4 ms·

I was waiting to see what miraculous solution the author had for making Windows XP safe to use, especially since they were adamant that they didn't use sandboxe

I was waiting to see what miraculous solution the author had for making Windows XP safe to use, especially since they were adamant that they didn't use sandboxes or VMs. Turns out their safety is just "don't download weird stuff" and "if you care about security you are probably a paranoid loser". So really you should not follow this guide and if you do for heaven's sake do not connect the machine to the internet. You are unlikely to be targeted by a 0-day or even a 1-day but when it comes to 1000+-day vulnerabilities against an OS with barely any security mitigations you are just tempting fate. Don't do this.

hbbio 2y ago
Same, the title made me think someone maintained/compiled an extensive list of patches to have XP with countermeasures against all the 1000+ vulnerabilities you talk about :) Too bad, XP was pretty great UX and indeed fast. I didn't ever used Windows on my own devices since...
ranger_danger 2y ago
I was thinking they're just going to say to use a local proxy for network traffic, or disable networking altogether.
- yjftsjthsd-h 2y ago
  I was expecting a half joking guide to disabling the networking stack completely. I don't know if it was true of XP, but I'm pretty sure there are operating systems that let you straight up uninstall TCP/IP, which would result in a mostly safe operating system...
  - JackSlateur 2y ago
    Most systems allows that : unplug the ethernet cable :p
ivanzk 2y ago
I searched for the word "loser" you quoted and did not find it in the article.
- saagarjha 2y ago
  I didn’t quote it.
Dalewyn 2y ago
>for heaven's sake do not connect the machine to the internet. You are unlikely to be targeted by a 0-day or even a 1-day but when it comes to 1000+-day vulnerabilities against an OS 1. If you don't have a firewall between your computer and the internet, regardless Windows XP, you're doing security wrong. 2. Assuming the above has been followed, the primary threat vectors to be concerned about are the things you run on Windows XP like a web browser and things that come into physical contact with the computer. You are making the classic case of "Look at all these CVEs and be terrified of them!", and as someone who actually doesn't have enough damns to give to every single threat vector imaginable, the only "loser" here is you for engaging in fearmongering. Keeping yourself secure isn't accomplished by just running a supported Windows and letting Windows Update run. Come the hell on.
- doublerabbit 2y ago
  And rebooting servers. My FreeBSD colocated box is now on 1100+ days uptime. Two of them actually. Running FBSD 12, Double firewall (at core hw, and at OS). Within in a jail with SSH off sits all other processes running many FBSD14 bHyve VMs. When all that machine does is run a single VM within a Jail, where exposure to the internet is to only to deliver packets. I don't see a purpose to reboot. There is absolutely no need and proven so to reboot that machine. Right or wrong, that's my boast anyway. I get it but I just don't feel it.
- JackSlateur 2y ago
  If you are using a firewall as a security feature, you are doing something wrong. Because you run whatever cruft on your device, and you think that you can prevent all of this bad software from harming you, based on nothing but L3/L4 informations. Firewall are very efficient in hurting sane usage. And very inneficient against malicious actors.
- saagarjha 2y ago
  I don't think you understand how attack surface works. I am not pointing to a list of CVEs and scaremongering–in fact I didn't even list any. I honestly have no idea how many there are beyond there being a lot. The actual problem here, which you have missed, is that when you run your browser on Windows XP (let's assume, for the same of argument, that it's a fully up-to-date browser somehow, instead of like Firefox from 10 years ago), it will assume that the system it is running on is not completely broken. And that is not true for Windows XP. This means that when it goes to talk to your graphics card it will expect that it can pass command buffers to the OS and they will faithfully be forwarded without the system dying, except XP is old enough that it probably is missing half a dozen checks on that code path, and when you fail one of those checks someone with who took a 4 week binary exploitation class can probably pwn your entire machine. So yeah, that's what I am talking about.

hbbio 2y ago

Same, the title made me think someone maintained/compiled an extensive list of patches to have XP with countermeasures against all the 1000+ vulnerabilities you talk about :) Too bad, XP was pretty great UX and indeed fast. I didn't ever used Windows on my own devices since...

ranger_danger 2y ago

I was thinking they're just going to say to use a local proxy for network traffic, or disable networking altogether.

yjftsjthsd-h 2y ago
I was expecting a half joking guide to disabling the networking stack completely. I don't know if it was true of XP, but I'm pretty sure there are operating systems that let you straight up uninstall TCP/IP, which would result in a mostly safe operating system...
- JackSlateur 2y ago
  Most systems allows that : unplug the ethernet cable :p

ivanzk 2y ago

I searched for the word "loser" you quoted and did not find it in the article.

saagarjha 2y ago
I didn’t quote it.

Dalewyn 2y ago

>for heaven's sake do not connect the machine to the internet. You are unlikely to be targeted by a 0-day or even a 1-day but when it comes to 1000+-day vulnerabilities against an OS 1. If you don't have a firewall between your computer and the internet, regardless Windows XP, you're doing security wrong. 2. Assuming the above has been followed, the primary threat vectors to be concerned about are the things you run on Windows XP like a web browser and things that come into physical contact with the computer. You are making the classic case of "Look at all these CVEs and be terrified of them!", and as someone who actually doesn't have enough damns to give to every single threat vector imaginable, the only "loser" here is you for engaging in fearmongering. Keeping yourself secure isn't accomplished by just running a supported Windows and letting Windows Update run. Come the hell on.

doublerabbit 2y ago
And rebooting servers. My FreeBSD colocated box is now on 1100+ days uptime. Two of them actually. Running FBSD 12, Double firewall (at core hw, and at OS). Within in a jail with SSH off sits all other processes running many FBSD14 bHyve VMs. When all that machine does is run a single VM within a Jail, where exposure to the internet is to only to deliver packets. I don't see a purpose to reboot. There is absolutely no need and proven so to reboot that machine. Right or wrong, that's my boast anyway. I get it but I just don't feel it.
JackSlateur 2y ago
If you are using a firewall as a security feature, you are doing something wrong. Because you run whatever cruft on your device, and you think that you can prevent all of this bad software from harming you, based on nothing but L3/L4 informations. Firewall are very efficient in hurting sane usage. And very inneficient against malicious actors.
saagarjha 2y ago
I don't think you understand how attack surface works. I am not pointing to a list of CVEs and scaremongering–in fact I didn't even list any. I honestly have no idea how many there are beyond there being a lot. The actual problem here, which you have missed, is that when you run your browser on Windows XP (let's assume, for the same of argument, that it's a fully up-to-date browser somehow, instead of like Firefox from 10 years ago), it will assume that the system it is running on is not completely broken. And that is not true for Windows XP. This means that when it goes to talk to your graphics card it will expect that it can pass command buffers to the OS and they will faithfully be forwarded without the system dying, except XP is old enough that it probably is missing half a dozen checks on that code path, and when you fail one of those checks someone with who took a 4 week binary exploitation class can probably pwn your entire machine. So yeah, that's what I am talking about.