Updates for older platforms to protect against potential nation-state activity

I wonder if it would be feasible to protect them with some dedicated firewall/proxy boxes or plug-in modules which could be cheaply updated (compared to the cost of updating and revalidating the whole machine), supplied by multiple vendors, etc.

Well, maybe there's more to a complex organization like a bank or hospital than software licensing. Maybe their service contracts had these exact contingencies but they've run into other problems that nobody could have predicted when XP was new, like:

* That there would be a Great Recession that would wipe out a lot of firms, including banks, hospitals and medical device manufacturers.

* That there would be a massive new piece of legislation that would tax medical devices heavily, thus changing the way that market works.

* That the same piece of legislation would encourage hospitals to merge into each other through various incentives that were intended to limit the cost of healthcare.

* That Microsoft would decide to break backward compatibility sharply compared to what they did before. Don't laugh at this one; they were business for nearly 30 years when XP came out and never broke backwards compatibility as much as they did in the past 10.

The fact that people are trapped on XP is Microsoft's fault. Because some manager in Microsoft decided that getting the upgrade numbers up by breaking hardware drivers was a good idea, you have a security nightmare decades on.

People do that?

The medical device was validated with a certain version of the OS and any special configuration placed on it. If you change the OS/configuration setup in anyway, you (the manufacturer) have to analyze it for impact and potentially re-validate it. The user cannot make this change This would be a violation of FDA regulation.

Now, the hospital can say that they're going to stop using your equipment until you "fix" it --- many such products are leased, not purchased and they may use the lack of security to break the lease. But that presumes they can get a replacement that works as well, train personnel in it, update the supply chain, storage, incoming inspection, etc. for this new product and any supplies it needs...

It's not as simple as running down to MicroCenter and installing a copy of Windows 10!

1. Well, maybe you could do that with your abundance of skill and time, but not everyone running a hospital/bank/other-large-organization has the time or budget to slap together and maintain that kind of amateur hour rope-and-tin cans proxy shit.

2. Not everything people use a computer for happens over a network. Some people write software because they need to communicate directly with hardware devices. You can’t intercept network traffic when there is no network traffic to intercept.

We don't necessarily know what the costs of "getting broken into" are. It depends on who you are and what the breakin does. It could only cost the time it takes for IT to restore a backup and plug the hole. I mean, yeah, if you suffer a spectacular ransomware attack and are screwed so badly that you must pay the ransom and everyone finds out, that's probably more expensive than updating. But that's not the only threat or even the most likely threat your organization may contend with.

We also don't necessarily know what the costs of updating are. If you're just doing boring office stuff, the costs are low and you should just fork over the money to Microsoft and get it over with. If you need to update a bunch of custom drivers for some devices that are important to your business because the device manufacturer went out of business, that could be a vastly expensive software development project that your organization can't afford to do. Certainly that costs a lot more than having Bob in IT rewind the tapes when Russian hackers get ransomware past the firewall.

They can (sometimes) put in intermediary proxies and the like, but that's not a cheap process.

These devices run embedded Windows because they all always have. There's almost no competitive advantage in changing OS vendors in the space, because it doesn't differentiate the product. Even if a device ran CentOS or whatever, you wouldn't be able to update it significantly without going back to the FDA.

On the other hand, many oss projects have rolling releases, so trying to compare like this is futile, expect for the fact they have been maintained for a very long time.

LaTeX 2e has been around since 1994 and is still the current, maintained version.

And yet Chromebook and iPad sales are booming at the expense of the PC. My sample size is ~20 family members. Those with Chromebooks love them and those with Windows 8/10 despise them. From a support perspective, it's considerably less for Chromebooks vs multiple issues with malware on the Windows devices.

Caveat emptor, YMMV etc.

Some industries are still full of Unix boxes from the 90's RS/6000 vintage. I've heard oil and gas industry is pretty bad for this sort of stuff especially in industrial control systems.

I just saw a system that used Java applets. Java applets are outdated so they rewrote it in ...drumroll... Flash.

Of course, security vulnerabilities do still become more known over time, and if you patch for them, you end up rotting code.

To handle both code rot and security vulnerabilities, you need software that is persistently maintained and upgraded, which means having a software team permanently on the job instead of what a lot of government software came from: One-time projects where a contractor comes in and does something.