4 ms·

Both of those statements can be true.

userbinator 5y ago
It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. If anything, the newer versions of Windows are "horribly inescure" because they contain so many "unknown unknowns". But that wouldn't fit the narrative MS wants to propagate...
- kube-system 5y ago
  Plenty of new CVEs are in code that has been around for decades. For an example recently in the news: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
- gruez 5y ago
  > It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Have they? We just had printernightmare (CVE-2021-34527) a few months ago. In certain configurations you can even get RCE.
  - userbinator 5y ago
    We just had printernightmare (CVE-2021-34527) a few months ago. That's a remote authenticated code execution...
    - userbinator 5y ago
      Downvoters, please GO READ THE PoC CODE THAT YOU CAN FIND EVERYWHERE.
      - userbinator 5y ago
        I guess the FUD-spreading paranoia-shills are too busy downvoting to actually check the facts. ...which is how this fucking corporatoracy will try to maintain its power. You can point out the very clear and visible truth, but they'll just deny it. Fortunately, the number of people who realise they're being fleeced is slowly rising.
        orf 5y ago
        You’re missing the point of why you’re being downvoted. Go actually reply to people engaging you, rather than ranting to yourself.
    - gruez 5y ago
      What are you trying to say here? "it's been 10 years so surely they ironed out the critical vulnerabilities (eg. eternal blue) by now. all the vulnerabilities left are probably the lame ones like printnightmare".
- eptcyka 5y ago
  I wouldn't use an Android phone for anything safety critical if it was more than 6 months behind the latest security patches. Why would it be any different for Windows? Of course, we can play the asterisk game and expressly state that if the machine is not connected to the internet and not used to browse the web, then it's probably safe. Or if you like browse the web in a VM. I still have to wonder if the patches for these kinds of issues[1] get backported to Windows 7. As to the appeal for age, I think software ages like seafood in terms of security. Just because it's been deployed for years doesn't mean that there aren't vulnerabilities lurking in that code. Although I will concede that as Windows 7 loses users, the payoff for finding a vulnerability will decrease too. [1]: https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/ https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-h...
  - Wowfunhappy 5y ago
    > Or if you like browse the web in a VM. What if you just browse the web in an up-to-date web browser? In both cases, the browser has a sandbox that should keep you safe. Multiple layers of defense are of course better—but in both cases, someone would need a zero day to escape the sandbox, right?
- spywaregorilla 5y ago
  Have all the insecurities been patched? There's pretty much only downsides to unpatched, known vulnerabilities vs. unknown vulnerabilities with the slight exception that you'd be a little more justified assuming you're safe when you're not. The likelihood of suffering a loss is much higher.
- jfrunyon 5y ago
  > and all the major bugs have already been found Excuse me while I die of laughter. People are still finding bugs which existed in XP. Which was supported for 12 years and was released 20 years ago. 7 was supported for 11 years and was released 12 years ago. > Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. Sure, except that the vast majority of malware doesn't come from a remote attack.
  - userbinator 5y ago
    People are still finding bugs which existed in XP. Ones which existed only in XP and not later? I doubt it. On the other hand, as for the bugs which exist only in the later versions... Sure, except that the vast majority of malware doesn't come from a remote attack. ...then where does it come from? Don't say "users installing it", because that's nothing more than an authoritarian excuse to take away freedom --- and as the saying goes, "Those who give up freedom for security deserve neither."
    - jfrunyon 5y ago
      > Ones which existed only in XP When did I say that? Finding a bug in Win10 which has existed since XP is just as dangerous as finding a bug only in XP, given that the patch Microsoft releases for Win10 will not be released for XP. > ...then where does it come from? Vulnerabilities in locally installed software? Supply-chain attacks, drive-by attacks, clickjacking attacks? Or, you know, users installing it? Believe it or not, users frequently install malware; otherwise, there wouldn't be such a proliferation of fake "driver" sites on the internet. I'm not sure how you reached the conclusion that facts are an authoritarian excuse to take away freedom, particularly since I have never and would never advocate for disallowing people to install whatever software they like.

It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. If anything, the newer versions of Windows are "horribly inescure" because they contain so many "unknown unknowns". But that wouldn't fit the narrative MS wants to propagate...

kube-system 5y ago
Plenty of new CVEs are in code that has been around for decades. For an example recently in the news: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
gruez 5y ago
> It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Have they? We just had printernightmare (CVE-2021-34527) a few months ago. In certain configurations you can even get RCE.
- userbinator 5y ago
  We just had printernightmare (CVE-2021-34527) a few months ago. That's a remote authenticated code execution...
  - userbinator 5y ago
    Downvoters, please GO READ THE PoC CODE THAT YOU CAN FIND EVERYWHERE.
    - userbinator 5y ago
      I guess the FUD-spreading paranoia-shills are too busy downvoting to actually check the facts. ...which is how this fucking corporatoracy will try to maintain its power. You can point out the very clear and visible truth, but they'll just deny it. Fortunately, the number of people who realise they're being fleeced is slowly rising.
      - orf 5y ago
        You’re missing the point of why you’re being downvoted. Go actually reply to people engaging you, rather than ranting to yourself.
  - gruez 5y ago
    What are you trying to say here? "it's been 10 years so surely they ironed out the critical vulnerabilities (eg. eternal blue) by now. all the vulnerabilities left are probably the lame ones like printnightmare".
eptcyka 5y ago
I wouldn't use an Android phone for anything safety critical if it was more than 6 months behind the latest security patches. Why would it be any different for Windows? Of course, we can play the asterisk game and expressly state that if the machine is not connected to the internet and not used to browse the web, then it's probably safe. Or if you like browse the web in a VM. I still have to wonder if the patches for these kinds of issues[1] get backported to Windows 7. As to the appeal for age, I think software ages like seafood in terms of security. Just because it's been deployed for years doesn't mean that there aren't vulnerabilities lurking in that code. Although I will concede that as Windows 7 loses users, the payoff for finding a vulnerability will decrease too. [1]: https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/ https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-h...
- Wowfunhappy 5y ago
  > Or if you like browse the web in a VM. What if you just browse the web in an up-to-date web browser? In both cases, the browser has a sandbox that should keep you safe. Multiple layers of defense are of course better—but in both cases, someone would need a zero day to escape the sandbox, right?
spywaregorilla 5y ago
Have all the insecurities been patched? There's pretty much only downsides to unpatched, known vulnerabilities vs. unknown vulnerabilities with the slight exception that you'd be a little more justified assuming you're safe when you're not. The likelihood of suffering a loss is much higher.
jfrunyon 5y ago
> and all the major bugs have already been found Excuse me while I die of laughter. People are still finding bugs which existed in XP. Which was supported for 12 years and was released 20 years ago. 7 was supported for 11 years and was released 12 years ago. > Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. Sure, except that the vast majority of malware doesn't come from a remote attack.
- userbinator 5y ago
  People are still finding bugs which existed in XP. Ones which existed only in XP and not later? I doubt it. On the other hand, as for the bugs which exist only in the later versions... Sure, except that the vast majority of malware doesn't come from a remote attack. ...then where does it come from? Don't say "users installing it", because that's nothing more than an authoritarian excuse to take away freedom --- and as the saying goes, "Those who give up freedom for security deserve neither."
  - jfrunyon 5y ago
    > Ones which existed only in XP When did I say that? Finding a bug in Win10 which has existed since XP is just as dangerous as finding a bug only in XP, given that the patch Microsoft releases for Win10 will not be released for XP. > ...then where does it come from? Vulnerabilities in locally installed software? Supply-chain attacks, drive-by attacks, clickjacking attacks? Or, you know, users installing it? Believe it or not, users frequently install malware; otherwise, there wouldn't be such a proliferation of fake "driver" sites on the internet. I'm not sure how you reached the conclusion that facts are an authoritarian excuse to take away freedom, particularly since I have never and would never advocate for disallowing people to install whatever software they like.