back to article Why Microsoft's Windows game plan makes us WannaCry

In the circular firing squad of WannaCrypt, the world's largest recorded ransomware outbreak, nobody looks good. Not end-users for clinging to dated and unprotected Windows PCs despite warnings, not the government whose National Health Service saw 61 organisations compromised, and certainly not Microsoft – the actual author of …

Page:

  1. Adrian 4

    Much wringing of hands about how the NHS can't afford costs or staff to pursue proper IT management.

    How much could be done for $200 per PC ?

    1. sad_loser
      FAIL

      It is the apps tied to ActiveX that cause the problems

      [I work in NHS IT]

      Some of those places worst affected are just poorly managed but the reason why somewhere like Royal London (a new £1bn hospital) kept all these PCs with XP was that certain critical software could not be (cheaply) updated because it needed XP because the browser interface was written with a load of ActiveX that only worked in Internet Explorer 6 which is part of XP.

      The root cause of these issues is therefore Microsoft's use of non-standard extentions as part of the embrace / extend / extinguish browswer wars.

      1. Gnosis_Carmot

        Re: It is the apps tied to ActiveX that cause the problems

        Not just browser based apps.

        A metric ton of vendors deliberately wrote, and continue to write, code using undocumented APIs and such. When MS or someone else (cough Java cough) comes along and patches/updates removing those undocumented APIs the code vendors refuse to update it because it would mean either degrading or removing functionality the customers have come to expect.

        1. Cris E

          Re: It is the apps tied to ActiveX that cause the problems

          It's not just Windows and IE. We have old yet vital crap tied to a particular Java version that's keeping some very obsolete hardware and software online. MS is just the largest and least motivated OS provider.

      2. PickledAardvark

        Re: It is the apps tied to ActiveX that cause the problems

        sad_loser explains how *some* NHS IT departments were trapped into running XP. Unfortunately, that is not sufficient. We need to know *why* NHS IT departments persisted with XP and failed to dig themselves out of the hole. We also need to know why NHS IT departments failed to patch supported Windows versions.

        The bulk purchase agreement conducted by the UK government for XP support was intended to give NHS IT departments a break, to extend the window for deploying Windows 7. It wasn't intended as an indefinite "get out of gaol free" card. Microsoft made it clear that the programme's purpose was to help organisations move away from XP rather than sticking with it. Microsoft's programme was designed to run for three years (UK gov paid for one year) and I believe that period is over.

        I feel sorry for anyone running a milling machine or centrifuge which is controlled by XP, otherwise in perfect condition. I reckon every NHS organisation or large company owns a few devices that are too good to scrap which depend on outdated computer systems. I'm not keen on a mass scrapage of XP-controlled devices just because IT departments don't know how to manage them.

        1. Anonymous Coward
          Anonymous Coward

          Re: It is the apps tied to ActiveX that cause the problems

          I feel sorry for anyone running a milling machine or centrifuge which is controlled by XP, otherwise in perfect condition.

          So do I but from experience there are very few of those machines in industry that are connected to the outside world and the few that are are very carefully managed.

          As I see it the main problem with the NHS and such places is that they were/are running the full fat versions of XP rather than using a cut down version that just does what is needed. There is also the problem that it is very difficult to slim down windows no matter what version. Because of that the two engineering works we support use tailored OS/2 and custom written software for the machine tools control and since those machines have at least another 25 years life there won't be any changes there for 20 years or more.

          1. trapper

            Re: It is the apps tied to ActiveX that cause the problems

            Four or five years ago I was supporting CNC milling machines that ran from custom DOS commands loaded by 3 1/2 inch floppies or a serial cable. Good machines, but antiquated controls. The machine mfr. wanted the contents of the Royal Mint to upgrade the control hardware. I solved it with a dedicated and isolated Win7 box running Win 98SE on MS Virtual PC. It was a bit of a PITA but it worked on the cheap, same as the owners. Cheap, secure functionality means thought, glue, string, duct tape and monitoring to ensure the duct tape remains stuck down. No duct tape means spending large amounts of money. Refusing both means WannaCrypt.

        2. Anonymous Coward
          Anonymous Coward

          Re: It is the apps tied to ActiveX that cause the problems

          I feel sorry for anyone running a milling machine or centrifuge which is controlled by XP, otherwise in perfect condition. I reckon every NHS organisation or large company owns a few devices that are too good to scrap which depend on outdated computer systems. I'm not keen on a mass scrapage of XP-controlled devices just because IT departments don't know how to manage them.

          Therein lies an interesting issue: why do those machines even have access to anything on the Internet? They're not desktops, they're basically machine interfaces and analytics. Patches no longer happen, and they have a limited function, a bit like an XP based POS. Why not isolate those machines on a firewalled subnet or vlan, make sure they don't talk SMB1 and use them as before?

          1. SImon Hobson Bronze badge

            Re: It is the apps tied to ActiveX that cause the problems

            ... why do those machines even have access to anything on the Internet? ... Why not isolate those machines on a firewalled subnet or vlan, make sure they don't talk SMB1 and use them as before?

            In many cases, the computers DO need some form of interaction with the rest of the business. Take the case of a precision CNC mill someone mentioned - it'll need to be on the office network so that the design engineers can upload the milling programs to it (what if one of those file transfers accidentally transfers something nasty from an infected desktop ?) In the case of (say) an MRI scanner machine, it will need to be on the network so that images can be exported from it.

            The simple fact is that yes, these devices CAN be protected, more or less, one way or another - and the rest of the network protected from them. But it's not a trivial exercise to do.

            Lets assume that for security reasons, the MRI scanner computer is party to the same security policies the rest fo the business has - that's going to mean authorised users (active directory) and the access controls that go with it. Have you tried doing the firewalling to allow AD to work across a "locked down more watertight than a duck's backside" firewall ? It's "interesting" the amount of network traffic needed for AD to work correctly.

            That's not to say this can't be done, but each device will have different requirements, and it takes time to work through how to deal with each of them. So there you are, as others have pointed out, with an IT team, limited budget - and tasked with keeping everything running as well as doing new stuff. You're barely coping with the everyday - where is this time going to come from ?

            So ultimately, it comes down to manglement (at whatever level) not providing the resources needed. And again, as someone else has already pointed out, when we are constantly told that the NHS has to save lots of money - who's going to stick their neck out and "waste" budget fixing something that "isn't broken yet" ? It's not an NHS thing - it's the same across all businesses.

          2. PaulFrederick

            Re: It is the apps tied to ActiveX that cause the problems

            My CNC controller is networked so I can move files over to it, and update it. I run LinuxCNC. I might just want to play a Quake deathmatch while it is cutting a job too. Because I can.

        3. RobHib
          Flame

          Re: It is the apps tied to ActiveX that cause the problems

          "I feel sorry for anyone running a milling machine or centrifuge which is controlled by XP, otherwise in perfect condition."

          1. A short while ago I visited a factory and saw a precision 5-axis milling machine worth about $400,000, it was still running Windows 2000. With that in mind I asked the factory manager how long it would be until they upgraded the Windows software to the latest version. His answer was "2025, the machine was purchased in 2000 and has an expected life of 25 years and the manufacturer provides no Windows upgrades—we expect W2K to be still on the machine at the end of its service life"

          Like it or not, the fact is that XP and even earlier Windows will be around for a long while yet, we have to live with that fact!

          2. The best article I've read to date on WannaCry is the New York Times one on the 13th by Zeynep Tufekci, associate professor at the School of Information and Library Science at the University of North Carolina:

          https://www.nytimes.com/2017/05/13/opinion/the-world-is-getting-hacked-why-dont-we-do-more-to-stop-it.html

          She hits the nail on the head as to why many do not upgrade/patch their systems, here's a short list of her reasons (read her article for the rest):

          * Unlike other manufacturers, software vendors are NOT responsible for manufacturing defects in their software products—like others, the law needs to make them so.

          * To get security updates, users have to upgrade to later OSes that often include features that are often unwanted (GUI changes etc.) and they are often very reluctant to do that, quote:

          "Further, upgrades almost always bring unwanted features. When I was finally forced to upgrade my Outlook mail program, it took me months to get used to the new color scheme and spacing somebody in Seattle had decided was the new look. There was no option to keep things as is. Users hate this, and often are rightfully reluctant to upgrade. But they are often unaware that these unwanted features come bundled with a security update."

          * In the case of Windows 10, users have had to sacrifice their privacy for a more secure system. This is not a palatable or acceptable option for many.

          It's time we all stopped whingeing about XP and started complaining about the many other real causes of the 'patches problem'.

          '

          1. DanceMan

            Re: The best article I've read to date on WannaCry

            Thanks, RobHib

            I join you in recommending others read it.

          2. Anonymous Coward
            Anonymous Coward

            Re: It is the apps tied to ActiveX that cause the problems

            That article tells Microsoft to do the work for free because they had money... It sounds like a disconnection between academic and commercial environment.

            There are people complaining about XP in general, but the real cause is more about incompetence. Seriously, why are XP or older pc on the internet?

            Windows XP should not be on open internet. Your example of windows 2000 for 25 years should be fine as long as that factory kept it the way it was 17 years ago, no internet. This is talking about the XP days, network licenses haven't existed yet. If this is about ActiveX or some weird 100% on IE with network plugin case, then the IT should have an enclosed network using the router to block everything else or something.

            It was because of incompetence in their organization for open internet that caused them the harm. They had a number of options including upgrade, pay support, firewall and plainly unplug the ethernet cable which all could have solved their problem. Too bad, they didn't.

            Much of this event is a very good lesson for those organizations. Fix it now or prepare to take out their wallet to pay for it again and again.

            1. RobHib
              Flame

              Re: It is the apps tied to ActiveX that cause the problems [and more important matters].

              "That article tells Microsoft to do the work for free because they had money... It sounds like a disconnection between academic and commercial environment."

              1. That's not the way I read it. Rather, my take on it is that Microsoft has made such vast sums of money simply because it opted out of its social responsibility to develop good code in the first instance (on evidence, a very deliberate decision on its part)—and that it took this course of action because it was NOT compelled by any law to ensure that its software products worked properly and securely before they were released. Certainly early on, the only things that mattered to Microsoft were its rush to market and maximizing its market share, security was hardly even on its horizon.

              2. You have not addressed the other very real issues [useability difficulties, etc.] as to why users do not upgrade. (Presumably, as an Anonymous Coward, you are a software writer or developer and these points have hit a raw nerve.) These issues are very real concerns for many users and they need to be addressed by not only Microsoft but also the software industry as a whole.

              3. As far as end users are concerned, the software industry suffers from very serious problems—major systemic issues that not only hinder software development per se but also ensure that software is much less secure than it ought to be. Specifically:

              (a) The industry obfuscates its dirty linen behind the fact that source code is compiled (i.e.: remains hidden from users and security personnel alike). Thus, as source code cannot be analysed by third parties, design errors, bugs and security faults escape independent scrutiny to the perennial disadvantage of end users.

              (b) The laws of most—probably all—countries militate against fixing these problems in any truly effective way and have done so for many decades. The lack of software 'fitness for purpose' laws essentially force end users to use software 'as-is' without any guarantee that faulty, buggy and insecure software will ever be fixed by vendors—this is especially relevant where software has been licensed for monetary profit (as in most other parts of the free market warranty laws, etc., actually apply).

              Moreover, this already inexcusable situation is aided and abetted by mad, lopsided and very unfair copyright law—the DMCA for instance—where it even stops users and or independent investigators from investigating bugs and security faults (at risk of their liberty and freedom).

              Furthermore, recently we've seen the truly detrimental effects that have resulted from the absence of appropriate software law that would require commercial software source code to be opened up to scrutiny by third parties in order to protect users against shonky and dishonest software developers; for example, the outrageous Volkswagen emissions scandal. In a democracy (or for that matter any civilised society), the fact that such laws do not already exist is nothing short of being outrageous. How many people have to die because of faulty software produced by shonky developers before legislators will act?

              (c) The lack of adequate and satisfactory law to regulate and govern both the quality and security of software has seriously hindered the technological development of software industry over many years; in fact, its lack thereof has effectively stopped it from becoming a proper engineering discipline/profession (as, for instance, chemical engineering is). For—as past decades have shown—without any such law or regulation, the industry—whose self-discipline has been demonstrated on myriads of occasions to be as rare as hens' teeth—has little or no incentive to improve itself; the only effective incentive being the default one—that of monetary profit (hence the huge and obscene profits made by companies such as Microsoft, Google etc.).

              When there are precious few if any constraints on an industry's actions (as in a world full of insects without any spiders), bad behaviour runs amok exponentially.

              With respect to the last bullet point, (c), before calling me a nark or going into flaming mode, I'd suggest that I'm far from being alone in this assessment. I refer you to the following article: Software's Chronic Crisis, W. Wayt Gibbs, Scientific American, September 1994, p 86., which is aptly prefaced by the comment: "Despite 50 years of progress, the software industry remains years-perhaps decades-short of the mature engineering discipline needed to meet the demands of an information-age society."

              Here is the PDF version and this is a HTML one.

              One must consider this SciAm article was written close to 23 years ago—that's nearly a quarter century ago, which is utterly eons in computer time. Also, now consider the many security issues that currently surround the WannaCry/WannaCrypt virus (and the various implications that arise there from), thus—as far as the end user is concerned—one is left with very little choice other than to question whether any practical (i.e.: effective) progress has been made in computer science since the time that article was written.

              With the plethora of evidence that's available and able to indict the industry on this account, there's precious little doubt that any reasonable person, even after applying the tiniest modicum of logic, could conclude other than that W. Wayt Gibbs was spot on target all those many years ago.

              It's a tragedy the software industry has made so few really relevant improvements over these intervening years.

        4. bobblestiltskin

          Re: It is the apps tied to ActiveX that cause the problems

          I'm not keen on a mass scrapage of XP-controlled devices just because IT departments don't know how to manage them.

          I wonder if it would be possible to :

          1. Attach an external drive and image the hard drive to the external.

          2. Install linux and VirtualBox on the hard drive.

          3. Create a VM and copy the data from the external drive to the VM

          4. Set the machine to run VirtualBox fullscreen at boot.

          Result would be a machine that looks the same to the user, but which has a linux interface to the external world - much more easily secured than unsupported Windows, and the users will not need re-training?

          1. Jakester

            Re: It is the apps tied to ActiveX that cause the problems

            It depends -- there may be hardware in the physical computer that won't talk with the virtual machine. Assuming that the hardware talks properly with the virtual machine and software, then possibly it may work.

            However, the unsupported version of Windows will still be unsupported and just as susceptible to infection. A big advantage of Virtualbox, and other virtual machine engines, is it is very easy to return to a previous snapshot of the operating system before an infection hits.

            On my main computer at home, I have Ubuntu running a Windows 10 virtual machine. My wife prefers Windows and I have a couple applications where I have to run Windows. If my wife or I suspect the Windows machine may have gotten hit by a virus or other malware attack, whether an infection occurs or not, I just restore to my last snapshop. I generally do a new snapshot about once a month as well as before and after new software installation, major upgrades, or major configuration changes. Periodically, I will delete snapshots that I am sure are no longer needed.

        5. Radio Wales
          WTF?

          Empty minds.

          I would have thought that the problem lay in machine interconnectivity rather than age.

          In a machining environment, or any other that is isolated from other computers, a system that uses XP or NT - or even 98, to run specialist software on specific machines that are dedicated to that task and working successfully, there is no logical reason to upgrade everything merely to continue what they were doing anyway.

          Stand-alone machines can run whatever software they want without risk.

          It makes me wonder whether malware isn't just the best way software companies have come up with so far to 'encourage' users to spend a lot of money merely to stand still.

          As far as the NHS is concerned, I have been treated perfectly adequately by machine-led medical intervention that was still using NT. In that I can understand their reluctance to upgrade, particularly when all that money is spent in re-equipping machines, software and re-training simply to continue doing what it is already successfully doing when that money could better be spent of extending its scope and capacity.

          Maybe the government should be employing expertise to write its own OS that works in its own field and eliminating its reliance on commercial software, which by definition is profit-driven.

          Being absolutely honest, outside of the computer industry, nobody really gives a damn about all the technological advances, bells and whistles new stuff does so long as it does what it was procured for, and that is most likely for a quite narrow range of tasks - that demonstrably XP is quite capable of performing.

          If Linux development can be done for free distribution, is it such a leap to use specific software for their single purpose applications a lot cheaper than relying on perpetual upgrades to nowhere?

          Who'd be writing malware for that?

      3. John Smith 19 Gold badge
        Unhappy

        "The root cause of these issues is therefore Microsoft's use of non-standard extentions"

        No. It's the developers of the software who fell for MS bull**it and did so with wild abandon.

        In 2000.

        But it's 2017 and for reasons still unexplained those developers have not got their s**t together and made their LOB apps browser neutral, which would go a very long way to making the next move (and there will be a next move with MS rule, of turning over the user base every 18-36 months).

        17 years.

        BTW People have bleated on about this being a problem with various diagnostic machines. But these are a special case. IIRC Embedded Windows XP is under support till 2019. So why didn't the suppliers use that instead?

        1. Not previously required
          Holmes

          The root cause of these issues is therefore purchasers buying poor software

          I run a diagnostic lab in the NHS. Win 7 and up since you ask.

          My employer has had some software in the past that required particular versions of IE or Java - these have been applications by big corporations that span multiple trusts. Applications like purchasing etc.

          Which government department thinks this was a good idea? The advantages of standards based software over schneaky API use have been apparent for decades

          1. Anonymous Coward
            Anonymous Coward

            Re: The root cause of these issues is therefore purchasers buying poor software

            "applications by big corporations that span multiple trusts. Applications like purchasing etc."

            Obviously not SAP or Oracle *, but maybe there are still others.

            "Which government department thinks this was a good idea? "

            The one that gets the kickbacks. It the same logic that leads corporates to use Amex for UK travel management when self-booked Travelodge (etc) would cost the *company* less overall, but Purchasing would lose the Amex benefits, so Amex it is.

            "The advantages of standards based software over schneaky API use have been apparent for decades"

            Ain't that the truth. But you have to follow the money.

      4. Anonymous Coward
        Anonymous Coward

        Re: It is the apps tied to ActiveX that cause the problems

        There are numerous solutions out there such as Browsium, application layering or application virtualisation that will allow you to run older browser versions on newer versions of Windows.

    2. oldcoder

      Complete replacement by chromebooks... :-)

      Replace the operating system with Linux :-)

      1. Mark 110

        So are Linux versions from 2001 still being supported by their vendors? I can't think of any product I have done a support review on where when I went looking for the vendors EoL staements there was anything more than 10 years old still in any kind of support.

        This isn't just a Microsoft problem. Its just the biggest problem because Microsoft have the largest installed base.

        1. billium
          WTF?

          I've had my Linux from 1999 and have still not had to pay for an upgrade.

          Nobody fears upgrading or changing their Linux in fear of data slurping.

          £5M of our tax payers money or $200 per PC only a monopolist with vendor lock in can do this.

          It is a Microsoft problem.

          Sometimes Windows will not update: KB4019472 failed to install error code 0x80832250

          1. cambsukguy

            Just because it was Linux doesn't mean you have the same version.

            Windows 10 is just another version of Windows but is not XP (which was version 6?).

            A Linux installed in 1999 does not have security patches available, it has what Windows has, OS upgrades and replacements, which include and have security updates.

            The reason that all (or most) Linux users have upgraded of course, is that it is free.

            Ironically, Linux is less likely to be attacked anyway, by several orders of magnitude I imagine.

            1. PaulFrederick

              But it is not free to upgrade Linux. It takes me a long time to install and configure everything on my system. Which is why I'm still running Debian Wheezy. OK not wanting to run Systemd has something to do with it too.

          2. Dinsdale247

            Sure thing. I dare you to stick that computer in front of a "normal" user and ask them to do their job. I don't care if you put Mate on it (which wouldn't run anyways), you are still going to have a computer that nobody but you can use.

            Software requires support. That either comes from the vendor or comes from IT.

            Windows = an OS that people can use and is easily supportable for non-technical people.

            GNU/Linux = IT hand holding and unproductive users. Just try explaining mount to someone that isn't a developer.

            There is no free lunch. Free operating systems just mean the IT department has to maintain the system. Want Linux support, you have to pay for that. Ubuntu and Redhat don't offer anywhere NEAR 15 year support.

            1. Richard Plinston

              > Just try explaining mount to someone that isn't a developer.

              You are obviously decades away from recent reality*. I plug in a DVD, USB or MicroSD and a dialog box pops up asking me what I want to do, or it simply gives me a file manager with the directories. It, however, does _not_ automatically execute any code on that device.

              Other distros options or configurations may just add other partitions or devices as icons on the desktop ready to double click to mount them, or provide a GUI program to list these and/or available shares.

              * the last 10 years or so.

            2. Anonymous Coward
              Anonymous Coward

              You have no idea !

            3. Not previously required

              The NHS does not really use Windows

              @Dinsdale247. Much of the NHS is run using applications that look like text terminals. Whether they are browser based or some other kludge. If they don't need special Java or browser versions they could just as easily run on Linux. Many of these machines only do one job (reception in outpatients for instance).

              For other systems, the changes in UI in different versions of Windows / Outlook / Office - and we have a horrible mixture - are no worse than changing to LibreOffice and your favourite flavour of Linux.

              There are some very bright, highly motivated people in the NHS. I'm sure they could cope with a sensible staged transfer to Linux. It would be a huge project so of course there would be a cost and some cockups on the way. I think the end result would be better.

              We could start with the government observing its own standards. We are meant to be using documents in OpenDocument or PDF formats only!

            4. Kiwi
              Linux

              Sure thing. I dare you to stick that computer in front of a "normal" user and ask them to do their job. I don't care if you put Mate on it (which wouldn't run anyways), you are still going to have a computer that nobody but you can use.

              My Uncle brought me a spare laptop so I could install Linux for him to have a trial of it, to see if he liked it. Took only a few minutes before he asked for an upgrade for his desktop as well.

              And he's one of those who would tell you his OS was "Firefox" and his computer was "that thing with the screen" and so on. The only "tech support" I've done since then was getting his printer working - which was actually a mechanical fault with the printer (print head wasn't moving). Now he has a secure OS that doesn't record his "typing history" (ie every single keystroke, doesn't have the multitude of security flaws. Oh, and is really easy and intuitive for someone to use as well. Unproductive? He's getting far more work done in far less time, doesn't have massively long downtimes with the "installing updates, please wait and wait and wait and wait and wait" that Windows does (updates are done in less than 5 minutes). He has owncloud to keep things sycned between the two machines, and I can see from the logs that his last Windows use was over a week ago, but daily Linux use and he even takes his laptop on the road with him now - meaning his available time for productivity has significantly increased.

              Stop spreading the fud. MS doesn't pay enough for your soul.

              1. This post has been deleted by its author

          3. Anonymous Coward
            Anonymous Coward

            Update fail

            You are correct. If you are unfortunate enough to have to clean install Windows 7 or 8.1, you will see how flaky the update process is. I wonder how many Windows 7 PCs will thus get reinfected by WannaCry.

            1. Anonymous Coward
              Anonymous Coward

              Re: Update fail

              " If you are unfortunate enough to have to clean install Windows 7 "

              I've done that quite a few times over the last few years (as informal support for neighbours etc).

              It had got to be an utter nightmare.

              And yet, the last couple of months when I've done it a few more times, it's been fine. Same hardware, same install media, but suddenly no need to wait overnight to see if Windows Update will bless me with the ability to keep patching my neighbours systems.

              What's changed? The date, and the ISP (was BT, now isn't BT).

              Odd.

              1. Jakester

                Re: Update fail

                I too have experienced the security patch updates to take days or fail completely. I don't remember the originator of the solution, but I have found that if Windows 7 has SP1 installed as well as KB3020369 and KB3172605 applied, the updates after that go smoothly. The trick is to first turn-off automatic updates, reboot the computer, download and install the two KB updates directly from Microsoft. I usually reboot after applying the KB's. After the reboot, the automatic updates can be turned back on, if desired. After applying the two KB updates (they will let you know if they were already installed), you should find that future updates will take minutes instead of days or weeks.

        2. Anonymous Coward
          Anonymous Coward

          Bovine Excrement!

          First off 2001 was 16 years ago, not 10 years ago, and yes this is just a Microsoft problem. Unix/Linux (any year any version) is not susceptible to attack in the way that Windows (any version) is. Even Mandrake circa 2001/2002 is not susceptible to this.

          1. Ragarath

            Re: Bovine Excrement! @ AC

            First off 2001 was 16 years ago, not 10 years ago, and yes this is just a Microsoft problem. Unix/Linux (any year any version) is not susceptible to attack in the way that Windows (any version) is. Even Mandrake circa 2001/2002 is not susceptible to this.

            Of course they are not susceptible to this, it was not written to attack them. They are though most likely susceptible to other things. Or are all the updates and patches for Linux just because the programs love to add bulk?

            1. Richard Plinston

              Re: Bovine Excrement! @ AC

              > Or are all the updates and patches for Linux just because the programs love to add bulk?

              Many, or most, updates are adding new features to the programs. 'Updates' for a Linux distro are not just for the operating system but also for several thousand system and application programs, not just bug fixes but new versions.

          2. Dinsdale247

            Re: Bovine Excrement!

            Heartbleed anyone?

            1. Kiwi
              Linux

              Re: Bovine Excrement!

              Heartbleed anyone?

              When HB was discovered, a patch was released within a few days. For free.

              However, this issue with SMB1 was discovered some time back. A few months back MS released a patch for paying XP customers. From what I've read the patches for non-paying customers (including 7, 8x &10) was only released after WC hit.

              So your point is what? That Linux does it far better?

        3. bombastic bob Silver badge
          Linux

          "So are Linux versions from 2001 still being supported by their vendors?"

          not directly, but since it's open source, you could fork it and do it yourself.

          Additionally, the upgrade is MUCH LESS PAINFUL for Linux than for windows. In short, to upgrade a typical Linux, a tar backup of the home dirs, and a list of installed packages is MOST of the work. That assumes you'll have to do a complete re-install. Most of the distros I've seen have a way of upgrading to a new release that's moderately painless.

          What Windows "upgrade" gives you is a bit like 'sticker shock' except it's "stick-it-to-you" shock, from removed customization to 2D FLATSO FLUGLY to SPYWARE and ADWARE and blatant ADVERTISING built into the OS.

          Wanting to stay on XP to avoid all of the "up"grades is actually a good idea. I wish _I_ could have done that...

          (I wish I could fork XP and release it to the world with a kickstarter campaign - instead, I'll have to do what I can promote Linux, as the only REAL alternative to Windows for the average desktop user, and that INCLUDES dealing with the FUD)

          1. Dinsdale247

            Until you have an app that's not compatible with systemd. Or requires a kernel feature that doesn't work as advertised anymore. Or has a driver that requires a specific kernel version. Or, or, or...

            Oh, your app was compiled against GCC 3.x? Oh, I'm sorry, it won't run unless you rebuild your software from source on the new compiler or support two runtimes.

            Oh, the application doesn't support the latest OpenSSL? No problem, I'll just tweak this and add that and oh, wait, I've now spent three developer months maintaining this application that will still only run on THIS instance of GNU/Linux so we need to build a custom image and...

            BUT before you even got here you need developers that know what GCC and OpenSSL are and how to maintain the kernel with the correct patches. No problem, I'll just find some senior C++/Linux fellows around... There's lots of those and they should be pretty cheap to come by...

            NO FREE LUNCHES

          2. jelabarre59

            (I wish I could fork XP and release it to the world with a kickstarter campaign

            Anyone who wants to do taht could just run ReactOS instead. At the rate they're developing it, it will reach full-WinXP compatibility in another 10 or so years.

        4. Colin Tree

          20 years of free upgrades

          Some files in my /home partition are 20 years old.

          My /home partition stays, and I upgrade Linux around it.

          Upgrades for free,

          different distros,

          different applications,

          new computers,

          new hard drives,

          keep and expand the /home partition.

        5. Anonymous Coward
          Anonymous Coward

          So are Linux versions from 2001 still being supported by their vendors? I can't think of any product I have done a support review on where when I went looking for the vendors EoL staements there was anything more than 10 years old still in any kind of support.

          You're like Republicans pointing at transgressions of the previous government to talk good what is happening today in the hope that anyone falls for it :).

          You're comparing apples and pears here (to avoid confusion, that's not a reference to macos).

          Updating linux generally does not require a massive update of hardware because the supplier could not code efficiently to save their life, it does not usually require a full review prior to update to cover any new privacy problems (with the exception of one version of Ubuntu) and it generally does not come with a massive exercise in license management and associated costs.

          Apropos cost, Linux will also not blow a large hole in your budget simply to buy it, and because there's no money involved there is also no need to change the UI and file formats every time to provide some argument for an upgrade. In other words, you also save a fortune on user training.

          Long story short: Linux can be kept current because there are no real barriers to upgrade when possible, but if you DO stick with an old version for embedded use it's far easier to lock down than Windows if you put in the effort. That said, idiots are everywhere and it is possible to make even Linux unsafe as many IoT devices are presently proving.

        6. PaulFrederick

          Today's Linux can still run software from 2001.

        7. Kiwi
          Linux

          So are Linux versions from 2001 still being supported by their vendors?

          Does Linux have undocumented APIs as a practice? (not counting the inability of some coders to write decent documentation). Or does Linux have, at lease for the kernel, a policy of "don't break userspace"?

      2. Dinsdale247

        Foolish

        Show me a GNU/Linux distro that provides 15+ years of long term support?

        https://www.kernel.org/category/releases.html

        Just because someone is running "Linux" doesn't mean they are able to leave systems unpatched for years and years and years and not suffer the consequences. Moreover, Linux upgrade paths can be an absolute nightmare that include custom kernel patches, custom driver software, new compilers/C libraries and incompatibility in the userland. It's not just as simple as "running Linux". Rolling releases are just as destructive.

        Regardless of vendor or operating system, IF YOU DON'T PATCH YOUR SOFTWARE, YOU HAVE UNPATCHED SOFTWARE.

        This is not the vendors issue. Microsoft has never promised unending OS support. Everyone was warned, everyone new what to expect. Everyone that ignored is suffering. Not an MS problem. Do you blame lung cancer on a government because someone smoked even though the government told them it was bad for them?

        1. Colin Tree

          Re: Foolish

          Your foolish,

          you don't upgrade,

          you partition your data from your OS

          It's all about OS design, data should be independent.

          Many years ago the venerable gurus designed Unix very carefully,

          it still works really well.

          M$ wanted your money,

          and here comes a new bucket full of money from the chumps.

      3. Field Commander A9

        And then spend trillions in rewriting applications and retraining users? Puff, Capitalism.

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like