5 ms·

"My belief is that computer security is highly overrated. [...] This can actually be quantifiable. [...] In 2021 Project Zero registered 10 0-days that concerne

"My belief is that computer security is highly overrated. [...] This can actually be quantifiable. [...] In 2021 Project Zero registered 10 0-days that concerned Windows. [...] None affected Windows XP." Clever! Security by running an OS which none of the exploit authors are targeting anymore.

nine_k 4y ago
Are all the old vulnerabilities patched up adequately? Are all old expoloits defeated?
- evmar 4y ago
  They are running a Chrome from 2016, so they are vulnerable to ~every exploit found in Chrome since then.
  - nine_k 4y ago
    Won't a modern version of Chromium build for XP, with some tweaking?
    - hippich 4y ago
      From my experience, there is a lot of software that will not build for platform older than 7/2008 due to missing APIs. Visual studio stopped support for xp compilation awhile ago. You still can use clang or such for simple programs today, but chromium is probably too complicated to port at this point.
      - jamesfinlayson 4y ago
        I thought I saw it in Visual Studio 2019 but I'm misremembering - Visual Studio 2017 was the last to support building for Windows XP by the looks of it.
      - planede 4y ago
        Chromium already builds with clang + libc++ on every platform, including Windows.
    - evmar 4y ago
      I was curious so I found the bug where they tracked some of the post-XP cleanup work: https://bugs.chromium.org/p/chromium/issues/detail?id=579196 https://bugs.chromium.org/p/chromium/issues/detail?id=579196
    - mikae1 4y ago
      https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy exists for macOS, so it would only be fair if there was something similar for old versions of Windows. :)
  - hulitu 4y ago
    That's not how (modern) SW works. Ever heard of "new features and security improvements" ?
    - KyeRussell 4y ago
      What? This is certainly how not updating Chrome works.
      - hulitu 4y ago
        They even took "security" out. On Android: "Thanks for choosing Chrome! This release includes stability and performance improvements."
mulmen 4y ago
Google Project Zero is a list of known vulnerabilities. It is not a comprehensive list of all vulnerabilities.
- lmm 4y ago
  Does it matter? An attacker has to know about a vulnerability to use it. Unless there's some reason that security researchers would be more focused on vulnerabilities in new systems than attackers are, or something like that.
  - bee_rider 4y ago
    I would assume that security researchers and most attackers go after what the general public has. But I wonder, are there still a bunch of old industrial/medical machines running XP? Now I have the mental image of some intelligence guy working on a “get into our geopolitical rivals’ grid in case there’s a war and we need to cause a blackout” discovering the author of the post. Maybe he will meet up with some friends in “assorted fraud” industry at the local after work watering hole and they can nostalgically steal the post author’s bitcoins together. Hacking an XP machine might trigger a midlife crisis though.
    - robinsonb5 4y ago
      I'd be amazed if there aren't still a number of Win2k or older machines in industrial settings. Until a few weeks ago I was using an Imagesetter at work which had a Windows Server 2003 machine running its RIP software. (Apparently it's just about possible to massage the custom PCI card's driver into working on Windows 7 - but it's easier just to use the intended OS.) Just the other day I found myself capturing a Vista machine into a VM just to preserve some perpetually-licensed software that we can't ever install again because the activation server's gone away
  - wkat4242 4y ago
    This totally ignores the concept of "zero-days", vulnerabilities discovered that are only known by bad actors or known but not patched yet. This is very common, and these vulnerabilities are sold for a lot of money and the buyers make sure to protect their investment as long as possible. Of course that also means they go exclusively for high-value targets which means end users are most likely fine (see Pegasus as an example). But that's not the same as being actually secure.
q845712 4y ago
sure in the tech industry we all know the best practices and more or less try to follow them, but in general I've found that I often have hardware that keeps working long past the desire of the corporate overlords to support it: - a windows 2000 laptop that I only stopped using (a while) after win2k stopped getting security updates, and the linux i put on it didn't work very well. - a flip phone that was gloriously good at doing the only two things it knew how to do (calls and sms) that I had to stop using because it literally stopped having compatible towers to talk to. - a 2013 macbook with a keyboard that still works, but it can't get the latest OS updates anymore, much like OP's XP machine. I feel like there's a willful blindness -- it's very profitable for companies to keep everyone upgrading all the time, but it creates a lot of trash and there's really no need. There's a huge swath of the population who doesn't mind having 20 year old appliances or cars, and who views their digital tools as just another appliance to be replaced as infrequently as possible. Those of us in tech need to consider the moral prerogative of slowing the trash cycle and the frugality enabled by letting things work for decades. And to stop pretending there isn't a user base out there who will insist on using things for decades even if we tell them it's not advisable.
- mikae1 4y ago
  > a 2013 macbook with a keyboard that still works, but it can't get the latest OS updates anymore, much like OP's XP machine. If a lack of web browsers is the problem: https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy
- BeFlatXIII 4y ago
  > a flip phone that was gloriously good at doing the only two things it knew how to do (calls and sms) that I had to stop using because it stopped having compatible towers to talk to. That was the situation that finally prompted me to buy an iPhone.
  - q845712 4y ago
    same... :)
admax88qqq 4y ago
Sounds more like project zero didn't bother looking for xp exploits, not that they don't exist. My understanding is project zero is about finding new zero days, not cataloging known vulnerabilities.
GoblinSlayer 4y ago
That's why GNU/Linux is safe, but Android/Linux isn't.

nine_k 4y ago

Are all the old vulnerabilities patched up adequately? Are all old expoloits defeated?

evmar 4y ago
They are running a Chrome from 2016, so they are vulnerable to ~every exploit found in Chrome since then.
- nine_k 4y ago
  Won't a modern version of Chromium build for XP, with some tweaking?
  - hippich 4y ago
    From my experience, there is a lot of software that will not build for platform older than 7/2008 due to missing APIs. Visual studio stopped support for xp compilation awhile ago. You still can use clang or such for simple programs today, but chromium is probably too complicated to port at this point.
    - jamesfinlayson 4y ago
      I thought I saw it in Visual Studio 2019 but I'm misremembering - Visual Studio 2017 was the last to support building for Windows XP by the looks of it.
    - planede 4y ago
      Chromium already builds with clang + libc++ on every platform, including Windows.
  - evmar 4y ago
    I was curious so I found the bug where they tracked some of the post-XP cleanup work: https://bugs.chromium.org/p/chromium/issues/detail?id=579196 https://bugs.chromium.org/p/chromium/issues/detail?id=579196
  - mikae1 4y ago
    https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy exists for macOS, so it would only be fair if there was something similar for old versions of Windows. :)
- hulitu 4y ago
  That's not how (modern) SW works. Ever heard of "new features and security improvements" ?
  - KyeRussell 4y ago
    What? This is certainly how not updating Chrome works.
    - hulitu 4y ago
      They even took "security" out. On Android: "Thanks for choosing Chrome! This release includes stability and performance improvements."

mulmen 4y ago

Google Project Zero is a list of known vulnerabilities. It is not a comprehensive list of all vulnerabilities.

lmm 4y ago
Does it matter? An attacker has to know about a vulnerability to use it. Unless there's some reason that security researchers would be more focused on vulnerabilities in new systems than attackers are, or something like that.
- bee_rider 4y ago
  I would assume that security researchers and most attackers go after what the general public has. But I wonder, are there still a bunch of old industrial/medical machines running XP? Now I have the mental image of some intelligence guy working on a “get into our geopolitical rivals’ grid in case there’s a war and we need to cause a blackout” discovering the author of the post. Maybe he will meet up with some friends in “assorted fraud” industry at the local after work watering hole and they can nostalgically steal the post author’s bitcoins together. Hacking an XP machine might trigger a midlife crisis though.
  - robinsonb5 4y ago
    I'd be amazed if there aren't still a number of Win2k or older machines in industrial settings. Until a few weeks ago I was using an Imagesetter at work which had a Windows Server 2003 machine running its RIP software. (Apparently it's just about possible to massage the custom PCI card's driver into working on Windows 7 - but it's easier just to use the intended OS.) Just the other day I found myself capturing a Vista machine into a VM just to preserve some perpetually-licensed software that we can't ever install again because the activation server's gone away
- wkat4242 4y ago
  This totally ignores the concept of "zero-days", vulnerabilities discovered that are only known by bad actors or known but not patched yet. This is very common, and these vulnerabilities are sold for a lot of money and the buyers make sure to protect their investment as long as possible. Of course that also means they go exclusively for high-value targets which means end users are most likely fine (see Pegasus as an example). But that's not the same as being actually secure.

q845712 4y ago

sure in the tech industry we all know the best practices and more or less try to follow them, but in general I've found that I often have hardware that keeps working long past the desire of the corporate overlords to support it: - a windows 2000 laptop that I only stopped using (a while) after win2k stopped getting security updates, and the linux i put on it didn't work very well. - a flip phone that was gloriously good at doing the only two things it knew how to do (calls and sms) that I had to stop using because it literally stopped having compatible towers to talk to. - a 2013 macbook with a keyboard that still works, but it can't get the latest OS updates anymore, much like OP's XP machine. I feel like there's a willful blindness -- it's very profitable for companies to keep everyone upgrading all the time, but it creates a lot of trash and there's really no need. There's a huge swath of the population who doesn't mind having 20 year old appliances or cars, and who views their digital tools as just another appliance to be replaced as infrequently as possible. Those of us in tech need to consider the moral prerogative of slowing the trash cycle and the frugality enabled by letting things work for decades. And to stop pretending there isn't a user base out there who will insist on using things for decades even if we tell them it's not advisable.

mikae1 4y ago
> a 2013 macbook with a keyboard that still works, but it can't get the latest OS updates anymore, much like OP's XP machine. If a lack of web browsers is the problem: https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy
BeFlatXIII 4y ago
> a flip phone that was gloriously good at doing the only two things it knew how to do (calls and sms) that I had to stop using because it stopped having compatible towers to talk to. That was the situation that finally prompted me to buy an iPhone.
- q845712 4y ago
  same... :)

admax88qqq 4y ago

Sounds more like project zero didn't bother looking for xp exploits, not that they don't exist. My understanding is project zero is about finding new zero days, not cataloging known vulnerabilities.

GoblinSlayer 4y ago

That's why GNU/Linux is safe, but Android/Linux isn't.