Slashdot Mirror
Microsoft Says No TCP/IP Patches For XP
CWmike writes "Microsoft says it won't patch Windows XP for a pair of bugs it quashed Sept. 8 in Vista, Windows Server 2003 and Windows Server 2008. The news adds Windows XP Service Pack 2 (SP2) and SP3 to the no-patch list that previously included only Windows 2000 Server SP4. 'We're talking about code that is 12 to 15 years old in its origin, so backporting that level of code is essentially not feasible,' said security program manager Adrian Stone during Microsoft's monthly post-patch Webcast, referring to Windows 2000 and XP. 'An update for Windows XP will not be made available,' Stone and fellow program manager Jerry Bryant said during the Q&A portion of the Webcast (transcript here). Last Tuesday, Microsoft said that it wouldn't be patching Windows 2000 because creating a fix was 'infeasible.'"
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
It is unclear how large a threat this is to the end user. However the fact that XP is being loaded on netbooks suggests that Microsoft has a revenue stream that it should protect by writing a patch if it is serious.
Facts are history now plebs have politics for religion on social media.
That's unpossible!
This sig left unintentionally blank.
So, basically, upgrade or you'll be hacked?
Two questions:
1. Does 7's XP mode potentially have this issue, or is there a compatibility layer so xp doesn't talk directly to the network?
2. They seemed to be able to make massive security updates for code that was that old, and still patch a number of other issues. What about this REALLY makes it so hard to code?
In the end, while I understand not wanting to waste resources on way older products, I think it is a marketing move.
well, that's one of the positive aspects of the open source code. If the main developer doesn't want to fix something, then someone else can do it.
Isn't the codebase for XP and Windows 2003 essentially the same? Why can't the 2003 patch be modified? I don't remember reading that the TCP/IP stack was that different in 2003.
While the code may very well be 15 years old, that does not really matter to the user. What matters is how long ago Microsoft sold the product. If they sell software today that uses some code written 15 years ago you should be able to expect security updates for some period of time. Now, had they decided not to patch software they haven't sold in 15 years that would be totally OK.
Since XP is still being shipped and supported on netbooks this seems a little strange. What's the message - spend extra on memory and hard drive so that you can run XP instead of Linux but we won't give you security patches?
In other news... 10 year old Linux 2.4 kernel patched yesterday...
A new car built by my company leaves somewhere traveling at 60 miles per hour. The rear differential locks up. The car crushes and burns with everyone trapped inside. Now: do we initiate a recall? Take the number of vehicles in the field (A), multiply it by the probable rate of failure (B), then multiply the result by the average out-of-court settlement (C). A times B times C equals X...
If X is less that the cost of a recall, we don't do one.
Loading...
...we lost the source code, we kept it in Microsoft Source Safe and it ate it.
Do daemons dream of electric sleep()?
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
Since 2008, the US Navy will acquire only systems based on open technologies and standards. That excludes M$ products explicitly in every way but name. The TCP/IP being just one example of failure on M$ part to implement standards. US Navy is ditching M$.
They'll probably go with an American company like Red Hat or roll their own spin of Red Hat.
The question remaining is will Bill's father's political connections keep lil Bill out of Camp X-Ray or not? If you've got Windows on your network, then you have a personnel problem, not just a network security problem.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
I guess these guys did not read: http://support.microsoft.com/gp/lifepolicy XP extended support goes thru 2014 and supposedly covers security fixes. I would think this counts as a security fix.
Conservative, mod down for violating
Today GM announced that the GMC trucks have some fundamental flaw and they are prone to explode randomly. GM said it wont fix the issue because the design is very old, and fixing it is unfeasible. When asked if they will when they stopped shipping trucks with the fatal flaw, GM spokesman said, "we have not stopped building or shipping them yet. We need to compete with the low cost competitors in the net-truck market and so we continue to make and ship the trucks, but we wont fix the safety issue. The drivers may wrap themselves in bags filled with thermocol peanuts to get some measure of protection.
If not, why do we let Microsoft get away with it?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Best Buy's recent "training" slide #9, where they say that "Linux is safer than Windows" is a myth, the "Real Facts" states (referring to Linux) 'There's no guarantee that when security vulnerabilities are discovered, an update will be created. Users are on their own.'
Here's proof that that statement is really talking about Windows...
Please..all underlying architecture has not changed from xp to vista, even though they want you to believe this...and for them to correct the wrapper on xp, would be trivial, however, they are testing the waters about phasing out xp, and want to see what the backlash will be like, seeing as no one wants vista garbage, and maybe even no windows7!
I prefer, being given the opportunity of just paying a yearly fee to keep getting updates on a system that runs properly compared to their new bloated versions of vista etc... too bad no one can pick it up like a linux distro and start their own version of windows...
Don't run an OS that you can't patch yourself. Seriously, if we put our trust in these guys after they've proven time and again that they really don't represent our best interests we are the only ones to blame. It's about time to let MS go gently into the night alone and without a sleeping bag into a rabid pack of wolves.
I don't believe in karma, I just call it like I see it.
The fix is to NEVER buy Microsoft products, again. Microsoft is a defective corporation that has made a mint off of selling knowingly defective products and reselling the HOPE that these defects will be fixed in the next update but reneging again, and again, and again, and again. MSFT's example of no/low quality has become the new American metric of quality, its business plan, corroding our society's business and work ethic, a complete mockery of the consumer laws on mechantability, deservedly debasing our reputation for quality goods.
Since the government has been ineffective in enforcing these laws, falling for MS legal theories, only insistent market rejection will [partially] protect a consumer from the borg. No doubt we will be seeing more FUD IP attacks, like SCO, traceable to MSFT. Good luck to all. Fsck MSFT.
Ah, a car analogy. It's more like this: You go to the Honda dealership and take a look at their 2010 models and purchase a vehicle. You discover that the engine has a serious flaw in it and ask Honda for a fix. Honda refuses because that engine is based on an 8 year old engine design. Except in this case, instead of a Honda you bought a brand new netbook and instead of an engine it came with a new copy of Windows XP.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Your argument doesn't work either though IMO. For one thing software changes a lot quicker than car technology so I was being pretty kind saying 10 years for the car stuff. You might expect a dealer to service a 30 year old car, but you're probably going to have to pay through the nose for it (and I've read of at least one case where a dealer didn't have the parts to service a car because it was so old).
XP is not the latest software, it is simply the most popular. Even if the majority of people in the world preferred the original VW Beetle from the 30s (or whenever it started production, I think it was in production for something crazy like 50 years), it doesn't mean that VW are still obliged to find and fix design flaws in it. You'd expect a product recall if a large problem was found in the latest incarnation of the Beetle sure - but we're not talking about the latest version, we're simply talking about the most popular version, and it's getting out of its support lifetime. I don't think any other version of Windows has lasted so long.
In this case the WINE team or some group like that could probably produce a replacement version of the TCP/IP stack to stick into Windows, it would be the equivalent of having to buy 3rd party copies of OEM parts for an ancient car. Yes you can "keep it running", but the original manufacturer has stopped supporting it. MS are not shutting down all old copies of XP, they're simply stopping support.
IMO it would be nice of them to keep supporting it, and some companies would do so, but they have no obligation to. And it's definitely not MS's style to be 'nice'.
which is totally what she said