11 ms·

Just because you can doesn't mean you should run something that old. I would not want to run a 21 year old native application written in C or C++ from a differ

Just because you can doesn't mean you should run something that old. I would not want to run a 21 year old native application written in C or C++ from a different era of security consciousness on any modern machine. Certainly not anything connected to the internet--remember that was the hey-day of massive worms that crippled entire networks of machines. If the source hasn't been touched in decades, treat it like an antique and keep it in a museum of a virtual machine.

deleted 6y ago
[deleted]
romwell 6y ago
You are aware that not all applications listen to the Internet, or need to, right? My audio editor (GoldWave) is from 2000. It works fine. I can't even think about what "security consciousness" would be on a software that runs locally and doesn't have (or need) accounts. Text editors fall into the same category.
- qbasic_forever 6y ago
  It's all fun and games until a rootkit finds a vulnerable executable to elevate privileges and really get going... just one mixed up bound check, missing end of string, etc in 20 year old code and oops! Don't run any of those old apps as an admin at the very least.
  - romwell 6y ago
    If the said rootkit is already running on my machine, I probably have larger things to worry about than a possible vulnerability in 20-year-old software. And yeah, there is very rarely a need to run apps as admin anyway.
- sp0rk 6y ago
  If you load outside data into the program, it has the potential to be exploited. There is no shortage of exploits for editors, media players, etc. that only require the victim to open a specially crafted file.
  - tomc1985 6y ago
    What makes you think exploit crafters are waiting around for you to load their random JPG into an old version of Paint Shop Pro? It's not like these exploits are one-size-fits-all
    - sp0rk 6y ago
      Waiting for victims to run your malware is not an active process. It requires no resources on the attacker's part beyond maintaining a server. Maybe it will connect to a server that has been dead for five years or maybe it's pointing towards a domain name that the attacker still maintains. Maybe instead of a trojan, it's a cryptolocker or old school destructive malware. I don't know why anybody would want to gamble with something like this. Also, some of the exploits are one-size-fits-all because they target the underlying libraries that the software is using.
      - tomc1985 6y ago
        Yes but the mechanics of exploit crafting aren't generic at the slightest. Everything is bespoke. Which means that for the random bystander the probability that your specific-combination-of-old-software-and-data being exploited is extremely low. If you've reason to be paranoid, sure. And if you're trolling old warez archives with software contemporary to the time, sure. But otherwise? The odds are too low and the possibility space too high for anyone to bother
      - romwell 6y ago
        >Waiting for victims to run your malware is not an active process. Except that's not what we are talking about. The old piece of software here is known to not be malware. >I don't know why anybody would want to gamble with something like this. Everything you do in life is a gamble. Everything is a risk. And the risk of opening an external file in a common format that just happens to have a carefully crafted exploit for extremely uncommon, outdated software that you happen to use to open it is so, so, low, that the risk of the computer exploding in your face on power-up becomes significant compared to that. Yet people aren't deterred from booting up their machines just because there was this laptop one time that did explode.
badsectoracula 6y ago
I'm using Paint Shop Pro 7 as my main image editor[0], it has the best UX of any image editor i've used, was released 21 years ago and i have zero concerns about its security - not because i expect it to be secure (chances are it is using, e.g., a jpeg library with security bugs) but because there isn't any use case where that would matter. Similarly i use Delphi 2 and C++ Builder (both around 25 years old) now and them for making small utilities (e.g. [1] and [2]) - again no internet connection nor any reason to worry about their security. Also i use Adobe PageMill (21 years old too) as a WYSIWYG word editor and simple site editor (like the sites i linked to) - that one can connect to the internet to upload stuff, but i use a separate (and under development) client for this. Also aside the possibility for security issues there is also the probability for you to face them: after all just because a program has an issue it doesn't mean you'll encounter it - if anything, nobody is going to spend any time targeting such old software. [0] https://i.imgur.com/wakdMXK.jpg https://i.imgur.com/wakdMXK.jpg (random shot i took some time ago) [1] http://runtimeterror.com/tools/pastepreview/ http://runtimeterror.com/tools/pastepreview/ [2] http://runtimeterror.com/tools/winless/ http://runtimeterror.com/tools/winless/
- teh_klev 6y ago
  > I'm using Paint Shop Pro 7 Same here, and TextPad from the same era still works (I occasionally try the version in my download archive saved back around 2001).
  - open-source-ux 6y ago
    TextPad is still being updated and available for sale (the latest release was on 11 April 2021). It's even older than PSPad. Wikipedia says it was first released in 1992, that's almost 30 years ago. (https://www.textpad.com/products/textpad/features https://www.textpad.com/products/textpad/features) I'm impressed by the longevity of both PSPad and TextPad and it's refreshing to encounter fast, native, nimble desktop programs.
    - teh_klev 6y ago
      I usually keep up with TextPad's updates, and also bought and paid for it and their other tool called WildEdit which is pretty neat. Also TextPad's ability to handle monster files was and still is quite impressive.
oblio 6y ago
Not everything is internet connected. http://www.weitz.de/regex-coach/ http://www.weitz.de/regex-coach/ -> Regex Coach is a very impressive Windows application I've used for debugging regexes. > The program hasn't changed since 2008 and this page is also essentially still the same. But I can confirm that in September 2019 the program still works fine for me on Windows 10. There are many apps like this one and even older apps. Some can be from the early 90's or even late 80's. The equivalent MacOS app would have been unusable, I imagine, as well as many Linux desktop apps. Especially those before the Great ELF Transition (1996?) as well as those before the Great ABI Breakage (I don't remember the year, it was a major glib change, maybe in 2005?).
pjmlp 6y ago
Like UNIX?
tomc1985 6y ago
Is this really people's attitude? Those of us actually around at that time will remember it was not that bad. Old apps of all stripes did not generally require internet (or even network) access -- a lesson we could learn from today.
passivate 6y ago
Our industry (biotech) relies heavily on Windows and specifically Windows backwards compat. Heck just this last month we put in some used analytical equipment that came with software that was first released on XP. It runs like a champ on W10-32bit. The software we use is often crazy expensive - when you add in the compliance addons, it routinely exceeds USD 10K. I can tell you unequivocally that Windows' backwards compat has saved our company tens of thousands of dollars. Software isn't magic, security isn't magic either. You can employ physical protections (air-gap) and hardware/software (firewall, etc) protections to contain the threat. All software has the potential to be vulnerable, and so a sysadmin would be wise to treat them equally - new or old.

deleted 6y ago

[deleted]

romwell 6y ago

You are aware that not all applications listen to the Internet, or need to, right? My audio editor (GoldWave) is from 2000. It works fine. I can't even think about what "security consciousness" would be on a software that runs locally and doesn't have (or need) accounts. Text editors fall into the same category.

qbasic_forever 6y ago
It's all fun and games until a rootkit finds a vulnerable executable to elevate privileges and really get going... just one mixed up bound check, missing end of string, etc in 20 year old code and oops! Don't run any of those old apps as an admin at the very least.
- romwell 6y ago
  If the said rootkit is already running on my machine, I probably have larger things to worry about than a possible vulnerability in 20-year-old software. And yeah, there is very rarely a need to run apps as admin anyway.
sp0rk 6y ago
If you load outside data into the program, it has the potential to be exploited. There is no shortage of exploits for editors, media players, etc. that only require the victim to open a specially crafted file.
- tomc1985 6y ago
  What makes you think exploit crafters are waiting around for you to load their random JPG into an old version of Paint Shop Pro? It's not like these exploits are one-size-fits-all
  - sp0rk 6y ago
    Waiting for victims to run your malware is not an active process. It requires no resources on the attacker's part beyond maintaining a server. Maybe it will connect to a server that has been dead for five years or maybe it's pointing towards a domain name that the attacker still maintains. Maybe instead of a trojan, it's a cryptolocker or old school destructive malware. I don't know why anybody would want to gamble with something like this. Also, some of the exploits are one-size-fits-all because they target the underlying libraries that the software is using.
    - tomc1985 6y ago
      Yes but the mechanics of exploit crafting aren't generic at the slightest. Everything is bespoke. Which means that for the random bystander the probability that your specific-combination-of-old-software-and-data being exploited is extremely low. If you've reason to be paranoid, sure. And if you're trolling old warez archives with software contemporary to the time, sure. But otherwise? The odds are too low and the possibility space too high for anyone to bother
    - romwell 6y ago
      >Waiting for victims to run your malware is not an active process. Except that's not what we are talking about. The old piece of software here is known to not be malware. >I don't know why anybody would want to gamble with something like this. Everything you do in life is a gamble. Everything is a risk. And the risk of opening an external file in a common format that just happens to have a carefully crafted exploit for extremely uncommon, outdated software that you happen to use to open it is so, so, low, that the risk of the computer exploding in your face on power-up becomes significant compared to that. Yet people aren't deterred from booting up their machines just because there was this laptop one time that did explode.

badsectoracula 6y ago

I'm using Paint Shop Pro 7 as my main image editor[0], it has the best UX of any image editor i've used, was released 21 years ago and i have zero concerns about its security - not because i expect it to be secure (chances are it is using, e.g., a jpeg library with security bugs) but because there isn't any use case where that would matter. Similarly i use Delphi 2 and C++ Builder (both around 25 years old) now and them for making small utilities (e.g. [1] and [2]) - again no internet connection nor any reason to worry about their security. Also i use Adobe PageMill (21 years old too) as a WYSIWYG word editor and simple site editor (like the sites i linked to) - that one can connect to the internet to upload stuff, but i use a separate (and under development) client for this. Also aside the possibility for security issues there is also the probability for you to face them: after all just because a program has an issue it doesn't mean you'll encounter it - if anything, nobody is going to spend any time targeting such old software. [0] https://i.imgur.com/wakdMXK.jpg https://i.imgur.com/wakdMXK.jpg (random shot i took some time ago) [1] http://runtimeterror.com/tools/pastepreview/ http://runtimeterror.com/tools/pastepreview/ [2] http://runtimeterror.com/tools/winless/ http://runtimeterror.com/tools/winless/

teh_klev 6y ago
> I'm using Paint Shop Pro 7 Same here, and TextPad from the same era still works (I occasionally try the version in my download archive saved back around 2001).
- open-source-ux 6y ago
  TextPad is still being updated and available for sale (the latest release was on 11 April 2021). It's even older than PSPad. Wikipedia says it was first released in 1992, that's almost 30 years ago. (https://www.textpad.com/products/textpad/features https://www.textpad.com/products/textpad/features) I'm impressed by the longevity of both PSPad and TextPad and it's refreshing to encounter fast, native, nimble desktop programs.
  - teh_klev 6y ago
    I usually keep up with TextPad's updates, and also bought and paid for it and their other tool called WildEdit which is pretty neat. Also TextPad's ability to handle monster files was and still is quite impressive.

oblio 6y ago

Not everything is internet connected. http://www.weitz.de/regex-coach/ http://www.weitz.de/regex-coach/ -> Regex Coach is a very impressive Windows application I've used for debugging regexes. > The program hasn't changed since 2008 and this page is also essentially still the same. But I can confirm that in September 2019 the program still works fine for me on Windows 10. There are many apps like this one and even older apps. Some can be from the early 90's or even late 80's. The equivalent MacOS app would have been unusable, I imagine, as well as many Linux desktop apps. Especially those before the Great ELF Transition (1996?) as well as those before the Great ABI Breakage (I don't remember the year, it was a major glib change, maybe in 2005?).

pjmlp 6y ago

Like UNIX?

tomc1985 6y ago

Is this really people's attitude? Those of us actually around at that time will remember it was not that bad. Old apps of all stripes did not generally require internet (or even network) access -- a lesson we could learn from today.

passivate 6y ago

Our industry (biotech) relies heavily on Windows and specifically Windows backwards compat. Heck just this last month we put in some used analytical equipment that came with software that was first released on XP. It runs like a champ on W10-32bit. The software we use is often crazy expensive - when you add in the compliance addons, it routinely exceeds USD 10K. I can tell you unequivocally that Windows' backwards compat has saved our company tens of thousands of dollars. Software isn't magic, security isn't magic either. You can employ physical protections (air-gap) and hardware/software (firewall, etc) protections to contain the threat. All software has the potential to be vulnerable, and so a sysadmin would be wise to treat them equally - new or old.