dependencies on any external suppliers and online services, other than a few trusted ones for things like off-site back-ups, and where it's a practical necessity for something like communications and payment processing. So the short answer to your question is that if Microsoft doesn't address our concerns, we're done with Windows, and presumably our future laptops and workstations will be Mac or Linux systems. The slightly longer answer is that in some cases a degree of lock-in has been unavoidable because the only suitable software is Windows-based, and that's why both the possibility we're discussing here and alternatives like virtualisation are interesting. We want to make sure we're in the clear legally and we're not doing anything silly in terms of security, but ultimately we need these systems for at least as long as any related engagements continue, so if we have to run Windows 7 with no updates and take other precautions to secure it as much as possible, we will.
- mxuribe 7y ago
  If windows 10 is not a desired option, what is the next step? As another poster noted, is desktop linux a serious consideration? I'm genuinely curious when enterprises take this approach - which admittedly i believe is fully rational - because it feels like MS sort of causes business to paint themselves into a corner. Ok, maybe that's not a fair portrayal, but nevertheless it creates a tough environment.
  - Silhouette 7y ago
    Yes, desktop Linux and Apple gear are the main contenders in our case. I work in a world of relatively small businesses, which among other things means all of our IT equipment tends to be customised to the specific hardware and software needs of each individual using it. We have no "standard desktop" image, nor would it make any sense for us to have one. Right now, in the office where I'm writing this, we have multiple Windows 7 boxes, some Linux gear, both Apple and Android mobile devices, and a variety of specialist kit applicable to our current engagements. Only the Windows 7 boxes are of immediate concern, because of the imminent EOS date combined with each of them running at least one piece of expensive and Windows-only software that we can't trivially replace on the most plausible alternative platforms. So either we keep Windows 7 for a while longer, or we have to at least invest time and potentially significant money in some sort of migration exercise to another package running on another platform in those cases, assuming at least one suitable alternative package is available.
    - mxuribe 7y ago
      I really appreciate what you've shared! Beyond your other comments, i think by not having a "standard desktop image" seems to have made your group that much more flexible; so kudos for that! Also, I'm wishing the best for you and your business, and if you should move to linux I'm keeping my fingers crossed even more! (The more diversity in operating systems, all the better for everyone! Though, i'll admit that i'm greatly biased in favor of linux :-) Best of luck!
- slacka 7y ago
  I hope you are not the IT decision maker. It seems all of your knowledge of Windows is based from experience with their Home edition. Unlike Home/Pro Edition, telemetry in Windows 10 Enterprise can be disabled with a single group policy option.[1] With GPO = Secure not more data is sent to MS than your Windows 7. You also have full control updates through the group policy(Also found in Pro). Windows 10 Enterprise is the true successor or Windows 7/8 Pro. If telemetry is really such a big deal to you, I'm surprised you didn't spend 2 min. on Google to learn this. I've seen in deployed in several small businesses that care are concerned with privacy/telemetry implications. [1] https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://docs.microsoft.com/en-us/windows/privacy/configure-w...
  - technion 7y ago
    If an IT decision maker researches this, the first thing they'll find is Microsoft's description here[0], which describes Windows Professional Edition as being designed for the SMB. It goes onto describe Enterprise as for "medium and large" businesses, a language they use elsewhere to describe business with 5,000 desktops or more. I get the view this isn't the space the above poster is in. If you buy a business computer, it will come with Windows Professional Edition - it's pointed out in this link that Enterprise Edition is only available to a Volume Licensing customer (noting there are purchase costs beyond what people are used to paying). I don't disagree with you in principle that a conscious person should look in this direction, but Enterprise is beyond the reach of many users. It's beyond the reach of a home user, it's beyond the reach of a business small enough that it doesn't want to buy into a bulk program and it's beyond the reach of a large enterprise that feels they've already spend enough on Microsoft licensing by buying "Professional" systems. They noted they had "zero interest in getting involved with enterprise-level", I have no reason to believe two minutes on Google would change anything for them. [0] https://blogs.windows.com/windowsexperience/2015/05/13/introducing-windows-10-editions/#gKtrdwWscfCqDytx.97 https://blogs.windows.com/windowsexperience/2015/05/13/intro...
  - tinus_hn 7y ago
    If by turn off you mean turn off some of it, yes.

Causality1 7y ago

There's some key part of this equation I'm missing. The premise is that Microsoft wants to focus on Windows 10 but developing security fixes for Windows 7 isn't any cheaper now than it was when Windows 7 was 90% of the userbase, therefore Microsoft wants to stop developing W7 security fixes. But they'll let you pay them to keep developing security fixes for your devices and only your devices. If W7 security fix development is so expensive, how can these fees cover it? Once the fixes exist, why couldn't they be applied to everyone else's Windows 7 PCs? Would it take only a single person with access to the new post-sunset security fixes to distribute them to the rest of the internet in a form of piracy?

Silhouette 7y ago
Assuming this is a genuine offer from Microsoft, the strategy could be as simple as assuming there are going to be very many small businesses reluctant to move from 7 to 10 by January because of the well-documented concerns about 10, but still wanting to keep a responsible level of security updates applied on their machines. Businesses in that position seem unlikely to resort to dubious sources for their security updates. It's just not worth the risk, or frankly even the time, assuming the costs for getting the updates legitimately as quoted in the article are accurate.
xen2xen1 7y ago
My read was that they would be getting money on a regular basis for Windows 7 this way. MS is pushing for Windows as SaaS hard, this pushes Windows 7 towards SaaS, aka the subscription model. For them it's the best of both worlds. Some stubborn places keep Win7, MS gets regular money from them, and then some day when they actually move to Windows 10 they keep selling them their "managment" features they're selling now. If not, they still replace the Windows Store $ and advertizing $ they get from Windows 10. Where's the downside for them? And in reality, they keep doing patches for YEARS anyway for big customers (US NAVY?) anyway, why not monetize it AND give a clear path to all future things they want to ell you? And all the while saying "You have to leave Windows 7" and washing their hands of lots of things, like WHQL for drivers, software testing, etc...

icebraining 7y ago

Seems like there's a company offering those patches to individuals: https://blog.0patch.com/2019/09/keeping-windows-7-and-windows-server.html https://blog.0patch.com/2019/09/keeping-windows-7-and-window... As a Windows 7 user myself (on a personal computer) for whom upgrading seems clearly net negative, I'm tempted. Has anyone here used their stuff?

batiudrami 7y ago
The minor hassle involved in making Windows 10 a far superior option to Windows 7 can be completed in about the same amount of time as it would take to manually install one of these third party "security" updates. It's just turning off a bunch of ad tracking settings if you're bothered by them, and uninstalling a bit of preloaded rubbish and you aren't relying on a third party to inspect code and port patches as best they are able.
- SmellyGeekBoy 7y ago
  This is assuming that the ads and tracking are the things holding people back. Windows 10 has plenty of other issues compared to 7 - UI sluggishness and visual glitches being one that I've experienced.
  - Krasnol 7y ago
    From my experience it isn't even true for "just" the ads and tracking. Considering that you have to redo it again after a major patch to be sure it gets even worse.
- icebraining 7y ago
  Yeah, I don't doubt I can disable most of that crap by this time, I just don't really see anything to gain from the upgrade, except for the official security fixes. I use Win10 on my work laptop, and I read a few reviews, and I'm left quite indifferent to it.

userbinator 7y ago

I often wonder how much of a practical threat the exploits which updates fix really are; it seems like the majority of them are either local privilege escalation or exploit a listening service, all of which won't much affect the typical situation of a single-user PC behind a NAT with no forwarded ports and a user who won't be downloading and running random binaries from strangers (a bad idea regardless of how many updates you install...) Fortunately, the truly scary scenario of an attacker taking control over the Internet of a machine that is just left on and with no action needed on the part of the user seems quite rare; in fact, something like that would be very memorable, yet I don't remember any in at least the decade. The closest to that would be Heartbleed, and that wasn't specific to Windows. IMHO Microsoft really alienated users starting with Win8's horrible UI changes, and the incessant "telemetry" spyware that grew profusely in the versions after that certainly did not help at all to restore any trust. Using security updates as an excuse to bundle other unwanted changes is also aggravating.

infosack 7y ago
> it seems like the majority of them are either local privilege escalation or exploit a listening service, all of which won't much affect the typical situation of a single-user PC behind a NAT with no forwarded ports and a user who won't be downloading and running random binaries from strangers Browser exploit chains often end up attacking the kernel or local services as part of escaping the sandbox, so it's important to patch these vulnerabilities. > Fortunately, the truly scary scenario of an attacker taking control over the Internet of a machine that is just left on and with no action needed on the part of the user seems quite rare; in fact, something like that would be very memorable, yet I don't remember any in at least the decade. EternalBlue, which exploited a vulnerability in SMB, is probably the most prominent example in recent times. BlueKeep, an RDP exploit, was another serious threat from earlier this year.
- userbinator 7y ago
  Yes, browser exploits are always worrisome, which is partly the reason I have JS off by default. RDP and SMB aren't exploitable from the Internet if you're behind a NAT

EvanAnderson 7y ago

Putting on my MSFT stockholder hat for a moment: I'm glad to see that they're capitalizing on this market. I don't know how significant the revenue stream will be, but it's better than leaving money on the table.