Slashdot Mirror
Microsoft Extends Updates For Windows XP Security Products Until July 2015
An anonymous reader writes "Microsoft today announced it will continue to provide updates to its security products for Windows XP users through July 14, 2015. Previously, the company said it would halt all updates on the end of support date for Windows XP: April 8, 2014. For consumers, this means Microsoft Security Essentials will continue to get updates after support ends for Windows XP. For enterprise customers, the same goes for System Center Endpoint Protection, Forefront Client Security, Forefront Endpoint Protection, and Windows Intune running on Windows XP."
If companies claim they haven't had enough time to upgrade their OS or update/rewrite their software, it is because they never will.
Now I look like an asshole for telling my boss that he ABSOLUTELY HAD to upgrade everything because even Microsoft was killing security updates.
Like Duke Nuke'm Forever, except opposite.
I knew that my preparations for a zombie apocalypse will someday finally pay off!
I want to see Microsoft issue one last update to every version of IE available on XP that replaces all of their cryptic as fuck SSL errors so instead of saying "the site you are trying to go to is broken" they say "The site you are trying to go to requires a higher level of security than is available on windows XP". Hell, throw a store link in there so they can go buy windows 9 or whatever and upgrade their security, damned if I care.
Until then, it is single-handedly holding back TLS 1.x (>0) and SNI adoption. I can't turn it on on my server or half my customers will call to blame me for my server being "down".
Oh.
The IRS is the one organization that you don't want to fuck with. Remember, these are the guys who took down Al Capone.
The announcement only refers to antimalware updates, not OS updates. So, you still need to move off of XP in April.
https://blogs.technet.com/b/mmpc/archive/2014/01/15/microsoft-antimalware-support-for-windows-xp.aspx?Redirected=true
This (announcement) does not affect the end-of-support date of Windows XP, or the supportability of Windows XP for other Microsoft products, which deliver and apply those signatures.
We really liked Windows XP. Windows 7 is OK too, but please stop churning your OS versions for planned obsolescence and give us what we really want: a stable, updated, secure OS that will last as long as our hardware.
We would be pleased to consider a reasonable subscription fee for such updates as it would afford us significant peace of mind and stability.
Signed,
Many Customers
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
How do you (Microsoft) expect to get people off of that d*mn OS if you keep patching security holes. That was the one lever that might just have been able to do it and now you've gone an f**ked that up. To make matters worse, your piecemeal security patching (MSE, etc.) but not the OS proper will give these holdouts the false impression that their systems are secure when nothing could be further from the truth. Windows 9 won't move them off any more than Windows 8 was able to. All you're doing is hanging yet another neon sign pointing to the ragged, fetid and diseased hole of the malware whore these XP boxes have become.
Two of my imaginary friends reproduced once
Please, please, please make IE10 for XP Microsoft.
Comment removed based on user account deletion
In case some people don't RTFA,
In other words, while Windows XP will no longer be a supported operating system come April, companies will be at least partially protected (the actual OS still won’t get security updates) until next July.
Emphasis mine. XP updates ARE ending, but MSE/Forefront will still get updated. XP will still be susceptible to any zero day until it gets detected by MSE--if it's even installed at all. This is a marginal increase in safety for XP post-EOL, at best. The apocalypse is still nigh.
My advice for fellow ITAs. Don't mention this to your boss at all if you're still trying to migrate. It's not really relevant to the threat posed by XP's end of support. If they get wind of it on their own, emphasize that XP itself is still going to be wide open. At best all MSE does is let you know you've been owned after the fact once MS gets around to updating the definitions. MSE already has a pretty poor record for detecting even older threats. It's better than nothing but you shouldn't be relying on it.
If you build it, nerds will come. Soylentnews.org
The idea that people won't ever move off is absurd. They will. Problem is, if they do so this year a good number are going to OS X, Ubuntu, Chromebooks, etc. Then those new Mac/Linux/Googlized people will begin experimenting with alternatives to Microsoft Office as well. Fuck.
If Microsoft can have those people wait for Windows 9 and Windows 9 is an improvement of any sort, they stand a better chance of keeping the customers. That's all this is.
Hackers have to wait another year before showing their talent..
On a more serious note, it seems Microsoft, as often, didn't think through the process: halting XP security support in the blink of an eye would open a non closing door to security threats highly harmful to the company image. They gave XP another year, probably to build new update plans from XP to 7 / 8 (...) that would allow more/most companies to migrate in the meantime.
Slashdot, fix the reply notifications... You won't get away with it...
> Problem is, if they do so this year a good number are going to OS X, Ubuntu, Chromebooks, etc rather than deal with Win8.
FIFY
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
... nuff said
When I was a kid, we had a washing machine and dryer that lasted 20+ years. Used daily. Occasionally needed the repairman out.
In fairness, software by comparison is more like paint and a room should be repainted at least every 10 years. If you use oil paint it will last longer than latex. Latex is friendlier to the environment.
For computers that are still running windows, it is time to repaint.
Time to make people move on to something else,whether 7 or 8 or Apple or Android, whatever. XP has been around twice as long as it should have. When 7 came out, XP should have been killed-off. Period.
I did not see this coming. I'm CIO and for the last 2 years I've warned the bosses about the problem @ about 95% XP and so far in those 2 years we've replaced negative 2. We added 2 seats and replaced zero lol. Every 100 days (the pattern I developed) they kicked it to the next period. Time to spend the $20 we do have in the IT budget to get a cake tomorrow and I'll announce it to the bosses!
But seriously, our shared and internet surfer and PoS computers are just fine with a socket 775 HT Pentium chip and 2GB of RAM. Why pull them just for XP?
I knew this was going to happen because Server 2003 was planned to receive extended support until July 14, 2015 and Server 2003 (NT 5.2) is the server edition of Windows XP (NT 5.1).
You're Welcome.
It has come to this.
Would migrating to Wine be an option for you XP-fetishists?
Take a look at the PC screens at Home Depot (Windows XP). Fry's Electronics (heck, they sell the new stuff... they're using XP on the store's floor). My dentist office (XP). It goes on. What other big hitters that I've missed? http://redmondmag.com/articles/2013/09/23/xp-still-in-use-by-28-percent.aspx indicates 28.98% are still using XP.
I have a friend in his mid-70s who just adores XP. He's not planning on upgrading after MS stops supporting it because he's sure that third-parties will continue to create and distribute patches for all the new security holes that will be showing up. Never mind the fact that there aren't any such third-parties and that if they were, they wouldn't have access to the source code. I haven't told him this, because we're friends, and I don't want to offend him by telling him things he doesn't want to hear, but IMAO he's acting like an ostrich. Just because he's not willing to admit that there are almost certainly zero-day exploits just waiting for support to end doesn't mean that he's going to get hammered when we all find out what the black hats have been sitting on.
Good, inexpensive web hosting
If McAfee announced that they would continue supplying virus definitions to their antivirus running on XP would that make the front page of slashdot? Because that's all MS announced here. I very much doubt it takes them much extra effort to port virus definitions to a previous version of MSE.
Other Anti-Virus vendors like Symantec, McAfee, and Kaspersky are going to continue to support XP past April, so why should Microsoft concede market share to these competitors?
Also, Microsoft is going to look pretty bad if a new virus makes a major impact, so having their security product database updates continue will mitigate that. Doing otherwise could easily be spun as irresponsible.
Actually he's correct and you're the one with no clue. Modern attack vectors are not the OS holes - they are browser holes, email software holes, PDF reader holes and so on. In fact, essentially all OS holes that can be exploited directly without third party are secured by a solid third party firewall.
All these will continue to be updated. In fact, as long as your friend runs solid 3rd party firewall software, he'll cruise for years after microsoft kills support, simply because he'll keep infection vectors closed. OS can have all the vulnerabilities it wants, as long as all the vectors to hit them are closed, you're safe. And that's where that 3rd party support is far, far more important than microsoft's support will ever be.
I heard Goldman Sachs still runs Bob on 3/4s of its PCs.
http://toastytech.com/guis/bob.html
Pay no attention to the man behind the curtain with all your metadata.
"Problem is, if they do so this year a good number are going to OS X, Ubuntu, Chromebooks, etc. " Complete BS. People moving to OS X? Really? Show me the numbers. OS X (and prior Apple OS) have been stuck in the same share of market for decades. The peak at 15% floor at 5% and generally dick around 8%. As to Chromebooks - the NPD "study" is based on a relatively small sample of US distributors. It is not a sales number in any way. And I would love to see those Ubuntu sales figures.
Outside of business - where the issues have been well documented by others on this page - ordinary end users who are still using XP are doing so because they have no desire to upgrade their hardware. That might mean they love XP, their pc/notebook does what they want or simply they do not have the money for a new one. And anyone still using XP after all this time certainly has some loyalty to Microsoft.
Also, imagine the PR hit MS would get if 28% of the world's computers were zombies.
That's fucking joke.
Unfortunately, only the M$ Security systems receive updates and NOT the OS itself.
Good luck using MSE or FF, a vast majority of infections have been tested to break these relatively easily on a cold day.
This is just a ploy to extend the life of an easier to maintain product that actually generates income by regular subscription (FF that is). Be damned to anyone else, esp those freeloaders.
Given the shitty reputation Microsoft "security" services have for protecting a system compared to other products in the same marketspace, this is hardly a reason for keeping an XP box around. What did the last tests reported on Slashdot mention for Security Essentials? 70% detection rate?
In other words they're going to continue delivering a shitty product that doesn't actually do the job properly as a "band aid" for those who adamantly refuse to get rid of XP as they should.
I do not fail; I succeed at finding out what does not work.
Actually he's correct and you're the one with no clue. Modern attack vectors are not the OS holes - they are browser holes, email software holes, PDF reader holes and so on. In fact, essentially all OS holes that can be exploited directly without third party are secured by a solid third party firewall.
I've noticed a number of GDI and Font type patches drop over the last years... these can get thru firewalls and exploit OS specific issues from any number of browsers or document rendering technology. Coupled with a few privilege escalation vulns of which there are infinite numbers and the result is you can still get owned pretty quickly hiding behind your firewalls.
... you.. fucking... kidding... me..... KILL IT WITH FIRE, I'm tired of supporting it :(
Yeah i'm sure all those people who were confused by the lack of a start menu while retaining existing application compatibility are going to be real happy with another OS that also doesn't have a start menu and discards existing application compatibility.
They're all of the above. As long as the underlying remains vulnerable, especially due to poor handling of the built-in CIFS file sharing and native authentication, the hosts will remain vulnerable to 10 year old scripts passed around by script kiddies not even born when XP was published.
You can't have it both ways Jack. You can't say that Windows 8 was a great fuck up, as the vast majority of /. insists, and then say people aren't buying alternatives when their machines inevitably fail. Oh, fuck it, go ahead. You can be Ballmer if you want. You can claim that it's a matter of love. They love their Microsoft OS from early last decade so much they aren't even for the briefest moment considering anything else. Good luck with that. That fast approaching light isn't a locomotive, there is no light. Darkness has the marketshare!
People are indeed going for alternatives like OS X, various Linux distributions or Chrome OS, which itself is of course derived from Linux. You can see this by not depending on Wikipedia articles about the existing base, but rather looking at sales figures over the last three years. After all, that's what we're talking about here. We're not talking about who sold the most a decade ago. Shit, we're not even talking about four years ago. We're talking about what people are likely to buy now.
Recent articles show that on the whole over 2013 Apple saw an increase in Mac sales while the overall desktop/laptop market shrunk. Don't believe me? Fine. One, I must wonder how then you explain Microsoft's move here and two, even if that weren't the case, it's all moot to the topic at hand because people are dropping Windows in droves. While those few staying in the traditional computing world are switching to alternatives like Chrome OS, the vast majority of the so called "end users" making the exodus from Windows are switching to TABLETS; the vast majority of tablets run either Android (Linux-derivative) or iOS.
I firmly believe that an improved desktop/laptop experience can slow this. The traditional computer has still so much more to offer than tablets and recent changes to Windows has done more to hide this rather than highlight it. However, this doesn't change the fact that for a great many, tablets offer enough. (It's a like a landline phone for your grandpa.)
As for your "they don't have the money" comment: that's the real BS. Windows XP has been out since 2001. Vista came out in 2006. So people have had roughly 8 to 13 years to plan out the purchase of a new computer. They can't have expected it to last forever. A new low end laptop today is $250 to $300 depending on where/when. As for their peripherals a new printer without any bells and whistles will set you back $30, the whole printer-wireless-scanner combo is $60. So we're looking at $280 to $360 spread over 8 to 13 years.
Oh fuck it, people are broke ass dumbasses who love Windows XP and will buy more Windows machines when they have more $$$. Oh and it must be Obama's fault that they don't have the $$$.
Although I'm not particularly a Mac fan, obligatory xkcd.
In other words, for some significant subset of the people still using XP who aren't doing it merely because of compatibility with old software, perhaps a browser and a few other basic resources would be enough.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Windows XP has been out since 2001. Vista came out in 2006. So people have had roughly 8 to 13 years to plan out the purchase of a new computer. They can't have expected it to last forever.
Which part of 'people were still buying new PCs with XP installed only three or four years ago' is proving so hard for people like you to understand? Why should they have to buy a new PC today after only getting three to four years' use out of the old one?
That's odd I could have sweated I had 4 updates today and 3 were security related
http://saveie6.com/
The biggest security hole I have ever seen is the user. I once asked "what did the error say?" The answer: "I'm not sure, I just clicked through it." Old quote from anoyances.org: "If it weren't for users computers would never have errors."
Try 25%! It is just a hair above the scanner ms defender
http://saveie6.com/
Just great. There were only 82.7739742361111 days left, and now I'll have to update my XP End of Life Bookmarklette.
So how is it that having to deal with Win8 would be any different to switching to OSX or Ubuntu or a Chromebook?
First off you are describing a very high level enterprise problem and the good news is that in 2014 we not only have a better desktop OS we have advanced virtualization that can run from a web browser.
With Citrix Receiver you set it up once and forget. Even the CEO with his Apple iPAD can log in and run IE 6 just fine and you save money. Save it because you do not have to upgrade those intranet apps which I guess are now tied to IE 8. ... in a very short time in 4 years it will be time to dump Windows 7. Then what? Start all over again?! Hell no. As long as the IE 6 app requires no internet access it can run unsupported in a VM forever.
This my friend is a much better approach then configuring per client and is future proof and runs on non PC's.
Can you tell me in a straight face in 5 years if management even will want pcs anymore? If I wrote in 2009 that tablets would make a killing on the pc market I would be laughed at here with a -1 offtopic faster than you can say goatse! If Windows 9 is a flop and cloud OS for just metro applets it is time to consider tablets with monitors and keyboards unless the trajectory changes?!
http://saveie6.com/
Looking at the subject line of the comments, this decision didn't go over well here...
I don't use XP, I like it; Only went to Win7 as Battle Field 3 required it or I'd still be using XP.
I'm sure there are more like me that didn't upgrade as they didn't have a reason.
I appreciate this as well for the fact that miniXP is being treated as public domain, and will be upgraded.
Linux excluded, for me the miniXP has overtaken a Win98 boot disk when it comes to Windows recovery software.
FWIW: Most of my USB pendrives will boot into a Win98 DOS window that will read and write to NTFS drives.
http://bootdisk.com/
Telling users to upgrade Windows because it is buggy is a flawed business model...
Came here to say exactly the same thing.
This strategy is pretty much par for the course with Microsoft, which makes frequent use of product announcements far in advance of actual launches in order to retain customers with a promise of things to come. What they've done here is a defensive form of the same strategy: announce the extension of a product in order to prevent customers from considering their alternatives for awhile. Corporate users will almost certainly upgrade shortly before updates cease to occur. By making this announcement now, four months before the original cutoff, and extending it until next year, they've made it clear that they think Windows 8.1 has not proven to be as compelling as hoped, but that they anticipate having an alternative available by next year.
Personally, I'm saddened by this announcement, since it means that it'll be over a year before I can start using the "you do realize your OS is going to get slammed by zero-day exploits in a few months, right?" statement as a reason to encourage people to abandon XP already.
Yeah i'm sure all those people who were confused by the lack of a start menu while retaining existing application compatibility are going to be real happy with another OS that also doesn't have a start menu and discards existing application compatibility.
You mean like win8? :-P
If Microsoft can have those people wait for Windows 9 and Windows 9 is an improvement of any sort, they stand a better chance of keeping the customers.
Really? MS didn't change much in Win8.1, and they are making Win7 really hard to buy. It implies they really believe Win8 isn't a disaster.
Have they fixed the incredible Windows Update bug that kills the usability of Windows XP machines when connected to the Internet, because svchost.exe starts eating 100% of the CPU for hours, even on powerful machines? That rendered any Windows XP machine that I've seen almost unusable, even though Microsoft is supposedly still supporting them.
windows 9 exceedingly most likely to be launched july 2015
Doesn't matter. I've already switched my father to Linux.
Microsoft is just putting off the inevitable shitstorm.
In other words: can be fixed by browser vendor by modifying the renderer but it's easier to fix by OS vendor. After OS vendor stops updates, browser vendors will handle the updates.
As for getting "owned quickly", I ran a vanilla XP machine for over two years after WAU borked itself trying to install SP1. I think two years is good enough not to count as "owned quickly".
Newsflash: these script kiddies still need a vector.
So if I don't update, I can expect to get my computer owned? One that is behind NAT, software firewall, running up to date 3rd party software?
Yo I have land on the moon to sell you. Cheap.
Dear Microsoft,
Please stop supporting any browser less than IE-10 and any OS that doesn't run at least IE-10
anything less than that is not doing you any favors, nor your customers ultimately.
There is no good business reason to support vista or XP at this point.
Because when this entire "Activate your software" BS came up for the first time, it was all "Well, don't worry, we won't lock you out of your software: we will produce a patch to remove software activation on products before then".
But one reason why they continue to extend the life of XP is that enough people are still using it that to kill activation without patching it out would kill them in lawsuits, but they DO NOT WANT to patch out activation, they never intended to do so.
Windows 98 still gets third party patches.
I have a Acer Aspire One 8.9" netbook with 1GB of memory and a 1.6GHz CPU. Great machine that is very portable and runs just fine - still - under XP. I would trash this machine to get one that will run Win 7 - why exactly? OK. It'll be insecure in a short while *if* I connect it to the Internet under XP. And if I don't? I would trash it and buy new hardware just to run an updated OS - why exactly?
OK - so I also dual boot this machine under Linux. I'll connect it to the net under Linux if I need to. But the whole idea of "You've got to upgrade in order to run our latest OS - throw out your old hardware" deserves the Opel Vectra analogy someone else gave above.
I have a Samsung Q1UP as well that is ultra portable as a working PC. It runs XP too - and - yes - I can dual boot it to Linux if I need to. It's touch screen with a thumb keyboard if you have never seen the beast (comes with a stylus too) and with dual batteries I can get 12 hours out of it on the road if I need to away from power sources. I would trash this just because I can't easily upgrade it to Win 7 - why exactly? Again - if I don't connect it to the net and it does what I want - like accurate stylus-based interactions - I would spend more money for what reason again? That's only got a Core Solo CPU too...
I manage a Studio DAW setup that runs everything that it currently needs to run just fine under XP. To be sure, the DAW supplier will not be supporting 32-bit XP beyond April so I *have* added Win7 64 G dual boot to that machine and up'ed the memory to 8G (which, BTW, for those speaking about 4G being a lot is *still* limiting for multiply loaded large VSTs - more memory is a big advantage for certain circumstances). However, it runs a studio just fine with XP and the current DAW - and the legacy studio audio hardware and drivers for the same are all supported under XP. Not replacing that external hardware anytime soon... Such machines - not connected to the Internet - aren't even running AV software to slow them down while doing DAW processing (this is not stupid - it is recommended for DAW setups - don't connect - don't run AV software - don't slow your machine down as a result - turn off wireless - turn of BT - reduce the loading by services you don't need, etc. etc.) I'd replace that machine with a Mac at some point in a studio setting - as in another studio setup I control - but for the fact there are still many VSTs that don't have an equivalent on MacOS. Maybe that'd run Snow Leopoard, Lion or Mountain Lion - all still work pretty well for DAW environments - even SL on "legacy" 2006 macbooks - still feels very snappy. Not upgrading to Mavericks any time soon. Why? External audio hardware support among other things until things catch up. It ain't broke, it ain't gettin' "fixed". Downtime and lost recording time.
See, it's not just the *machine* that's the issue in OS upgrades, it's what it's used for. Not everything is a stock laptop or desktop - although I agree that a lot of computer usage is like that still.
I think it's pretty much been established that people don't *like* Win8.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
What do you even need privilege escalation for? Damn near everybody runs XP as Admin; it's too painful to do otherwise (I tried for about half a year prior to the public Vista betas; compared to that, Vista's UAC, even during beta, was a godsend). For that matter, a lot of XP installs (at least in the early days) were on FAT32 systems, not NTFS, which meant you could get EoP just by overwriting some system files (no ACLs). Vista and later require NTFS.
Then there's the matter of ease of exploitation. XP has optional DEP, not widely used. That means you can trivially use return-to-libc attacks, or return-oriented programming, making it trivial to weaponize any vulnerability found. Vista and above have DEP enabled by default, plus ASLR (especially since Vista SP1 / Win7, as a number of libraries from before that shipped without ASLR-compatible flags). That means that even a wide-open vulnerability - think something really stupid, like the equivalent of gets() on a network socket - will typically require an additional vulnerability that leaks information about the state of memory before it can be exploited (for anything other than DoS, at least).
Anybody who thinks that "XP + firewall + Firefox = about the same security as Win8.1, really" is talking out their ass. They either don't have a fucking clue or they've got an agenda (probably nothing more than "I don't want to spend money" but they're still intentionally blinding themselves to reality).
There's no place I could be, since I've found Serenity...
I work in GIS and with large Oracle databases, and other technical functions. I have run out of local memory on multiple occasions. There is always away around it, however it usually involves breaking you process into digestible chunks, which just means extra work, longer processing time (or not doing it locally if you have the resources which not everyone has access to).
When we finally upgraded to Windows 7, some pinhole made the decision that 32bit was good enough for everyone (among other bad decisions). Those of us in the technical group revolted, REFUSED to accept the upgrade (well delayed anyway) as it did not meet our needs. Eventually the leasing company that had the contract worked with us to make a 64bit specification which did.
However the end result is now the IT folks have to support two sets, one is 32 the other 64, and not everything works on both, causing all sorts of headaches. There are a considerable amount of 64s out there, that have to be dealt with more less manually and by themselves for certain things. If they had realized that a significant part of the business required 64bit machines, they could have saved themselves some headaches and went with that as the standard.
Fun? XD
I think it's pretty much been established that people don't *like* Win8.
Of course some people don't like it and of course they will be vocal about it but the usage share of Windows 8 is more than OSX or Ubuntu or Chrome OS and the latter 2 are a viable alternative on all the systems that ship with Windows 8 it's just that most people don't want them.
Yea, what is funny is that nobody seems to pay much attention to Office 2003 end of support even though privilege escalation bugs are not usable without another exploit that executed code in the application in the first place.
Two years happens to be how long MS continues support for a previous service pack after a new service pack release. And they do not fix the renderer directly, rather they use https://code.google.com/p/ots/ which validates the fonts before passing them to the kernel.
To clarify: WAU owned itself completely. No updates at all for over two years.
The cost of finding exploits for Windows has gone up so much the criminals prefer to just trick users into running their software. No general-purpose OS is immune to that.
I guess the peace of mind that comes from increased difficulty of inadvertently installing a trojan is one more reason that the majority of people, who do not need programming tools or wireless network troubleshooting tools, can choose a platform that isn't general purpose, like iOS or PlayStation 4.
Windows does have annoying traits (like having to reboot to apply patches) that Linux doesn't.
I'd be willing to discuss any annoying trait that differs between the platforms, but your example isn't the best. Whenever the linux-image package gets an update, any Ubuntu flavor has to restart. Or are you assuming that most Linux users will install Oracle Ksplice?