Hacker News Reader

Comment by v9v | Hacker News Reader

Why do people keep bringing up this e-waste argument and act like they have to throw their Windows 10 computers into the garbage? It's not like the operating system stops working the second official support ends.

View on HN

I also agree that the machine doesn't go off on a puff of smoke the second the OS is no longer supported, but having an Internet connected device with an unsupported OS is not tenable. There are options, like of course running Linux instead for as long as distros support your hardware, but even then you're only buying time. At some point the avalanche of "progress" will cause software to rely on things your hardware can't do. That is a shame, because I don't really need anything from post-2000 hardware beyond pure speed increases. I have a fully functional and up to date T460 that I enjoy using, as long as you're not compiling anything big on it, running more than a handful of applications or doing anything while YouTube is playing.

Also, software stops working. Steam dropped support for windows 7 now.

Sure, there is nothing wrong with that if you either:

1. Disconnect that computer from the internet.

2. Are happy to have your computer infected and join a botnet.

Can someone who has knowledge about this explain how a PC with "unsupported OS" will actually get attacked just by web browsing and being connected to the internet? Your PC will always be behind NAT, it'll never have a public IP, therefore someone port scanning it can be ruled out unless it's maybe some infected device on the local network? It's normal in modern web browsers that you can just break out of the javascript sandbox and get OS level access by running an OS that hasn't been updated for a few years? If you're running an exe that exploits some known userspace security issue of older OS versions how likely is it that this exe doesn't have any other malicious code that'd cause issues even on an up to date OS?

A lot of these are non-exe files, like images/video, crafted to execute arbitrary code through some bug in outdated software that opens them. Could be a web browser or something else. It does take a while for an OS to be so old that browsers don't support it anymore, but sufficiently old ones are vulnerable to known spectre exploits breaking out of the JS sandbox for example. Or random other browser features can be exploited.

Also, Wannacry is a good example of a LAN attack reaching further than you might expect. Or there are various conditional ways to breach the NAT, one of them simply being NATless ipv6 with a misconfigured firewall.

Microsoft might bluff a bit and actually backport fixes for very serious issues, like how Wannacry was patched all the way back to XP. Maybe Win10 is fine for several years, but the real problem is that you don't know how vulnerable you are with each passing year.

With outdated browsers it does make senese. A bit more surprising is the image or video decoding exploit, considering that I'd assume those would usually be done in hardware rather than by some userspace or OS level code.

Hardware transcoding still involves software, plus the hardware itself can be vulnerable. It's not meant to act as security. But anyway, it's also very hit-or-miss. The drivers need to support it, and even then the software might not use it.

One random thing that ticks me off, Google Meet insists on using VP8/VP9 because they invented it, which has way less overall support for hardware transcoding. That's why it uses so much more CPU on many devices than Zoom etc which use the more common H.264.

If you open a browser, you expose yourself to other servers. Same with opening files you download. Plus, with exploits like NAT slipstreaming, your computer can be exposed to arbitrary packets from anywhere on the internet as soon as any device you own loads and ad.

Microsoft at some point had a bug where a single packet could take over the entire kernel. I think it was a bug somewhere in the IP stack (something related to fragmentation in IPv6 I think?). Linux had similar issues.

If the built-in JPEG viewer or h.264 decoder or whatever component you use contains a bug, your computer can get infected. That also goes for things like preview generators and file indexers that run even if you don't open the file.

As much as the web seems to have consumed everything, there are still plenty of files people open.

In practice, you'll probably be fine as long as you keep your browser up to date and use up-to-date third-party software to open most files. At some point Chrome and Firefox stop supporting your system, though, and that's when infection suddenly becomes real easy.

This was a thing back in the windows 95 days...but is no longer an issue.

Defender won't stop getting updates for devices running 10 from everything I've seen.

Maybe they're throwing them in the garbage and getting Macs? When the choice is leave the ecosystem or embrace 1984: the desktop, it seems like a worthwhile complaint. Microsoft burned everyone's trust by thinking they can charge money for an OS AND sell your data.

Whoa there - the Apple ecosystem is also 1984: the desktop.

I have an old MacBook that even after a factory reset or a wipe and reinstall from scratch is unusably slow and can’t update to the latest OS, and so isn’t compatible with updates to software I use or new stuff I might be interested in -

Like come on. Let’s not pretend this is a M$ problem. Apple is just as greedy in terms of what is effectively planned obsolescence.

The problem doesn't seem to apply to other Apple devices. The iPhone 11 I've been using every day for the last 6 years is still working exactly the same as when it was new, all while still getting the newest OS updates.

Apple also arbitrarily drops OS support on devices. On mobile devices they used to be the leading edge, but on desktop they end support faster than Microsoft does. Microsoft guaranteed 10 years of support when Windows 10 launched, but Apple is dropping support for their 2020 Intel Macs after this year. Plus, in terms of "1984", Apple's notarization system is as bad as it gets, and it's even harder to turn off than Windows Smartscreen.

Apple does have better speakers, though. So that's a nice plus.

Many companies have a policy that requires active support for all software and for good reason. Failing to install security updates or using software which no longer receives security updates might be the easiest way to shoot yourself in the foot. If you have ever worked in information security you know that the vast majority of attacks companies face day to day are malware exploiting patched vulnerabilities and social engineering attacks. If you don't have good patch management or end user training, you don't have good security regardless of anything else you do.

Yeah and in this case the author even admits that he could have upgraded his PC to Windows 11 but he bought a new one anyway! I suspect he doesn't really care that much about e-waste.

Reply on news.ycombinator.com