In case something goes wrong, you might have to restart anyway. So you better exercise that process to know it works. Also, I'd rather get really good at dealing with the first day of uptime of a system, then discover what the n-th day brings for ever larger values of n for the first time ever.
Not every system has to be connected to the internet....imagine that ;)
> They required a dhcp, an internal DNS, an Apache + PHP server for some internal (and a couple of external) websites, a file server accessible via both NFS and Samba (as Windows PCs needed access), an internal SMTP connecting to an external relay to ensure faster email dispatches for employees given their unstable connectivity, and a few other nuances.
It's running basically everything. But even if it was exposed only internally, that's usually only one other issue or misconfiguration away from being fully exposed again.
I believe they're saying it would be irresponsible - in the current climate - to leave a system without upgrades and attention for so long. We can agree on that.
That really only reflects the "current climate"; which is one of colossal dereliction and reckless engineering amounting to a total abandonment of cybersecurity. Cybersecurity is presently such a circus because of endemic poor software engineering, a worship of expedience, convenience, efficiency and plain old greed. These are all the reasons that good engineering and big business do not intersect in modern times.
A couple of weeks ago Jen Easterly called out current industry practices as enabling cybercrime and harming society [0].
So not all unattended code is equal. I think there is a great deal of pride to be taken in building and using stable and reliable systems. That shows up in smaller groups, non-profits, and volunteer networks that are strongly focused on a smaller set of goals and who eschew giddy neophyte values in favour of a more sedate and responsible stance. But those are rather different flavours of "pride". I would characterise what the parent said as more an "absence of shame" for leaving what are evidently cheap-ass vulnerable systems that are "pwned out of the box" in a hostile environment.
The fact having having been neglected nobody realised because it Just Kept Working for close to a decade is still a testament to the software running on it.