Microsoft ends support for Windows XP and Office 2003 | Hacker News Reader

Microsoft ends support for Windows XP and Office 2003

thenextweb.com

102 pointstweakz101 comments

Except for our government who are paying MS an exorbitant amount of money to keep support up... http://www.zdnet.com/dutch-government-pays-millions-to-exten...

Quite shocked that they've struck a multimillion dollar deal to keep support UNTIL JANUARY! Is there a reason they couldn't just move their upgrade cycle up 9 months? Obviously they knew this was coming.

For the benefit of people that haven't had the dis/pleasure of working in a really big company, the large banks / govy places often have a ton of dependencies and at (least) one place I worked at had a custom tailored build of Windows with features they need.

They're also heavily regulated and if they can't show evidence that they've done all the required audit checks to ensure they're in line then the repercussions make millions look like chump change (think an investment bank being banned from trading on certain desks).

Depending on their priorities and at that size this might be the most economical move.

It's worse in government. I knew a very important Australian government department that used four levels of test for a service management system.

It's not just about upgrading the OS - it's also about upgrading the software built for that OS, which in some cases requires a complete rebuild.

You are not alone. The UK government is doing something similar.

http://www.theguardian.com/technology/2014/apr/07/uk-governm...

Looks like Microsoft dropped the ball on this one - it's a government, they could probably have charged billions. Hopefully, the UK government will realise this, and either a) go open source b) get their house in order much earlier next time.

How open source will fix it for an organization that can't bother to move from a decade old operating system? In 10 years we'll reading about the UK govt having trouble moving away from Ubuntu LTS 14.04.

They only have option b) if they won't to avoid this in the future. Open source or not.

Upgrading an OS OS is a lot cheaper than upgrading a proprietary one.

Yep, if they run into any issues, just post to the Ubuntu forums, and lazer420 will tell you how to fix it!

Or there's always the paid Canonical support. But the thought of David Cameron hunched over a laptop having some tea and getting assistance from lazer420 in saving the NHS from the next heartbleed is priceless.

No, they ask their IT department. The difference being, they can fix issues with the OS themselves (or hire someone to). With something closed like Windows, there's only one place to go for support.

If you are a major customer, like many national governments are, you can get the source code to a lot of Windows.

Access to the source code is one thing, but you'd need also developers who are familiar enough with the source to be able to actually make changes. With OSS, there is a large community from which you recruit these folks, with Windows, not so much (outside of MS).

These kinds of posts are destructive, and provoke arguments. Please don't do this on HN.

It's not the license cost that's keeping these people from upgrading. It's verifying that the hundreds of applications, many of which were built by systems integrators that you have a strained relationship with that need to work correctly on whatever you're replacing it with. It's training users - some people "need" a two-day offsite seminar and a couple of weeks of reduced workload to transition to a new system. Also, something invariably goes wrong, so you also have to account for lost productivity when that happens.

I believe you get that with all OS upgrades.

They slowly are going open source.

A big example is Gov.UK which is mostly mostly open source as well as a few other big UK gov services like police.gov [1]

A large part of the NHS was moved off of a proprietary oracle system just a few months ago [2]

[1] http://github.com/alphagov [2] http://www.theregister.co.uk/2013/10/10/nhs_drops_oracle_for...

If their installed apps mean they can't move from XP to Windows 7, it's hard to see how they can move Linux....

In any case, if they have the usual volume licensing deal with Microsoft, they can use any version of Windows without charge.

That works out at about £13,000 for our site, which is £16 per XP box. Our renewal program - like many big public-sector ones - is contingent on budget, manpower, and horrible crufty software for which there is no more modern compatible alternative or update. Or where the update is just broken (gee thanks), so we have to wait out vendors' promises versus a ticking clock.

£16 per XP PC is a big discount on the official rate of $200 for the first year....

> no more modern compatible alternative

Sounds like a good startup opportunity.

Windows XP is incorporated so deeply in utility management systems, that it would cost an estimated US$100 million and several years of work to upgrade the outdated system. Research by EHI intelligence revels that 85% of England’s healthcare system IT systems were still using Windows XP. http://www.dazeinfo.com/2014/04/07/hackers-will-pounce-micro...

Windows Embedded POSReady 2009, which is essentially a stripped down Windows XP SP3, will be supported with security updates until 2019. Realistically, as an individual you can't buy it but as far as I can tell you can use the evaluation version (http://www.microsoft.com/en-us/download/details.aspx?id=1119...) for up to 120 days for free, which may be useful for VMs and the like.

Where I work we still have business specific apps that run only on XP and our suppliers have no plan on upgrading them (unless we fund the entire project, which they will happily resell full price to over companies).

This is a clear example of what the lack of competition does

What makes them specific to XP instead of just Windows?

Probably code that relies on implementation details and only works by coincidence.

We had a bug in our application that only manifested on Windows 8 and later.

The problem was that we were passing NULL instead of some other sentinel value (MSDN said to use a specific sentinel value). XP/Vista/7 took NULL anyway and the effect was the same as the sentinel value but in Windows 8 it did something different.

I remember Microsoft had "strict" builds of libraries (and Windows itself, IIRC) that did parameter checks. You would boot the machine with that software and run your program (more slowly) and some functions that would work on a consumer OS would generate errors on it.

Do they still do it?

Yes, you can download the checked build from the MSDN Subscriber Downloads.

But last time I checked the .NET Framework abused some Win32 API calls [1] so if you had some WinForms application you'd end up with loads of errors in code that wasn't yours.

Might be fixed, it's been a while since I looked.

[1] http://connect.microsoft.com/VisualStudio/feedback/details/3...

That's exactly something that an app compatibility shim should fix.

I'm not sure, but on one app we have errors at install and on the other certain functionalities don't work as they should.

Now I wouldn't be able to tell you what are the incriminated part of Windows.

There's even an app that is written in dotnet and that is not Win 7 compatible. Can you believe it ???

As in, your supplier lacks any competition in their line of business sector? Or is this a claim that MS are to be found wanting because you're locked into your app supplier?

I was speaking about the suppliers : they almost have a monopoly and can do as they want with their customers.

This is so bad that one of them shipped us a software upgrade with a hard-coded ip address. Next time the ip change they will have to recompile ...

/barf

That reminded me of a company I worked at. We were moving to a new datacenter, and the job of auditing and moving all of the scheduled tasks fell to me. A good 75% of the scheduled tasks were .exes for which we did not have the source code; and they all had connection strings hardcoded.

Thankfully, they were built in .NET, so I was able to decompile them, move the hardcoded stuff to .config files, and get it moved. But boy did that make me mad at the institutionalized laziness and sloppiness.

What did you use to decompile them into a project that was actually good enough to read through, change the needed things and compile it again?

I just used Reflector, which, at the time was free. There were a few issues that I had to tweak since reflector didn't do well with things like switch statements ... but for the most part it wasn't too bad. I was able to discern most of the munged variable names just by looking at the code and being familiar with the domain of the company.

What you should do is to encapsulate these apps to virtual machines with reduced-credential users, tight firewall settings, non-essential services disabled, etc. If possible, create a separate virtual storage medium for the application data and snapshot the operating system & app virtual disk so that any changes to it will not persist.

This is what I have been doing. The users have a hard time understanding what a VM is. It's a bit magical for them.

And I can't make Vm-Ware Player work with a scanner ...

There is USB passthrough in VirtualBox at least, though it's a bit shaky especially with Windows hosts.

Even if there was competition, it would only apply when buying new software - once you're belted in for the ride, people are loath to change.

The specialist software market seems so crappy, and so prone to throwing good money after bad, that I can understand that.

If you'll state what apps these are, I bet someone here would throw together a web based SaaS replacement in an afternoon. If there's no competition for a business app it's often because no one is aware of the need.

Well it's not as easy as you think : it's business specific software.

I work in public transportation : one company provides us with a way to bill customers, from the time they use their card in a bus (you would have to build the card reader too) to sending a monthly bill.

The other company provides us with a way to track our buses (specific hardware too), and there's even a supposed way to optimize their flow.

But if someone wants to tackle the challenge they'll need a "bit" more than an afternoon ;-)

Technically security updates are released at 10am PST on Patch Tuesday. http://amirunningxp.com/ got this wrong (they used midnight instead).

It prints "You are NOT running Windows XP" on x64 XP.

That is because it is actually based on Server 2003.

I would like to read an article about whether or not an up-to-date anti-virus is going to protect users (how and why) as a lot of IT people defend that position.

Exactly. Any AV worth it's salt should pick up something that a security update should have fixed.

But that's the catch: I am not convinced AV vendors have the resources, the complete knowledge and the access to Windows inner workings to fill in MS role.

And what about the legal rights ? Would they be allowed to patch a security kernel breach, or a lib, made up of closed proprietary code in binary format (an extreme and unlikely case but that's what I read when IT people tell users "we'll just use an anti-virus to circumvent the lack of MS updates") ?

Which versions of Internet Explorer are supported on Windows beyond XP? Is it now 'officially' impossible to support IE6 users anymore?

You are right. Here's wikipedia:

"It is the default browser shipped with Windows XP and Windows Server 2003, and was also made available for Windows NT 4.0, Windows 98, Windows 98 SE, Windows Me, Windows 2000, and Windows Home Server (a derivative of Windows Server 2003). IE6 SP1 is the last version of Internet Explorer available for Windows NT 4.0, Windows 98, Windows 98 SE, Windows Me, and Windows 2000. Although Internet Explorer 6 was superseded by Internet Explorer 7 in October 2006, Microsoft still supports it in Windows XP SP3."

The IE6 compatibility issue should be mostly a thing of the past now, except for some corporate settings and china. But I feel IE8 will stay with us for a long time with a few annoying percentage points that can't always be ignored - and by now it's almost as bad as IE6 was 8 years ago. The only thing that makes the situation better than before is the much higher adoption of FF and Chrome, which at least keeps IE8 users at single digit rates for consumer websites.

Why would 8 be a problem? There is nothing supported that can't run higher and the situation that made IE6 end up being so entrenched, that MS sat on IE development for so long and IE6 was the only IE for many years, didn't happen with anything after that.

IE8 is a problem because many big enterprises still run it. I know of several big US corporations that, even though they run Windows 7 now, still deploy it with IE8 for compatibility with legacy applications.

Once you start dealing with big corporations, it's not as simple as "oh it's time to update".

Unless you're targeting enterprise customers, is that really much of a problem?

It's not just enterprise. For consumer websites the usage is going to hover around 3-5% (IE6,7,8 combined) for a long time - if you target less technically inclined people probably more. Tablets and Smartphones probably help more than Win7+ adoption in that area, but there's still going to be a significant amount of people using browsers on older computers.

> hover around 3-5% (IE6,7,8 combined)

I do not see the point of worrying about this. If enterprise (put forward as the major user of these) is the worry then you might have to care. If it's random users that just don't feel like running Windows Update, well, these people aren't going to be spending much money anyway.

Worrying about [insert version of IE here] hanging around forever seems to be nothing but complaining for the sake of complaining now that IE6 is completely out of the picture.

> Internet Explorer 8 was released on October 25, 2001.

... That's not right.

Yea, it was IE6 that was released when XP RTMed.

Was it? I thought XP used IE 5.5.

EDIT: My bad, it didn't.

Today On April 8 2014, the decade long support from Microsoft for Windows XP will be terminated. This means no more security updates, patches, or technical support for the popular OS, which is still running on 30% of all computers. It's very interesting to see how it affect the XP user who are using it, after the end of XP support era. Research by EHI intelligence revels that 85% of England’s healthcare system IT systems were still using Windows XP.

That's an English healthcare IT problem, not something you can blame MS for. And let's face it, IT project management and risk management has never been stellar in the NHS.

While I don't blame Microsoft for ending support (they have been very accomodating already), but I find it strange of them to leave so many users stranded. Especially now there's several alternatives to Windows, all requiring a similar learning curve and migration pains to that of moving to Windows 7 or 8.

Personally, when people have asked me about it I usually point them to Linux Mint, using their existing computer - not because I'm a fan of Linux, but I'd feel bad advising them to spend 100's on a new computer, when their current one works perfectly (physically).

Apart from someone who plays The Sims 2, I've had no complaints.

It's been more than long enough already. People who haven't upgraded yet fools at this point.

They are either fools or computers are not their lives.

I know plenty users who Linux would be an ideal fit: web browser? Check. Office suite? Check. Device drivers for hardware Vista/7/8 dont have? Check. WINE layer for common XP apps? Check. Better security and malware defense? Check.

And it's free, and wouldn't require any new hardware. Getting 7 on XP hardware would be mighty uncomfortable, if possible at all.

I teach adults. In my classes, I now have 3 or 4 people out of 20 who rely on tablets for all their Internet use, i.e. they don't own a laptop or PC. About half use a phone/phablet/tablet a lot but also fall back to a laptop/PC for some uses (e.g. Flash based learning materials).

I'd agree with one of the more 'automatic' GNU/Linux distributions for casual use on an XP era machine. I suspect the future will be disposable tablets however. I'm now talking to students about backups...

Windows 8.1 runs pretty well on XP hardware, and Update 1 will run even better (minimum 1GB). You might have to buy a cheap graphics card. It browses much faster than XP on the same hardware.

Otherwise, if you have people who wouldn't pay for a cheap Windows upgrade (launch offers), they probably don't want to spend a huge amount of time and effort figuring out a "free" Linux with all the other complications you mention. On their own. From scratch.

Just a couple of weeks ago I got for free a Pentium IV PC with 514MB of RAM and Windows XP.

I changed the cmos battery, the AGP card and did a clean XP reinstall in an SSD drive. The computer is blazing fast. Any newer version of Windows would make the computer slow as shit.

Here in developing countries, we people tend to use our stuff for a LONG time. You see 30yr old cars running around; 20yr old washing machines, which have been re-re-re-re-patched. Buying a new computer just because of some magical limit date, just doesn't cut it. Is it unsafe? maybe, but why throw something away when it is 100% usable!.

Most people don't realize it but Apple does this all the time. Goos luck running most 5+ year old mac on the latest Mac OS X ;)

And going the other way apple only supports each individual Mac OS X version at most 2-4 years...

OS X Mavericks today runs on some machines that are 7 years old. True, that's still not great, but better than you claimed.

Doesn't run on 32-bit machines, doesn't support classic apps. Doesn't run on PowerPC-based machines, obv.

Define "some". The percentage is very low even at the 5 year mark ;)

Seriously? More than the "none" which the original post implied.

I've heard a few people saying that they're staying with Windows XP in their company internally. The idea being that as the internal computers share a single access point to the Internet that they can filter everything incoming there.

This doesn't really sound correct and obviously it won't help for physically bringing in USB sticks etc but I'm still interested to know what others think here?

Is there about to be a large number of 3rd party firewalls trying to protect internet computers from Windows XP exploits?

Malware detection in a firewall/proxy is already very common. See Blue Coat, FireEye etc.

We have internal web based apps that require IE 7 and Windows XP due to Active X controls. We've moved to Windows 7 with virtual XP machines. To prevent internet access we've stopped any traffic at the firewall with the virtual machines.

We think this will work to prevent internet based attacks, but realize we're still vulnerable to physical attacks through media. It was the best we can do given our reliance on the older system.

Any other holes in this other than the physical issue?

Interesting, the company I work for has made a real push to get off of XP, but not a peep about Office 2003. I guess they don't want to spend that money.

Time to switch to Linux on old PCs.

Actually, that's just what I did for my mother. She got emailed by her bank that using Windows XP would not be safe anymore and worriedly asked what to do: "do I have to buy a new computer?"

Since all she basically used was OpenOffice, Thunderbird and Chrome she's now running those three apps in Window Maker on Debian.

>> "She got emailed by her bank that using Windows XP would not be safe anymore"

Before switching to Linux I'd recommend checking the bank supports it. I know a couple of banks in my country that use weird security systems that won't run on Linux/Mac.

As long as they support an open-source browser, you can fake the user agent to make them happy.

Assuming there aren't any plugins or applets involved in the authentication process. Sweden, for example, is moving to a system where you use a smart card and USB card reader for authentication on most/all bank and government sites.

In Belgium, they used to bundle a java app with some certificates or keys on a floppy disk years ago. Fortunately most of them have switched to a custom calculator-like device that spits out verification numbers and doesn't require any connection to the computer or the network.

The smart-card based banking systems I am aware of don't run in the browser (not saying they couldn't have chosen to work via a plugin, they just don't seem to). Gnucash has for several smart card systems, and at least HBCI/Fints support is good [1,2].

[1]: http://www2.aquamaniac.de/sites/aqbanking/overview.php

[2]: http://wiki.gnucash.org/wiki/AqBanking

There's online bank systems in Bulgaria that require users to run IE6.

At my place, all the non-technical people rush out and buy new overpriced computer with win7. Only one of my neighbors decided to let me show him linux. The lokal store dont care, they are very happy to sell some old intel i3 prozessor, Onboard-graphics, and windows 7 for €800+

uh, no.

Quite a few people on XP are there because its what they know. It also is all they need. Personal example, I would love to replace my mom's computer but she likes her version of Office which was the version we installed when she obtained her PC, which runs XP. I suspect she isn't alone in not wanting to change something that works.

For many people tech is just the annoyance they have to put with to do what they want to do. Top that off with hundred dollar or more to upgrade and why should people do it? At least Apple got it right, FINALLY, after many years of charging for OS upgrades to not doing so.

Having helped organizations with donated computers I am not sure there is a real alternative. Linux? Really? Its hard enough sourcing decent used machines for people, I certainly am not game to loading Linux and then teaching them to use it. Perhaps if there were one install and software was available at the store... do you understand?

A web browser is typically all they need. It works the same way in Linux. Turn on automatic updates and show them the web based version of Office.

So you're going to leave your non-technical mom using an unpatched OS connected to the public Internet? Let me know how that works out.

Yeah, that's pretty much the current situation anyway with a lot of folks.

Would be interesting to know. Based on anecdotal reports, I would guess that we are now today in a situation in which more people than ever are running an unpatched, Internet-connected computer - I'm hypothesising that XP is by far the most 'un-upgraded' OS we've had since mass adoption of the Internet.

For someone that doesn't know what google is, and are barely able to click on that Internet Explorer icon - much less use it once it does open, my mother is far from what I'm worried about.

My sister, clicking everything that looks flashy, though... Her, I'm worried about.

There's Linux distros that specifically try and look like Windows to make the transition easier.

Last I checked Zorin OS[1] was one of them but looking at their website now it seems they've decided to take a different route. It's certainly gone a lot more, um, sci-fi since then.

[1]: http://zorin-os.com/

This should not be news for hackers

I believe there are a lot of people here interested in dropping support for IE8 and this is just one more nail in the coffin.

Dear Microsoft, please open source WinXP.

That is never going to happen.

Microsoft ends support for Windows XP to prevent noobs from using IE6.

"Alternatively, you can choose to use a different operating system, such as one of the many Linux variants, or even purchase a new computer running OS X or Chrome OS. If you prefer mobile operating systems as a replacement to your machine, Android, iOS, Windows Phone, and BlackBerry OS are all viable options, but you’ll naturally have to buy a new device."

I really appreciated this comment and the following part about IE8 and Chrome. Well done MS.

The article isn't written by anyone at MS.

You're right, my bad 😊 lol, that was a bit too open eh ?

Reply on news.ycombinator.com