Hacker News Reader

Comment by jiggy2011 | Hacker News Reader

jiggy2011

Whilst I agree with the big one about plain text passwords some of the niggles here seem a little odd.

Tesco are not advising that everyone goes back to IE 3, they are simply stating this as a lowest common denominator since I'm assuming that was the first browser to support whatever version of TLS they were using etc.

Also, is running an old version of ASP.NET and IIS really a problem? Does he advocate going through the expense of rewriting/retesting the entire website every time MS drops a new version? If they are pulling down security patches this should be a non issue.

View on HN

The post advocates simply staying reasonably up to date, then says that IIS 6 is unreasonably old. relevant bit:

This is not necessarily a high-intensity exercise, once every few years you simply make sure you haven’t fallen too far behind the eight ball. Certainly you don’t let key software components get 9 years old and nearly 5 versions out of date.

This is quite a bit less intensive then you describe and I think it's reasonable to expect that a website taking payments not be more the a couple years out of date.

IIS 6 is part of Windows 2003 Server, therefor it will be on "Extended Support" until 14/07/2015

http://support.microsoft.com/lifecycle/search/default.aspx?a...

This means that if there is some security vulnerability discovered with it then Microsoft will provide a patch, therefor from a security point of view it isn't "out of date".

The number of years and versions is fairly irrelevant, there will be plenty of very secure systems in use by banks and the military that will no doubt pre-date much of what tesco is using by several decades.

The relevance is that none of the additional protections added to the technologies are available. We're in a very different threat landscape today than what we were in 9 years ago and the technologies provide advances to better protect ourselves. If you're using them!

Why rewrite? When there's a new major feature release, take the opportunity to change the target framework. Most servers also have a refresh cycle so update that at the time and roll it into the testing procedure. I'm not saying do this immediately after every new IIS / .NET release, but going 9 years without change is risky.

Reply on news.ycombinator.com