Hacker News Reader

Comment by giancarlostoro | Hacker News Reader

So if this really goes back that far, I would hate to be anyone using Windows XP.

XP is 13 years old.

When the Blaster worm hit in 2003, the Unix people laughed, because they were immune. The Morris worm was ancient history, because it had been 15 years since that hit.

XP is almost ancient history. You shouldn't be running it, any more than you should've been running something vulnerable to the Morris worm in 2003.

edit 'omh makes a good point below

You shouldn't be running it but a hell of a lot of people and businesses still are. And MS is to blame IMO. The continued extending support, they screwed up with Vista and after making things right with Windows 7 screwed up again (although no where nearly as badly as with Vista) with Windows 8.

I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows they really want or need.

The pace of change in big orgs mean it takes 2-3 years to implement a change like xp->win 7. When you have 100k employees and regulatory hell and have outsourced every last bit of everything you are pretty fucked.

I work for a big corporation which has not fully made the windows xp to windows 7 transition. We have an extended XP support contract with MS which to my understanding includes bugfixes for this kind of major problem.

If you think that's bad, try the NHS in the UK. Its the largest organisation in the world with 1.4M employees (!). They've been rolling windows 7 out for 4 years. It'll be obsolete when they've finished.

..."the NHS in the UK. Its the largest organisation in the world with 1.4M employees..."

It's big, but it's not that big, fifth or sixth largest employer in the world according to Wikipedia:

http://en.wikipedia.org/wiki/List_of_largest_employers#Large...

Ok I'm a bit off there. My data was from 2009 :)

Plus DoD is several branches so that's a bit of a push.

Is there a better way?

Maybe they should standardise on a particular UI for specific applications - maybe with desktop icons in specific locations for launching those apps. Then they remove the OS from user view entirely - any OS or version of an OS that will present the particular applications with the required views would then be appropriate.

That way when determining if they can upgrade to Windows 10 they just need to ask "will our current apps run, with largely coterminous views and function? Can the OS login direct to our launch icon layout?".

Most users use applications rather than OS, especially in a work setting I'd warrant.

> I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows they really want or need.

They don't need security updates? Aren't they connected to the internet?

Most people can't "see" security vulnerabilities in their OS.

I've made that point to this person many times but they're pretty specific about the sites they browse to and regularly run anti-virus scans. Not ideal but they seem fine with it and their system runs pretty nice.

> You shouldn't be running it but a hell of a lot of people and businesses still are.

I am currently creating an application that has "runs on Windows XP" as part of the requirements list.

I hope they're compensating you some way or other. One of the last things I did at my previous job involved spelunking around some awful ancient VBScript code, boy am I glad I left that place.

It is not that bad, just that I am constrained to .NET 4.0.

Windows XP is old, but to call it 13 years old is somewhat misleading.

XP was the newest possible version of Windows as recently as 2007, and since most people ignored Vista it was the default install for many (most?) people up until Windows 7, which was only 5 years ago. SP3 came out in 2008 and significantly improved the features and security.

Combined with some odd licenses and old PC stock in stores there were plenty of people buying new laptops in 2010 with XP installed.

Yes, it's old. But more like 5-6 years than 13.

XP came out before Debian 3.0. At that point, Google hardly existed, iTunes hadn't been released, and the Nokia 3310 was less than a year old - http://en.wikipedia.org/wiki/Nokia_3310

Anyone who is still running Windows XP has this coming.

On the other hand, you could buy a brand new PC with XP on it 2 years ago. PC which could be still working perfectly fine for its intended purpose - so many people don't understand why would they want to spend money on something that works without any problems.

The vulnerability seems to be present in Windows 95 (and equivalent Windows Server), as well as IE 3.0+. So yeah.. quite a big deal.

I'm using XP but also a filtering/reencrypting proxy, so all secure connections are going through OpenSSL's client code. Ironically, I just updated OpenSSL 2 days ago and patched the proxy to add SNI...

MS is still pushing monthly updates to XP users, purportedly to scan for malware. How hard would it be for them to push a patch with a fix for this?

As far as I know they haven't explicitly said they won't. The "affected systems" lists on the recent advisories currently only go back as far as 2003/Vista, but IE6 is listed in some of them so if they are going that far back with IE (6 dropped out of extended support at the same time as XPsp3) there is a chance there is a patch coming for XP too.

Of course they are under no obligation to.

And some might argue that giving people updates so they can continue to use IE6 is as bad as giving an alcoholic a double G&T to help keep withdrawal symptoms at bay...

There are plenty of running installations of Windows 95/98/2000, too.

Reply on news.ycombinator.com