5 ms·

It would really behoove MS to rethink their lack of XP support for a hole this big. Edit for the multiple comments: Certainly, a corporate strategy can be "We

It would really behoove MS to rethink their lack of XP support for a hole this big. Edit for the multiple comments: Certainly, a corporate strategy can be "We don't care that your machine/network was compromised: We warned you." There are other strategies, and perhaps the we-warned-you strategy is indeed the path to maximum corporate profit, but like I said above: It would be good to rethink that through entirely given the magnitude of the bug.

drzaiusapelord 13y ago
Then next week it'll be another bug, and another, and another. When exactly does it end?
- epenn 13y ago
  It should end when XP's market share is vanishingly small. Given that as of a couple weeks ago it still has 27% among Windows users [1], we are nowhere near that point. Microsoft should do everything they can to help customers, especially corporate users, upgrade to the current version. Presumably they're already doing this, but in the meantime they should continue at least providing XP security updates given its sizable user base. [1] http://www.theregister.co.uk/2014/04/08/windows_xp_istilli_has_27_per_cent_market_share_on_its_deathbed/ http://www.theregister.co.uk/2014/04/08/windows_xp_istilli_h...
  - drzaiusapelord 13y ago
    You have been warned about XP's end of support date for several years, on top of it corporate customers can buy updates directly from MS. I'm not seeing the problem, other than the public being irresponsible, which no corporate policy can cure. We can extend support another 6 months and be in the exact same place. There's no winning here. I also find it hard to believe those old XP machines aren't compromised already. Worst case scenario is that they leave one botnet and join another. Also, those stats are from web user agents, many bots use XP user agents, so we really don't know how many XP machines there are. I imagine most are corporate for compatibility reasons and are receiving patches. The rest are irresponsible people unwilling to upgrade and probably aren't running updated AV either. At the very least this can be an opportunity to scare people into upgrading or at least switching to a non-IE browser and making sure their AV is up to date. tldr; can't save the world and you can't save people from themselves
  - cwyers 13y ago
    The point of the previous EOL extension was this, basically. What Microsoft figured out was that XP's market share was not going to appreciably shrink unless they let it finally reach end of life.
  - superuser2 13y ago
    No, XP's market share needs to become vanishingly small yesterday, and this is part of how we're going to get there.
IgorPartola 13y ago
No. It would behoove all the XP users who have been warned for the past god knows how many years to move on, to, you know, move on. I know it's a loose analogy, but Heartbleed got everyone to upgrade their services overnight. Perhaps this security hole will get people moving off XP faster.
higherpurpose 13y ago
It's not just XP, though. This bug applies to all IE versions.
- camus2 13y ago
  question is ,which IE version will get a patch.
- jpmattia 13y ago
  My understanding is that the IE update will not happen for XP. Is this not right?
- pilif 13y ago
  They will get patched on other OSes though. Only XP will remain vulnerable forever (or until people manually disable VML which will be annoying for web developers using VML as a canvas fallback)
raesene3 13y ago
What makes you say that? Microsoft have been providing warning of XP going End of life for years now, and (AFAIK) they already supported it for longer than other OS vendors do for desktop OSs. It hasn't been the current offering for them for 6 years and there's been 3 major releases since it... Ultimately there's got to be a cut off for support of any software product...
hrktb 13y ago
More and more I'd wish MS provided a extra limited version of IE6+WinXP packaged in a sandboxed VM. Any group seriously needing IE6 would switch to a combination of a modern windows + the sandoxed VM. This could already be done now, but a more compact, efficient and blessed solution from MS could make a difference. It's horrible to have IE6 or winXP only software, but instead of just throwing it away, putting it in a confined executing environment would help desl with issues pressing right now.
- Already__Taken 13y ago
  My understanding is that people who _need_ ie6 still need it exactly the way it is. Trying to strip stuff out or secure it would break why people need it just as much as upgrading it would.
  - hrktb 13y ago
    Putting it in it's own VM would allow to keep IE in a perfect replica of it's current environment (same OS, libraries, plugins, helpers etc), while securing it from the outside (for instance firewalling, snapshot of valid states to prevent corruption, check on the data exchange on the network interface, sanitizing of the input/output if really needed)
  - awj 13y ago
    Then have the VM be configured to only allow traffic to/from specific addresses/dns names/whatever. There has to be a way to solve this that doesn't involve running an ancient browser/OS combination as your host operating system.
- jongalloway2 13y ago
  There are app compat VM's with XP and IE6 for a variety of VM platforms here: http://modern.ie/en-us/virtualization-tools#downloads http://modern.ie/en-us/virtualization-tools#downloads There's also XP Mode for Windows 7, although I don't know how secure or supported that is: http://windows.microsoft.com/en-us/windows7/install-and-use-windows-xp-mode-in-windows-7?woldogcb=0 http://windows.microsoft.com/en-us/windows7/install-and-use-... There's also Enterprise Mode in the IE11 (Windows 7 and 8) that makes it easier to get legacy web apps working in IE11: http://technet.microsoft.com/library/dn640687.aspx http://technet.microsoft.com/library/dn640687.aspx
JeremyNT 13y ago
> Certainly, a corporate strategy can be "We don't care that your machine/network was compromised: We warned you." Except they have an option available for die-hard XP fanatics: they can pay MS for extended support. A patch will be developed and paying customers will be able to install it. I don't see any advantage to MS for continuing to support XP at no additional charge. They have newer products and a paid service offering that keeps XP viable. Supporting XP for "free" actually competes with their other products and gains them only what... good will amongst non-paying XP users? I doubt that is worth very much.

drzaiusapelord 13y ago

Then next week it'll be another bug, and another, and another. When exactly does it end?

epenn 13y ago
It should end when XP's market share is vanishingly small. Given that as of a couple weeks ago it still has 27% among Windows users [1], we are nowhere near that point. Microsoft should do everything they can to help customers, especially corporate users, upgrade to the current version. Presumably they're already doing this, but in the meantime they should continue at least providing XP security updates given its sizable user base. [1] http://www.theregister.co.uk/2014/04/08/windows_xp_istilli_has_27_per_cent_market_share_on_its_deathbed/ http://www.theregister.co.uk/2014/04/08/windows_xp_istilli_h...
- drzaiusapelord 13y ago
  You have been warned about XP's end of support date for several years, on top of it corporate customers can buy updates directly from MS. I'm not seeing the problem, other than the public being irresponsible, which no corporate policy can cure. We can extend support another 6 months and be in the exact same place. There's no winning here. I also find it hard to believe those old XP machines aren't compromised already. Worst case scenario is that they leave one botnet and join another. Also, those stats are from web user agents, many bots use XP user agents, so we really don't know how many XP machines there are. I imagine most are corporate for compatibility reasons and are receiving patches. The rest are irresponsible people unwilling to upgrade and probably aren't running updated AV either. At the very least this can be an opportunity to scare people into upgrading or at least switching to a non-IE browser and making sure their AV is up to date. tldr; can't save the world and you can't save people from themselves
- cwyers 13y ago
  The point of the previous EOL extension was this, basically. What Microsoft figured out was that XP's market share was not going to appreciably shrink unless they let it finally reach end of life.
- superuser2 13y ago
  No, XP's market share needs to become vanishingly small yesterday, and this is part of how we're going to get there.

IgorPartola 13y ago

No. It would behoove all the XP users who have been warned for the past god knows how many years to move on, to, you know, move on. I know it's a loose analogy, but Heartbleed got everyone to upgrade their services overnight. Perhaps this security hole will get people moving off XP faster.

higherpurpose 13y ago

It's not just XP, though. This bug applies to all IE versions.

camus2 13y ago
question is ,which IE version will get a patch.
jpmattia 13y ago
My understanding is that the IE update will not happen for XP. Is this not right?
pilif 13y ago
They will get patched on other OSes though. Only XP will remain vulnerable forever (or until people manually disable VML which will be annoying for web developers using VML as a canvas fallback)

raesene3 13y ago

What makes you say that? Microsoft have been providing warning of XP going End of life for years now, and (AFAIK) they already supported it for longer than other OS vendors do for desktop OSs. It hasn't been the current offering for them for 6 years and there's been 3 major releases since it... Ultimately there's got to be a cut off for support of any software product...

hrktb 13y ago

More and more I'd wish MS provided a extra limited version of IE6+WinXP packaged in a sandboxed VM. Any group seriously needing IE6 would switch to a combination of a modern windows + the sandoxed VM. This could already be done now, but a more compact, efficient and blessed solution from MS could make a difference. It's horrible to have IE6 or winXP only software, but instead of just throwing it away, putting it in a confined executing environment would help desl with issues pressing right now.

Already__Taken 13y ago
My understanding is that people who _need_ ie6 still need it exactly the way it is. Trying to strip stuff out or secure it would break why people need it just as much as upgrading it would.
- hrktb 13y ago
  Putting it in it's own VM would allow to keep IE in a perfect replica of it's current environment (same OS, libraries, plugins, helpers etc), while securing it from the outside (for instance firewalling, snapshot of valid states to prevent corruption, check on the data exchange on the network interface, sanitizing of the input/output if really needed)
- awj 13y ago
  Then have the VM be configured to only allow traffic to/from specific addresses/dns names/whatever. There has to be a way to solve this that doesn't involve running an ancient browser/OS combination as your host operating system.
jongalloway2 13y ago
There are app compat VM's with XP and IE6 for a variety of VM platforms here: http://modern.ie/en-us/virtualization-tools#downloads http://modern.ie/en-us/virtualization-tools#downloads There's also XP Mode for Windows 7, although I don't know how secure or supported that is: http://windows.microsoft.com/en-us/windows7/install-and-use-windows-xp-mode-in-windows-7?woldogcb=0 http://windows.microsoft.com/en-us/windows7/install-and-use-... There's also Enterprise Mode in the IE11 (Windows 7 and 8) that makes it easier to get legacy web apps working in IE11: http://technet.microsoft.com/library/dn640687.aspx http://technet.microsoft.com/library/dn640687.aspx

JeremyNT 13y ago

> Certainly, a corporate strategy can be "We don't care that your machine/network was compromised: We warned you." Except they have an option available for die-hard XP fanatics: they can pay MS for extended support. A patch will be developed and paying customers will be able to install it. I don't see any advantage to MS for continuing to support XP at no additional charge. They have newer products and a paid service offering that keeps XP viable. Supporting XP for "free" actually competes with their other products and gains them only what... good will amongst non-paying XP users? I doubt that is worth very much.