4 ms·

Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that run

Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that running an old software version. Try exposing a windows XP to the internet and watch how long it takes before it‘s hacked.

card_zero 9mo ago
Debatable. "I connected Windows XP to the Internet; it was fine" - https://news.ycombinator.com/item?id=40528117 https://news.ycombinator.com/item?id=40528117 One comment there points out that XP is old enough for infected attack vectors to have all died out. I dunno.
- illiac786 9mo ago
  https://www.tomshardware.com/software/windows/idle-windows-xp-and-2000-machines-get-infected-with-viruses-within-minutes-of-being-exposed-online https://www.tomshardware.com/software/windows/idle-windows-x... But good we are talking about my point rather than than the example.
  - badsectoracula 9mo ago
    > YouTuber Eric Parker demonstrated in a recent video how dangerous it is to connect classic Windows operating systems The video referenced in that article explicitly connects directly to the internet, using a VPN to bypass any ISP and router protections and most importantly disables any protections WinXP itself has. So yeah, if you really go out of your way to disable all security protections, you may have a problem.
    - conorcleary 9mo ago
      Like leaving the lid off of my typewriter at lunchtime :-o
    - illiac786 9mo ago
      That’s still the example, not my point. My point is, statistically, it is more secure to install updates as fast as possible. We can take another example: search for “shitrix”, there’s thousands more CVEs out there to use as example.
- bigfatkitten 9mo ago
  I experienced this first hand in 2014. We got to a point where drive-by exploit kits just weren’t shipping IE8, Java 6 or Windows XP payloads anymore.
- expedition32 9mo ago
  Anyone else noticed that we don't even GET patch notes anymore? "Fixed some bugs" Yes thank you very helpful that! Now I can make a very informed decision.
  - latexr 9mo ago
    I hate that. “Bug fixes and improvements” every time. And then there are the ones who think they’re being cute with “our bird Fernando has been hard ar work eating those nasty bugs and flying over the rainbow to bring you an ever delightful experience”. Just, no. I don’t mind you flexing some creative writing muscles in your release notes if you provide actual clear information, but if you’re going to say nothing like everyone else, might as well use the same standard useless message so I can dismiss it quick.
    - Breza 8mo ago
      Yes! Mobile apps are the worst about this. As a rule, I don't update any apps unless I have a clear reason to do so.
tasuki 9mo ago
I don't know about Windows, but I've been running all kinds of outdated Linux (Debian mostly) and it never once caused a security problem.
- pxc 9mo ago
  Debian backports security patches.
bulbar 9mo ago
It depends if the application itself touches the Internet or only when conducting updates. The threat model for a server and for a personal computer are very different. On a consumer device, typically only the OS mail app and browser have direct contact with the outside world.
pibaker 9mo ago
To be fair I doubt there are that many people scanning for internet facing XPs in 2026. On the other hand, any server running old, unpatched versions of apache or similar will get picked up by script kiddies scanning for publicly known vulns very, very fast. The notepad++ attack is politically targeted and done through unconventional channels (compromise in the hosting provider). I don't think 99% of the people reading this thread has a comparable threat model.
thegrim000 9mo ago
You assume that the old software version has critical vulnerabilities. If it does not, then yes, updating is more of a risk since the new versions are unknowns.
- illiac786 9mo ago
  My assumption is statistical. All software has critical vulnerabilities, not just the old ones. It’s just that these vulnerabilities are known, in the case of the old ones, which significantly increases the risk.

card_zero 9mo ago

Debatable. "I connected Windows XP to the Internet; it was fine" - https://news.ycombinator.com/item?id=40528117 https://news.ycombinator.com/item?id=40528117 One comment there points out that XP is old enough for infected attack vectors to have all died out. I dunno.

illiac786 9mo ago
https://www.tomshardware.com/software/windows/idle-windows-xp-and-2000-machines-get-infected-with-viruses-within-minutes-of-being-exposed-online https://www.tomshardware.com/software/windows/idle-windows-x... But good we are talking about my point rather than than the example.
- badsectoracula 9mo ago
  > YouTuber Eric Parker demonstrated in a recent video how dangerous it is to connect classic Windows operating systems The video referenced in that article explicitly connects directly to the internet, using a VPN to bypass any ISP and router protections and most importantly disables any protections WinXP itself has. So yeah, if you really go out of your way to disable all security protections, you may have a problem.
  - conorcleary 9mo ago
    Like leaving the lid off of my typewriter at lunchtime :-o
  - illiac786 9mo ago
    That’s still the example, not my point. My point is, statistically, it is more secure to install updates as fast as possible. We can take another example: search for “shitrix”, there’s thousands more CVEs out there to use as example.
bigfatkitten 9mo ago
I experienced this first hand in 2014. We got to a point where drive-by exploit kits just weren’t shipping IE8, Java 6 or Windows XP payloads anymore.
expedition32 9mo ago
Anyone else noticed that we don't even GET patch notes anymore? "Fixed some bugs" Yes thank you very helpful that! Now I can make a very informed decision.
- latexr 9mo ago
  I hate that. “Bug fixes and improvements” every time. And then there are the ones who think they’re being cute with “our bird Fernando has been hard ar work eating those nasty bugs and flying over the rainbow to bring you an ever delightful experience”. Just, no. I don’t mind you flexing some creative writing muscles in your release notes if you provide actual clear information, but if you’re going to say nothing like everyone else, might as well use the same standard useless message so I can dismiss it quick.
  - Breza 8mo ago
    Yes! Mobile apps are the worst about this. As a rule, I don't update any apps unless I have a clear reason to do so.

tasuki 9mo ago

I don't know about Windows, but I've been running all kinds of outdated Linux (Debian mostly) and it never once caused a security problem.

pxc 9mo ago
Debian backports security patches.

bulbar 9mo ago

It depends if the application itself touches the Internet or only when conducting updates. The threat model for a server and for a personal computer are very different. On a consumer device, typically only the OS mail app and browser have direct contact with the outside world.

pibaker 9mo ago

To be fair I doubt there are that many people scanning for internet facing XPs in 2026. On the other hand, any server running old, unpatched versions of apache or similar will get picked up by script kiddies scanning for publicly known vulns very, very fast. The notepad++ attack is politically targeted and done through unconventional channels (compromise in the hosting provider). I don't think 99% of the people reading this thread has a comparable threat model.

thegrim000 9mo ago

You assume that the old software version has critical vulnerabilities. If it does not, then yes, updating is more of a risk since the new versions are unknowns.

illiac786 9mo ago
My assumption is statistical. All software has critical vulnerabilities, not just the old ones. It’s just that these vulnerabilities are known, in the case of the old ones, which significantly increases the risk.