4 ms·

In 2024, I prefer older operating systems that do not get updates. First, hackers have long moved away from creating exploits and second, OEMs and the OS mainta

by 1-6 3y ago

In 2024, I prefer older operating systems that do not get updates. First, hackers have long moved away from creating exploits and second, OEMs and the OS maintainer no longer create software to log activity. Third, it just runs quickly on newish hardware given that it installs.

jupp0r 3y ago
They also don't get any updates should vulnerabilities surface. Also they don't run newer software (which might be ok depending on your use case).
nancyp 3y ago
This is exactly what DDOS hackers are looking for. Older unpatched vulnerability, that allows either remote execution or full take over. Please do not do that. A better alternative is to just move over to other os distribution such as Linux arch, chromium or something similar. Linux desktops are lot more capable these days.
- Wowfunhappy 3y ago
  I don't want to re-hash the discussion from down-thread [1], but I think this is important. If XP is behind a NAT firewall and the user is browsing the web via a modern build of Chromium, how exactly would a hacker take over the machine without a zero day? 1: https://news.ycombinator.com/item?id=39580985 https://news.ycombinator.com/item?id=39580985
  - GrumpySloth 3y ago
    Probably through RCE-s in Windows XP’s TCP/IP stack implementation.
    - Wowfunhappy 3y ago
      What CVE(s) in the TCP/IP could be used for this?
      - GrumpySloth 3y ago
        A quick search led me to CVE-2010-2568, which isn’t in TCP/IP[1], but is an RCE vulnerability that could be triggered by a website triggering a file download and the user later opening the folder with the downloaded file in Windows Explorer. Windows XP with Service Pack 3 is vulnerable. [1]: The CVE database has to have the worst search out of all bug trackers I’ve ever used. (I think using older versions of Windows is fine. But under no circumstances would I connect them to the internet.)
        Wowfunhappy 3y ago
        Right, but that requires downloading a file, which on an older OS you shouldn't do except from sources you absolutely trust. I really don't think there's anything wrong with browsing the internet.
        GrumpySloth 3y ago
        Downloading a file is something that happens automatically when you e.g. navigate (or are automatically redirected) to a link which is served with Content-Type of application/octet-stream. Example: <https://0x0.st/H7bb.bin https://0x0.st/H7bb.bin>. If you don’t modify your browser somehow, it’s not something you as a user can protect yourself against.
        Wowfunhappy 3y ago
        Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180e2583dffa16fbbb9b99fd293821d0/chrome/browser/download/download_extensions.cc#:~:text=%7B%22-,lnk,-%22%2C%20ALLOW_ON_USER_GESTURE https://chromium.googlesource.com/chromium/src/+/39841e54180... So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.
        jasomill 3y ago
        Not that I'd recommend browsing on an older, unpatched OS, but the modification in question is easy, and IMO worth the extra single click or keypress it introduces in exchange for eliminating "drive-by downloads" from questionable sites. Chrome: Settings → Downloads → check "Ask where to save each file before downloading". Edge: Settings → Downloads → check "Ask me what to do with each download". Firefox: Settings → General → under "Files and Applications", check "Always ask you where to save files". Safari (macOS): Settings → General → as "File download location", choose "Ask for each download". While you're here, uncheck "Open “safe” files after downloading" (Apple scare quotes "safe" appropriately, yet AFAIK still enables this option by default, even after it's been a factor in multiple exploits over the years).
  - nancyp 3y ago
    It sounds so dumb on surface that someone would go such a great length to try protect a vulnerable operating system for browsing by building a forked browser and not use a modern os such as arch/linux.
    - Wowfunhappy 3y ago
      If you need access to legacy Windows software, this may not be an option. I know Wine has gotten a lot better in recent years, but it still isn't 100%. There are other options as well such as virtual machines, but these often come with worse hardware requirements. I also think it's perfectly valid to just prefer the feel of one OS over another. We live so much of our lives in front of a computer, it is meaningful whether or not that OS brings you joy.
  - saagarjha 3y ago
    n-day in any part of the OS stack that the browser touches?
ck2 3y ago
If Windows 10 LTSC is good enough for submarines and ATMs with an EOL of 2032-01-13 it should be great for consumers but nope, we can't have it (unless pirated) There is supposedly a loophole to owning it with EU software laws but not sure if applicable to USA (and even then, some rare software detects it and refuses to install)
smashed 3y ago
A modern Linux distro with an older generation desktop environment like MATE or xfce is incredibly snappy, has modern hardware support and is maintained with security updates and up to date crypto stack.
josephcsible 3y ago
> hackers have long moved away from creating exploits That's not because they're not targeting old operating systems anymore (they are). It's because they already have so many exploits that will never be patched that there's not really a point to coming up with more.

by 1-6 3y ago

jupp0r 3y ago

They also don't get any updates should vulnerabilities surface. Also they don't run newer software (which might be ok depending on your use case).

nancyp 3y ago

This is exactly what DDOS hackers are looking for. Older unpatched vulnerability, that allows either remote execution or full take over. Please do not do that. A better alternative is to just move over to other os distribution such as Linux arch, chromium or something similar. Linux desktops are lot more capable these days.

Wowfunhappy 3y ago
I don't want to re-hash the discussion from down-thread [1], but I think this is important. If XP is behind a NAT firewall and the user is browsing the web via a modern build of Chromium, how exactly would a hacker take over the machine without a zero day? 1: https://news.ycombinator.com/item?id=39580985 https://news.ycombinator.com/item?id=39580985
- GrumpySloth 3y ago
  Probably through RCE-s in Windows XP’s TCP/IP stack implementation.
  - Wowfunhappy 3y ago
    What CVE(s) in the TCP/IP could be used for this?
    - GrumpySloth 3y ago
      A quick search led me to CVE-2010-2568, which isn’t in TCP/IP[1], but is an RCE vulnerability that could be triggered by a website triggering a file download and the user later opening the folder with the downloaded file in Windows Explorer. Windows XP with Service Pack 3 is vulnerable. [1]: The CVE database has to have the worst search out of all bug trackers I’ve ever used. (I think using older versions of Windows is fine. But under no circumstances would I connect them to the internet.)
      - Wowfunhappy 3y ago
        Right, but that requires downloading a file, which on an older OS you shouldn't do except from sources you absolutely trust. I really don't think there's anything wrong with browsing the internet.
        GrumpySloth 3y ago
        Downloading a file is something that happens automatically when you e.g. navigate (or are automatically redirected) to a link which is served with Content-Type of application/octet-stream. Example: <https://0x0.st/H7bb.bin https://0x0.st/H7bb.bin>. If you don’t modify your browser somehow, it’s not something you as a user can protect yourself against.
        Wowfunhappy 3y ago
        Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180e2583dffa16fbbb9b99fd293821d0/chrome/browser/download/download_extensions.cc#:~:text=%7B%22-,lnk,-%22%2C%20ALLOW_ON_USER_GESTURE https://chromium.googlesource.com/chromium/src/+/39841e54180... So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.
        jasomill 3y ago
        Not that I'd recommend browsing on an older, unpatched OS, but the modification in question is easy, and IMO worth the extra single click or keypress it introduces in exchange for eliminating "drive-by downloads" from questionable sites. Chrome: Settings → Downloads → check "Ask where to save each file before downloading". Edge: Settings → Downloads → check "Ask me what to do with each download". Firefox: Settings → General → under "Files and Applications", check "Always ask you where to save files". Safari (macOS): Settings → General → as "File download location", choose "Ask for each download". While you're here, uncheck "Open “safe” files after downloading" (Apple scare quotes "safe" appropriately, yet AFAIK still enables this option by default, even after it's been a factor in multiple exploits over the years).
- nancyp 3y ago
  It sounds so dumb on surface that someone would go such a great length to try protect a vulnerable operating system for browsing by building a forked browser and not use a modern os such as arch/linux.
  - Wowfunhappy 3y ago
    If you need access to legacy Windows software, this may not be an option. I know Wine has gotten a lot better in recent years, but it still isn't 100%. There are other options as well such as virtual machines, but these often come with worse hardware requirements. I also think it's perfectly valid to just prefer the feel of one OS over another. We live so much of our lives in front of a computer, it is meaningful whether or not that OS brings you joy.
- saagarjha 3y ago
  n-day in any part of the OS stack that the browser touches?

ck2 3y ago

If Windows 10 LTSC is good enough for submarines and ATMs with an EOL of 2032-01-13 it should be great for consumers but nope, we can't have it (unless pirated) There is supposedly a loophole to owning it with EU software laws but not sure if applicable to USA (and even then, some rare software detects it and refuses to install)

smashed 3y ago

A modern Linux distro with an older generation desktop environment like MATE or xfce is incredibly snappy, has modern hardware support and is maintained with security updates and up to date crypto stack.

josephcsible 3y ago

> hackers have long moved away from creating exploits That's not because they're not targeting old operating systems anymore (they are). It's because they already have so many exploits that will never be patched that there's not really a point to coming up with more.