4 ms·

>for heaven's sake do not connect the machine to the internet. You are unlikely to be targeted by a 0-day or even a 1-day but when it comes to 1000+-day vulnera

>for heaven's sake do not connect the machine to the internet. You are unlikely to be targeted by a 0-day or even a 1-day but when it comes to 1000+-day vulnerabilities against an OS 1. If you don't have a firewall between your computer and the internet, regardless Windows XP, you're doing security wrong. 2. Assuming the above has been followed, the primary threat vectors to be concerned about are the things you run on Windows XP like a web browser and things that come into physical contact with the computer. You are making the classic case of "Look at all these CVEs and be terrified of them!", and as someone who actually doesn't have enough damns to give to every single threat vector imaginable, the only "loser" here is you for engaging in fearmongering. Keeping yourself secure isn't accomplished by just running a supported Windows and letting Windows Update run. Come the hell on.

doublerabbit 2y ago
And rebooting servers. My FreeBSD colocated box is now on 1100+ days uptime. Two of them actually. Running FBSD 12, Double firewall (at core hw, and at OS). Within in a jail with SSH off sits all other processes running many FBSD14 bHyve VMs. When all that machine does is run a single VM within a Jail, where exposure to the internet is to only to deliver packets. I don't see a purpose to reboot. There is absolutely no need and proven so to reboot that machine. Right or wrong, that's my boast anyway. I get it but I just don't feel it.
JackSlateur 2y ago
If you are using a firewall as a security feature, you are doing something wrong. Because you run whatever cruft on your device, and you think that you can prevent all of this bad software from harming you, based on nothing but L3/L4 informations. Firewall are very efficient in hurting sane usage. And very inneficient against malicious actors.
saagarjha 2y ago
I don't think you understand how attack surface works. I am not pointing to a list of CVEs and scaremongering–in fact I didn't even list any. I honestly have no idea how many there are beyond there being a lot. The actual problem here, which you have missed, is that when you run your browser on Windows XP (let's assume, for the same of argument, that it's a fully up-to-date browser somehow, instead of like Firefox from 10 years ago), it will assume that the system it is running on is not completely broken. And that is not true for Windows XP. This means that when it goes to talk to your graphics card it will expect that it can pass command buffers to the OS and they will faithfully be forwarded without the system dying, except XP is old enough that it probably is missing half a dozen checks on that code path, and when you fail one of those checks someone with who took a 4 week binary exploitation class can probably pwn your entire machine. So yeah, that's what I am talking about.
- Dalewyn 2y ago
  Thanks for telling me you literally do not know what you are talking about. Also, for your enlightenment: >let's assume, for the same of argument, that it's a fully up-to-date browser somehow, https://win32subsystem.live/supermium/ https://win32subsystem.live/supermium/ | https://github.com/win32ss/supermium https://github.com/win32ss/supermium
  - saagarjha 2y ago
    You're welcome! It's always a timesaver when someone realizes a conversation isn't productive.

doublerabbit 2y ago

And rebooting servers. My FreeBSD colocated box is now on 1100+ days uptime. Two of them actually. Running FBSD 12, Double firewall (at core hw, and at OS). Within in a jail with SSH off sits all other processes running many FBSD14 bHyve VMs. When all that machine does is run a single VM within a Jail, where exposure to the internet is to only to deliver packets. I don't see a purpose to reboot. There is absolutely no need and proven so to reboot that machine. Right or wrong, that's my boast anyway. I get it but I just don't feel it.

JackSlateur 2y ago

If you are using a firewall as a security feature, you are doing something wrong. Because you run whatever cruft on your device, and you think that you can prevent all of this bad software from harming you, based on nothing but L3/L4 informations. Firewall are very efficient in hurting sane usage. And very inneficient against malicious actors.

saagarjha 2y ago

I don't think you understand how attack surface works. I am not pointing to a list of CVEs and scaremongering–in fact I didn't even list any. I honestly have no idea how many there are beyond there being a lot. The actual problem here, which you have missed, is that when you run your browser on Windows XP (let's assume, for the same of argument, that it's a fully up-to-date browser somehow, instead of like Firefox from 10 years ago), it will assume that the system it is running on is not completely broken. And that is not true for Windows XP. This means that when it goes to talk to your graphics card it will expect that it can pass command buffers to the OS and they will faithfully be forwarded without the system dying, except XP is old enough that it probably is missing half a dozen checks on that code path, and when you fail one of those checks someone with who took a 4 week binary exploitation class can probably pwn your entire machine. So yeah, that's what I am talking about.

Dalewyn 2y ago
Thanks for telling me you literally do not know what you are talking about. Also, for your enlightenment: >let's assume, for the same of argument, that it's a fully up-to-date browser somehow, https://win32subsystem.live/supermium/ https://win32subsystem.live/supermium/ | https://github.com/win32ss/supermium https://github.com/win32ss/supermium
- saagarjha 2y ago
  You're welcome! It's always a timesaver when someone realizes a conversation isn't productive.