4 ms·

I run out-of-support software on an internet-connected computer, and I'm aware of the risks. I'm just really careful and I acknowledge that I'm at risk every ti

I run out-of-support software on an internet-connected computer, and I'm aware of the risks. I'm just really careful and I acknowledge that I'm at risk every time I go online. I assume the author thinks the same way.

highwaylights 4y ago
“I acknowledge that I’m at risk every time I go online.. I assume the author thinks the same way.” Just from reading the article, it does not seem that the author thinks the same way at all.
bowsamic 4y ago
It's impossible to be careful if you aren't doing security updates, because there's literally no way that you can even be aware of most of the dangers. These things are designed to be covert. It really is more like driving a car with no safety features that might fall apart at any moment because you think your reaction times are very good. The car might fail in a way that you cannot even see, based on vulnerabilities in the car that you are not aware of
- kilpikaarna 4y ago
  Hyperbole much? Do you really think the potential consequences of driving the car of your analogy are comparable to the potential consequences of using an out of support operating aystem on your laptop?
  - bowsamic 4y ago
    You have purposefully misinterpreted my analogy in a bad faith way. The point is not to compare the severity, but to compare the total invisibility of the danger. That's why it's an analogy and not totally equivalent, it is only comparable in some ways... I swear to God sometimes Hacker News is so tiring
    - prepend 4y ago
      There are safety features, they are just out of date. I think a more accurate analogy would be like driving a car frozen with the safety features from the year 2010. Millions of people do this. Or driving a car without patching the firmware. Again, this is common. I agree the risk is unknowable, but I think it’s estimateable enough so that it can be accepted or rejected.
      - bowsamic 4y ago
        The risk is not at all estimateable, since you have no idea what the vulnerabilities are
      - adamckay 4y ago
        > I think a more accurate analogy would be like driving a car frozen with the safety features from the year 2010. Millions of people do this. I don't think it's any more accurate really, because whilst newer cars can said to be safer with more recent features, there's nothing that can compromise a 2010 crash structure or airbag without you noticing. The same cannot be said for internet connected machines.
      - enneff 4y ago
        No, it’s like driving a car whose airbag is known to have a fault that will send shards of material into the driver’s face in the event of an accident. (A real issue that many manufacturers had to issue a recall for.) This is actually a great analogy now, because Apple (or whoever) regularly issue “recalls” for their known-insecure software in the form of software updates. If you follow the discussion in the info sec community surrounding these updates, often the vulnerabilities that are patched are being actively exploited. One recent iOS update that comes to mind is one that patched an issue where a PDF sent via iMessage could give remote code execution with no user interaction or visibility. (Actively exploited.) So yeah, you can drive around with your faulty airbag if the possibility of getting your face mangled doesn’t bother you. Or you can just follow the recall procedure, which is a bit inconvenient but it seems much less inconvenient than facial reconstruction. And if you don’t care about your data being compromised and sold to bad actors, who may then steal your identity and cause a LOT of trouble for you, then by all means run known-insecure software. That seems like very poor risk assessment to me.
  - MonkeyClub 4y ago
    > Hyperbole much? Nah, I’d say GP was within the limits of hyperbole /s

highwaylights 4y ago

“I acknowledge that I’m at risk every time I go online.. I assume the author thinks the same way.” Just from reading the article, it does not seem that the author thinks the same way at all.

bowsamic 4y ago

It's impossible to be careful if you aren't doing security updates, because there's literally no way that you can even be aware of most of the dangers. These things are designed to be covert. It really is more like driving a car with no safety features that might fall apart at any moment because you think your reaction times are very good. The car might fail in a way that you cannot even see, based on vulnerabilities in the car that you are not aware of

kilpikaarna 4y ago
Hyperbole much? Do you really think the potential consequences of driving the car of your analogy are comparable to the potential consequences of using an out of support operating aystem on your laptop?
- bowsamic 4y ago
  You have purposefully misinterpreted my analogy in a bad faith way. The point is not to compare the severity, but to compare the total invisibility of the danger. That's why it's an analogy and not totally equivalent, it is only comparable in some ways... I swear to God sometimes Hacker News is so tiring
  - prepend 4y ago
    There are safety features, they are just out of date. I think a more accurate analogy would be like driving a car frozen with the safety features from the year 2010. Millions of people do this. Or driving a car without patching the firmware. Again, this is common. I agree the risk is unknowable, but I think it’s estimateable enough so that it can be accepted or rejected.
    - bowsamic 4y ago
      The risk is not at all estimateable, since you have no idea what the vulnerabilities are
    - adamckay 4y ago
      > I think a more accurate analogy would be like driving a car frozen with the safety features from the year 2010. Millions of people do this. I don't think it's any more accurate really, because whilst newer cars can said to be safer with more recent features, there's nothing that can compromise a 2010 crash structure or airbag without you noticing. The same cannot be said for internet connected machines.
    - enneff 4y ago
      No, it’s like driving a car whose airbag is known to have a fault that will send shards of material into the driver’s face in the event of an accident. (A real issue that many manufacturers had to issue a recall for.) This is actually a great analogy now, because Apple (or whoever) regularly issue “recalls” for their known-insecure software in the form of software updates. If you follow the discussion in the info sec community surrounding these updates, often the vulnerabilities that are patched are being actively exploited. One recent iOS update that comes to mind is one that patched an issue where a PDF sent via iMessage could give remote code execution with no user interaction or visibility. (Actively exploited.) So yeah, you can drive around with your faulty airbag if the possibility of getting your face mangled doesn’t bother you. Or you can just follow the recall procedure, which is a bit inconvenient but it seems much less inconvenient than facial reconstruction. And if you don’t care about your data being compromised and sold to bad actors, who may then steal your identity and cause a LOT of trouble for you, then by all means run known-insecure software. That seems like very poor risk assessment to me.
- MonkeyClub 4y ago
  > Hyperbole much? Nah, I’d say GP was within the limits of hyperbole /s