3 ms·

For one, a large number of native applications use the OS's webview widget, so you remain exposed to the outdated Safari engine even if you don't use Safari. Y

For one, a large number of native applications use the OS's webview widget, so you remain exposed to the outdated Safari engine even if you don't use Safari. You're also going to have to use outdated versions of various software packages, as you describe in your post. That's another security hole. As you note, bugs are often found in video and image decoders. The one in your OS isn't being updated anymore. And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues. I imagine most engineers fix the buggy code and move on, and never really consider if there was a security hole there. In other words, it's common for vulnerabilities to be discovered long after they were fixed. And there are probably many more that remain undiscovered despite being present in old versions.

Wowfunhappy 7y ago
Yeah, the chances I'd run into those things just seems incredibly low. Separately: > And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues. But this would imply that the newer version is inherently less buggy, wouldn't it? At least in terms of user-visible bugs, Mavericks is actually a lot more solid in my experience. That's a part of why I want to do this. Apple keeps adding new features and breaking old ones in the process. There is no question Mavericks has more known vulnerabilities, and that's significant. But as an academic question, I'm not at all convinced that Mavericks has more unknown vulnerabilities. If nothing else, it almost certainly has a smaller attack surface.