4 ms·

See my comment in the other thread. Basically, Windows XP / Windows Server 2003 and other OSes of that vintage still probably drive a good portion of industrial

See my comment in the other thread. Basically, Windows XP / Windows Server 2003 and other OSes of that vintage still probably drive a good portion of industrial machines. For example a new and modern dentist office, with top of the line equipment had to buy a used panoramic x-ray machine. It makes sharp images, it runs on a separate network and only talks to the NAS - so it is quite decoupled. It works really well but it runs Windows XP. I noticed when I was there, that is how I know all this. In this case, the unicast extension doesn't really apply but it could be other Windows XP machines connect e.g. over a VPN somewhere perhaps in the public cloud. The machine doesn't listen on any port on the public IPs it has... until one day, it can't connect to the VPN endpoint for some reason, because it is in the 0/8 or 127/8 range or whatever. You have to consider it, it is still millions of devices potentially flooding the new addresses, causing major security holes in legacy networks and a lot of maintenance burden. It is a dream/ nightmare come true for support companies and contractors depending on who you support.

Fnoord 5y ago
How about a Windows XP VM which can only talk to the NAS?
- kaliszad 5y ago
  Not certified I guess. Remember, medicine. :-) In practice, VMs on PCs for non-technical personnel are a major pain. All kinds of stuff breaks in curious ways e.g. the pass-through of the protocol or the specific interface might not work reliably, there is a custom setup to support, some pop-up causes the windows to overlap in a way that makes it hard for the medical personnel to get going quickly yadayada. Yes, you can do snapshots and other stuff. Also, the technicians setting this up are usually not trained in IT DevOps/ broad sysadmin tasks so much as in the setup of special medical devices. They also tend to cost a small fortune, because again, they are certified to work on those machines costing on the order $100000 when used and multiple that when new and there might be a handful of them for the whole region. In this particular case, as a patient you also don't want more x-rays than you absolutely need to get. Doing a panoramic x-ray multiple times because e.g. of some software failure could breach some daily/ monthly whatever irradiation limits so you would need another appointment etc. Not something you want to go through as a responsible doctor because of some custom setup. I get it, I am also enthusiastic about Windows never touching bare metal if at all possible for long running professional stuff precisely because of snapshots and e.g. the possibility to cut the network remotely and bring it back up if needed. But I also come in contact with non-technical folks that don't want to risk stuff, deal with more stuff than they already deal with etc. I respect that, it is an approach that works for them.
yyyk 5y ago
These XP/2003 devices should be isolated behind a million firewalls and perferably not connected to the internet at all. If these devices can't route to some portion of the net which they shouldn't have been connected to in the first place, that's hardly a loss. * Personally I think 240/4 is very reasonable since it was always reserved, 0/8 is doable but would require effort enough people might not want to do, and 127/8 is hardcoded in too many places and isn't doable. IPv6 is the future, but it isn't justified to make things now worse to make deployment faster (it won't be). IPv6 will win by default anyway.
- kaliszad 5y ago
  I am absolutely with you. At least unsupported Windows versions should be eradicated where at all possible. Sadly, this isn't the reality we live in as I described at length. Only including 240/4 and parts of the multicast space perhaps in the unicast extension would most likely minimize the impact to potential legacy use-cases and setups and be the 80/20 kind of compromise.

Fnoord 5y ago

How about a Windows XP VM which can only talk to the NAS?

kaliszad 5y ago
Not certified I guess. Remember, medicine. :-) In practice, VMs on PCs for non-technical personnel are a major pain. All kinds of stuff breaks in curious ways e.g. the pass-through of the protocol or the specific interface might not work reliably, there is a custom setup to support, some pop-up causes the windows to overlap in a way that makes it hard for the medical personnel to get going quickly yadayada. Yes, you can do snapshots and other stuff. Also, the technicians setting this up are usually not trained in IT DevOps/ broad sysadmin tasks so much as in the setup of special medical devices. They also tend to cost a small fortune, because again, they are certified to work on those machines costing on the order $100000 when used and multiple that when new and there might be a handful of them for the whole region. In this particular case, as a patient you also don't want more x-rays than you absolutely need to get. Doing a panoramic x-ray multiple times because e.g. of some software failure could breach some daily/ monthly whatever irradiation limits so you would need another appointment etc. Not something you want to go through as a responsible doctor because of some custom setup. I get it, I am also enthusiastic about Windows never touching bare metal if at all possible for long running professional stuff precisely because of snapshots and e.g. the possibility to cut the network remotely and bring it back up if needed. But I also come in contact with non-technical folks that don't want to risk stuff, deal with more stuff than they already deal with etc. I respect that, it is an approach that works for them.

yyyk 5y ago

These XP/2003 devices should be isolated behind a million firewalls and perferably not connected to the internet at all. If these devices can't route to some portion of the net which they shouldn't have been connected to in the first place, that's hardly a loss. * Personally I think 240/4 is very reasonable since it was always reserved, 0/8 is doable but would require effort enough people might not want to do, and 127/8 is hardcoded in too many places and isn't doable. IPv6 is the future, but it isn't justified to make things now worse to make deployment faster (it won't be). IPv6 will win by default anyway.

kaliszad 5y ago
I am absolutely with you. At least unsupported Windows versions should be eradicated where at all possible. Sadly, this isn't the reality we live in as I described at length. Only including 240/4 and parts of the multicast space perhaps in the unicast extension would most likely minimize the impact to potential legacy use-cases and setups and be the 80/20 kind of compromise.