Microsoft risks security reputation ruin by retiring XP
computerworld.com
computerworld.com
I don't know how much this will hurt MS with its core users. XP is largely kept alive by users in the East, not the West, and by businesses. The businesses will either pay for additional security or upgrade, and many of the users in Eastern countries don't pay for XP as it is, so what exactly is MS risking here?
MS needs to move on. There is no money in continuing to support a 13-year-old OS. You could argue that MS should make available paid support and security updates, but even OSes like Redhat aren't kept going for 13 years. I just don't get the outrage here.
When the cost of staying is greater than the cost of moving. For many embedded scenarios, the cost of staying is generally small (just occasional maintenance) and the cost of moving is huge (probably a whole new set of hardware).
One of my clients has a set of 7 or so touchscreen POS systems at a restaurant. They are all older XP embedded machines and the software they run has no upgrade path to a newer OS. It will take somewhere around $20k to put in new computers and do the initial inventory setup.
They do have a good idea of what they would go to if they needed to upgrade tomorrow. It's just currently a no sale, supporting a new system will cost more at this time then the old system.
Can you say if that system would be any more maintainable than the current one, especially e.g. 7-8 years after installation? Do these restaurants update e.g. prices or sales tax rates without outside help? Could they radically change their menu if they needed to do so? Are there forests of sticky notes sprouting from the sides of the machines reminding users how to make the system do what they want? How long does it take for new waitstaff to use the POS without supervision?
Is the current setup PCI-compliant, and will it still be a couple of months from now?
However, even if these systems are, for whatever reason, running a consumer version of XP which is slated to end extended support on April 8, 2014, they are most likely not connected to the internet and therefore safe from external threats.
That's just the best case scenario anyway. As we saw with the Target breach, they obviously did not have the required network segmentation in place. Any PCI compliant company is going to have their POS terminals running on an isolated network. This is hardly a reason to justify not upgrading though.
Blaming the Target break-in on the OS security is like having unprotected sex in the back of a Buick, and blaming GM for the STD you contracted because it would've happened if the car hadn't had such a roomy backseat.
[1] http://www.computerworld.com/s/article/9246074/Target_breach...
Their surface area was "just enough" - they're online in order to run credit cards and early versions of the POS software kept the card details in local files. Once he was into their system, he had access to thousands of cards... when the cards were used fraudulently, it was very difficult to know how it'd been stolen because it was via lots of small breaches that never made the news.
Appropriately for this post... the POS software vendors eventually rushed to be compliant with new security standards (PCI?) and not store those details locally. But the store owners were reluctant to upgrade because the new software versions had an upgrade fee or, even when the upgrade was free, they'd have to pay thousands to their local consultant to actually perform the upgrade.
[1] - http://amzn.com/0307588696 ... Twitter-sized review: Pretty good book and it read like a technology novel at times. Will definitely get you re-thinking where/when your cards are used.
But running a company is not about doing the right thing, and Microsoft is not in a good diplomatic position to force an update on people after Vista and Windows 8 have been publicity disasters. I won't blame MS whatever they do, but if I were them, I would try to fix the Windows 8 mess first before risking negative headlines.
It will hurt everyone with an Internet connection.
MS has filled the World with machines which are full of security holes and which only they can patch, and they've made a mint doing it. I would say it's their responsibility (ethically, not legally) to patch those machines until they stop being a massive threat to the stability of the Internet. I realise that this wont happen though.
XP was able to upgrade to Vista, but nobody did.
XP could not upgrade to Windows 7, so nobody did. Microsoft advertises third-party migration tools, rather than owning this problem and building out of it. They've had years to get it right.
And yes, the cost in reality is not just an OS upgrade. It's sometimes a new machine, and also $300 for Office and peripherals without updated drivers.
But it is mostly convenience: preserving apps, preferences, and licenses is important to regular people. It also isn't that hard, because they did the work for migrating XP to 32-bit Vista.
I've been consistently amazed that my Mac has updated from version to version perfectly, even 32-to-64. Windows has been a disaster every time.
Preserve people's state, preserve their data, and they will buy your software.
Just because you can run your business on a DEC Vax from 1986 doesn't mean that you should!
Don't forget the whole PowerPC -> Intel thing too.
I started on Mac OS X 10.2 on a G3 iBook, made my way up to a PowerBook, then an Intel MacBook Pro follwed by another Intel MacBook Pro. There were a handful of programs that didn't get updated to support Intel along the way, but the only one that I actually miss is Quicken. I wish Apple hadn't dropped Rosetta, but I suspect that they needed to in order to force software makers to move forward. Intuit didn't, and a few other companies opted to force a paid upgrade to get a version that works on Intel.
By and large, my programs and data have survived being migrated through four computers, seven major OS versions, a major architecture change, and the move from a 32-bit OS to a 64-bit OS. That's pretty cool.
I'm still looking for a Quicken-like program that works for me, but I have a feeling I'll end up either making my own or using Excel.
If you stayed on 10.5 too long, there was no way to go to 10.8 without serious hijinx.
"After April [2014], when we release monthly security updates for supported versions of Windows, attackers will try and reverse engineer them to identify any vulnerabilities that also exist in Windows XP," said Tim Rains, director of Microsoft's Trustworthy Computing group. "If they succeed, attackers will have the capability to develop exploit code to take advantage of them."
Right now, the cadence of security updates to Vista/7/8/Windows Server 2003/Windows Server 2008/Windows Server 2012 is tied to how quickly those updates can be backported and tested for Windows XP, because as soon as those patches are released for any Windows operating system, attackers can use them to create exploits for those vulnerabilities and backport those exploits to XP (which they can do faster and with fewer resources than Microsoft can backport patches, because exploits have a much smaller test suite to ensure they don't break systems, ie they don't have such a test suite at all).
Continuing to support XP degrades the ability to support newer operating systems that haven't gotten an extension on their end of life, and at this point it's pretty clear that people still using XP aren't taking advantage of postponing its EOL to do anything but keep using XP. Something's got to give.
... or the people who are still using XP could upgrade?
(Also I want a pony)
But suppose that you are the manager of an organisation with just over 1 million PCs running XP, and those PCs are used to access hundreds of applications that are only guaranteed/certified to work with XP[1]. What do you do?
At present, you pay at least $200 for each one of those PCs. And the associated servers. Let us just say some in Whitehall do not like having to pay that kind of money for updates that Microsoft is already committed to provide for XP Embedded customers. The result[2] may be an interesting change in attitude towards Microsoft in government circles.
[1] http://www.bcs.org/content/conWebDoc/51393
[2] http://www.theguardian.com/technology/2014/jan/29/uk-governm...
That could be some pony :-)
All this really sounds like is a regurgitated argument along the lines of "Regulations are so expensive, we shouldn't have to follow them" or "Minimum wage is to expensive, get rid of worker protections!"
Keeping your systems up to date is the cost of doing business. If you can't afford the cost of doing business please feel free to leave the market to others that can.
PS: I would like to see the NHS get rid of XP as soon as possible, don't worry. It is just the complexity of the job exacerbated by budgets being hammered in the last 5 years or so (exactly when a planned approach to upgrade should have been happening).
Then you've had years to figure out a solution to this. It's not like there haven't been 3 OS releases since then (Vista came out 7 years ago). Microsoft has offered extended (paid) support for their end of life products in the past, so this is nothing new.
I place blame squarely on Microsoft here. This a problem of their making, and they are dumping customers out in the cold at a time where it is really dumb for them to do so.
First, consider the train wreck that has been Microsoft's strategy over the last decade. Many of my customers were well funded and eager to keep modern equipment out in the field. Problem is, the internet happened, and Microsoft decided at one point to stop developing IE and party like it was 1989 with client/server apps. So when Vista came around, we couldn't upgrade because IE6 wouldn't run in a supported configuration. Microsoft's bungling of 64-bit support even breaks older printers!
Then the financial crisis came around, followed by the iPad revolution. That dried up budgets (my PC replacement budget dropped 85%) and drove early adopter users to tablets.
Microsoft followed up with lots of fail: IE version weirdness, divergence from the old polices re: app compatibility, etc. We have a couple of small legacy apps written for windows 3.1.1 that work great on Windows 7, but MANY applications written for XP don't work due to a myriad of reasons. It's a real problem, and my employer has invested 3 years and millions of dollars to resolve.
And guess what? We are for the first time at a crossroads where we have choices re:end user computing. And in many cases, we're choosing non-Microsoft platforms, since we need to rewrite apps anyway. I can deliver and run an iPad for mobile users for 1/3-1/2 the cost of a laptop -- and the users LOVE them. We'll be buying thousands of iPads and galaxy tabs!
So I hope Microsoft saves a lot of money by cutting off XP. They will certainly see a lot less revenue from us in the future.
The chickens have finally come home to roost it seems.
Your problems are not Microsofts fault. Your problems are that your business did not have any foresight. At the time computers were changing drastically every few years, and yet you thought you'd be able to run them and the software on them forever. You bought crappy printers with no demands that the manufactures support future operating systems on them. Your businesses problems are they gave the CEO's 50 million dollar golden parachutes and did not keep infrastructure up to date. Your businesses problems are bad software design paradigms.
What are the alternatives? Who would have made the call to sole-source all computers and buy Macs in 2002? Other than Munich, who is operating broad-scale Linux desktop environments?
I'm not whining about it, my organization is dealing with it just fine. But Microsoft should be handling it in a way that is less painful, because they are going to lose a lot of business. They are forgetting that 2014 isn't 2004.
Anyone who hasn't updated yet isn't going to update until they get cut off from patches. Time to do so.
The longer answer is about the mismatch between PCs and mission critical enterprise computing. There is blame to spread around for that one.
http://www.theregister.co.uk/2013/06/19/nuke_plants_to_keep_...
Supporting people who run at 13 year old 32 bit desktop OS is a money losing proposition all the way around from Microsoft at this point, both in lost time and in lost sales of later version of windows.
The thing is that Microsoft's profits is what matters here. IT is their product.
As a developer, I actually loathe XP, simply because It's another platform I should test things on before I can consider it working. Generally, the users running it are doing so because of 2 things: lock in by a different vendor or a total lack of IT budget. Either of those things is just asking for trouble, So, when a client starts to ask about XP support I start to get worried about the bigger picture.
To put it another way, Would you want to write extra code and run extra tests to support windows 98 today? What about windows 95? 3.1?
I really don't.
True, but those people are needed to continue to support XP Embedded. So some of the work is being done...
Note: I'm not hankering after running XP, but I am realistic about the effect of the $200 per screen annual tax on mega-corp computers. That isn't going to win friends and influence decision makers lets just say.
These businesses had a decade to plan to transition off XP. It's not like other vendors that have no planned EOL dates and don't even announce their plans. Contrast Microsoft with Apple where Snow Leopard, which is only 5 years old, is suddenly abandoned and is no longer getting security patches, but there's been no announcement.
In any case XP is way past it's lifetime. I can only imagine how the developers must feel working on a code base that is 13 years old.
Because that is the only rational reason to not upgrade, right?
In business the cost of the applications and data is many hundreds if not thousands of times more expensive then the computer systems.
A recent example of my own is a vet clinic with a older digital x-ray machine. I asked what it would take to upgrade the machine to Windows 7. Around $50,000 was there answer. They had to replace all the hardware and software. There was no 'upgrade' path.
That's where the niche is. The xray machine (I assume) still works well. "All" they need is Win 7 software to run it, and to display the xrays, and to display the existing xrays.
For xray machines the niche is too risky and expensive to exploit but there's a bunch of similar industrial equipment that could have simpler software re-writes.
So, will companies be willing to trade Apple's lack of commitment to maintaining a version of the OS long term like MS for free upgrades? Keep in mind that OS X upgrades tend to work fairly smoothly, and some of the OS upgrade issues that Windows faces have not impacted OS X.
Add in the increasing pressure from Linux distros that work well for specific uses, and MS is in a bind with trying to sell expensive OS upgrades. I wonder if this will cause MS to move more into the hardware business, where you can make money off of the whole package.
Of course, if you really like Windows, maybe you'll need to pay for the OS more than once a decade.
However, the various SMBs with which I'm familiar seem unlikely to replace their dusty collections of antique XP boxes with brand-new 8.1s. I predict they'll buy used win7 machines where they must for BSS compatibility, but in general will move to chromebooks and web apps. I don't know that Ms could have stopped this transition, but they may have hastened it with actions like this. Then again, how much money did they ever really make from a business running 15 XP boxes in 2014?
Why is this metric secret? Do Ms want to conceal this from competitors, blackhats, consumers, or some other party?
But it would definitely make patching and improving the thing easier.
[1] http://www.pcworld.com/article/2103680/chinas-windows-xp-use...
There are still a lot of businesses that, unfortunately, depend very heavily on Windows XP for their ongoing operation. The cost associated with switching may far, far exceed any benefit it could bring.
We aren't talking about a couple of Ruby on Rails developers sitting in a cafe using MacBooks. We're talking about global organizations with tens of thousands, if not hundreds of thousands, of computers. We're talking about applications that will only run properly on Windows XP. We're talking about astronomical costs that will bring only comparatively minor gain. That's the kind of situation that does not lead to change.
To expect MS to bail out global corporations who write crappy software is crazy. If you have software in 2014 that requires Windows XP and/or IE 6, you need to look at your life and look at your choices.
There is so much bad IT management and procurement at large corporations, and that's the root cause of a lot of the XP consternation from certain companies.