Comment by RIMR | Hacker News Reader

Comment by RIMR | Hacker News Reader

Parent Full thread

Using a 15 year old OS that hasn't had a security update for over 4 years as your daily driver isn't something I would recommend anyone do. ESU ended over a year ago, so you're stuck on an abandoned OS even if you're willing to pay for updates.

Apple has been keeping the user experience a priority in all their latest updates, and Linux desktops are more usable than they've ever been. There's absolutely no reason to use Windows 7 for anything important if Windows 11 is a dealbreaker.

Microsoft isn't about to reverse course and make Windows good again, so if you've already decided not to use Windows 11, start the process of acclimating to a new OS now, rather than stagnating on a dead OS that is only going to get less safe to use moving forward.

If budget is a concern, I promise you your Windows 7 PC will run Linux. If you are experiencing the sunken cost of all the Windows-exclusive software that you have already purchased, then pony up for a Windows 11 PC, because you're not going to survive on a EOL Windows OS for very long.

I'm curious what is the vulnerability there exactly, would it be from the browser or the browser not getting updates? If someone were to bring a Win95 machine online and connected to the web today would it be bombarded with assaults or something? I'm curious the mechanics of this all.

It's less about known vulnerabilities, and more about how there is nobody to care about vulnerabilities on the OS anymore. Why tie your horse to an abandoned platform?

Two random examples: A malicious Word document that when opened can automatically run an attacker's Powershell script [0], or if you're tricked into using Remote Desktop to access an attacker they can run commands on your machine [1].

[0] https://www.cvedetails.com/cve/CVE-2022-30190/

[1] https://www.cvedetails.com/cve/CVE-2022-21851/

> If someone were to bring a Win95 machine online and connected to the web today would it be bombarded with assaults or something? I'm curious the mechanics of this all.

Generally speaking yes, but realistically only if you’re opening your ports to the internet. There are lots of random scanners out there that are attempting to exploit known 0-days etc in all systems. Granted the biggest one is probably ETERNALBLUE, which I think doesn’t go back to 95, but still.

Obviously browsing infected pages on a hypothetically working web browser would also do the trick, but sites like HN are benign. Windows 95 is so old, though, that you’re unlikely to find much web-enabled software that works well outside of enthusiast projects.

There are unpatched remote code execution vulnerabilities on basically every version of Windows that is out of support.

If you plugged it into the internet with a public IP, someone would likely gain full remote control of the machine in a matter of seconds to hours.

You might think you’re safe if you only connect to your home internet, since that’s not wide open for anyone to scan. But then your kid/nephew/friend uses your wifi and they have a spyware-filled Doodle Jump game clone on their phone that asks for permission to connect to the local network, and your kid/nephew/friend wants to play the game so of course they click yes, and now that’s scanning your home network, and now your Windows 7 computer is part of a botnet.

The same thing would happen on the coffee shop’s WiFi, the hotel’s wifi, and so on. Unless you never connect to a network of any kind ever, it’s a bad idea.

We have a project XP machine that has been plugged into the internet for nearly a year now with no third party firewall etc. Nothing has happened despite all the proclamations it'd be an infested box within seconds of touching the internet.

The reality seems to be that problems stem from the user and what software they use to access the internet more than just being connected. This jives with your comments as you keep mentioning user actions that result in infections.

> We have a project XP machine that has been plugged into the internet for nearly a year now with no third party firewall etc. Nothing has happened despite all the proclamations it'd be an infested box within seconds of touching the internet.

Is it behind a router? Most routers have stateful firewalls doing a lot of work to keep random connections from passing to the NAT'd devices behind them. All the "infected in under 5 minutes" stories I've seen were machines connected directly to the internet.

Also, are you monitoring inbound/outbound traffic for that machine? It seems like you should at least be seeing attempts to compromise your machine (even if they're not working). Is it using IPv4? If you've got a setup that stops port scans, vulnerability scanners, and internet worms you should share!

maybe this gets into the why more, like is the ISP doing a lot of heavy lifting behind the scenes.

Reply on news.ycombinator.com