Why Microsoft really patched XP | Hacker News Reader

Why Microsoft really patched XP

nothingjustworks.com

"Long story short, it hurt their IE brand. MS no longer has to worry about reputation management for the XP brand, but they sure do for IE."

Maybe I'm being a little off-topic, here, but I don't think it can be overstated how much Internet Explorer has destroyed Microsoft's brand. Apart from it being their largest consumer-facing brand apart from Windows (I think), I suspect that more people came into programming through web development between 1995 and 2005 than via any other path -- and for that decade IE was basically a big advertisement for the worst sides of Microsoft during those years -- the side that steamrolled competition with their lower-quality software, the side that tried to destroy open source and open standards, the side that attracted customers by manipulation and force.

Huh? I think you're off by a decade. Microsoft burned a lot of reputation by letting IE stagnate between 2001 (IE6) and 2011 (IE9), but at the time IE5 and IE6 shipped, they were legitimately faster, more compliant, and all-around better browsers than the Netscape versions of the time. I don't remember IE4 to comment on that, but there was certainly a time where IE was the best browser, both to users and developers. They simply failed to keep innovating on it.

When IE4 came out there was no comparison. Netscape Communicator was already a bloated, unstable mess. IE4 was a giant leap forward at the time with a cohesive DOM.

And IE 5 brought xmlhttprequest, which became kinda popular.

> They simply failed to keep innovating on it.

This was not a failure. Web browsers are a direct threat to the Windows platform and Microsoft consciously chose to drop out of the browser wars.

I wouldn't go as far back as 1995. I remember using Netscape those days and IE was considered the "hip & modern browser" just like we do now for Chrome. It was the best viewed in IE days and since there were no real standards or committee back then, everyone wrote their own feature set including MS. It did sure give us the annoying <blink> and <marquee> tags but remember it also gave us Ajax. The shit only really blew when Firefox came into scene with a faster, secure and more progressive browser than IE.

Although, I personally feel if firefox doesn't catchup with the webkit browsers, we will soon be taking a full circle.

Yeah, MSIE was the best browser through version 4. The real reason Netscape lost the browser wars was that it became a huge bloated mess. Now it probably couldn't have beat IE regardless of how good it was because of Microsoft's monopolistic practices, but IE was the best browser for a few years in the mid-90s.

Of course, they then proceeded to let it stagnate for the better part of a decade...

>they then proceeded to let it stagnate for the better part of a decade...

That is one of the side effects of being on top without the worry of competition AKA being a monopoly. Despite Chrome being my favorite browser, this is one the things that worries me the most when everyone yells "Port all browsers to Webkit!!!", we will inadvertently repeat history.

Southpark best visually described it in one of their episodes [1].

[1]http://en.wikipedia.org/wiki/Something_Wall-Mart_This_Way_Co...

+1. I try to figure out where the "Port all browsers to WebKit!" crowd is coming from, but the only reasonable speculative theory that I can think of is that they weren't there for the first go-round.

> <blink>

<BLINK> was from Netscape. http://www.montulli.org/theoriginofthe%3Cblink%3Etag

In related amusements: https://www.google.com/search?q=%3Cblink%3E+tag

Oh, but let's not forget page transition animations introduced by IE. Thank God those died a rapid death.

The other thing that killed NetScape Communicator is that it had been costing $70 per copy. Remember... people used to pay for browsers.

> that killed NetScape Communicator is that it had been costing $70 per copy.

It didn't kill Netscape to charge per copy, that's how software works. People need to earn money for their work creating software.

What killed Netscape was Microsoft taking advantage of its monopoly by pushing itself into a new market with free software. Microsoft didn't need to earn money directly from the browser, so they could afford to give it away for free and take a loss.

I was jesting. ;) I happily bought several copies back then, which was a lot on an allowance for mowing grass, but FREE was very hard to beat. Of course there was a little Anti-Trust case that came out of those dealings.

While the monopoly control provided a simplified avenue for distribution the free price tag alone cannot be held to blame. By that analogy any free, open source product can push its way into a new market and kill the paid for competition which is clearly not the case.

>The other thing that killed NetScape Communicator is that it had been costing $70 per copy. Remember... people used to pay for browsers.

Yes but mine came free with the ISP's installation floppy diskettes, which was very cool of them. If I remember correctly, wasn't Opera initially a paid browser too?

Yeah, I actually paid for it back in the day.

Opera had paid versions, then ad supported versions.

> the side that steamrolled competition with their lower-quality software

That's not true at all, IE was the superior alternative (and the "standard-following" browser) when it steamrolled Netscape. The problem came after that and was a great demonstration of what happens when you give the keys to the kingdom to a single profit-driven entity.

I doubt anybody's learned shit though, considering how fast people jumped to a Chrome-based monoculture and started arguing for the blessing of any and all Google proprietary dropping.

You're thinking techies vs the average user who just uses IE cause it's there. The average user barely knows there's other browsers, or even that xp is no longer supported. How many people still use xp :(

>I wonder why these protections aren’t enabled by default.

Because bugs exposed by a change in Windows are used to denigrate Windows, not the developer of the buggy app[1].

[1]: http://blogs.msdn.com/b/oldnewthing/archive/2003/12/23/45481...

Unfortunately, this sort of thing seems to snowball. MS bends over backwards to preserve backwards compatibility, so third-party vendors basically have free reign to abuse the OS, requiring MS to bend over backwards even more to accommodate them, and on and on.

Apple, for example, had much less of a problem with this even before the days of the App Store and the accompanying restrictions, because developers largely knew that if they depended on undocumented behavior there was a good chance that their app would break and Apple wouldn't fix it for them.

The other side is that Apple is not preferred in many corporate shops exactly because of that.

That's an excellent point. Neither approach is perfect, just different tradeoffs.

And how. My company relies on a lot of in-house software that was built against Microsoft technologies from the 1990s, and are still supported. We have plenty of resources; we could port/rewrite them if we needed to. But that isn't cheap, and I imagine we've saved a lot of money over the years thanks to Microsoft's devotion to backward-compatibility on Windows. Not just development cost, but cost related to software defects we have not created because we've been able to leave already-working software in place.

(Web applications that rely on ActiveX, on the other hand. . .)

There are many stories to MS doing this. There are actually tons of conditionals in the MS source and kernel explicitly to fix broken vendor code. Look up the SimCity fixes they put in the Win Malloc to fix bugs Maxis wouldn't so that upgrades wouldn't break the game, despite the bug being entirely Maxis' fault.

Such things are no longer fixed directly in the kernel or other OS code. They have shims that can be enabled on a per-application basis that sit between system calls and the program. Those can then fix such things, e.g. lie about the OS version, allocate a little more than requested to avoid buffer overruns, etc. Windows then ships with a database which application requires which shims; in Vista that included some 5500 programs.

It's actually much simpler than you think. Microsoft have some big customers that pay them to maintain XP. Microsoft like making money, so they maintain XP for them. If these patches make it to general availability is up to Microsoft however, and it looks like they are still doing that.

Big customers like Target that would prefer to run their POS machines on Windows XP. So sad..

I assume these are Windows XP Embedded machines, which have support as far out as 2019[1].

[1]: http://www.zdnet.com/microsoft-remember-some-xp-based-embedd...

It's not sad at all when XP does the job and it would cost ridiculous amounts of money to update for no benefit. Now, waiting until the product fell out of support was a mistake, but Microsoft failed to produce a compelling upgrade for XP, period. Even Windows 7, which people generally like, doesn't run on the same hardware as well as XP if that hardware is older, which XP computers are going to be. And Windows 8? Aside from whatever bug fixes or improvements to the kernel might be involved, there is not one thing in Windows 8 that does not exist solely to serve Microsoft's interests, regardless of what customers want.

You can't blame MS when the customers don't see the value in upgrading, because from their point of view, there wasn't one. Now that XP has been sunsetted, everyone is worried, and there are a lot of companies that were very foolish in not moving to a viable and supported solution... except that in some cases, there literally isn't one.

There's a tremendous amount of legacy software out there that does the job and doesn't need a newer OS. A few years ago, one of my kids had use a portable brain wave monitor for a couple days, and was issued a device that he would be hooked up to, and guess what? It ran Windows 2000. I wasn't surprised at all. Windows 2000, as an OS, was one of the most solid releases Microsoft ever had (not necessarily the userland stuff, some of which was horrible, but the OS itself was fine).

By the way, the monitor found that everything was normal, my kid's just weird. ;-)

I would imagine those devices are probably still in use, and why not? Windows 2000 was a perfectly solid OS and was very secure on a non-networked device. XP didn't suddenly become not a good OS, Microsoft just pulled the plug without offering a good option for people with old hardware that didn't want to (or couldn't afford to) replace it.

Part of "doing the job" is keeping customer data secure, and the company's reputation -- and the CEO's job -- intact.

was target's data breach caused by an xp bug?

Site is being hammered. Cache: http://webcache.googleusercontent.com/search?q=cache:xhJHpCh...

> Can you imagine the conventional wisdom for IE being, “Don’t use it, ever.

That is accepted conventional wisdom among most techies I know.

Yup. No need to imagine at all.

Just a nitpick: What features were lost in the transition from the start menu to the start screen? The start menu closes if it loses focus anyway, so you can't do other stuff with it open. Arguably, the start menu not being full-screen is a bug. I suspect this is just a case of people not liking change, no matter how trivial.

Well, it did lose the off button, but other than that I can't come up with anything.

> Arguably, the start menu not being full-screen is a bug.

A bug introduced in Windows 95 that they waited until 2013 to patch? I think after a certain number of years it might have moved from a bug to a feature.

For me, the problem with the new start screen is exactly what you describe. I'm fairly scatterbrained. When I'm going to open a program, file, etc., it's usually because of something else I have open, like an email with a request from a co-worker. When the start screen takes up the whole screen, I get distracted from the reason I opened it in the first place and have to go back to my email before I remember. I know that it's my problem, not Microsoft's, but at least having the choice between overlay or full screen would be nice.

I consider the context-switching of the huge fullscreen start menu the same as the "forget why you entered a room when you walk through a door" phenomenom.

http://www.scientificamerican.com/article/why-walking-throug...

Interesting idea, yet it doesn't quite line up with the facts, IMNSHO: IE on XP only goes up to 8, yet this CVE goes up to 11, and it's what, two weeks old? http://www.symantec.com/connect/blogs/emerging-threat-micros... - and guess what, the recommendation is "Do not use IE, at all, not even the new versions." Both the browser and its brand are broken beyond any repair.

Sure it does. The moment I saw headlines like "US government recommends against using Internet Explorer" because of that bug, I thought "Chrome and Mozilla guys must be over-joyous with this". Google already promised enterprises that they'd support XP a year longer than Microsoft, for Chrome. This made it even easier to convince them to switch to Chrome. And I don't think Mozilla plans on ending XP support anytime soon either. I think they only ended Windows 98 support a few years ago.

But after the patch the advice wouldn't hold any more, everyone could go back to happily using IE.

If XP wasn't patched then the news articles would be more nuanced. The "Internet Explorer is dangerous!" theme from earlier articles might have continued and left the average consumer thinking that IE was broken everywhere.

(I'm not sure if I totally agree, but this seems to be what the article is suggesting. And I think it still makes sense even with IE on XP stuck at IE8)

"Do not use IE until a patch is released" is what it really said. The browser has been steadily improving its standards compliance with each new version. Yes, many people are using alternative browsers nowadays but I don't think that means IE is hopeless.

"Until a patch is released - sometime, eventually, hopefully: no clear date is given, and the track record says this same situation will repeat within six months."

There's this particular style of writing blog articles that assumes that the reader knows all about the context of the topic (here: Microsoft has patched something, have they?) and the relevance to something (what, really?). It's a 5 minute brain dump for the author himself.

That's pretty much a pure example of what a blog entry originally was. Since the author is directly responding to an earlier story, he can assume that the reader is familiar with the context. Especially within the HN community, this is a reasonably accurate assumption. This isn't an article for Time magazine or CNN.

Looks like their WP DB borked...

HN effect, I suppose. Reposting here (let me know if I'm stepping on anyone's toes):

Why Microsoft really patched XP

Long story short, it hurt their IE brand. MS no longer has to worry about reputation management for the XP brand, but they sure do for IE.

Can you imagine the conventional wisdom for IE being, “Don’t use it, ever. It has known holes that MS refuses to fix.” Even with the qualifier, “Only on XP,” it would be a PR nightmare for a browser that isn’t exactly well loved.

So where does this leave MS now? Arguably, they’re going to continue to patch XP for non-paying extended support customers depending on the severity of the exploit and especially if it affects IE. We probably won’t see anything patched outside of serious IE vulnerabilities or maybe a conficker-type vulnerability that can be exploited remotely. Serious vulnerabilities like privilege escalation that crop occasionally will remain unpatched.

What does this extended support mean for web developers? IE8 on XP is alive and well apparently. This is a five year old browser with a poor feature set compared to modern browsers. I remember watching my remaining IE6 traffic disappear almost completely in a 12 month span about three years ago only to be replaced with IE8. Is IE8 the new IE6? Maybe, but whats for certain is that this kind of extended support is just going to make the problem worse.

Of course, the larger question is why aren’t we all using EMET, which thwarts this, and other, vulnerabilities without patching? I tested it in my environment, and Sophos refused to let IE run when EMET was running. Sophos support had no resolution. If third-party AV companies can’t work with first-party utilities, what hope is there of Joe User or Joe Corporate Admin rolling this stuff out and expecting it to work without major issues?

The protections EMET offers are pretty impressive. I wonder why these protections aren’t enabled by default. This would be a good differentiator for Windows9. I could see a business friendly version of Windows with less focus on the Modern mobile-like UI and a return to the full features of the Start menu. Now, imagine it with EMET on by default with an option for admins to disable it via a whitelist. One can dream.

Here is a link to the google cache of the post: http://webcache.googleusercontent.com/search?q=cache:xhJHpCh...

#1 on HN on Saturday was about 150/min sustained. That's not even 3 per second. What in WP makes this an issue, or is it just running WP on a shared instance on a wimpy server. Or is it some config in WP that you need to change?

Some web sites are limited by a fairly paltry network usage limit, not by throughput of the server. I don't think you can ever assume that a privately-held domain can cope with unaccustomed traffic, even if it is only 3 per second. Seems to be responding well now, anyway.

Off topic - but I can't decide if I love or hate the theme used on this site..

I like it, although colorful banner ad at the bottom does not fit well with this design. On the other hand, banners ads rarely fit well with any design.

It bugs me that the font is off...

It has promise, but it irks me that trouble was went to to include the iconography, but they aren't interactive - only the labels are.

http://theme.wordpress.com/themes/retro-mac-os/

It's a fun theme for a personal site. I see the theme reference was removed from the site though.

The irritating thing is: While IE is the most veulnerable, the most slowest and the clunkiest internet browser in the universe, it still manages to be the most used browser.

https://en.wikipedia.org/wiki/Browser_usage_share says chrome overtook IE already 2 years ago.

Ahh, my bad! But I think it overtook in 2013, cause many websites claim that. Cheers!

Reply on news.ycombinator.com