Clever! Security by running an OS which none of the exploit authors are targeting anymore.
- a windows 2000 laptop that I only stopped using (a while) after win2k stopped getting security updates, and the linux i put on it didn't work very well.
- a flip phone that was gloriously good at doing the only two things it knew how to do (calls and sms) that I had to stop using because it literally stopped having compatible towers to talk to.
- a 2013 macbook with a keyboard that still works, but it can't get the latest OS updates anymore, much like OP's XP machine.
I feel like there's a willful blindness -- it's very profitable for companies to keep everyone upgrading all the time, but it creates a lot of trash and there's really no need. There's a huge swath of the population who doesn't mind having 20 year old appliances or cars, and who views their digital tools as just another appliance to be replaced as infrequently as possible.
Those of us in tech need to consider the moral prerogative of slowing the trash cycle and the frugality enabled by letting things work for decades. And to stop pretending there isn't a user base out there who will insist on using things for decades even if we tell them it's not advisable.
That was the situation that finally prompted me to buy an iPhone.
If a lack of web browsers is the problem: https://github.com/blueboxd/chromium-legacy
This is very common, and these vulnerabilities are sold for a lot of money and the buyers make sure to protect their investment as long as possible. Of course that also means they go exclusively for high-value targets which means end users are most likely fine (see Pegasus as an example). But that's not the same as being actually secure.
If we're talking zero-days, then XP offers no more or less protection than any other version of Windows on that front.
I'm not ignoring them, I'm just assuming that vulnerabilities discovered by bad actors will follow more or less the same distribution as those found by security researchers.
Now I have the mental image of some intelligence guy working on a “get into our geopolitical rivals’ grid in case there’s a war and we need to cause a blackout” discovering the author of the post.
Maybe he will meet up with some friends in “assorted fraud” industry at the local after work watering hole and they can nostalgically steal the post author’s bitcoins together. Hacking an XP machine might trigger a midlife crisis though.
Just the other day I found myself capturing a Vista machine into a VM just to preserve some perpetually-licensed software that we can't ever install again because the activation server's gone away
Someone looking to hack the last remaining XP machines would just scroll down the list of new exploits and test them out.
The hacker does, GPZ does not need to know.
My understanding is project zero is about finding new zero days, not cataloging known vulnerabilities.