5 ms·

One of the good things about Windows is the backwards compat. I know this particular code has been updated in 2021, sure, but in general, you can take binary f

One of the good things about Windows is the backwards compat. I know this particular code has been updated in 2021, sure, but in general, you can take binary from early 2000s and it will run on Windows 10 most likely. (OK, games and rich "multimedia CD-ROMs" from that era have problems, but it holds in general.) In linux, it kinda holds, because everything is open-source anyway, but binaries in general are not compatible. In macOS, it really really doesn't hold, Apple likes to move fast-break things. They changed just the architecture like 4 times, and macOS and OS9 are entirely different. (They did things like Rosetta 1, Rosetta 2, Classic, Carbon, but they never maintain them for long.) Windows is rock solid in this way. Windows 10 still has 32-bit version, and it can still run MS-DOS code apparently. (Although 64-bit Windows apparently cannot.)

qbasic_forever 6y ago
Just because you can doesn't mean you should run something that old. I would not want to run a 21 year old native application written in C or C++ from a different era of security consciousness on any modern machine. Certainly not anything connected to the internet--remember that was the hey-day of massive worms that crippled entire networks of machines. If the source hasn't been touched in decades, treat it like an antique and keep it in a museum of a virtual machine.
- deleted 6y ago
  [deleted]
- romwell 6y ago
  You are aware that not all applications listen to the Internet, or need to, right? My audio editor (GoldWave) is from 2000. It works fine. I can't even think about what "security consciousness" would be on a software that runs locally and doesn't have (or need) accounts. Text editors fall into the same category.
  - qbasic_forever 6y ago
    It's all fun and games until a rootkit finds a vulnerable executable to elevate privileges and really get going... just one mixed up bound check, missing end of string, etc in 20 year old code and oops! Don't run any of those old apps as an admin at the very least.
    - romwell 6y ago
      If the said rootkit is already running on my machine, I probably have larger things to worry about than a possible vulnerability in 20-year-old software. And yeah, there is very rarely a need to run apps as admin anyway.
  - sp0rk 6y ago
    If you load outside data into the program, it has the potential to be exploited. There is no shortage of exploits for editors, media players, etc. that only require the victim to open a specially crafted file.
    - tomc1985 6y ago
      What makes you think exploit crafters are waiting around for you to load their random JPG into an old version of Paint Shop Pro? It's not like these exploits are one-size-fits-all
      - sp0rk 6y ago
        Waiting for victims to run your malware is not an active process. It requires no resources on the attacker's part beyond maintaining a server. Maybe it will connect to a server that has been dead for five years or maybe it's pointing towards a domain name that the attacker still maintains. Maybe instead of a trojan, it's a cryptolocker or old school destructive malware. I don't know why anybody would want to gamble with something like this. Also, some of the exploits are one-size-fits-all because they target the underlying libraries that the software is using.
        tomc1985 6y ago
        Yes but the mechanics of exploit crafting aren't generic at the slightest. Everything is bespoke. Which means that for the random bystander the probability that your specific-combination-of-old-software-and-data being exploited is extremely low. If you've reason to be paranoid, sure. And if you're trolling old warez archives with software contemporary to the time, sure. But otherwise? The odds are too low and the possibility space too high for anyone to bother
        romwell 6y ago
        >Waiting for victims to run your malware is not an active process. Except that's not what we are talking about. The old piece of software here is known to not be malware. >I don't know why anybody would want to gamble with something like this. Everything you do in life is a gamble. Everything is a risk. And the risk of opening an external file in a common format that just happens to have a carefully crafted exploit for extremely uncommon, outdated software that you happen to use to open it is so, so, low, that the risk of the computer exploding in your face on power-up becomes significant compared to that. Yet people aren't deterred from booting up their machines just because there was this laptop one time that did explode.
- badsectoracula 6y ago
  I'm using Paint Shop Pro 7 as my main image editor[0], it has the best UX of any image editor i've used, was released 21 years ago and i have zero concerns about its security - not because i expect it to be secure (chances are it is using, e.g., a jpeg library with security bugs) but because there isn't any use case where that would matter. Similarly i use Delphi 2 and C++ Builder (both around 25 years old) now and them for making small utilities (e.g. [1] and [2]) - again no internet connection nor any reason to worry about their security. Also i use Adobe PageMill (21 years old too) as a WYSIWYG word editor and simple site editor (like the sites i linked to) - that one can connect to the internet to upload stuff, but i use a separate (and under development) client for this. Also aside the possibility for security issues there is also the probability for you to face them: after all just because a program has an issue it doesn't mean you'll encounter it - if anything, nobody is going to spend any time targeting such old software. [0] https://i.imgur.com/wakdMXK.jpg https://i.imgur.com/wakdMXK.jpg (random shot i took some time ago) [1] http://runtimeterror.com/tools/pastepreview/ http://runtimeterror.com/tools/pastepreview/ [2] http://runtimeterror.com/tools/winless/ http://runtimeterror.com/tools/winless/
  - teh_klev 6y ago
    > I'm using Paint Shop Pro 7 Same here, and TextPad from the same era still works (I occasionally try the version in my download archive saved back around 2001).
    - open-source-ux 6y ago
      TextPad is still being updated and available for sale (the latest release was on 11 April 2021). It's even older than PSPad. Wikipedia says it was first released in 1992, that's almost 30 years ago. (https://www.textpad.com/products/textpad/features https://www.textpad.com/products/textpad/features) I'm impressed by the longevity of both PSPad and TextPad and it's refreshing to encounter fast, native, nimble desktop programs.
      - teh_klev 6y ago
        I usually keep up with TextPad's updates, and also bought and paid for it and their other tool called WildEdit which is pretty neat. Also TextPad's ability to handle monster files was and still is quite impressive.
- oblio 6y ago
  Not everything is internet connected. http://www.weitz.de/regex-coach/ http://www.weitz.de/regex-coach/ -> Regex Coach is a very impressive Windows application I've used for debugging regexes. > The program hasn't changed since 2008 and this page is also essentially still the same. But I can confirm that in September 2019 the program still works fine for me on Windows 10. There are many apps like this one and even older apps. Some can be from the early 90's or even late 80's. The equivalent MacOS app would have been unusable, I imagine, as well as many Linux desktop apps. Especially those before the Great ELF Transition (1996?) as well as those before the Great ABI Breakage (I don't remember the year, it was a major glib change, maybe in 2005?).
- pjmlp 6y ago
  Like UNIX?
- tomc1985 6y ago
  Is this really people's attitude? Those of us actually around at that time will remember it was not that bad. Old apps of all stripes did not generally require internet (or even network) access -- a lesson we could learn from today.
- passivate 6y ago
  Our industry (biotech) relies heavily on Windows and specifically Windows backwards compat. Heck just this last month we put in some used analytical equipment that came with software that was first released on XP. It runs like a champ on W10-32bit. The software we use is often crazy expensive - when you add in the compliance addons, it routinely exceeds USD 10K. I can tell you unequivocally that Windows' backwards compat has saved our company tens of thousands of dollars. Software isn't magic, security isn't magic either. You can employ physical protections (air-gap) and hardware/software (firewall, etc) protections to contain the threat. All software has the potential to be vulnerable, and so a sysadmin would be wise to treat them equally - new or old.
anthk 6y ago
>and it can still run MS-DOS code apparently. Use ReactOS NTVDM, it's far more compatible. Just copy the DLL in the game folder and voilá.
HideousKojima 6y ago
On Linux, so long as you have the older versions of any of the app's dependencies pretty much anything will still run. Getting all the right dependencies set up (and hopefully not opening yourself up to numerous security vulnerabilities as a result) is the hard part.
- noja 6y ago
  Well yeah of course. But on Windows you don't need to do any of that. I think that was GP's point.
  - levosmetalo 6y ago
    You don't need any of that, but not because Windows is somehow "better" but because it's Windows "culture" to package almost all dependencies with the application, while on Linux application use a bunch of libraries that are part of the distribution.
    - throwaway8581 6y ago
      No. On Linux, the only stable ABI is the kernel. On Windows, the stable ABI and API includes many platform components outside of the kernel (in fact, the syscall interface itself is undocumented and NOT backward compatible on Windows). The Windows platform APIs are very expansive and cover a lot of territory that on Linux is covered by non-ABI-stable dependencies.
    - deleted 6y ago
      [deleted]
    - passivate 6y ago
      How is it not better for the end user?
- aruggirello 6y ago
  You can also use containers for that. I'm running Phatch under Ubuntu 12.04 via LXD on an Ubuntu 20.04 machine (which was maybe 14.04 or 16.04 when I first set it up to do some batch image processing), and it's working fine.
whalesalad 6y ago
It is a double-edged sword. I believe the primary reason Windows has so many 'issues' in general is the sheer amount of hardware and ancient software that is supported. Keeping the surface area small is easier to maintain, more secure (less attack vectors), etc... I am not saying one approach is better than the other - but when it comes to Apple it makes a lot of sense that they did what the did considering they have full control over their entire stack top to bottom. That being said, they did extend Carbon compat for a really really long time. AFAIK Photoshop was still Carbon for a long time after the switch to x86.
- blinkingled 6y ago
  > believe the primary reason Windows has so many 'issues' in general is the sheer amount of hardware and ancient software that is supported The hardware part in the old days maybe - they have solved that problem. I am not sure beyond people's opinions there are any real issues directly attributable to backwards s/w compatibility.
type0 6y ago
And Wine is better than Windows 10 for the use cases you are describing.
livre 6y ago
> Windows 10 still has 32-bit version, and it can still run MS-DOS code apparently. (Although 64-bit Windows apparently cannot.) This is because Windows uses VM86, hardware virtualization that is only available in 32 bit (legacy) mode. https://en.m.wikipedia.org/wiki/Virtual_8086_mode https://en.m.wikipedia.org/wiki/Virtual_8086_mode

qbasic_forever 6y ago

Just because you can doesn't mean you should run something that old. I would not want to run a 21 year old native application written in C or C++ from a different era of security consciousness on any modern machine. Certainly not anything connected to the internet--remember that was the hey-day of massive worms that crippled entire networks of machines. If the source hasn't been touched in decades, treat it like an antique and keep it in a museum of a virtual machine.

deleted 6y ago
[deleted]
romwell 6y ago
You are aware that not all applications listen to the Internet, or need to, right? My audio editor (GoldWave) is from 2000. It works fine. I can't even think about what "security consciousness" would be on a software that runs locally and doesn't have (or need) accounts. Text editors fall into the same category.
- qbasic_forever 6y ago
  It's all fun and games until a rootkit finds a vulnerable executable to elevate privileges and really get going... just one mixed up bound check, missing end of string, etc in 20 year old code and oops! Don't run any of those old apps as an admin at the very least.
  - romwell 6y ago
    If the said rootkit is already running on my machine, I probably have larger things to worry about than a possible vulnerability in 20-year-old software. And yeah, there is very rarely a need to run apps as admin anyway.
- sp0rk 6y ago
  If you load outside data into the program, it has the potential to be exploited. There is no shortage of exploits for editors, media players, etc. that only require the victim to open a specially crafted file.
  - tomc1985 6y ago
    What makes you think exploit crafters are waiting around for you to load their random JPG into an old version of Paint Shop Pro? It's not like these exploits are one-size-fits-all
    - sp0rk 6y ago
      Waiting for victims to run your malware is not an active process. It requires no resources on the attacker's part beyond maintaining a server. Maybe it will connect to a server that has been dead for five years or maybe it's pointing towards a domain name that the attacker still maintains. Maybe instead of a trojan, it's a cryptolocker or old school destructive malware. I don't know why anybody would want to gamble with something like this. Also, some of the exploits are one-size-fits-all because they target the underlying libraries that the software is using.
      - tomc1985 6y ago
        Yes but the mechanics of exploit crafting aren't generic at the slightest. Everything is bespoke. Which means that for the random bystander the probability that your specific-combination-of-old-software-and-data being exploited is extremely low. If you've reason to be paranoid, sure. And if you're trolling old warez archives with software contemporary to the time, sure. But otherwise? The odds are too low and the possibility space too high for anyone to bother
      - romwell 6y ago
        >Waiting for victims to run your malware is not an active process. Except that's not what we are talking about. The old piece of software here is known to not be malware. >I don't know why anybody would want to gamble with something like this. Everything you do in life is a gamble. Everything is a risk. And the risk of opening an external file in a common format that just happens to have a carefully crafted exploit for extremely uncommon, outdated software that you happen to use to open it is so, so, low, that the risk of the computer exploding in your face on power-up becomes significant compared to that. Yet people aren't deterred from booting up their machines just because there was this laptop one time that did explode.
badsectoracula 6y ago
I'm using Paint Shop Pro 7 as my main image editor[0], it has the best UX of any image editor i've used, was released 21 years ago and i have zero concerns about its security - not because i expect it to be secure (chances are it is using, e.g., a jpeg library with security bugs) but because there isn't any use case where that would matter. Similarly i use Delphi 2 and C++ Builder (both around 25 years old) now and them for making small utilities (e.g. [1] and [2]) - again no internet connection nor any reason to worry about their security. Also i use Adobe PageMill (21 years old too) as a WYSIWYG word editor and simple site editor (like the sites i linked to) - that one can connect to the internet to upload stuff, but i use a separate (and under development) client for this. Also aside the possibility for security issues there is also the probability for you to face them: after all just because a program has an issue it doesn't mean you'll encounter it - if anything, nobody is going to spend any time targeting such old software. [0] https://i.imgur.com/wakdMXK.jpg https://i.imgur.com/wakdMXK.jpg (random shot i took some time ago) [1] http://runtimeterror.com/tools/pastepreview/ http://runtimeterror.com/tools/pastepreview/ [2] http://runtimeterror.com/tools/winless/ http://runtimeterror.com/tools/winless/
- teh_klev 6y ago
  > I'm using Paint Shop Pro 7 Same here, and TextPad from the same era still works (I occasionally try the version in my download archive saved back around 2001).
  - open-source-ux 6y ago
    TextPad is still being updated and available for sale (the latest release was on 11 April 2021). It's even older than PSPad. Wikipedia says it was first released in 1992, that's almost 30 years ago. (https://www.textpad.com/products/textpad/features https://www.textpad.com/products/textpad/features) I'm impressed by the longevity of both PSPad and TextPad and it's refreshing to encounter fast, native, nimble desktop programs.
    - teh_klev 6y ago
      I usually keep up with TextPad's updates, and also bought and paid for it and their other tool called WildEdit which is pretty neat. Also TextPad's ability to handle monster files was and still is quite impressive.
oblio 6y ago
Not everything is internet connected. http://www.weitz.de/regex-coach/ http://www.weitz.de/regex-coach/ -> Regex Coach is a very impressive Windows application I've used for debugging regexes. > The program hasn't changed since 2008 and this page is also essentially still the same. But I can confirm that in September 2019 the program still works fine for me on Windows 10. There are many apps like this one and even older apps. Some can be from the early 90's or even late 80's. The equivalent MacOS app would have been unusable, I imagine, as well as many Linux desktop apps. Especially those before the Great ELF Transition (1996?) as well as those before the Great ABI Breakage (I don't remember the year, it was a major glib change, maybe in 2005?).
pjmlp 6y ago
Like UNIX?
tomc1985 6y ago
Is this really people's attitude? Those of us actually around at that time will remember it was not that bad. Old apps of all stripes did not generally require internet (or even network) access -- a lesson we could learn from today.
passivate 6y ago
Our industry (biotech) relies heavily on Windows and specifically Windows backwards compat. Heck just this last month we put in some used analytical equipment that came with software that was first released on XP. It runs like a champ on W10-32bit. The software we use is often crazy expensive - when you add in the compliance addons, it routinely exceeds USD 10K. I can tell you unequivocally that Windows' backwards compat has saved our company tens of thousands of dollars. Software isn't magic, security isn't magic either. You can employ physical protections (air-gap) and hardware/software (firewall, etc) protections to contain the threat. All software has the potential to be vulnerable, and so a sysadmin would be wise to treat them equally - new or old.

anthk 6y ago

>and it can still run MS-DOS code apparently. Use ReactOS NTVDM, it's far more compatible. Just copy the DLL in the game folder and voilá.

HideousKojima 6y ago

On Linux, so long as you have the older versions of any of the app's dependencies pretty much anything will still run. Getting all the right dependencies set up (and hopefully not opening yourself up to numerous security vulnerabilities as a result) is the hard part.

noja 6y ago
Well yeah of course. But on Windows you don't need to do any of that. I think that was GP's point.
- levosmetalo 6y ago
  You don't need any of that, but not because Windows is somehow "better" but because it's Windows "culture" to package almost all dependencies with the application, while on Linux application use a bunch of libraries that are part of the distribution.
  - throwaway8581 6y ago
    No. On Linux, the only stable ABI is the kernel. On Windows, the stable ABI and API includes many platform components outside of the kernel (in fact, the syscall interface itself is undocumented and NOT backward compatible on Windows). The Windows platform APIs are very expansive and cover a lot of territory that on Linux is covered by non-ABI-stable dependencies.
  - deleted 6y ago
    [deleted]
  - passivate 6y ago
    How is it not better for the end user?
aruggirello 6y ago
You can also use containers for that. I'm running Phatch under Ubuntu 12.04 via LXD on an Ubuntu 20.04 machine (which was maybe 14.04 or 16.04 when I first set it up to do some batch image processing), and it's working fine.

whalesalad 6y ago

It is a double-edged sword. I believe the primary reason Windows has so many 'issues' in general is the sheer amount of hardware and ancient software that is supported. Keeping the surface area small is easier to maintain, more secure (less attack vectors), etc... I am not saying one approach is better than the other - but when it comes to Apple it makes a lot of sense that they did what the did considering they have full control over their entire stack top to bottom. That being said, they did extend Carbon compat for a really really long time. AFAIK Photoshop was still Carbon for a long time after the switch to x86.

blinkingled 6y ago
> believe the primary reason Windows has so many 'issues' in general is the sheer amount of hardware and ancient software that is supported The hardware part in the old days maybe - they have solved that problem. I am not sure beyond people's opinions there are any real issues directly attributable to backwards s/w compatibility.

type0 6y ago

And Wine is better than Windows 10 for the use cases you are describing.

livre 6y ago

> Windows 10 still has 32-bit version, and it can still run MS-DOS code apparently. (Although 64-bit Windows apparently cannot.) This is because Windows uses VM86, hardware virtualization that is only available in 32 bit (legacy) mode. https://en.m.wikipedia.org/wiki/Virtual_8086_mode https://en.m.wikipedia.org/wiki/Virtual_8086_mode