Ask Slashdot: Preparing For Windows XP EOL?

An anonymous reader writes "As most of us working in IT may know, Microsoft will stop supporting Windows XP on April 8th, 2014. Although this fact has been known for quite some time, XP is still relatively popular in companies and also enjoys noticeable marketshare for home users. Even ATMs are running XP and will continue to do so for some time. A lot of companies/users don't want to change because they see no additional benefit to do a costly upgrade, no reason to change a running system, and they may in some cases be right with their assumptions. So what is the best way to secure this remaining Windows XP systems? Installing the latest security patches, checking firewall status and user permissions etc. should be fairly obvious, as Microsoft Security Essentials may also not receive updates anymore, changing antivirus programs seems a sensible thing to do."

Comments

No problem

[Anonymous Coward]

Just don't run as an administrator! Also don't run IE or OE. Use Firefox with NoScript. Keep and updated and supported anti virus package installed. Don't use Flash, Adobe Reader or Java. It's actually not a problem.

Re:No problem

[TheGratefulNet]

stupid AC. I'll tell you why: some people have expensive hardware that only works with xp and its NOT practical to rebuy working hardware just to run a more modern os. the os only exists to run apps and if the value of the apps and hardware are high enough, you will stay with the older os.

of course, AC's think that only linux matters. they can't see that in the real world, you need TOOLS to do your job and if those tools are only running on an older os, you keep that older os!

this should not have to be explained. maybe I got trolled, but figured if he was serious, I'll at least explain WHY you need to continue to run older systems.

Re:No problem

[I'm New Around Here]

Really. One of my customers has a Win98 box, because it controls a $50,000 device. Another one runs NT Server, because porting 100,000+ part numbers to a new database isn't worth the upgrade.

People forget these contraptions we are typing on are simply tools, especially to businesses that focus on their own products, not what OS is on their computer.

Re:No problem

[Sprouticus]

The logical counter to that is:

YOU HAVE SOMEONE RUNNING A $50,000 ON Win98? Holy crap that is stupid.

On, not logical, but my point is salient. If you are willing to accept the risk, go for it. But dont be surprised when it breaks and ends up costing you a LOT to fix/recover the data/device.

Re: No problem

[Anonymous Coward]

Kind of frustrating that those in the "don't upgrade camp" ignore the cost to their business if one of those older oses gets infected and destroys the machine it controls. Hell, I've seen it happen.

Re:No problem

[zipherx]

Seriously not a good reason. Problem is, people who can not accept how IT works, and evolve, should just use pen and paper and be safer for it.

Or they will just suffer the consequences, or the rest of us will, whenever their pc become part of a botnet.
Yes, there are systems that are running equipment, which has to run its life before it can be retired along with whatever version of any operating system it came with. It is just how it is, and those who are responsible for those systems will just have to sandbox them the best they can.
But honestly any private person, who is not running expensive equipment (no your US robotics 33.6 modem is NOT part of that list), have about zero excuses for running a 13 year old system. Djeez!

Re:No problem

[aix tom]

Depends on the device and the support you get for the device. Just think about it: Microsoft never did give any real "support" to you, most of the time they told you to go to your manufacturer for that. If the manufacturer of the $50,000 device still gives you support in the sense that he will fix any problems that occur with the device, including replacing the hardware that still runs Win98, that is more support that you have ever gotten and will ever get from Microsoft.

Re:No problem

[mark-t]

This may not necessarily apply to every use case, but I'd suggest that any reason why one might need to run an older system is probably trumped by the distinct possibility of being cut off from the Internet entirely.

Because if or when any previpously unknown exploits for XP get discovered after April 8th, they will probably not be patched, Virus detection can only go so far to stopping vulnerabilities in the underlying OS.

Alert ISP's that can detect the presence of zombie computers on their network and will be able disconnect any that they find

This is singularly the best reason I know of to stay current with regards to whatever operating system one uses to stay online. If one does not have the hardware to remain current, then they may just have to accept staying offline until they do.

Re:No problem

[Impy the Impiuos Imp]

We do embedded development. This means re-qualifying a whole new version of tools, and the tools frequently don't work right and you cannot "just upgrade" because these are in the millions of recallable units.

Re:No problem

[Anonymous Coward]

of course, AC's think that only linux matters. they can't see that in the real world,

Well, that AC's not the only stupid one. You do a pretty good job of it, too.

Re:No problem

[DeathElk]

It's not stupid. It's quite common for specialised equipment to rely on drivers written for a particular OS. We have a 3 year old transmission dynamometer that cost us $180,000 that is controlled by redundant commodity x86 hardware running XP. There is no need to keep the OS up to date as it serves only one purpose.

Stupid lusers these days think all "PCs" are to be connected to the Internet and used for browsing file sharing sites.

Re:No problem

[mlts]

Even without admin rights, malware can do a lot of harm with just user profile data.

XP is very lightweight (runs well in 512MB of RAM), so it makes for a great OS to run in a VM for Web browsing. Have the user that the Web browser is running in be a non-admin, use the above add-ons, and use a sandboxing program like sandboxie, and one can have decent protection. Every few weeks or so, roll back the snapshot so if something did get past the sandbox, it would be gone. Of course, bookmarks would have to be saved somewhere else, but that isn't an impossible task. For AV protection, something like Malwarebytes that blocks rogue IPs is decent, but usually AV software is useless against most attacks due to the 0 day nature.

Re:No problem

[boristdog]

At my company we have dozens of $500K+ machines that are controlled by NT 4.0 boxes, and dozens of somewhat newere $2M machines contolled by XP boxes.

The vendor has no incentive to upgrade their software to work with a new OS, they'd rather we spend several hundred million on new equipment. And the software that controls the machines is closed and proprietary to the vendor.

We'll still be using NT and XP in 2020.

Re:No problem

[The Grim Reefer]

The logical counter to that is:

YOU HAVE SOMEONE RUNNING A $50,000 ON Win98? Holy crap that is stupid.

Why? These types of systems are in a lot of industries. None of those systems are on the internet. And probably not even on a network at all. It may cost $10K to upgrade the controlling computer. And for what? So you can play a game on it? Or iTunes, or surf the web? No one in thier right fucking mind is going to do this. These are very specific use systems. They don't' need to do anything more than what they are doing and spending a pile of money to upgrade them to a modern OS will gain nothing.

Here's a car analogy for you. You own a red 1500 lb. Ferrari with a 500 HP carbureted single cam pushrod engine that gets 15 mpg. Are you going to buy another one for $150K that looks and weighs exactly the same and has 500 HP and gets 15 mph too but the engine is a dual overhead cam with a turbocharged EFI engine and maybe some LCD touch screen gauges and a DVD player? It's a more modern vehicle, but you gain nothing of any value. Seems like a waste of money to me.

Re:No problem

[dissy]

Where I work a good number of the surface mount assembly lines are run by windows 2000 and XP.
The screen printers still run DOS. Many of the electrical testers and chip programmer rigs need XP or lower as well.

As most of these setups require custom PCI IO cards, visualization isn't an option either.
(Though I am happy to have found an ISA to USB adapter that works well under visualization)

When "a pc upgrade" involves replacing a quarter million dollars in hardware and finding the time to eat the cost of downtime over three running shifts, even I couldn't justify the cost of doing so just to get a newer OS (that will still be windows and still go EOL at some future point!)

My solution is to segment older OSes on the network. They can reach the SQL server and occasionally the file server as needed.
NO email, NO internet, NO intranet, no random transfers between there and other networks.

Everyone has Win7 desktops for office, outlook, and firefox. There is no need to even treat the XP systems as computers anymore. They are now appliances.

With the SMT line PCs not even showing a desktop or letting the operators exit the controller GUI, and the test hardware being locked to a list of approved executables (More for QA actually), the likelyhood of an infection requiring a reinstall is next to nill.

That leaves hardware failures. I have full drive images to restore once the HDs fail. On a more serious failure, the entire rig is considered failed. Either time to pony up the $25k for a new system, or we do without.

As long as you get your desktops upgraded, there is a lot less you need to use XP for, and most attack vectors can actually be completely blocked without effecting any work flow what so ever.

Re:No problem

[Anonymous Coward]

Why even bother with a 13 year old operating system, seriously?

I wish, its sad and frustrating how many products still require it, particularly in retail. Sure you can say "well run it in wine, run it in windows 7 with compatibility mode set" But then the vendor that supports your sales terminals has a nice little out every time something goes wrong and you require them to replace something.

i don't want to keep using windows XP i just don't have a choice, in this particular case the software is old but still licensed we'd have to pay an amount equal to the entire tech budget to upgrade the license to the newer version, then we'd also have to buy windows again its unfortunate that this situations exists, whats even more frustrating is that i know better but am still stuck with it.

Re:No problem

[LoRdTAW]

We have a spare glove box here at work that handles overflow from our main glovebox. It used to be our main glovebox until we bought a much larger, more modern box. It has two Pentium 3 computers running Windows 98 but they boot straight to DOS and run the control software. One PC runs the glove box environmental controls and vacuum airlocks/ovens. The second PC runs an ancient DOS based motion control system.

Here is the problem: Replacing the glovebox is at least 100,000 USD. And that does not include upgrading the motion system which I estimated between 20 and 60 thousand depending on how much of the motion system we want to replace.

So now we look at how much work the glove box does per year: about twenty thousand dollars. So the boss has to justify dropping over 120-160 thousand dollars and waiting over 5-8 years to recoup the cost. Does that make sense? Of course not. We need the box but at the same time its not worth the cost to upgrade. So you live with it. I have a small stock of old computer parts to keep it going along with block level disk backups. I could upgrade the environmental controls but the engineering cost would still wind up costing tens of thousands of dollars, months of design and a lot of downtime. Not worth it.

And if it breaks? Oh well. It wont kill us, we just might have to pay someone overtime to get the extra work out.

Re:No problem

[kyrsjo]

Or, more likely, they have a stack of old computers with a win98 install, ready to swap out. The biggest issue is probably to keep all the driver disks around as well - installing old windows on old hardware is "a bit" more work than installing Linux, as you have to install a bunch of software after installing the OS, and the drivers are often hard to find via google...

To be honest, I've seen much, much older than that. I remember using a old IBM PS/2 (looked ~ like this: http://en.wikipedia.org/wiki/F... ) around 5 years ago. It was running some kind of instrument to measure the thickness of the oxide layer on Si wafers. Also remember having fun reparing Win95 boxen with a SCSI card connecting to some educational DAC box - which I eventually got to work win Windows XP (it supported the SCSI board right out of the box, and the new version of the LabView-esque software supported the ancient DAC!).

Re:No problem

[Collective 0-0009]

Yes, we have a multi-million dollar machine that runs on NT4.0. They will upgrade it to XP for $20k. But the company won't pay for it. We did however pay to upgrade from XP to 7 on another machine.

The older "must haves" don't get plugged into the network.

Re:No problem

[Darinbob]

True. There is no support from Microsoft, *especially* with something like Windows 98 which didn't even come with automatic patches. If you need a bug fixed or a problem solved, you have to call someone other than microsoft.

The problem here is that there are capital purchases that last longer than Microsoft supports their operating systems. Support by MS, non-existent as it is, has never lasted more than 5 years past the time that they last sold the OS. But capital purchases may last several decades. Great, you just put in a new house automation system that runs your AC, heating, security system, and so on, for a $10,000 price. 5 years later the OS no longer gets updates (big deal, the computer is in the attic with no internet access). But let's say you're nervous and call up the original company, if they're still in business, they'll say "we'll sell you an upgraded product for only $11,000".

If you're a corporation there may be a lot of expensive machines purchased with the expectation that they would last for a very very long time. No one gets a budget for new oscilloscopes every five years, yet most clockwork IT drones will advise that everyone gets a new PC every 3 to 5 years. IT rules should have no place in manufacturing or industrial sectors. Thus people keep around the XP or NT computer because it still works (even if you get a new computer you can put XP or NT on it, even if it's via VMware).

You're going to see the same effect soon because of all those automobiles that came with smart entertainment/navigation systems because they'll stop working when the services they connected to stop working; or new smart TVs that won't be able to upgrade (whoops, bad design choice to leave off ipv6).

Re:No problem

[Abalamahalamatandra]

I got you beat - I know of a company that's still running OS/2 Warp on two production systems. They track the entire backup tape library.

Re:No problem

[Darinbob]

So just remove all computing from industry then? Because it's impossible to buy a $100,000 manufacturing machine that will last more than the 5 year IT upgrade cycle?

And XP is most definitely not 13 years old, Microsoft still sold it NEW five years ago. May as well say that Windows in its entirety is 25 years old, and that only a fool would buy Windows 8 today because it's a quarter of a century old.

Re:No problem

[Anonymous Coward]

But honestly any private person, who is not running expensive equipment (no your US robotics 33.6 modem is NOT part of that list), have about zero excuses for running a 13 year old system. Djeez!

I have hundreds of software (legitimate not warez, between pc games and application software) that won't run on Windows 7+ or even GNU/linux. I won't lose it all just to upgrade to the latest shiny. And I do more than just browse the web and/or write on shitbook etc... So XP is staying active in my house, of course I'll take all the possible precautions so that it is not infected but I won't turn it off. If that pisses off Microsoft or the rest of the internet I don't give a damn.

Re:No problem

[Anonymous Coward]

XP is very lightweight (runs well in 512MB of RAM), so it makes for a great OS to run in a VM for Web browsing.

Strange my experience with Microsoft Windows XP fully-patched and with Microsoft Security Essentials enabled has been the operating system, or at least the applications, load very slowly and run very slowly. This is on a dedicated computer system with Microsoft Windows XP running natively. The CPU is 1.2 GHz Pentium III or thereabouts and 1 024 MB RAM. Granted the hard disk is relatively small although it reports 56% free space.

CAPTCHA: disagree

Re:No problem

[kimvette]

FWIW there are print shops with $2mil+ printing presses that still run Windows NT 4.0 on Dec Alpha-based controller PCs (AT motherboard no less - not even ATX!), with no upgrade path offered other than being told by the manufacturer to "buy a new press." WHY buy a new press just because the OS and motherboard are outdated, when it otherwise runs flawlessly?

There are perfectly valid reasons to stick with an EOL OS.

Re:No problem

[wiredlogic]

To alleviate some of the pain of not being admin you can put yourself into the "Power User" group which is less restrictive than the defaults for ordinary users. It does introduce some security holes but will still thwart most malware expecting to run as admin.

Re:No problem

[UltraZelda64]

Really. XP's future was looking a bit bleak about 8-10 years ago, why the fuck would anyone want put up with the torture this long... and then *STILL* (!) not want to let it go even at the official end of its life? Which, I might as well add, was continually put off by Microsoft due to their own failures (Vista) and the unexpected success of their competition (Linux) in markets that they themselves weren't quite a part of. Now it's such a crusty old turd, you have to be a masochist to keep wanting to use it. If that's the case... have at it. Cut away.

I will never know why people have such a reliance on such an antiquated operating system, but then, I don't really care, because I jumped ship back in 2006 for Linux, just in time for the V-Bomb. It's been much better ever since. The simple solution is to get a new, "modern" computer; or if you're cheap, switch to a different operating system. It's not rocket science.

Re:No problem

[Anonymous Coward]

Disk I/O is probably an issue as well as cores. I've fed XP 2-4 cores so the apps don't have to compete with the malware for CPU to bind to, and it performs fairly decently with 512-768 MB of RAM.

XP running natively is one thing. XP running in a VM can be sped up in a number of ways. I've yet to slap the virtual disk on a SSD, but it is tempting.

Re:No problem

[FlyHelicopters]

And there is nothing wrong with using XP for that machine for the next 20 years...

So long as it isn't online, isn't used for anything else, etc...

It doesn't even have to know what decade it is in, just run the transmission dynaometer and that's it...

Your only real issue is that at some point, spare parts for the computer itself may become hard to get, I personally would invest in 1 or 2 spare computers, clone the current one, set them in storage, and have them for backups. It shouldn't cost much, a few hundred dollars, and you'll have backups to the one part that is least likely to get support.

Re:No problem

[NFN_NLN]

some people have expensive hardware that only works with xp and its NOT practical to rebuy working hardware

Old hardware as in systems without support contracts? Or old hardware with no available parts?
So you just wait until the hardware fails AND THEN scramble to get the services back online? Doesn't sound very proactive to me.

Worst case scenario is to virtualize the system and use IO Passthrough for any proprietary cards. But hardware availability should not be a limitation because hardware fails.

This should not have to be explained. Maybe I got trolled.

Re:No problem

[VortexCortex]

One of my customers has a Win98 box, because it controls a $50,000 device. Another one runs NT Server, because porting 100,000+ part numbers to a new database isn't worth the upgrade.

I have had similar experiences in the past with customers. I recommended them not allow the systems Internet connections. In the cases where this wasn't possible, GNU/Linux + WINE and Linux + VirtualBox have proven effective solutions. Even for some crazy low level COM port gizmo made by a now defunct company with Win Server 2003 only driver...

You talk a big talk, but I suspect you haven't tried walking the walk. The contraptions are simple tools, which can bring down the entire company with a single crypto locker exploit.

Re:No problem

[js_sebastian]

It's not stupid. It's quite common for specialised equipment to rely on drivers written for a particular OS. We have a 3 year old transmission dynamometer that cost us $180,000 that is controlled by redundant commodity x86 hardware running XP. There is no need to keep the OS up to date as it serves only one purpose.

Stupid lusers these days think all "PCs" are to be connected to the Internet and used for browsing file sharing sites.

Before you pay 180k for a piece of hardware, you should require either one of (a) a support contract that commits them to developing drivers for the foreseed lifetime of said hardware or (b) an open source driver and specification that allows you to develop the driver yourself. A combination of the two is also possible, where the source code and spec is held in escrow, and you have access to it only if they go under or breach their support contract.

Re:No problem

[js_sebastian]

The logical counter to that is:

YOU HAVE SOMEONE RUNNING A $50,000 ON Win98? Holy crap that is stupid.

Why? These types of systems are in a lot of industries. None of those systems are on the internet. And probably not even on a network at all

That airgap worked real well at Natanz, didn't it?

Re:No problem

[Collective 0-0009]

Replying to myself to say that the NT4.0 box is probably more secure than upgrading to XP at this point.

Re:No problem

[Anonymous Coward]

This happens more than you think. I recently helped a Mechanic migrate his 15-20 year old maintenance database to a Win7 machine running Dosbox because they didn't want to pay to upgrade the software!

Re:No problem

[MightyMartian]

And what percentage of XP users do you suppose are running such specialized equipment that something like Linux Mint would not install and run on?

Re:No problem

[MightyMartian]

Hell, the phone system we're about to retire runs an embedded DOS variant.

Re:No problem

[NatasRevol]

What's the cost of the computer dying, and replacement parts are weeks out?

Re:No problem

[Kremmy]

While it is possible to trim XP down and squeeze it into 512MB, my own experience tells me that it's foolish to consider it to run well in 512MB. The very idea throws me back to a slightly earlier time, upgrading a Windows 2000 machine from 64MB to 128MB of RAM. Coincidentally, if you've trimmed XP down to fit into the low memory environment, you've basically got Windows 2000...

Re:No problem

[Anonymous Coward]

To be fair, it's the bean counters (who optimise the lease for 2.5-3 years) who determine desktop replacement policies. It's a bit like cars bought/leased by government (at least here in Australia). They turn them over roughly every 3 years because the expected maintenance costs will exceed the trade-in amount for a new car.

Re: No problem

[pspahn]

This is the same FUD all those guys at the Microsoft shops always tell me. "You need to upgrade because it will be catastrophic if you don't."

Meanwhile, he's perfectly content selling upgrades from Win7 to Win8 on machines that do nothing but run an HP-UX terminal emulator running a basic inventory system. The irony in this is brilliant.

There is always going to be systems that were sold by a sales person. These systems will need to be updated. There are also going to be systems that were built in-house. These systems are also going to need to be upgraded. The difference between the two is who decides the upgrade path.

Re:No problem

[Anonymous Coward]

What do you do when the Win98 machine has a hardware failure?

Unless you've been stockpiling spares since the late 90s, that is a real problem.

Re: No problem

[Anonymous Coward]

Dude that's so lame you can't even run games on that stuff. Linux steam ftw.

All the games I have don't require activation. Yep that's from a time before steam/ windows games crap/ ea passport and what not... A time when you got to buy pc games, and they were yours forever. No limited activation crap, no limited multiplayer etc...
A time when simulations/rpgs/4x games ruled the roost. There are still people out there that play those intelligent challenging games.

Alpha Centauri is still as challenging today as it was more than a decade ago. And Fireaxis has never been able to topple it. So why should I not play it ? These are infinite games. They'll still be as challenging 30 years down the line.

Re:No problem

[Macgrrl]

I used to do consulting for Xerox, it was fairly typical for hospitals to depreciate hardware (such as beds, autoclaves, photocopiers) over 20 years. You can't even get parts for copiers after that amount of time, you are generally relying on 3rd party refill kits for toner and other consumables. From memory 10 years was pretty standard for printers.

Re:No problem

[lgw]

Windows is typically disk I/O bound when it's slow. Booting and launching IE are both amazingly I/O intensive.

Re:No problem

[RabidReindeer]

stupid AC. I'll tell you why: some people have expensive hardware that only works with xp and its NOT practical to rebuy working hardware just to run a more modern os. the os only exists to run apps and if the value of the apps and hardware are high enough, you will stay with the older os.

of course, AC's think that only linux matters. they can't see that in the real world, you need TOOLS to do your job and if those tools are only running on an older os, you keep that older os!

this should not have to be explained. maybe I got trolled, but figured if he was serious, I'll at least explain WHY you need to continue to run older systems.

Oh crap. April 8?

There are exactly 2 apps in my collection that I run under Windows. MS Flight Simulator (the Linux sim is supposed to be good, but I just happen to like what I have). And Turbo Tax. Because Intuit has Microsoft so far up their butts that their idea of "export to Excel" means use OLE to bring up a copy of Excel installed on the machine that the Intuit product is located on and ram the data in that way instead of allowing export to XLS files like everyone else does (just in case Excel might happen to be on some other machine, maybe?)

I like my little XP box - when I have it powered up - but it ain't going to stand moving up to Windows 7 and I wouldn't touch Windows 8 while wearing a hazmat suit even if the chances weren't even worse. So I'd better do my taxes fast. After that, I guess I just found a new Linux box.

I already have enough Linux boxes. Most of them started out as Windows boxes that I recycled when the next big version of Windows wouldn't run on them.

Re:No problem

[ebh]

If it works, don't fix it.

In the real world, the risk of unnecessarily perturbing working systems is often higher than the risk of those systems breaking on their own. (Think about the longevity of Netware 3.12.)

Re:No problem

[bsDaemon]

Run it in a VM and pass the hardware through to the hypervisor?

Re:No problem

[Anonymous Coward]

Not really a problem. There's plenty of zombies out there who junk perfectly good hardware only because Microsoft told them to upgrade.

Re:No problem

[khellendros1984]

Give virtualization a try, if you don't have spare hardware and don't have a way to get more (we've ordered out-of-production hardware from Ebay before). There are PCIe cards that supply serial ports, and VMWare lets you add things like serial/parallel controllers, mapped to your real hardware. Assuming they've got a disk image of their super-important computer, things shouldn't be too hard to work out.

Re:No problem

[slashmydots]

YOU
ARE
WRONG!!!!!!!!!!!!

I hear that stupid, incorrect argument all day. When you buy a piece of hardware, IMMEDIATELY budget for its replacement in the recommended average number of years. Doing anything else is 100% your fault for doing the SDLC and 5 year planning wrong. For example, if you bought a desktop, plan and save for replacing it with another desktop in 5-7 years because that's reality. Pretending your machines will run forever then blaming microsoft because you fucked your budgeting is so unbelievably incorrect.

Re:No problem

[Salgat]

I worked at a place where they had a SMD (tiny electronic components) placement machine that used 98. It didn't connect to the internet and only accepted tab deliminated placement files. Running 98 in this situation is completely acceptable.

Re:No problem

[toddestan]

Your only real issue is that at some point, spare parts for the computer itself may become hard to get, I personally would invest in 1 or 2 spare computers, clone the current one, set them in storage, and have them for backups. It shouldn't cost much, a few hundred dollars, and you'll have backups to the one part that is least likely to get support.

If you do that, also be sure to find the drivers and installation packages for them and store them along with the computers. If you want to get a fresh Windows 98 box running today, it's often harder to track down the proper drivers for Windows 98 for the various pieces of hardware than it is to come up with the 15 year-old parts themselves.

Re:No problem

[Anonymous Coward]

I've had this exact same axe for forty years. I've had to replace the head twice and the handle three times but it's served me well over that time :-)

Re: No problem

[lewi]

The real problem is that Microsoft wedged its software into industrial and other non-consumer systems without apparently understanding those markets.

An industrial system, say a steel press for instance, is designed to function without the need for changing software unless new features are added. That same type of steel press may have been built forty years ago with relay controls and pushbuttons. Those relays and pushbuttons don't get upgraded - they get replaced as needed and upgraded when improvements are desired.

On the other hand using a consumer based set of software such as Windows that is intended to be upgraded every five years is an unneeded and unwanted expense with no real benefits. This supports the idea of using PLC's and Panelmates/Panelviews because their manufacturers usually provide support for at least ten years - in some cases 20 - and even provide an upgrade path at a reduced cost in many cases.

However, the real lunacy to me is when such a company provides SCADA systems that run on Windows. On the other hand, they will likely sell you an upgraded system that is equivalent when Windows XP dead next month.

I don't wasn't to be a Luddite but in some cases it may be better to just stick with or go back to relays and pushbuttons.

Re:No problem

[rubycodez]

nonsense, why would a cnc machine, for example, need a new driver after running fine for 10+ years? nothing changes!

a manufacturing plant that cuts metal has no interest in developing drivers, probably wouldn't even know what the phrase meant

Re:No problem

[rubycodez]

newflash for you, 486 machines and motherboards still made

Re:No problem

[rubycodez]

also common with ms-dos, not just in printing world but cnc

Re:No problem

[The Grim Reefer]

What do you do when the Win98 machine has a hardware failure?

Unless you've been stockpiling spares since the late 90s, that is a real problem.

Most places that have these systems have done just that. Plus most of the hardware from that era tends to be a less complex and on larger die sizes than what we have today, so it tends to last a lot longer.

Re:No problem

[Anonymous Coward]

If you do that, also be sure to find the drivers and installation packages for them and store them along with the computers. If you want to get a fresh Windows 98 box running today, it's often harder to track down the proper drivers for Windows 98 for the various pieces of hardware than it is to come up with the 15 year-old parts themselves.

And this is why, in the good old days, we didn't have auto-updating software that fetched things from a cloud service provider that could go away at a moment's notice.

We installed a bare OS. We downloaded a set of drivers and applications from various sites. And we kept the original installer binaries stored locally on the damn drive, because you never know when your hardware, software, or service provider is going to go away.

Re:No problem

[Nefarious Wheel]

There are analogue targeting computers on naval ships that still work, and work quite well. Deck guns that can fire a Volkswagen Golf-sized projectile from (say) Hobart to any tennis court in Launceston. Maybe not the best economical solution, but what's money to the military, anyway?

Point is, you look at the system, and determine whether you can support the subsystem that drives it. As an integrated system it either works or it doesn't, irrespective of the weight, the cost, or the paint job on any subcomponent of it. And sometimes the bit that the computer controls is just as old and slagged-out as the operating system driving it.

Re:No problem

[MeNeXT]

Really? What risk? I have the same situation. They are custom cash registers which would require hundreds of thousands of dollars to replace. to you it's a computer to my client it's a fancy cash register. He tried to replace the business logic by off the shelf software but none would meet the requirements. So his choice is to spend hundreds of thousands on redeveloping his cash register, buy off the shelf software and hire additional staff to meet the requirements, or go to discount stores and pickup the stuff that is been thrown away?

Yeah Win95, Win98, NT are still going strong today and they will for at least the next 10 years. Maybe by that time the off the shelf software will catch up to his business logic. It's not for you fine, but I know for a fact that if he would have followed MS current he would have spent over a million just keeping up with the times. The code is completely debugged in the last 20 years of operation and a solution that none of his competitors can match.

Re:No problem

[Blaskowicz]

Btw the just-launched AM1 platform from AMD comes with Windows XP support, which may seem assinine except for those industrial scenarios.

Re:No problem

[the_Bionic_lemming]

Huh?

Can you elaborate? Because if someone actually has a win XP machine or better in that office the cost should be free.

Re:No problem

[Blaskowicz]

I see you're running MS-DOS 7.10, great version, with fat32 support, really easy to get over 600K of conventional memory for playing games. I think it will run in nearly every PC, but doesn't support a hard drive bigger than 2 TiB.

Re:No problem

[Anonymous Coward]

If you were smart you would sell that old mill used to some chump that is in your position needing a new mill...

Re:No problem

[Chirs]

The screen printers still run DOS.

DOS was actually decent as an RTOS if you could dedicate it to one task. I did some control systems work for a lab-size Tokomak fusion reactor in DOS.

Re:No problem

[hairyfeet]

So does Win 7 Tiny and unlike XP it doesn't pimpslap the swap even when there is tons of RAM available. And in this day and age there really is no point in running an OS, VM or not, in a lousy 512Mb of RAM. After all what good is a VM if you don't run any programs? Look at how much Chrome or Firefox uses with just a half dozen tabs open and you'l see 512Mb of RAM really don't cut it anymore.

Re:No problem

[Will.Woodhull]

Not so fast.

If the box can run Win XP, it can run any contemporary Linux distro, and the original Win XP with the apps that are still needed can be run as a VM under that Linux. Performance will not be affected.

But this approach is probably not going to be widely adopted since the great majority of persons who provide Windows support for a living cannot be bothered to learn anything new. This upgrade path won't be utilized mostly because learning new stuff is hard and the value for the tech support person is not obvious.

Re:No problem

[Will.Woodhull]

In both cases, a possible low cost upgrade that would probably provide a fix good for a decade or two is to get contemporary hardware, install an industrial grade Linux distro, and install Win98 or WinNT in virtual machines under the Linux shell. As far as the critical Windows apps are concerned, they would see the same environment they are in now. Except that the new hardware would be a lot faster.

If there is something basically wrong with this approach, I'm sure it will be mentioned in following comments. Along, almost certainly, with a lot of Windows fanboi crap about how this can't possibly work since you aren't spending any money (except for the better hardware).

Re:No problem

[Will.Woodhull]

The magic words in parent post are "via VMware"). Running the original OS in a VM under a solid Linux distro is an inexpensive solution for many upgrade issues. The VM can be set up to keep the WinXP, Win98, or WinNT isolated from sources of infection while distros like RH/Fedora, Debian, or Ubuntu have excellent patch and upgrade management systems.

Re:No problem

[Will.Woodhull]

There are better car analogies.

There are lots of farms that use trucks that were new in the 1950s to haul stuff to and from the fields. I once had a summer job at a seed cleaning plant that used a 2 ton 1938 Ford flatbed truck to move pallets of grass seed from the cleaning operation to the warehouse, a quarter mile away. That truck had not been on a paved road in decades, first and third gear were shot, it was always parked on a hill at overnight because the starting motor was too weak to turn crank the cold engine; it had to be jump started in the morning. We routinely overloaded it with up to 8 tons, but it would chug between the two buildings at all of 5 mph.

Continuing to use WinXP or even Win98 in situations that require nothing more is a no brainer. When the hardware wears out, either placing an order with the local computer refurbisher for a rebuilt box of the same vintage, or jumping to Linux on a new box with the ancient OS and its apps running in a VM, would work just fine.

Re:No problem

[Hal_Porter]

XP had a bug where you got very high CPU usage in SVCHOST.EXE. Somewhat surprisingly MS fixed it a couple of months ago. If I were in charge I'd have left it unfixed in order to encourage people to upgrade.

Re:No problem

[Hal_Porter]

The people that hacked Natanz would probably find it easier to get exclusive access to a zero day exploit on Windows 7 or 8 than XP.

When you're working for a government spy agency and have endless cash to pay off unprincipled 'security researchers' I think you can get into any OS whether old or new.

China can do the same thing. E.g.

http://en.wikipedia.org/wiki/O...

http://www.symantec.com/connec...

If you look at Stuxnet it seems like the initial infection was done by leaving USB sticks around

http://spectrum.ieee.org/podca...

Ralph Langner: Yeah, that's true. So the distribution we see with Stuxnet is mainly done via infected USB sticks. So, in technical terms, it would be not appropriate to call Stuxnet a worm because Stuxnet does not distribute by self-replication over the Internet, but thisâ"it distributes mostly by infected USB sticks. This is the exact strategy that you would use when attacking an aero jet facility. So just like a nuclear power plant. In this case, it makes most sense to assume that the attack was carried out via the Russian integrator that built the plant. Because if you are familiar with the commissioning of such big plans, you know security in those situations is practically nonexistent, especially IT security. So engineers walk in and out with their notebooks, with their programming devices that they use for programming the PLCs. And those engineers that walk in and out, they easily be lured into picking up infected USB sticks, so this makes very much sense to assume that the attack was performed via the integrator just by making sure that some of their engineers accept infected USB sticks, plug them in their notebooks, go home with their notebooks to their company headquarters, and at some point in time, go with their infected notebooks to the target site. By the way, this also explains all the infections that we see in India, Indonesia, and Pakistan. Because these are also regions where this particular integrator has business.

I've worked at companies where you were searched for removable storage going in. Hell I've worked at places where the USB ports where filled up with epoxy or disabled by group policy.

If you look at Bradley Manning air gap security is vulnerable to a single rogue employee. Also you need management that will enforce the policies - in Manning's case they should have stopped him bringing in CDs.

Re:No problem

[dbIII]

There's so many escalation holes that you can assume that malware without apparent admin rights never wanted it in the first place :(

Re:No problem

[thsths]

> Just don't run as an administrator!
> Also don't run IE or OE.
> Don't use Flash, Adobe Reader or Java.

Well, in that case you could just switch to Linux? IE6 is one of the main reasons why XP is still so popular. Many old web applications were targetting IE5.5 or earlier, and IE6 is the last version with a good compatibility mode.

The only other important reason is hardware. If it is just the PC, the scales have tipped now: a new basic PC is cheaper than another year of support for XP.

But there is also specialist hardware, from ATMs to raster electron microscopes, that need XP for the hardware interface. These are the use cases were locking down XP may actually be an option.

Re:No problem

[Chris Hodges]

I know of kit with ~£1million replacement cost running on a mix of 95 and 98. The ISA cards that support the hardware won't run under anything later, and an upgrade to what's on the other end would be ~£20k per unit if you could convince the manufacturer to do it. Budget for upgrades =0. Data recovery - not an issue: store it properly. If the controlling PC breaks - well, it's getting harder to find 98 boxes, but we've got spares and we can reinstall everything in a few hours.

Of course we're about to be in the same position with the next-gen kit that only supports XP.

We'll end up with all the data from the XP and 9x machines written over a local network to a win7 box, which can also see the proper network and therefore be backed up properly. No more VNC/RDP into the XP machines though - unless we can find a workaround - and we probably can.

Re:No problem

[Chris Hodges]

I agree - but not completely - and do something like this for software that requires XP. When the limit is hardware it's another story. Especially if the hardware was pretty esoteric in the first place (and it usually is - mass-market stuff can often be replaced if the drivers aren't avilable).

Re:No problem

[Chris Hodges]

That's support contract is a very nice idea. And the vendor will either just say "no" or quote you what we used to call in the industry a "fuck-off price". Perhaps the cost of employing a software engineer for the next ten years. Per unit.

Source code isn't much use to the average user - even if it includes the code to the drivers for the stuff the hardware vendor just embedded. And that's even if it wasn't written in something you can't even compile on modern systems.

Re:No problem

[rew]

I wrote software that is now cloned to 5 machines. The machine runs a terribly old OS, no longer supported. But the rest of the machine cost about $2M each....replacing them or part is not an option! So: don't connect it to the internet. These machines have processed countless billions worth of product. The product is worth more than whatever can be found on the machine, so yes the operators will be able to use a privilege escalation bug to gain root access.

Anyway, they run Linux 2.4 on Suse 7.2....

Re:No problem

[rew]

Haha. I worked on a project where the machine doesn't const a lowly $50K. The machine costs on the order of $2M. The machine has processed (I just looked it up) about $40B worth of product... And it's still running software from around '2000. (installed in '97, upgraded in '00)

Re:No problem

[FlyHelicopters]

Nice story, but frankly that old truck is an example of extreme life extension. :)

I'm all for getting your use out of equipment, but I think that one is past its prime, past its extended life, and past its dead by date. :)

Re:No problem

[FlyHelicopters]

If the machine costs over $1M and the vendor will do an upgrade for $20K, that is cheap.

Re:No problem

[FlyHelicopters]

Yes, but the ax sold back then is more or less the same as the ax sold today.

The same is not true of computers, hence the problem with such comparisons.

Re: No problem

[TellarHK]

Have you ever looked closely at medical devices? I work with some systems less than five years old that cost close to $100,000 and they run Windows XP. Should they be replaced? No, not just because the OS beneath the application layer is old. I'm probably the only person in the office that knows it's an XP machine, which helps with security. Sometimes you can't just upgrade.

Re: No problem

[TellarHK]

Numbers that you can't even comprehend. Any system that uses Windows software on non-upgradeable hardware. Medical devices that require specific levels of precision and predictability.

Re:No problem

[MouseTheLuckyDog]

You know that OS/2 is still being sold as eCommStation?

Re:No problem

[e70838]

Run XP in a VM that starts always fresh.

Re: No problem

[Anonymous Coward]

Depends on how the virtualization solution is configured.

Re:No problem

[Anonymous Coward]

None of those systems are on the internet. And probably not even on a network at all.

Maybe for windows 98 systems, but I doubt that's the case for most XP machines, even for industrial appliances.

As I recall a lot of dirt-old unsecured SCADA systems have found their way onto the public internet.

Re:No problem

[BVis]

Yeah, because drivers are never buggy shit developed in some third world country for 25 cents an hour.. Some bugs may not emerge for years.

Re:No problem

[queBurro]

have you virtualised it?, because that HW will give up one day

Re:No problem

[Anonymous Coward]

Yeah, because it makes so much sense to spend another $50k to not run Win98.

In a previous position, we had a NT4 server running a RIP software for a $45k film printer that still worked perfectly fine. Instead of buying a new $45k film printer that had newer OS support to eliminate the NT box, we just put it on a private network and added a $50 NIC to the machine that sent it jobs.

OH NOES.

That thing still works today.

Re:No problem

[Megane]

What in particular about web browsing in a VM requires Windows as the OS, as opposed to Linux? The only thing I can think of is Flash, if you happen to like advertisements that wave or scream at you, or take over the whole browser window. And maybe a few video players, except that YouTube can work with plain HTML5 now, right?

Re:No problem

[Anonymous Coward]

What windowing system would you recommend? I've tried the usual ones that came with mainstream Linux variants, and found them porky and slow in 2-3 GB of RAM, compared to a working XP instance in 768 megs. Linux itself is lean and mean, but the graphical environments are not.

Re:No problem

[Megane]

I know someone who is an optometrist who years ago wrote up some cool software to type in and print out exam prescriptions using Wordstar and Mailmerge. At least it's the x86 version (he got it with a Sanyo MBC-555 back in the day), but his main problem so far is finding printers that will work with it. At some point, being a .COM executable is going to be another problem. At least there's no problem with losing that version of Wordstar, because you can download it from Computer History Museum. (I even verified the CRCs.)

Re:No problem

[Will.Woodhull]

And yet, still doing the job and saving the company from the cost of purchasing a new(er) truck. Much as Win98 or even DOS boxes can save a ton of money in similar, specialized, situations. Which is why it is a good car analogy. For those who need car analogies.

Re:No problem

[Anonymous Coward]

That leaves hardware failures. I have full drive images to restore once the HDs fail. On a more serious failure, the entire rig is considered failed. Either time to pony up the $25k for a new system, or we do without.

Not that simple. If you trigger the reactivation requirement due to hardware changes, your MUST connect it up to the internet (assuming MS still has those servers online).

Otherwise your drive images mean squat.

Re:No problem

[FlyHelicopters]

Is it? What is the labor cost of having a truck that only goes 5 mph? What is the labor cost of having to screw around with something so old, you have to park it on a hill to start it?

What is the business risk that it just doesn't start one day, a critical day, and it takes time to fix or get a replacement, yet the crops are ready to go?

It is called stepping over dollars to pickup pennies.

I'm all for being frugal, but at some point you're just being foolish.

Re:No problem

[david_thornley]

On the other hand, when you buy a $100K machine that you intend to use for years, you probably should inquire about the software. Is it likely to be EOLed in the next ten years when you were hoping to use the machine for thirty?

Much like two-digit years and IE6-only webapps, where there was never money to do something that had no immediate value until it was suddenly necessary.

Re:No problem

[david_thornley]

Sure. Now, how do you get the gcode to the cnc machine? Is it connected to the same ethernet that handles the outside connections? I sometimes create gcode on the computer I'm currently using to connect to /., myself, and I'm not saying there is or isn't an air gap, but air gaps are inconvenient and not necessarily effective (*cough*Stuxnet*cough*).

Re:No problem

[I'm New Around Here]

When it died last year, I grapped another Win98 computer I have on hand and brought it to his business. Loaded the software and he was back up and running.

I then bought another Win98 computer that someone was selling, and it is sitting in the corner, waiting its turn.

Re:No problem

[martyn1807]

Except access to:

* Serial Ports
* Parallel Ports
* USB Devices
* Firewire Devices

(..obviously differs based on hypervisor chosen...)

With PCI devices, it may even be possible to do passthrough in some cases.
He's probably on nootropics, you should probably try some ;-)

Re:No problem

[Anonymous Coward]

Better solution... Just buy some new asus or gigabyte motherboard based on the just released AM1 soc by AMD, that supports WinXP

Re:No problem

[I'm New Around Here]

I'm not talking any particular size of talk. And others have far outpaced what I wrote anyway. But as we see above, there are valid reasons for many places to keep systems running outmoded (by today's standard) operating systems. Whether the reason is purely physical (no other hardware will work) or purely financial (not worth the cost of upgrades), or a combination of the two with other considerations thrown in (not worth the risk of trying other hardware), it is up to the business owner to decide, since that is the person who makes or loses money based on the decision.

All I can do is research the issue and give recommendations. I can't force them to spend money if they don't want to.

Re:No problem

[I'm New Around Here]

The hardware may be free, as in already there, but my time isn't. If they don't want to pay me, or can't pay me until the economy actually recovers, then the system stays as it is now. I mentioned above, but the Win98 system died last fall, just as that customer started a big job for a customer. He called me in a panic, I grabbed a Win98 system I had in my room, brought it to his shop, loaded the software, and he was back up that afternoon. A week later, I bought another Win98 system that someone was looking to sell, so I have one on hand if needed.

Would a newer system work in its place? Probably. But he isn't interested in paying me to find out. And the software is very specialized to run one piece of machinery, so I can't exactly test it at home. After reading some of the responses above, I may give some effort to trying Linux with a VM, but I haven't used either too much and have no idea what I would be able to make work for this case. It is worth a look-see though. :^)

As for the WinNT server with the database, this is a new client (not same one as the Win98), so I don't know the whole details. But he explained that the database is some custom software that he's used forever, and he has looked into porting it to something newer. But the task would have to be done manually by a database expert, and it isn't worth the attempt. The box is actually a newer HP server, not something 15 years old. But he made sure it would run WinNT 4, and that is what he is happy with.

Re:No problem

[I'm New Around Here]

Not all computers are on the internet of things.

Re:No problem

[mark-t]

You didn't read the first 9 words that I wrote above, did you?

Re:No problem

[I'm New Around Here]

You didn't read the last 10 words of that same sentence, did you?

I'm not trying to get in a pissing match, but it does seem like you are saying all these outdated systems are on the internet.

Re: No problem

[Anonymous Coward]

what about ISA cards?

I have several clients running industrial equipment controlled via custom ISA cards in 98/XP machines.

(Thankfully, it's the equipment vendor's problem when there's a motherboard failure and they're out of business for 3 weeks...)

Re:No problem

[mark-t]

Yes. but owing to the fact that I had already prefaced the whole comment with "This may not necessarily apply to every use case..." one would generally figure that facing a "... distinct possibility of being cut off from the Internet entirely" wasn't ever intended to apply to systems which do not regularly utilize an internet connection in the first place.

Re:No problem

[the_Bionic_lemming]

Not going to try to fight here, but I think that if you had elaborated in the OP about this then the impact you were striving for would of been greatly diminished.

If you could provide me some contact information for that client, I'd most likely be able to fix the situation for a nominal fee that I'm sure they'd accept.

Re:No problem

[I'm New Around Here]

I'll concede I misread your point. But you buy the first round at the beer summit. Fair?

Re: No problem

[nine-times]

I would generally disagree. I could see having some weird old piece of hardware that is completely isolated from the internet running an old OS for a good long time simply because there's no reason to upgrade, but then again, 10 years is already a good long time.

Among most users, the problem is usually just poor planning and bad budgeting. Someone spent a bunch of money buying a solution that they then don't have the money to maintain properly. That's how you end with with businesses running internal custom apps that only run on IE6. That's how you end up with businesses relying on some junky old piece of hardware that constantly breaks down and nobody can fix. That's how you end up needing to rebuild your system from scratch because there's no upgrade path-- the upgrade path from v3 to v7 requires you upgrade through v4, v5, and v6, but v4 is completely unavailable now.

If you're spending 50k in hardware this year, you should have an estimated lifetime for that hardware, a maintenance plan for the lifetime of the hardware, and you should be budgeting for the replacement of the hardware once the lifetime expires. I don't have much sympathy for businesses that bought hardware 10 years ago with no maintenance plan or budget for replacements. If you're running your business and you can't afford to maintain and eventually replace business-critical systems as needed, then your business model isn't sustainable.

Re:No problem

[wild_berry]

Another one runs NT Server, because porting 100,000+ part numbers to a new database isn't worth the upgrade.

Can you name and shame your customer*, so I don't get delayed by parts from that DB when it goes pear-shaped? Data should be transferrable; migration -- like backups and disaster recovery -- should be a thing we expect as normal for digital information.

*: well, no you won't, this request is hyperbole on Slashdot.

Re:No problem

[RockDoctor]

I used to do consulting for Xerox, it was fairly typical for hospitals to depreciate hardware (such as beds, autoclaves, photocopiers) over 20 years.

One of my friends works in infrastructure maintenance. His typical equipment lifetime is expected to have a mean lifetime of about 50 years, otherwise they get very, very pissed off.

It's not very computerised equipment though.

Use a firewall

[Anonymous Coward]

If XP is behind a corporate firewall - no problem.
Everyone should have a separate non-Windows firewall.
It really is all very simple and never requires the running of ridiculous anti-virus products.

Re:Use a firewall

[hawguy]

If XP is behind a corporate firewall - no problem.
Everyone should have a separate non-Windows firewall.
It really is all very simple and never requires the running of ridiculous anti-virus products.

A corporate firewall does little to ensure safety of a Windows installation. I've seen users behind a malware scanning firewall, running antivirus software on Win7 *still* manage to get infected by malware.

If a remote exploite is found in WinXP, a single infected XP machine on a corporate network can hop around to other WinXP machines in that network.

Re:Use a firewall

[Anonymous Coward]

If XP is behind a corporate firewall - no problem. Everyone should have a separate non-Windows firewall. It really is all very simple and never requires the running of ridiculous anti-virus products.

People really believe this?? That firewall does nothing to protect you against most common internet threats. And neither does "safe user practices" - legitimate sites are the main vector for malware now, not links, downloads and attachments you shouldn't have clicked on.

Re:Use a firewall

[Anonymous Coward]

a single infected XP machine on a corporate network can hop around to other WinXP machines in that network.

I saw that happen at a former employer. They were in the process of switching from an old in-house point-of-sale system (running on MS-DOS) to a shiny Windows XP Embedded 3rd-party system. They had about 100 computers in the Q/A lab (all on a common private network), and all had just been converted to the new Windows P.O.S. (read that both ways).

Within a matter of a couple of weeks, a virus managed to get on to one of the computers. I don't know if they ever figured out whether it was through the network or through someone using an infected thumb drive, but every one of the computers was infected within minutes.

It took them a week to clean up the mess. Those of us who had been warning them away from a Windows-based solution had a good laugh at the expense of the idiots in management who insisted that Windows was a good choice for a special-purpose system running one specific program.

Re:Use a firewall

[mlts]

Firewall and AV products will not catch 0-day exploits of the Web browser and add-ons. If they are pulled via SSL, even the best SPI firewall will be bested, unless one goes with a MITM system and forces all inside machines to trust the MITM appliance's key as a root one.

Browser exploits are the biggest vector of infection these days, and XP has little to no resistance innately against those, other than running as a non-admin user... and even then, malware can do a lot with a regular user's context.

Re:Use a firewall

[kimvette]

> A corporate firewall does little to ensure safety of a Windows installation. I've seen users behind a malware scanning firewall, running antivirus software on Win7 *still* manage to get infected by malware.

That is why you run multiple layers of protection; a UTM with antivirus/malware signature update subscriptions plus centrally-administered antivirus/antimalware software and policies covering use of USB devices.

Re:Use a firewall

[hawguy]

> A corporate firewall does little to ensure safety of a Windows installation. I've seen users behind a malware scanning firewall, running antivirus software on Win7 *still* manage to get infected by malware.

That is why you run multiple layers of protection; a UTM with antivirus/malware signature update subscriptions plus centrally-administered antivirus/antimalware software and policies covering use of USB devices.

Multiple layers is good. Running an unsupported and unpatched version of Windows is a huge gaping hole in your layers of security. Your UTM should automatically block WinXP machines from the network when they fail the NAC check - no network access for devices not up to date on patches, and by definition, WinXP systems are not up to date on patches after support ends.

Errrrrr

[segedunum]

No.

Re:Errrrrr

[VernonNemitz]

"No" to what, exactly? XP is probably OK as part of an "intranet", especially if that intranet is isolated from the Internet.

Re:Errrrrr

[Hadlock]

Until you need to install some new package to your webserver which requires IIS 9 or .net 5.5 framework or whatever crazy new thing is coming down the pipeline.

Re:Errrrrr

[Anonymous Coward]

no to another stupid article on XP's demise. It's dead. It's been dead. anyone using XP at this point has zero imagination and is dead from the neck up, lazy and unworthy of comment.
it's a tired discussion. release this OS, this OS has poisoned your soul.

Check you premise

[Anonymous Coward]

If you think that newer versions of windows don't have anything to offer you shouldn't have to do anything at all (as presumably you don't think continued security support is something worth upgrading for).

Re:Check you premise

[rudy_wayne]

If you think that newer versions of windows don't have anything to offer you shouldn't have to do anything at all

First, the only newer version of Windows that "has anything to offer" is Windows 7. Vista isn't as bad as some people have tried to claim, but once Windows 7 became available, Vista became meaningless and there is absolutely no reason to even consider it. Windows 8 is a mess. One of the all time worst.

But the real problem isn't that newer version of Windows don't have anything to offer. The problem is the expense of switching.. Whether it's an individual with one computer or a business with a few thousand, the cost far outweighs the benefits.

Then there is the dirty little secret of business, that isn't so secret. There are millions of computers running shitty, poorly written software that will stop working if you make the tiniest change to the underlying hardware or operating system. That makes switching even more difficult and expensive.

Re: Check you premise

[cyber-vandal]

It's not a well kept secret.

Re:Check you premise

[Darinbob]

Yes, XP is good enough, and all later versions really offer nothing new that the average consumer needs. This is all just forced upgrades to guarantee that you keep buying new microsoft products. They could have added a support option and keep XP around; say $5/year gets you continued updates. This would be popular I think for businesses which have many legitimate reasons to keep around old turnkey systems or the like, many of which aren't even on the network. Alternatively MS could provide better XP compatibility in newer systems instead of treating it like a pariah (as well as having newer versions of office actually be able to read and write older office formats).

Forced obsolescence was a bad idea when given to the home consumers. But forced obsolescence foisted upon business and industry is destructive.

Antivirus is obsolete

[Anonymous Coward]

I stopped using an antivirus program in 2005, shortly before converting to Linux.
Aren't actual viruses pretty rare nowadays? Most malware attacks the browser and plugins.

Re:Antivirus is obsolete

[kthreadd]

Anti virus is sort of an incomplete term. Trojans are much more popular these days, and despite its name an anti virus program can protect against them too. It's just software when it comes down to it.

Re:Antivirus is obsolete

[Anonymous Coward]

I was under the impression that, for a typical box that has updated software AV software is more or less redundant. There's signature-based AV which only protects you from old threats and is pretty easy to subvert with polymorphic code and packers. That's old and busted. Then there's heuristic-based AV which tries to guess when a program is doing something it shouldn't be doing. Which gets in the way constantly and takes a lot of resources. AV is really just a stop-gap solution for doing what the OS should have been doing in the first place.

And most reasonably intelligent users know not to give questionable software the keys to the kingdom.

And no matter of OS security or AV will keep idiots from giving malware the keys to kingdom if they REALLY want to see those kitties.

At this point, AV software companies were making their money on tradition and fear. Ostensibly helping the computer security ecosystem by helping identify and close security holes, but really just preferring to leech of corporate America.

Re:Antivirus is obsolete

[rudy_wayne]

Aren't actual viruses pretty rare nowadays? Most malware attacks the browser and plugins.

The term "virus" has evolved to include all forms of malware and anti-virus programs now detect more than just the traditional "virus".

Re:Antivirus is obsolete

[Anonymous Coward]

I was under the impression that, for a typical box that has updated software AV software is more or less redundant. There's signature-based AV which only protects you from old threats and is pretty easy to subvert with polymorphic code and packers. That's old and busted.

It may be old, but it is prevalent. Even the APT vendors acknowledge that stopping known AV threats stops 90% of real world threats. Discounting the value of that is like discounting the value of condoms because they are not 100% safe.

Then there's heuristic-based AV which tries to guess when a program is doing something it shouldn't be doing. Which gets in the way constantly and takes a lot of resources. AV is really just a stop-gap solution for doing what the OS should have been doing in the first place.

What exactly should the OS be doing (that is different from an AV) when I want to install app X and it is compromised with a trojan?

And most reasonably intelligent users know not to give questionable software the keys to the kingdom.

Malware and exploits have moved on from being avoidable by good user practices. You will lose the keys to the kingdom to a good pickpocket without knowing what hit you.

And no matter of OS security or AV will keep idiots from giving malware the keys to kingdom if they REALLY want to see those kitties.

You are right that OS security won't prevent that, but this is exactly what AV will prevent, it will block and quarantine those kitties, and it will not be easy for the user to circumvent that.

Re:Antivirus is obsolete

[mlts]

AV programs are useful for two things:

1: Make the legal eagles happy.

2: Scan an offline volume (a VM's disk image) for potential infections.

For real time threats that attack the Web browser and the add-ons, the only real protection is blocking ads via AdBlock, utilities that block by IP address, denying plugins the ability to run unless explicitly clicked on, sandboxing the whole mess so any changes to the filesystem can be easily dumped, and running the browser that you use for banking in a different browser/sandbox as the one you do for other sites.

Open your files in text mode

[Anonymous Coward]

If you need to deal with end-of-line, then it would be a good idea to open your file in text mode. It makes no difference on Unix because the line separator is LF anyway, but as you may know on Windows XP it is CRLF.

You want the best way? You got it.

[trifish]

So what is the best way to secure this remaining Windows XP systems?

If you can't keep the box permanently offline, then the best way to secure Windows XP after the EOL date is to uninstall it. By believing otherwise you are only fooling yourself.

Re:You want the best way? You got it.

[Anonymous Coward]

If you can't keep the box permanently offline, then the best way to secure Windows XP after the EOL date is to uninstall it. By believing otherwise you are only fooling yourself.

Wouldn't just switching the computer off be a lot easier than going to the trouble of uninstalling XP?

Re:You want the best way? You got it.

[mspohr]

I don't understand what all the fuss is about. Windows XP has been infested with malware for years in spite of attempts to patch it up. I don't think the patches did much to improve security since the malware is winning. The lack of new patches shouldn't make much difference. It will still be infested with malware.
If you're concerned about security, you would have moved to something else a long time ago.

Re:You want the best way? You got it.

[Anonymous Coward]

Wouldn't just switching the computer off be a lot easier than going to the trouble of uninstalling XP?

Yes, but it would be equally easier for the end user of said computer to simply switch it back on again, which is probably what would happen, and the problem will be back. If it doesn't boot when switched back on, then the end user of said computer will request a replacement, which they should have done by now anyhow, and the problem will be solved.

Re:You want the best way? You got it.

[Darinbob]

And what's the worst that happens to a computer that's on and not connected to the network? Microsoft loses some profits.

Re:You want the best way? You got it.

[Anonymous Coward]

Spot on. The truth of the matter is that if you were doing everything that you were supposed to be doing in the first place, you wouldn't be worried about the EOL of XP, as you would already be doing the following:

* Run as a standard user. No application needs total access to a system. Your IT guru's should be able to use procmon (regmon + filemon) to figure out what permissions the app needs.

* Firewall off the machine, both incoming and outgoing, use a proxy server for web access and let the proxy server monitor for malware installs.

* Whitelist all your applications, vet any app on a throw away box and then add it to the whitelist if you really need it.

* Don't open attachments from strangers.

* Don't open attachments from friends either.

* Keep the other crap (java, flash, acrobat, etc) up-to-date. More infections come from those venues then OS exploits.

* Lastly, keep your anti-virus up to date. Since all anti-virus products are crap, just put on security essentials (as that will get updates for another year, at least) until you can figure out what to do with your XP box.

Probably more, but these are the biggies. But nobody does this anyway, so it'll be life as usual.

Must keep running XP

[Anonymous Coward]

We have mission-critical software that must be run under XP. The software checks the OS somehow and reports Operating System Not Supported if we try to install it under Win7. It *does* run under Win7 in the XP virtual machine, however the software has a hardware security key that attaches to the parallel port, and the VM doesn't let it access the LPT at the low level it needs to (apparently) to recognize the key. It's XP for us for a while, damn the torpedoes.

Re:Must keep running XP

[kthreadd]

So what's your plan going forward? Will you use XP ten or twenty years from now? If not then you should start a migration now rather than later.

Re:Must keep running XP

[JohnVanVliet]

That is some "bleeped up "software

Re:Must keep running XP

[Anonymous Coward]

No. There are about a half dozen other issues complicating the situation that I don't feel like spelling out here, but I think they can all be solved by applying sufficient money and programming time. Unfortunately neither has been available up until this point, I'm hoping the growing publicity around the EOL of XP will help the cause. I know, I know, should have started a long time ago - not up to me. The other option is allow something to break irreparably at some point, and everyone will go into meltdown crisis mode. *Then* it'll get fixed. There is a newer version of the software that uses a USB security key, we need to move to that. However, big $$$$$$, and we have no other reason to do it. The EOL of XP probably will be a windfall to a lot of software companies.

Re:Must keep running XP

[Anonymous Coward]

Crack the software - you already bought it. Dongles are for dummies.

Re:Must keep running XP

[Anonymous Coward]

Exactly this. The end of XP support isn't news, it was announced several years ago. There should have been plenty of time to migrate to newer software versions or find alternate solutions. I'm betting in most cases decision-makers have just been putting it off to not have to spend the money in the short term. Now they are stuck. So it goes...

Re:Must keep running XP

[I'm New Around Here]

So what's your plan going forward? Will you use XP ten or twenty years from now?

They probably will, if there are motherboards that still support it.

Re:Must keep running XP

[Anonymous Coward]

Test it on ReactOS or WINE?

If the software vendor does not support Win7, hire a hacker to hack the dongle.

Re:Must keep running XP

[Collective 0-0009]

The other option is allow something to break irreparably at some point, and everyone will go into meltdown crisis mode. *Then* it'll get fixed.

You have to weigh the cost of doing it now vs. doing it then. If your company thinks "then" will be in 10 years, then don't bother now. But be prepared for the meltdown. Either way you have perfectly stated the case that you do not have to "Must keep running XP". You have made a risk-based assessment that it will be cheaper to continue running XP.

Re:Must keep running XP

[Mashiki]

So what's your plan going forward? Will you use XP ten or twenty years from now?

Why not? We've still got mission critical systems that use fortran and cobol in use.

Re:Must keep running XP

[Anonymous Coward]

Dongles and calling home are the only to really make sure you only want the right people to use the software, especially when iran is trying to get it, and make sure the programming office is well locked down and monitored 24/7, the ruskies etc are known for smash and grab to get software

Re:Must keep running XP

[Sylak]

That said this is 100% the case the Library of Congress said was okay to do as fair use last time they did a DMCA review.

Re: Must keep running XP

[Anonymous Coward]

Yeah, but that software written for os/360 isn't running on os/360 any more.

Re:Must keep running XP

[mark-t]

You better hope that either a) no remote exploits for XP get discovered after april 8th, or b) your systems do not need any kind of connection to the internet.

Certain types of infected computers which have an impact on network usage (zombies, in particular) can be detected by the ISP and disconnected from their network (and it is usually in their best interests to do so)

Re:Must keep running XP

[Anonymous Coward]

Consider a better VM system. I would expect VMware, in particular, to handle the parallel port well enough to let you continue using your system.

Re: Must keep running XP

[cyber-vandal]

IT departments also have other things to do as well as doing a major upgrade to core systems that takes several months to do. Stuff that actually makes money for firms and therefore is far easier to justify.

Re: Must keep running XP

[cyber-vandal]

No but the systems are backward compatible for this reason.

Re:Must keep running XP

[BobMcD]

But chances are, there won't be. The Intel rep said that they will no longer be developing drivers for it, and their new chipsets do not support it.

Re:Must keep running XP

[kyrsjo]

There are still tons of software being *written* in FORTRAN. COBOL I don't know, I don't work for a bank... But when I (2-3 years ago) where digging into the depths of the website of our local equivalent of IRS to try and figure out some piece of tax law, I found a link named "program for calculating tax" or somesuch. Clicked it - and got my screen filled with what I eventually identified as COBOL code!

Re:Must keep running XP

[westlake]

Test it on ReactOS or WINE?
If the software vendor does not support Win7, hire a hacker to hack the dongle.

Do the words like "mission critical" or "breach of contract" have any meaning to you?

Re:Must keep running XP

[Darinbob]

If it was me, my plan for the future would be to never again buy equipment that requires a closed source operating system to run, or even never buy equipment that requires a computer, stick with analog or mechanical devices. Also instill heavy doses of cynicism, and realize that if you buy the least available OS that the next day they will announce the end of life data for it.

Or just go with a whole startup mentality and pretend that your business will never last more than 5 years anyway and never plan on buying any equipment that might last longer than that.

Re:Must keep running XP

[Anonymous Coward]

You could try 'run in XP compatibility mode' too, but I would expect that this has already been tried.

Re: Must keep running XP

[Darinbob]

And sometimes this actually gives new companies an advantage, because they can afford (with the help of naive investors) to buy brand new equipment whereas the older companies are stuck with capital equipment that they can not discard or replace without massive investments. This is where idiocy like outsourcing or renting services or cloud services will start taking off big time, because companies will realize that they can not afford to ever buy anything because it will become obsolete by fiat before the cost has amortized.

Re:Must keep running XP

[Darinbob]

Problem most likely is being unable to hire the hacker either. It comes down to the budget. Generally nobody ever has the budget to replace something that works. Even in rich companies all that profit goes to the execs and not to the guy in the basement.

Re:Must keep running XP

[Anonymous Coward]

Both actually trumped by "EOL", the company's is just a few months behind XP's date.

Re:Must keep running XP

[Anonymous Coward]

Try running it as a virtual machine under VMWare instead of WIndows7. We've had good luck with that with both parallel and USB dongles. We even have software that only runs under Windows98!!! still running with their parallel port hardware security key under VMWare.

Re:Must keep running XP

[Anonymous Coward]

If there's an active contract, why would the provider not upgrade from WinXP?

Re:Must keep running XP

[Anonymous Coward]

I'm a different coward than the original poster. We have some niche specialty software with a parallel port hardware dongle that runs only under Windows 9x. We don't use it much, but we do occasionally need to use it. The manufacturer is out of biz, the source code is not available, and the cost of creating new software and validating it to be 100% identical in function under all conditions (which would be needed) would be price prohibitive.

The motherboards that supported it have all died since. For the past ~7 years we have been running it as a VMWare virtual machine. It's been doing just fine. No network card is on the virtual machine, so there are no worries about network vulnerabilities, and we transfer data to/from it via USB drives only. It runs as needed, and if there is ever any issue, we can restore from the multiple backups of the Virtual machine we have archived.

Re:Must keep running XP

[Anonymous Coward]

Dongles and calling home are the only to really make sure you only want the right people to use the software, especially when iran is trying to get it, and make sure the programming office is well locked down and monitored 24/7, the ruskies etc are known for smash and grab to get software

Why you no like Iran? :(

Re:Must keep running XP

[Anonymous Coward]

That is some "bleeped up "software

Welcome to the Real World.

Re:Must keep running XP

[Anonymous Coward]

You should be fine as long as those systems are not accessible to the internet. If they are indeed open to the internet you will not be able to keep up with the amount exploits that will be written for XP.

Re:Must keep running XP

[AmiMoJo]

You are headed for disaster. Eventually the hardware will fail. New mobos don't come with drivers for XP any more. You will be scouring eBay for used junk and praying it carries on working. You will find it increasingly difficult to even get LPT ports too.

FWIW both VMWare and VirtualBox support LPT ports IIRC, and both are free. Migrate to a VM ASAP.

Actually, one other thing. Try running the app in compatibility mode. When it asks for the OS version it will be told it is running on XP, even if it is really 7. Works a treat.

Re: Must keep running XP

[Anonymous Coward]

What are you talking about? IT departments are almost NEVER revenue centers, in the vast majority of cases they're cost centers. Nothing the IT department does actually makes money, they can only make it easier for other departments to make money. Go and upgrade the machines, you serf :-)

Re:Must keep running XP

[Anonymous Coward]

Wow.. you said 'dongle'. I am offended at your blatant misogyny.. My name is adria richards.. I'm getting you fired.

Re:Must keep running XP

[camperdave]

If it was me, my plan for the future would be to never again buy equipment that requires a closed source operating system to run, or even never buy equipment that requires a computer, stick with analog or mechanical devices.

Why bother with mechanical devices when there are draft animals and ethnic slave labour available?

Re:Must keep running XP

[Darinbob]

Because I'm a geek and like mechanical devices?

Re:Must keep running XP

[thegarbz]

What's my business case to upgrade fully working production because one small component is EOL?

No seriously, what is the business case? Spend $100k to maintain the status quo? We have machines that still run Windows NT4, heck we have one system which still runs on DOS. The other day I ordered a network card for a 10base2 network off ebay. If a vendor keeps supporting the expensive components then how do you justify upgrading because the cheapest part of the system is obsolete?

Our mitigation strategy is spare parts. Hardware runs a long time, lots of hardware is interchangeable. Where we've had 10base2 networked systems fail we've switched to ethernet on the PCs and used media converts to talk to the 10base2 systems. Where we've had DOS based laptops break we've virtualised the OS where possible to run in windows. And some times when we didn't have another option we built a new system out of compatible parts. There's heaps of stuff available on ebay that will still run on ancient systems and we've started stockpiling.

Re:Must keep running XP

[Anonymous Coward]

So what's your plan going forward? Will you use XP ten or twenty years from now?

They probably will, if there are motherboards that still support it.

What do you mean if there are still mobos that support it? Their current mobo running XP will probably still function in 10+ years. I have a few 15 year old computers that are still working.

Re:Must keep running XP

[Anonymous Coward]

a) no remote exploits for XP get discovered after april 8th

I fear it's much worse than that, with existing malware writers simply waiting until after this deadline to release software containing their already discovered vulnerabilities that will no longer be patched.

Re:Must keep running XP

[Anonymous Coward]

You must be new here. Have you ever been to a site that has lots of automation that is controlled by a PC or has a pretty touch screen HMI, a hell of a lot of it is running on XP. It's absolute lunacy to be tied to a 14 year old operating system that has more patches than Raggity-Anne's knees because the vendor doesn't want to update their software or release a new version but I have seen a brand new (2013) automated packing machine that came with a fresh install of XP. It didn't even come with any service packs or updates, the manufacture was explicit in stating that it should not be updated (so as not to break their software) but also that we should hook it up to the network and forward the port for remote support and diagnostics. That is the norm and the norm scares the hell out of me, how long after the XP EOL before it starts getting seriously exploited and people find their 500 tonn press all of a sudden has a new, remote, operator with a warped sens of humor?
 
Vendors, I'm looking at you and your friends Seimens, should be getting their asses in gear and addressing this but most of their clients don't even know its a problem.

Re:Must keep running XP

[dbIII]

If it was me, my plan for the future would be to never again buy equipment that requires a closed source operating system to run

That's why the stuff at my workplace that requires SunOS 5.6 or Win98 is steadily getting rewritten in python. Don't like linux/Win7 ? Run it on whatever you do like. A nice side effect is being able to run it on dirt cheap tablets standing right next to the gear it's testing.

Re:Must keep running XP

[FlyHelicopters]

Then the Target data breach happens...

The problem is people keep saying "it works, why change it".

No, it doesn't work, having security holes is not "working", it is broken.

The first task is to change the status from "working" to "broken due to unpatchable security holes".

Re:Must keep running XP

[Anonymous Coward]

It *does* run under Win7 in the XP virtual machine, however the software has a hardware security key that attaches to the parallel port, and the VM doesn't let it access the LPT at the low level it needs to (apparently) to recognize the key. It's XP for us for a while, damn the torpedoes.

Have you tried VMWare? It seems to do the best job of virtualising access to real parallel ports, it was the only virtual machine software I found to work with my old parallel port logic analyser and its screwy 32 bit only Chinese parallel port driver. It can host a Microsoft "XP mode" image too, so if you have Windows 7 Pro, Ultimate or Enterprise you don't have to waste an XP license.

Re:Must keep running XP

[Anonymous Coward]

You have to weigh the cost of doing it now vs. doing it then. ...

Easy to say & it sounds reasonable. But when is the average corporation reaasonable? They can be very unreasonable when considered against end-of-month end-of-year reporting income vs. expenditure tradeoffs. Don't spend the money, write a glowing income report, get the big bonus, bail out. How many companies have failed in the long haul by using that philosophy.

Re: Must keep running XP

[Anonymous Coward]

Stuff that actually makes money for firms and therefore is far easier to justify.

Yup, because Technical Debt can always be swept under the rug...until the bill is due with interest.

Re:Must keep running XP

[Anonymous Coward]

If you have a mission critical application that depends on horse carriages and gaslights, you either have very specific religious customers or you're doing something seriously wrong.

The innovation cycles in the OS world are much faster. Windows XP was released in 2001, a month after 9-11. That was 13 years ago. The OS life cycle was known by then and with Microsoft postponing the end of support several times, XP was and has been "about to end" for many many years.

In aviation, running a jet engine for thousands of hours after the last maintenance is negligence amounting to attempted manslaughter. Running Windows XP for years is the same in IT.

If your company is seriously unable to migrate to a newer OS version within 13 years, after knowing this date for 10 years, then whatever you are doing is not "mission critical" and pretty complacent. Even settiing up any kind of mission critical application in Windows XP is questionable, but please do not expect any sympathy if the company loses money or its business when they absolutely have not been doing their jobs for thirteen whole years.

I sincerely hope that any people that may lose their jobs over Windows XP-related bankruptcies never ever start to work in any industry relating to aviation, power plants or medical equipment.

Re: Must keep running XP

[Anonymous Coward]

Also some of us have production lines with robots installed as part of the production line, and Windows XP industrial PC's built into every robot stations. We don't replace the production line every 10 years, it's safe to say we'll be running this line for 30 years.

Re:Must keep running XP

[I'm New Around Here]

Then those will be the motherboards they are using. I didn't insist they will be changing hardware, just speculating on what happens if they need to.

Re:Must keep running XP

[Maxoverdrive]

Hex Edit

Re:Must keep running XP

[Darinbob]

Also realize that much of this stuff is not a big security problem because the machines are not on any network.

Re:Must keep running XP

[FlyHelicopters]

Tell that to Iran who had the computers running their nuclear centrifuges air gapped.

Re:Must keep running XP

[Anonymous Coward]

We have mission-critical software that must be run under XP

Seems to me you need to find a new software vendor. You know one that has moved into the 21st century and doesn't use a dongle on a parallel port.

Re:Must keep running XP

[Anonymous Coward]

It sounds like the problem is with that shitty software you are using. Which idiotic programmer decided to put an OS check that isn't forward compatible in there?

Re:Must keep running XP

[Anonymous Coward]

I assume the software vendor is either defunct or is staunchly unwilling to support the product on a newer OS. If the system(s) can be isolated from the internet, then perhaps there is little urgency. You might consider requesting enhanced LPT port access from the VM vendor/maintainers. Maybe there's even some undocumented configuration option already. It sounds like that might be all you need, so maybe you can afford to wait for it.

Otherwise, have you already investigated everything here:

http://msdn.microsoft.com/en-u...

If the MS ACT can't get you past the installer, then you might try modifying it. Another poster suggested using a hex editor, but that usually won't work on installers as they tend to verify their own signature. However, if the installer is MSI-based, you might be able to use orca and related MSI tools from MS (should still be available for free download) to alter the version-checking in the installer and repackage it. I have done this before. If the installer appears to be MSI-based yet is still shipped as an EXE, you should be able to unpack the MSI file from the EXE with administrative installation switches passed to the EXE (memory fails me; google is your friend). Also, some InstallShield installers are actually MSI installers built with IS, so similar techniques might work with those (but not with InstallScript-based IS installers). Most other installer types, such as Inno Setup installers, are not MSI-based.

If the installer is MSI but signed, then you're probably hosed. However, it might be possible to reverse engineer it if you can find a copy of an old tool called InCtrl5. It has a mode where it will take a snapshot of the WinXP system, then you run the installer, then run InCtrl5 again to determine what has changed and get a report detailing files, registry keys, and so on. If the application's installation is simple or you have exceptional patience and diligence, you might be able to achieve a manual installation on Win7 through copying files and editing the registry by hand (or building your own installer). Note that the InCtrl5 report won't reveal the order of changes, which can sometimes be important. If you're not intimately familiar with the guts of Windows installation, find someone who is, unless the installation is dead simple.

Once you work around the installer, you still might need to use the ACT to allow the application to run properly on Win7 (or later) with access to the LPT port for the stupid dongle. If you achieve that and also need to run this application on multiple systems, you can use the ACT to create an SDB file which can be applied to other systems using the sdbinst tool. Here's a reasonably good walk-through:

http://www.techradar.com/us/ne...

Keep in mind that some dongles allow having part of the application functionality embedded in them. If you've got one of those, and it also does an OS-specific verification within the dongle-embedded code, you're probably hosed. At that point you have to hire someone to crack the application, which probably won't make it past the legal team.

HTH. Good Luck.

- T

MSE

[theheff]

MSE will have definitions for a year after the EOL: http://blogs.technet.com/b/mmp...

Re:MSE

[RR]

MSE will have definitions for a year after the EOL: http://blogs.technet.com/b/mmp...

I think that is a grave mistake on Microsoft's part. It makes people think that they can still run Windows XP securely, just intercepting viruses that match the signatures, instead of patching the underlying vulnerabilities.

I also think continuing to let OEMs install Windows XP until Windows 7 was also a grave mistake. In the short term, it slowed people from fleeing to Linux, especially for the early-model netbooks. In the long term, it has delayed the end of Windows XP by years, making it more painful when people do finally upgrade.

The usual suspects

[bbroerman]

Load all patches, install a good antivirus, have a second or third one that you run occasionally manually (not all anti-virus packages get everything), use an updated chrome or Firefox browser. For Firefox, I'd suggest using noscript and web of trust as well. Keep Java in medium or high security mode, only go to reputable sites, and only enable JavaScript when needed.

Re:The usual suspects

[jones_supa]

I wouldn't bother with general web surfing using XP at all, when the support ends.

Re:The usual suspects

[Sylak]

don't forget make a disc image if you ever need to restore that machine

Re:The usual suspects

[Anonymous Coward]

Firefox? Chrome? That's fine if your Mom doesn't want to upgrade to Win7, but do you think that the sort of people who are stuck on XP get to choose what browser they use? One of the main reasons to be stuck on XP is that they have a mission critical system that requires IE6!

dom

Re: The usual suspects

[bbroerman]

I do that anyway when I get a machine or when I upgrade it.

Re: The usual suspects

[bbroerman]

Don't have a choice. I don't have hundreds of dollars for new copies of Windows, and the time to spend days reinstalling all the apps for everyone in the house...

Re:The usual suspects

[bbroerman]

I've worked for companies like that. Sometimes it happens. They don't have the time or money to invest in writing all new software. I'm still writing web apps that have to support IE 6 due to a partner using an older version of Developer Studio where the embedded browser widget renders as IE6. They don't have the money to re-tool and rewrite it all, and we have to support them...

Re: The usual suspects

[jones_supa]

Why not just install a Linux distro?

Re: The usual suspects

[Anonymous Coward]

Most of the kids games, and most of my work apps won't run on linux. Seriously, though, I don't expect any problem. I have good anti-virus / anti-malware, I have a good SPI firewall between the net and my home network, each box has a non-windows firewall (webroot) as well as the windows firewall, and I run malwarebytes and superantispyware every few weeks on each of the boxes. They all run Firefox / chrome with extensions added to weed out problems... I also have backup images of each box that I made last time I reinstalled.

Only 2 of my 4 boxes could even run Windows 7, so to upgrade the house, it would be $400 for the windows licenses, plus another $1000 for 2 new boxes. I have higher priorities for that kind of money currently (3 teenagers who are driving & in high school). Maybe next year I'll upgrade one of the 2 boxes, and then maybe I can squirrel enough away to pick up some licenses... It's still a pain in the a$$ to reinstall all of my apps, all of the kids apps, etc.

Re: The usual suspects

[Blaskowicz]

Just use warez Windows 7. You torrent an iso and it's free, CD key baked in (you don't even need one), activated, "genuine" and receives updates. At this point it's getting more ethical to run non-legit Windows 7 than legit XP.. You will be endangering your family, friends, and also the internet at large as your computers are added to botnets.
In the mean time watch for license deals, MS may have cheap Windows XP to 8.1 upgrade, "family plan" to install Windows 7 on three computers, whatever.

You can reconsider what's a box needed to run Windows 7. Anything with 1GHz or less and 1GB or more runs it, and Windows 7 32bit has vast compatibilty with software and even some XP/2000 drivers. Most software that doesn't run on it wouldn't run on XP either.
RAM upgrades are possible and hard drives can be shuffled around. If a computer still can't run Windows 7 after that, it probably isn't able to play youtube videos decently. You might as well put Windows 98SE or ME on such a computer to run 90s/early 00s games on it, or use a linux distro with LXDE if you want to browse the web and other networked tasks.

Re:The usual suspects

[FlyHelicopters]

Your partner will have to update that sooner or later, or if there is really no money, why be in business?

I keep hearing "but we can't afford to upgrade".

Really? Then why do you go to work every day for years on end, if you'll never have the money for upgrading anything.

What, you bought computers and figure they'll last 50 years?

Budget for it, or change something, cause you're just one step from bankruptcy if the budget is really that tight.

Is it really that costly?

[Collective 0-0009]

Other than your one embedded example, that I don't think pertains to the other 99% of computer you are discussing, I question that it is really that expensive to upgrade to Win 7...

I realize there is more than hardware costs, but did you really expect your software to work for more than 10-15 years without needing an upgrade? Most people in this situation are there because they have deferred the (most likely needed) updates until now. And now they have an unusual number of computers to upgrade. My employer is squarely in this position.

Bite the bullet and upgrade. If you really want to stand firm against M$ or something, simply install any number of old-hardware-friendly linux distros. Knoppix is my current favorite.

Re:Is it really that costly?

[Anonymous Coward]

It can be that expensive. We have some large, high volume scanners that only work with XP because the drivers required to run the interface cards don't work on newer versions of Windows. The cost to upgrade is not just the cost of a new computer. It's the many hundreds of thousands of dollars per device that it would cost to upgrade the interface cards and scanners. We've already had to decommissions two scanners because they only ran under DOS. All the hardware and software involved is proprietary.

Re:Is it really that costly?

[rudy_wayne]

but did you really expect your software to work for more than 10-15 years without needing an upgrade? .

Why not? Automobiles can last for 20 years or more with little more than minor repairs and routine maintenance. Musicians routinely use instruments made in the 1950s or earlier. But for some reason, people have bought into the absurd idea that software is obsolete and unusable after a few years.

Re:Is it really that costly?

[Collective 0-0009]

How much have roads changed in the last 20 years? Do we now drive on a surface completely un-fathomable just 20 years ago? Have cars increased in power/efficiency by orders of magnitude? Did cars run for 20 years in 1914?

Did you know that my paper cup from my morning coffee is already soaked through and unusable? Why can't they make paper cups to last 20 years like a car?

My dog died last year. He was only 13. Why can't dogs simply live as long as humans?

Do you have any more stupid propositions?

Re:Is it really that costly?

[Cammi]

I am surprised you did not post as AC due to all the trolling you just did. Perhaps you should read his post.

Re:Is it really that costly?

[Collective 0-0009]

Why? So he can compare a mostly mechanical object with 100 years of continuous improvements to hardware/software that has radically changed in the past 20 years? Or in the case of musical instruments - completely mechanical with thousands of years of improvements.

It is true that software will continue to work for thousands of years, theoretically. If the hardware, the items they interface with (including humans) don't change. Sure the software is good. But to plan for software that has that level of stability in it's environment is rather ridiculous.

So, instead of your one-liner troll statement, why don't you add something to the discussion?

Re:Is it really that costly?

[caseih]

I think you kind of gave away you age there with your comments (20 years wasn't that long ago). But rather than mod you as troll for completely missing the point of the OP, I'll answer your questions:

No we don't drive on a surface un-fathomable just 20 years ago. What do you think roads were made out of back in the ancient times of the 1990s.

No cars haven't increased in power/efficiency by "orders of magnitude" in the last 20 years (you didn't say 20 years here, granted). Not even close. Do you understand what "orders of magnitude" means? Since the dawn of the automobile age, average car HP has increased by about one order of magnitude, and has pretty much plateaued, mainly because it doesn't make much sense for most cars to have much more horsepower than they currently have. In terms of raw horsepower, IC engines were developing hundreds even thousands of horsepower in the 20s, 30s, and 40s, though not in everyday cars. Efficiency has probably doubled, tripled, or quadrupled, but I'm hard pressed to find a single order of magnitude there.

Your paper cup analogy sort of works, though. Software is hard to get right, and we're really bad at writing it, so the best we can do is make paper cups. That's not likely to change either.

Re:Is it really that costly?

[Cammi]

How about reading his post? Trolling him doesn't help a thing. The whole theory that software changes radically in the past 20 years is pure BS as anyone know develops know. Try coding for once, instead of making crap up? Anyone who EVER developed on their lives know for a fact that software does not change radically. The tools to develop software -sometimes- changes. Ever looked at C or even C++? Seriously ... your trolling is getting old.

Re:Is it really that costly?

[AdamHaun]

Computers in 2004 weren't all that different from today's computers, though. The AMD64 instruction set was out and consumer-level 64-bit CPUs were available. PCI Express and Serial ATA were standardized the previous year. DDR2 was in use, and you can still buy that today! The biggest changes in PC hardware since 2004 have been multi-core CPUs (which XP handles just fine) and solid state disks, which aren't exactly a compatibility killer. There have been a lot of huge changes in the mobile space, but that has nothing to do with XP. Virtualization is a big deal for servers now, but there are plenty of applications where it's irrelevant.

As a gamer, I upgraded to Win7 for hardware support and newer versions of DirectX. Aside from that, I didn't see a compelling reason to do so. It's not like I could suddenly do anything new with my computer. I can understand why people wouldn't want to shell out tons of money to upgrade. And then there are embedded applications. Where I work we have a ~$20k oscilloscope that runs XP. We're certainly not going to throw *that* out.

Re:Is it really that costly?

[Darinbob]

Often this happens because the original creator of the software has gone out of business or it is too expensive to upgrade. They planned to keep it up to date for a long time, assuming the TrustUsLol LLC would stay around and support the system as necessary. Only they were acquired by someone else who dropped the product that wasn't sellling well, or are willing to only sell new products intead supporting old ones, etc.

And by the fictional TrustUsLol LLC, this can refer to many big name companies who make it a common practice to drop old products at a moment's notice or provide lousy service. Basically once they get your signed purchase order the honeymoon is over and the friendly sales people will have nothing more to do with you.

Re:Is it really that costly?

[Anonymous Coward]

It's not trolling to disagree with you. I mean, him.

Btw, you're losing. Badly. Best stop flapping your gums.

Re:Is it really that costly?

[Anonymous Coward]

but did you really expect your software to work for more than 10-15 years without needing an upgrade?

Where are you getting 10-15 years from? Sure, the first XP licenses were sold in 2001, but they were still selling XP well into 2008. So you could very well have purchased a computer in 2008 with XP installed. In which case it's only been 5-6 years for which you've expected your software to work.

Re:Is it really that costly?

[AmiMoJo]

The reality is that there isn't even that much hardware from 10-15 years ago still working. I'm sure there will be a flood of anecdotes about stuff that old now, but it was right around the time when the capacitor plague was at its height and when the ultra unreliable P4 was in everything. A lot of mobos of that era don't support hard drives over a certain size or have broken SATA controllers too, so even a HDD failure could be fatal.

Re:Is it really that costly?

[Bing Tsher E]

Some of us have a dream of software convergence. Where software 'improves' over time by getting better and better, until almost all the bugs are found and removed.

Sadly, this can only occur in an Open Source world, and not the one we presently have. It has to be a world where programming fads don't replace consistency. Where the latest hot dog volunteer programmer doesn't rip out an old section of code and replace it wholesale with something completely new.

Still, the idea that if software continually improves, new versions of software based on the same code base should run faster and faster on the same hardware isn't out of reach. It's just out of mind, sadly.

Re:Is it really that costly?

[toddestan]

My experience is if the capacitors don't fail, 10-15 year old hardware is overall pretty reliable. Even if the capacitors fail, they can be replaced with some patience. True, hard drives that old are kind of a crap-shoot, and by now you've probably replaced all the fans at least once. But otherwise the stuff will keep going. It's certainly more reliable than the newer (2005-2009 or so) stuff that seems to like to randomly die for no apparent reason. I blame the lead-free solder and tin whiskers, but that's only a theory.

I've also never considered the P4 unreliable. Sure, a bit slow, but Intel's chipsets are pretty solid. Now, the contemporary Athlon systems are junk. Not really AMD's fault so much, but the available chipsets, especially VIA which is in the majority of Athlon systems I run across. Unless it's an nForce2 chipset, a 10-15 year old AMD system is pretty much only good for parts.

Re:Is it really that costly?

[Anonymous Coward]

You seem to be forgetting the fact that Windows 7 runs better/faster/smoother than XP ever did. It's not like Microsoft did *nothing* to the internals of their OS between the versions ... constantly expecting them to 'back-port' all of this work into a legacy OS is unrealistic.

Re:Is it really that costly?

[LordLimecat]

Must be the profits. Thats clearly why Linux 2.4 (released at the same time as XP) was EOL'd several years back. Clearly its why Firefox EOL'd support for Win 98 about 5-6 years ago, and Win 2k a few years back.

Software changes, the internet changes, frameworks change, and new vulnerabilities are discovered. Hardware changes and support for old stuff just ends; thats how it works.

Re:Is it really that costly?

[Anonymous Coward]

Given that XP came out in 2001, and was likely in development since they released Windows 2000 a few years earlier, I'd say that things have changed a lot. The 64bit instruction set was not established between AMD64 and IA-64. SATA was not around along with the other things you were talking about.

Microsoft shot themselves in the foot when they released so many service packs for it and then followed it up with Vista. If they had released something of Windows 7 quality in 2004/2005, I'd think this most of this problem just doesn't happen. The fact that companies could get away with releasing software/drivers that only work with XP for so long is the main issue.

Re:Is it really that costly?

[Blaskowicz]

The environment around software changes.
20 years ago we used computers that had no notion of users and services/daemons, javascript didn't exist and the computers didn't know what books you read, what music you listen to and what movies you watch (among other things)

Re:Is it really that costly?

[Blaskowicz]

If you have "only" 1GB RAM (which used to be an unfathomably high figure) and a not-that-great hard drive, Windows 7 will be a pig and XP will fly. It's fallacious to believe that because it runs great with your 4GB or whatever, then it runs great everywhere. (Like Chrome : nice on a computer with 16GB RAM, but with "only" 4GB or less it may be too much of a memory pig).

Still, I recommend upgrading a 1GB machine to 7 and live with the slowness (or live within the memory limitations)

Re:Is it really that costly?

[Blaskowicz]

Funnily the Pentium III systems tend to survive the newer Athlon/XP systems and some bad Pentium 4 ones (there were bad motherboards and VIA chipset for Pentium 4 too, and the high power draw may put some strain on the electric stuff on the motherboard)

Not many people still use Pentium III systems though. They are still decent (much better than a Raspberry Pi) but can't play fullscreen youtube video, which is apparently an extremely demanding task unless you use html5 + hardware acceleration.

Re:Is it really that costly?

[BadDreamer]

"did you really expect your software to work for more than 10-15 years without needing an upgrade?"

Yes, I did. What reason would I have not to expect this?

Many banks still run software from the 1960's and it does what it's supposed to do just fine. What is it about my software which makes it impossible to continue to use it after 10-15 years? Other than Microsoft being greedy, that is.

Re:Is it really that costly?

[dbIII]

How much have roads changed in the last 20 years?

With computer networking we had fibre optics, copper and microwave links 20 years ago.

Re:Is it really that costly?

[dbIII]

Sun, DEC and others had 64 bit back then.
I had a relatively cheap two socket PC motherboard with two fairly inexpensive CPUs (Celeron300) back then.
SCSI was more complicated and capable than SATA is now back then. SATA is a similar thing for a subset of what SCSI does for hardware that doesn't need all the rest.
Gigabit networking was around back then as well.

WinXP was never about the state of the art.

Re:Is it really that costly?

[FlyHelicopters]

C and C++ may not have changed as much, but the computers they run on sure have...

10 years ago, my desktop computer had a 20GB hard drive.

Today, my desktop computer has 32GB of RAM.

What a change... the world moved on, the pace of computers FAR exceeds the pace of... well, just about everything else...

Re:Is it really that costly?

[FlyHelicopters]

If cars had the same level of improvement, we'd all be getting 1,000+ MPGs and driving at 1,000 MPH.

If cars today could do either of those, do you think ANYONE would be driving a 20 year old car? (besides the odd collector)

A 20 MPG car would be insane and a waste of time in a world of 1,000 MPG cars.

That is why 20 year old computers are very rarely used anymore.

Even Supercomputers have this problem, go look up ASCI Red, once the world's most powerful computer, less than 20 years ago.

Today? It no longer exists, it was taken apart because replacements were faster, cheaper, and smaller, using far less power.

Re:Is it really that costly?

[FlyHelicopters]

You are looking at it all wrong...

Yes, most of what we have today, was coming out about 10 years ago, give or take a year...

But computers in 2004 may have had a 20GB hard drive and 1GB of RAM. Today they have 2TB hard drives and 16GB of RAM.

In order to continue development and have anything new in 10 years, we have to let 2004 go and move towards 2024. We can't do that and hold on to Windows XP, an OS that was really written in the late 1990s.

Re:Is it really that costly?

[FlyHelicopters]

That, and the whole computer revolution is still chugging along.

As long as we continue to fit 2x as many transistors in the same space every 18 months, you simply can't compare computer advancements to anything else.

Once that slows down, the business model will change, but the fact is a computer today can easily have more RAM in it than a computer had in total hard drive space 10 years ago, to say nothing of 20 years.

Re:Is it really that costly?

[FlyHelicopters]

Of course it will continue to work, it just won't be supported.

Microsoft isn't being greedy, they are in business to make money, not provide free support for decades for software that you paid for a LONG time ago.

Re:Is it really that costly?

[BadDreamer]

I am prepared to pay for support. Microsoft do not care. They want me to upgrade from a perfectly working system so they can make more money than they can from support.

That is greed, pure and simple.

Re:Is it really that costly?

[Anonymous Coward]

Other than your one embedded example, that I don't think pertains to the other 99% of computer you are discussing, I question that it is really that expensive to upgrade to Win 7...

I realize there is more than hardware costs, but did you really expect your software to work for more than 10-15 years without needing an upgrade? Most people in this situation are there because they have deferred the (most likely needed) updates until now. And now they have an unusual number of computers to upgrade. My employer is squarely in this position.

Bite the bullet and upgrade. If you really want to stand firm against M$ or something, simply install any number of old-hardware-friendly linux distros. Knoppix is my current favorite.

I work for a government IT in a health care setting in Atlantic Canada.

  We as of yesterday morning have ~500 computers left to upgrade. (out of 6000).

  It was a massive and expensive undertaking.

  Especially with clinical and lab software that barely supported XP, let alone 7.

Re:Is it really that costly?

[Vlad_the_Inhaler]

My "old laptop" - it was released as "Vista ready" which gives an indication as to its age - has 1GB and a Core Duo processor.
It is totally unuseable under XP for several minutes after booting, XP is doing all the things it really *has* to do with the very highest priority.

I'll admit it runs decently after that.

It is not going to be upgraded for several reasons, what I have done is to uninstall security holes like Flash or Java. I never browsed as Administrator anyway, people who did are a big reason XP is considered so insecure.

Re:Is it really that costly?

[AdamHaun]

But computers in 2004 may have had a 20GB hard drive and 1GB of RAM. Today they have 2TB hard drives and 16GB of RAM.

But again, what about the OS needs to change to accommodate that? WinXP can handle 2 TB hard drives just fine. And 16 GB of RAM is neither common nor a necessity for most users. Best Buy still sells plenty of computers with 4 GB of RAM.

Now what we do (and did) need is a good 64-bit operating system, and XP-64 never fit the bill. But what are the alternatives? Vista was a mess. Win7 is good on newer hardware, but only the OEM versions are sold anymore. Today there's a choice between sticking with XP, buying Win8, or taking a chance on an eBay copy of Win7. I did the latter for my wife's computer, but it's hard to recommend for the general public.

I'm not disagreeing that we need to move on. But Microsoft has spent most of the last decade screwing up their upgrade path. Maybe if they stopped wildly redesigning the UI every time they put out a new OS, more people would have upgraded by now.

Re:Is it really that costly?

[Anonymous Coward]

Highways did change considerably in the early years (not so much lately). Cars got faster and driver view planes lowered and widened. Highway curves changed as well as the slope for rain runoff.

Lots of other changes on the highway undersurface as well.

Re:Is it really that costly?

[FlyHelicopters]

If it were greed, Microsoft would charge you $50 per seat, per year, for continued XP support.

Re:Is it really that costly?

[FlyHelicopters]

Windows XP does handle 2TB just fine, it does not handle SSDs as well. It also doesn't really use the 4GB of ram in those BB computers, and a lot of machines have 8GB now.

XP also uses an older driver model, the way Windows Vista/7/8 handle drivers is better than the old way, display drivers being the single biggest improvement.

You're also mistaken about the Windows 7 options. If you buy a copy of Windows 8 Pro, you can downgrade to Windows 7 Pro. In addition, companies that use a volume licence can install almost any version of Windows they want, so long as each seat is paid for.

Windows 8 happened due to Microsoft taking their eyes off the desktop ball and being suckered into phones and tablets. In fairness, I understand why, they are worried about computer use habbits changing and they not changing with the times.

How many companies have been accused of not improving? Microsoft is dammed if they do, dammed if they don't. Keep it the same and half the people will say they aren't keeping up with technology and living in the past, change it all and the other half will say "stop messing with my OS!".

What they really should have done was hedged their bets and offered both options, boot to desktop on desktops (hey, what a thought!) and boot to Metro on anything with a touchscreen (hey, what it was designed for).

Balmer is gone, we'll finally hopefully see some change and improvement, finally...

BTW, Vista sucked due to the hardware not being ready and the drivers sucking for about a year or so, Vista fully updated and patched today on current hardware is actually just fine. Keep in mind that it was launched in 2006 on hardware that looks downright quaint today. :)

Re:Is it really that costly?

[BadDreamer]

There is greed and there is the impossible. If Microsoft tried that they'd be abandoned for alternatives. Instead they try to use the planned obsolescence to make XP no longer viable and let regulations and policies do their dirtywork.

But sure, if they were still in the position they were 15 years ago they would charge that. Even they know they're not. But they're still greedy, and still care not one iota about the worldwide IT infrastructure they have helped building up.

Fixing a leak with tape

[Arith]

While what the article says is probably a good way to handle the EOL.. over time this is just going to get bad.
Ever image a machine to win98 and plug it in to the intertubes lately?
Yeah.

Re:Fixing a leak with tape

[0racle]

Are you saying that there aren't windows 95/98/2000/older machines out there doing work? Because there are. This really is going to be a non-event.

Re:Fixing a leak with tape

[Arith]

No, I'm saying it's not a great idea. I realize there's cases where it's unavoidable. Software/hardware constraints and what have you.
Patches stop coming out, exploits rise and then what?. Fixing a leak with tape.

xp

[Anonymous Coward]

every one that stays with a unsupported OS
whether it is Windows, Apple , or Linux
should be help LEGALLY RESPONSIBLE for all the "shit" they cause

now there are some needed instances that can be solved by running XP on a VM
just like the sometimes needed need to run RH9 on a VM or RHEL3 on a VM

propitiatory NEVER to be updated software

See no benefit?

[MikeRT]

A lot of companies/users don't want to change because they see no additional benefit to do a costly upgrade, no reason to change a running system, and they may in some cases be right with their assumptions.

How about this one. All of your software options are better on 7 than XP. Firefox and Chrome are moving away from supporting it. Microsoft is moving away from supporting it too. You know what that means, Mr. Super Conservative Executive/IT guy? It means your threat vectors are now starting to approach "everything installed on this workstation" instead of just the OS.

Re: See no benefit?

[Anonymous Coward]

How 'boSo this: box works. We are on a 5-year replacement cycle now at six due to budget issues. Didn't bite the dog called Vista. Budget cuts meant we didn't roll out Win 7 until 2011. So, given that every year's IT budget is less than the last, where do we find the cash?

Welcome to the public sector. No, I'm not in IT. Show me a competent public-sector IT employee, and I'll show you someone who could earn twice as much in the private sector.

Re: See no benefit?

[Cammi]

Ah yes, the private sector where people are canned because the manager is mentally unstable .... no thanks. Security over stupidity is better in every case.

Re: See no benefit?

[CohibaVancouver]

Show me a competent public-sector IT employee

My buddy.

Pension plan, 9-5, 5 weeks vacation, stat holidays. job security. Lots of reasons people stay in the public sector.

Re:See no benefit?

[multimediavt]

A lot of companies/users don't want to change because they see no additional benefit to do a costly upgrade, no reason to change a running system, and they may in some cases be right with their assumptions.

How about this one. All of your software options are better on 7 than XP. Firefox and Chrome are moving away from supporting it. Microsoft is moving away from supporting it too. You know what that means, Mr. Super Conservative Executive/IT guy? It means your threat vectors are now starting to approach "everything installed on this workstation" instead of just the OS.

You've never worked with specialized equipment that costs hundreds of thousands or millions of dollars have you? Either that or you work for a DoE lab with deep pockets. Businesses, universities and private research labs usually don't get to replace equipment costing that much on a four to five year cycle. They get the equipment and use it until it just flat out doesn't work anymore then they spend the money to get something new. If the machine that interfaces with the equipment requires a 16-bit DOS or older version of Windows and has a proprietary dongle or need for some 16-bit ISA card then that's what stays. You buy replacement computers that will support the equipment at auction or on eBay and you keep the thing running. If the equipment can still be used, you use it. Like was said above, the computer's only job is to interface with the equipment. It's not networked, doesn't need to be. Modern malware can't effect it because it won't run on it, dummies! You can't run 32-/64-bit malware on a 16-bit machine! XP maybe, but there are very good ways around the security issues. You don't obsolete $250,000 plus machine that still gets used because the OS needed to interface with it is "old". Why is this so hard for some people to understand? You just don't treat capital expenses like that unless you have a ridiculous amount of money to burn. There really isn't a good analogy for this. It is what it is. I am sure you know the common euphemism, "If it ain't broke, don't fix it." That saying isn't just a saying, just like stereotypes exist because there are people that fit them.

Re: See no benefit?

[Anonymous Coward]

The private sector just needs to fool a few shareholders. The public sector needs to fool the whole country.

Having spent years in both, working in the public sector is miles better in terms of working conditions, overall compensation (i.e. base salary slightly lower, but more vacation and better pension) and quality of workmates (who are genuine geeks rather than just in it for a quick buck).

Re:See no benefit?

[Anonymous Coward]

"if it ain't broke, don't fix it"

That just about sums it up. It's just that people don't realize that Microsoft saying "EOL" for the OS does not qualify as "broke" when we're talking about an appliance.

At work a few weeks ago I watched this brandy dandy new "Entertainment IT" guy freak the hell out because he saw a laser controller running Win98. He was going on some tirade about how if his boss knew he would never let the machine in the building and blah blah blah. Should have seen the look on his face when I told him the entire stage hydraulic system was controlled by a PLC hooked up to a Win95 machine... Some people just don't get it...

Re:See no benefit?

[Anonymous Coward]

"everything installed on this workstation" is a no-brainer to justify.
"One piece that works perfectly well and could continue to work perfectly well except the vendors are forcing us to move" - not so much.

Re:See no benefit?

[nmr_andrew]

Seriously, why don't I have mod points when a comment like this comes up. Seriously, +5 Insightful

I work at a university. Around here, lots of investigators have aging but perfectly serviceable equipment of all flavors. Some of it is tied to XP (or Win9x, or DOS) because the software to run the equipment hasn't been updated to run under a newer OS. Some of the equipment is one off or made by a company that's been out of business for years, or there is a newer and fancier instrument so they won't upgrade software for the old stuff and there's no budget to spend >$100k to upgrade a piece of equipment just so it can run newer software.

This isn't limited to Windows, either. The NMR spectrometer I'm chiefly responsible for has parts (including the acquisition computer) that are nearly 16 years old, and the software we use to control it was released in ~2006. That version of the software will only run under RHEL 4.0 with certain specific PC hardware and drivers. When the Dell PC died ~2 years ago, I could either find a similar box online ($350 delivered) OR I could upgrade 1. the computer (cheapest supported workstation was ~$2500) and 2. buy a license for a newer version of the control software (~$10k). That's not the newest software, which only works with newer hardware.

Fortunately, at least our IT and CompSec people are willing to begrudgingly accept the status quo. They are "mandating" that nearly all Windows boxes get update to at least Win 7 by next Monday. However, for those computers that can't, they are willing to accept keeping them offline as much as possible and behind a strong firewall plus using common sense security measures (i.e. not running normal tasks as admin).

Re:See no benefit?

[Anonymous Coward]

So if you buy me a new printer, scanner, camera and a control for some medical hardware that only works in XP, for me I will upgrade to windows 7. Ah no, none of my hardware needs Firefox or Chrome! :P How bad!

One solution: Migrate

[spacefight]

Migrate your apps, fork the code, invest some cash. And next time, write up a long term strategy regarding on how to live with well known product lifecycles.

Re:One solution: Migrate

[xushi]

Now if only the corporate companies can also do the same with the damn ticketing systems that insist on an old unpatched version of IE8, with an old version of Java6, where any change will break it.. :/

Re:One solution: Migrate

[spacefight]

OTRS to the rescue.

Re:One solution: Migrate

[Darinbob]

Product life cycles are not well known, especially if what you're doing is buying a turnkey software product from a no-name company from a smooth salesman. Even if they do tell you "oh ya, this runs on Windows and that version expires in only 6 years", they'll say "don't worry, we'll help you upgrade since you have a support contract", but then they go out of business or the support contract turns out to be too expensive or doesn't cover migrating to a new product.

As for investing cash, these problems occur at the bottom level of the company. If this was the CEOs computer you can guarantee there's a brand new shiny PC every month with an intern hired to polish it every night. But down in the basement where the product actually gets made they don't even have budget for duct tape to keep their office chairs from falling apart. If it's this year, then they don't get any readjustments to the budget until next year anyway, and they could have replaced it all last year except that they needed the budget for a different emergency.

Sure, this all sounds so simple from outside the companies that have these old systems. But on the inside there aren't simple solutions.

Re:One solution: Migrate

[Anonymous Coward]

Long term strategy: To hell with the OS vendor, stockpile enough spares to keep the gear running until the end of time.

What hardware were the flight control systems on the space shuttle running when it retired? Oh right... Odd coming from somebody with 'spaceflight' as their username.

CloneZilla

[almitydave]

I plan to clone my hard drive on April 8th and just restore from that backup whenever I get hacked. No fail in this plan!

In all seriousness, I've been gradually transitioning to Linux Mint as my primary OS, with XP as a dual-boot option (basically for games). I also have a XP VM running under Mint that I'll be able to use if I need XP and don't want to reboot. Everything's installed on a single 1TB platter drive so I really do have 2 cloned backups (on- and off-site) available.

I hadn't planned on getting a Windows OS after XP due to draconian DRM, although I haven't had a problem with XP licensing since I bought it retail in '04; I'm considering getting Win7+SSD since that's what I have at work and it's actually quite nice. That being said, most of the programs I use are cross-platform FOSS, so it's not a strong need (notable exceptions are rFactor and Visual Studio).

Re:CloneZilla

[spads]

I'm mainly concerned with java and adobe/flash updates, which I believe I should still get. I'll give it a try for a while and if I run into trouble I'll probably go to linux and possibly wait for a better, new Windows release to come out. F- 8, and 7 is halfway in the ground itself.

My main concern was using my personal desktop to connect to my work VPN, which I prefer to the company laptop. They (Fortune "mongo") screen your hardware for eligibility, but I was surprised to recently learn that they won't curtail access for XP users. As long as that persists, I'm gonna let er ride!

Btw, that's a good idea what almity said about saving an image. That way you can reinstall with all the final updates. I think this should be fairly practical (???)since I finally wised up and moved all my user data off my main drive. WE SHALL SEE!!! :)

Re:CloneZilla

[Threni]

> I plan to clone my hard drive on April 8th and just restore from that backup
> whenever I get hacked. No fail in this plan!

That's actually quite a good plan, with just one small change; replace "get hacked" with "boot".

Re:CloneZilla

[operagost]

I kind of wonder whether activation is going to work after April 8. No one has brought this up in years. Microsoft's servers have to still answer to requests from XP machines; if they don't, the software is unusable. Really, they should activate any request with any key since it's unsupported and it would take more effort on their part to continue maintaining the database.

Re:CloneZilla

[Dogtanian]

I kind of wonder whether activation is going to work after April 8. No one has brought this up in years. Microsoft's servers have to still answer to requests from XP machines; if they don't, the software is unusable.

I kind of wonder what the legal issues would be if they *didn't* keep the activation servers working for the forseeable future.

Yes, I'm sure they've got a "you agree to give us your firstborn if we ask for it and not to sue us if we turn of the servers" clause in the EULA somewhere. Whether that would stand up in court- especially outwith the US- given MS's near-monopoly position on the desktop market (*) is open to question.

(*) Yes, MS are arguably losing dominance, not because anyone achieved the impossible and unseated them in the desktop arena, but because the current paradigm shift in computer hardware is moving things away from desktop PCs. Still a massively dominant company, however.

Re:CloneZilla

[Anonymous Coward]

I'd say they should go the next step and release a Windows Update on 4/8 which disables the calling home features and product activation functions of XP altogether. People not paying for extended support isn't a concern and the reduced load/calls should actually save MSFT some cash.

Re:CloneZilla

[Anonymous Coward]

The FAQ says new activations will still work.

Re:CloneZilla

[LordLimecat]

Just set up the system with Server 2008 /2012 and install your guest XP box as a VM. Set the primary disk as transient (assuming HyperV supports that?) and do a reboot once a day. No more permenant threats!

Re:CloneZilla

[LordLimecat]

I sort of wonder how much luck you'd have trying to activate RHN on Red Hat 8 (or whatever the equivalent would be) these days. I sort of feel like their answer if you complained would be "what are you, stupid? Upgrade to RHEL 5.6."

Re:CloneZilla

[Blaskowicz]

You have transient threats instead :)
I wonder if malware will target such "clever" uses of Windows. You boot your XP VM, get owned in 5 minutes and then the malware has a 10 hour or so window to do some malware stuff. Next day you start anew.

Re:CloneZilla

[Anonymous Coward]

According to investigations by German IT mag c't, activations will continue to work.

Re:CloneZilla

[AmiMoJo]

The official word is that the activation servers will remain operational for the foreseeable future, as will Windows Update. There just won't be any new patches or support available.

Re:CloneZilla

[Anonymous Coward]

Microsoft's servers have to still answer to requests from XP machines; if they don't, the software is unusable.

Only during install/after hardware replacement.

And not to worry, but Micky$oft is too scared to pull the trigger on that one.

Re:CloneZilla

[Anonymous Coward]

There's a special key that you can enter so that you can turn off the Internet Activation thingy.

Install "common sense antivirus"

[nctritech]

Use Firefox. Keep the biggest attack vectors up to date (Adobe stuff in particular). Get rid of Java entirely unless you desperately need it; in that case, keep it up to date religiously. Use Adblock Plus (or equivalent) to block ads which sometimes carry malicious code. Don't do stupid things online. Don't run executables unless you absolutely know they're safe. Don't install pirated software since pirated software sometimes comes with lovely surprise infections. Use a limited user account for your daily activities and an administrator account only for maintenance tasks or to run software that won't work under the limited account. Always use a NAT router between the computer and the Internet, and don't run any open wireless network with that PC attached.

It's largely just a matter of (A) don't do obviously dumb things and (B) don't run everything as an administrator in the first place. Remember that antivirus and security software is a final line of defense; everything else is basically a problem with the user's behavior or knowledge, and if you are careful and follow good security practices in the first place, you aren't at any significantly greater risk than you are now.

One more thing: if someone really wants to break in, they will. XP or 7 or 8 or 8.1 and all the updates in the world won't matter in such a case, so my final piece of advice: don't piss anyone off that might want to come after you.

Re:Install "common sense antivirus"

[Threni]

> Get rid of Java entirely unless you desperately need it; in that case, keep it up to
> date religiously

Three - sorry now four - updates a year, so that's not going to be hard.

Re:Install "common sense antivirus"

[Anonymous Coward]

Configure an IDS and firewall. Learn how it works deeply, not just the "automatic stuff" and then spend your days watching new vulnerabilities. Any new vulnerability should be checked against Windows XP as most people will no longer be checking and XP may still be vulnerable. Be prepared to use the IDS/firewall to block attack signatures that current technologies have immunity. Be prepared to convert these highly specialized machines to embedded systems (e.g. include the firewall and IDS as part of the embedded system).

Re:Install "common sense antivirus"

[Anonymous Coward]

If it's a machine that runs software/hardware critical to your company/lunar base then you have to accept that it's just waiting to shit on your parade and try to minimize the exploitation vectors as much as humanly possible.

One attempt out of a thousand, a hundred thousand. If the machine is networked, treat it like it's going to go nuclear at any moment, and prepare accordingly. It does not touch or send a packet anywhere unless whitelisted.

If it's a machine for your granny, I think it's time to buy her a gift.

Re:Install "common sense antivirus"

[steelfood]

You forgot NoScript. That single-handedly, even more so than AdBlock, prevents a good chunk of website-delivered malware from running client-side.

It can't help if you trust the wrong site that's compromised by injection or some other method though.

Re:Install "common sense antivirus"

[antdude]

You pissed me off with your post so I cam coming after you with your computers. I care not if it is Linux, Mac OS X, etc. [grin]

Re:Install "common sense antivirus"

[Blaskowicz]

I would even run dillo on cygwin (if built successfully) or elinks/links/lynx etc. Lynx at least has a Windows version.

Even then I would have trouble trusting it. Near every service would have to be disabled, hack to prevent any execution of mshtml.dll and whatever things, no internet access other than by proxy and you still could get owned by a vulnerability in some jpeg or png rendering library or whatever stupid thing.

Re: Install "common sense antivirus"

[Anonymous Coward]

There was a guy I knew who would boot his Linux router from a flash drive and then crash it. Apparently he figured out how to crash it such that it would still route packets but wouldn't run software at all.

I've done my part

[viperidaenz]

10 year old laptop now runs Lubuntu and 5 year old desktop "server" is going in the trash, replaced by an ARM SBC running debian.

"Installing the latest security patches"

[xushi]

Hell can you even still do that?

I've been having nothing but hell with a broken updater on all my VMs.. Either it takes 100% CPU usage non stop, or completely fails and immediately fails every update.. Every workaround in the book didn't fix that either.

Luckily I only use the VMs for testing at work.. happy to dump them and get back to my non MS OSes...

Re:"Installing the latest security patches"

[jandrese]

Leave it be. Amazingly enough, Microsoft's patching system is insanely inefficient and having it require 100% of the CPU for an hour or more to determine which patches to install is normal. It's apparently a flaw in the way the patches work that makes it take an amount of time equivalent to the exponent of the number of patches installed. Since there are a lot of patches now, that can be a very long time. Microsoft has a fix for this, but you'll have to wait through at least one incredibly slow patch cycle for it to get installed.

reference

Re:"Installing the latest security patches"

[nctritech]

I understood that all the updates have standalone installers; couldn't you install the standalone for the WUAU fix and THEN run all the other updates?

Re:"Installing the latest security patches"

[jafac]

They also eat a shitton of disk space.

Windows 7 SP1, set of windows updates, is nearly 1 gb.

Re:"Installing the latest security patches"

[nctritech]

cd \windows
for /f "tokens=*" %d in ('dir /a:dh /b $Nt*$') do rd /s /q "%d"

All update uninstallers deleted. Once XP EOL happens, you can also permanently delete \Windows\$hf_mig$ and then turn off automatic updates entirely.

Re:"Installing the latest security patches"

[wonkey_monkey]

If it's the same problem I had, installing IE8 fixes it. For some reason.

Re:"Installing the latest security patches"

[FlyHelicopters]

1GB of space is a lot in 2014?

We have different definitions of "shitton of disk space" then...

Re:"Installing the latest security patches"

[Darinbob]

Microsoft won't fix it anyway. Their business plan is to make sure that everything is vital and can't be lived without while also being incredibly annoying so that everyone upgrades when they're told.

Re:"Installing the latest security patches"

[Anonymous Coward]

In 2014 or in any year 1GB of space could very well be a shitton on a box that is still running Windows XP.

administrator accounts

[Anonymous Coward]

one tip i keep seeing is not to log in as an administrator if you don't need to. using a regular user account is fine for most uses. from what I understand, malware need administrator access to copy files and send data to remote servers. I might be wrong. also, keep anti-virus software updated.

only downside to using Windows XP is that some games and new software for home users won't run under XP

As a Web Developer

[Anonymous Coward]

I already have a day off scheduled for the 9th. I will get black out wasted drunk.

missing the point...

[Anonymous Coward]

" A lot of companies/users don't want to change because they see no additional benefit to do a costly upgrade, no reason to change a running system".

Sigh, organizations with this mentality still view IT departments as an expense instead of a strategic partner...

Re:missing the point...

[nctritech]

There's a customer of mine who still uses a Windows 2000 machine. It's not connected to the Internet and runs a rare piece of machinery, and the software can't exactly be moved to another platform. Another customer is in a similar spot except their machinery operates on a P3 with Windows 2000 for a different reason: the software works fine on 2000, but for some reason the manufacturing line occasionally moves further than it's supposed to when the software runs on XP, and that could result in dead employees. There are legitimate reasons to not move to newer platforms. The machines not being on a network and not having any storage media plugged into them largely mitigates any security concerns, though.

Re:missing the point...

[nevermindme]

If a desktop OS computer command can kill an employee you have a bigger problem than end of support. There is a reason for those wacky statements in the Licensing Agreement.

Re:missing the point...

[nctritech]

Your statement makes no sense. "A desktop OS computer" describes pretty much every single computer used to control machinery, excluding embedded systems/PLCs (which are still programmed with "desktop OS computers") and machines can kill users if they behave outside of specified parameters for whatever reason.

Take 'em offline

[browndizzle]

For many of my clients that run milling machines that still run XP, I am just making sure that they are not connected any longer. In that scenario, continuing XP is sensible and cost effective, with little to no risk. I'm sure most of the IT world is going to see the flare up of exploits that people have been hanging on to waiting for MS to no longer be willing to patch. Anyone of my other clients - law firms, non profits etc. - I am forcing the upgrade. No need to be so tied to such a clunky and difficult to recover OS anymore. Embrace the already 4 year old future, get on the update bandwagon and move on. None of my clients are seeing this as the end of the world like the media and others are describing it.

Re:Take 'em offline

[FlyHelicopters]

For offline machines that are kept for a single task, such as running an expensive machine and they do nothing else, you can generally lock them down to the point where it doesn't matter.

For general use Internet connected machines, yea, XP needs to go, and frankly, needed to go years ago.

Windows 7, for general computer use, is far superior to XP from just about every angle.

Re:Take 'em offline

[jsepeta]

there are good reasons to keep XP around in a virtual machine for running apps that won't work on newer OS's, but I fear that i won't be able to authorize XP so there will be no more fresh installs / reinstalls of XP

Re:Take 'em offline

[WuphonsReach]

there are good reasons to keep XP around in a virtual machine for running apps that won't work on newer OS's, but I fear that i won't be able to authorize XP so there will be no more fresh installs / reinstalls of XP

In other words, companies with products who rely on software that only runs in WinXP have had their head in the sand for 5+ years now.

We spent the last 5 years moving everything to web applications (that work fine across all the major browsers) and switching to open-source applications in every possible niche. I estimate that in another year, 80-90% of our desktop users could easily be switched to OS X or Linux. There's only a few remaining applications which are Windows-only.

Re:Take 'em offline

[Anonymous Coward]

Superior in taking disk space

Re:Take 'em offline

[ThatsNotPudding]

For many of my clients that run milling machines that still run XP, I am just making sure that they are not connected any longer. In that scenario, continuing XP is sensible and cost effective, with little to no risk.

Unless they also epoxy all the USB ports closed, they run the real risk of it becoming a viral reservoir, created and spread by harried machinists sneaker-netting CNC code back and forth to various machines and even home and back again after a little custom tweaking. Most machinists I know ain't overly concerned about security - nor are their smallish companies.

Re:Take 'em offline

[Anonymous Coward]

Just be sure that the USB ports, etc. aren't available as an alternative attack vector. I ran into that problem a couple of years ago after an vendor for a $500,000 piece of equipment would only support a specific patch level of XP.

Re:Take 'em offline

[Anonymous Coward]

Taking them offline will work great, but the use case of a milling machine requires users to transfer files to the machine for milling. Since the machine will be offline, they won't be able to transfer via the network, so they'll use USB sticks most likely ... that's been a notoriously easy way to transfer viruses. Make sure to disable autostart to protect yourself a little bit ... but beware

Re:Take 'em offline

[browndizzle]

I prefer the invisible force field that is packing tape when I need truly secure. However, most the machines that are there are still running serial, and not USB. If security over USB is a concern of yours you can disable them on BIOS level, Windows level, or as suggested really get to grit of it with some glue. Building security on the other hand isn't really up to the external IT guy =/ Thanks for the nightmares though, I'll be panicking about my clients issues with USB now.

Relatively safe

[JBMcB]

There hasn't been a root exploit in XP for a couple of years now, which means if you are running as a user and not root, and you know what you are doing, XP should be fairly safe.

1. Run as a regular user and only elevate permissions when you need to
2. Make sure your directory permissions are locked down properly (there are guides to help you do this)
3. Turn off all unnecessary services
4. Run a 3rd party antivirus app - BitDefender Free is excellent
5. Regularly run rootkit detectors and a second on-demand scanner (I use Trend Micro)
6. Don't use IE, use Firefox with NoScript turned on
7. Don't use Flash, Adobe Reader or Java. Use Sumatra PDF for PDF viewing.

I keep a VM of XP around for running some old apps and reading my junk email account. I've been sent virii and all sorts of junkware, and running the above config is pretty impervious to anything thrown at me. I can revert the image to it's original state if something bad happens, and I've yet to have to do that.

Re:Relatively safe

[FlyHelicopters]

You can do all that, if you know what you're doing, which 90%+ of computer users do not, nor will they EVER do that...

Upgrading to Windows 7 or 8 makes far more sense.

Just last year I managed to get my Mother off Windows XP, I simply told her that it was time and that if she wanted any further computer help from me, she had to do it, I haven't personally used XP in years and my skills in it are starting to rust and frankly I have no interest in messing with EOL support.

It was $500 to buy a brand new machine that is about 10 times faster than her old 2005 model (one of the very first Athlon X2 machines, just before the Core 2 line came out). Her new machine is a Core i5 and runs Windows 7 and runs rings around the old machine. I did spend $100 and put an SSD in for her, what a difference that makes. :)

Re:Relatively safe

[Anonymous Coward]

There hasn't been a root exploit for XP because they knew it could be patched.

People are probably sitting on a whole host of Day 1s, knowing full well that support is going to expire soon.

Re:Relatively safe

[Anonymous Coward]

s/virii/viruses/

Re:Relatively safe

[Anonymous Coward]

> BitDefender Free is excellent

BitDefender Free is DANGEROUS. It has no configuration options and automates all actions. You don't get a choice about what it does. I've had it mess up software installations because it thought part of the package was malicious, so it arbitrarily deleted it. Now imagine if it decided it didn't like a macro in that big financial spreadsheet you've been putting together...

When I realized it was BitDefender, I promptly uninstalled it and didn't look back. I would seriously use earth-enemy Norton or McAfee before using BitDefender Free.

CAPTCHA: idiotic

Re:Relatively safe

[Anonymous Coward]

There hasn't been a root exploit in XP for a couple of years now

That's because MS hasn't "released" them yet. There will be two or three critical exploits after the EOL date, at least one of which will be a remote hole. MS will, with much feigned groaning, offer "emergency" patches even though WinXP is EOL. That will ratchet up awareness, and also make MS look good for providing the emergency patches. Then there will be one that MS says cannot be fixed - "We would create another emergency patch, but it's just not possible." Yay, more sales of Win8 with the Win7 downgrade option exercised but still counted as Win8 licenses for the investors. And it's all perfectly plausible.

Or did everyone forget how it went with the Win2000 EOL?

- T

This is a small shop question.

[Anonymous Coward]

So what is the best way to secure this remaining Windows XP systems?

At a large company you pay MS for an extended service contract and life goes on as usual. It isn't like all the ATMs will never get patched again after April.

Don't Use . . .

[Anonymous Coward]

Don't use IE or Word/Office. That covers most of the exploits.

Embedded XP is going to be here for a long time

[jandrese]

We were scouring the lab here and noticed that our traffic generator had an embedded OS and it was of course XP. It took a LOT of back and forth with the vendor (whom we pay a big fat support contract to each year) to get a Win 7 disc. Apparently they don't have a plan for XP migration because they don't want to buy a ton of new license keys. This is a problem for people who can not have unpatched systems on the network. Technically the embedded edition is not going EOL yet, but we have concern about Microsoft keeping the patches flowing when the majority of the installs are no longer supported. The last thing we want is someone using one of our own network appliances as an attack vector. The printers are bad enough (they had to be vlaned--no way to properly secure them), but some of the other stuff requires real network access.

Re:Embedded XP is going to be here for a long time

[Darinbob]

Embedded operating systems are supposed to last for the life of the product. They are not intended to live and die by the whims of Microsoft or the IT support staff. Whoops; time to replace your pacemaker Mr Smith, it seems you have a 5 year old operating system and the legal department has determined that you're a security risk.

Re:Embedded XP is going to be here for a long time

[jandrese]

This is unfortunately not compatible with the security threat from a connected world. If a machine is on the network then it needs to be supported and fixable if some previously unknown security flaw is detected. You can minimize the risk with careful design and programming, but hardware manufacturers generally don't do a good job of that. This is why in places where it matters, people set up secure private networks for their embedded devices, and when they don't it is a disaster. See: Target.

2014

[Anonymous Coward]

Year of the linux desktop

Windows SteadyState

[benjymouse]

Windows SteadyState from Microsoft is available for Windows XP.

SteadyState virtualizes the OS directories transparently on the disk. File writes/updates are directed to a secluded area. You can set it to simply delete those journaled updates upon restart/signoff. Any malware will be effectively gone. Windows Update would still be possible when signing in as the SteadyState administrator (creating an updated image), but that's kind of moot at this point.

Re:Windows SteadyState

[Krishnoid]

File writes/updates are directed to a secluded area.

But what if the malware directly modifies disk sectors? Is there malware that can attack in this way?

Re:Windows SteadyState

[benjymouse]

From Steve Gibson and Leo Laporte:

Now, it's not quite as onerous in my experience as Jim's letter indicates because it does not
make an entire copy of your system partition and/or drive. Instead you set aside a block of
hard drive space. And using a feature, basically it's file system filtering, this is able to capture
any changes which are made to the system drive. And essentially it caches the changes. So, for
example, when any application, installer, literally anything you do, I mean, this thing is global.
You cannot turn it off without restarting Windows. So it's not something that just sort of easily
comes and goes. I mean, this is meant to be bulletproof.
And I discovered the hard way that it even protects the partition table, and that first track of
the drive which we were talking about recently could be prone to preboot kernel rootkits. I was
using something else that did deliberately change that first track, very much in a kernel rootkit
fashion. And that'll be the subject of an upcoming podcast because it involves performing whole
drive encryption. And it turns out that SteadyState uninstalled this thing, even though I had
SteadyState sort of in a mode where it was supposed to allow changes to be saved. So, I
mean...

Simple fix: Air gap.

[thevirtualcat]

That's what's going to happen to all the XP machines (that haven't been air gapped already) where I work.

Most of the XP holdouts are lab equipment. (Oscilloscopes, Arbitrary Waveform Generators and the like.) They were already air gapped, anyway.

There are a few machines that run old development tools needed for production. (As in factory, not web services.) They will be left connected long enough to catch the last batch of updates, then relegated to USB storage and optical media for data dransfer. (With sensible precautions, like disabling autorun, of course.)

Fortunately, those projects will not be around forever and will slowly be replaced with newer versions that run on Windows 7 and/or Ubuntu 12.04. (Maybe 14.04.)

Next on the todo list, Ubuntu Server 10.04. It's number is up soon, and that one will be a lot more obnixious to get rid of than XP was.

Re:Simple fix: Air gap.

[cognoscentus]

Of course, an air gap isn't enough to defeat all malware:

http://arstechnica.com/securit...

I guess if they have no speakers and the internal beeper is disabled, the black hats will have to find another covert channel, though. Watch out for steganographic TCP/IP-over-Osciloscope.

Re:Simple fix: Air gap.

[thevirtualcat]

Oh, crap. That must be why there's a camera crudely duct taped to every oscilloscope we've ever ordered. We were given strict instructions to NEVER EVER EVER remove them for ANY REASON EVER because the were EXTRMELY CRITICAL to the operation!

Re:Simple fix: Air gap.

[Anonymous Coward]

Of course, an air gap isn't enough to defeat all malware:

http://arstechnica.com/securit...

I guess if they have no speakers and the internal beeper is disabled, the black hats will have to find another covert channel, though. Watch out for steganographic TCP/IP-over-Osciloscope.

This has been debunked in several places.

Re:Simple fix: Air gap.

[Anonymous Coward]

While you should always do testing first, the in place upgrade from Ubuntu Server 10.04 to 12.04 isn't actually that bad. I've found that it's mainly the desktop packages that get royally messed up with upgrades.
At least it's easy to backup and restore a Linux system. When I was in a similar situation with a really old version of ubuntu server, it was trivial to copy the OS over to a VM, make a snapshot, and then test out how difficult the upgrade process to an actually supported version would be.

Honestly, I think the biggest problem for most places is that they set up boxes and then forget. As boring as it is, setting out life cycle management and testing, along with good documentation and config management will really save a lot of time, headaches, and money down the road.

Captcha: funded

Block 'em all

[Amorymeltzer]

I work in a lab in a large research university, and they are taking it very seriously. All of our lab machines are being swapped out for Windows 7 - a non-trivial task given some of the individual software for certain lab machines is... clunky at best. Any computer that must stay running XP (because the instrument's software requires it) will be removed from the network. Personally, I only run XP (for said lab purposes) in VirtualBox, completely cut off from the web. There has even been serious discussion amongst school administrators to proactively block any machine running XP from even connecting to the school's network. Drastic, perhaps, but I can understand it from their point of view.

Re:Block 'em all

[FlyHelicopters]

If I was a University Network admin, that is my first thought, simply refuse access to any OS that is EOL, such as XP.

So long as everyone knows this, it makes life easier.

Vista will EOL in a few years, when it does, any machine still running that needs to upgrade, but thankfully going to 7 is pretty easy. :)

It's all the lifecycle....

[Anonymous Coward]

A vast majority of people have moved away from XP due to the natural IT lifecycle - hardware breaking and replacement machines coming with newer operating systems and newer versions of software only working on Vista/7/8. Even Vista is starting to show its age with Microsoft's decision not to let Office 2013 support Vista - so that's a lot of your customer base etc already sorted.

There's always going to be an "overlap", as such, there's no real way of convicing people off something they see no benefit in replacing - the same reason why people drive battered old cars. If it works, why replace it...? The natural lifecycle will denote these products, like anything else, will be replaced when the owner deems them fit to be replaced - when they're not fit for purpose any more.

A lot of people have been chastitsing MS for their decision not to support XP anymore, which they are well within their rights to withdraw support for a product now >13 years old. Shouldn't some of the blame for XP's continual use be shifted onto the third party software developers who kept XP support in their products going for such a long time?

you can do better than that

[dirtyhippie]

don't use firefox. don't use any browser at all. if you need a browser, you need windows 7. sorry to burst your bubble, but anything else is going to be dangerous. you should be getting rid of any potential vector for badness (any software, particularly software that is known to touch the internet) altogether.

Re:you can do better than that

[nctritech]

"Any potential vector for badness" includes all software that exists.

Re:you can do better than that

[Twinbee]

SOG aka - shades of grey. The risk is a continuum, not a binary state.

Re:you can do better than that

[nmr_andrew]

you should be getting rid of any potential vector for badness (any software, particularly software that is known to touch the internet) altogether.

While you have a point, how do you suggest data get moved on and off that old PC? SFTP/SCP touch the internet. USB sticks are a potential attack vector. We can restrict access to only computers on the LAN that lives behind the firewall, but our other computers have to be able to get outside in order for us to do work, which means that our LAN could in theory get compromised.

Re:you can do better than that

[Waccoon]

If there's a vulnerability in your web browser, it really doesn't matter what OS you use.

Zero budget. You can't be helped .. yet.

[Sloppy]

they see no additional benefit to do a costly upgrade, no reason to change a running system .. So what is the best way to secure this remaining Windows XP systems?

Don't. Don't secure it. Just let the chips fall where they may. Failure is an option, and you've presented things such that it's the best option.

Before you reply with "that's crazy" (or "that's lazy") let me remind you, that you there's "no .. benefit" to being more secure, and "no reason" to worry about the consequences. The submission has already stated that solving the security problem has zero value. So why are you working on it? Just let it go. Security is a don't-care condition. Every hour spent on it, is an hour wasted for no benefit.

If you change your mind about it being a don't-care condition, then you open the door to upgrading to a maintainable OS. But you can't do that, until you decide that upgrading does have benefits, and there is reason to change a running system.

So .. have you changed your mind? Are you still sure there's no benefit to an upgrade and no reason to change a running system? Or have you realized that's TOTALLY FUCKING ABSURD yet? Because I think once you realize that it's TOTALLY FUCKING ABSURD then you're going to see some options appear.

Why I am still using XP

[Anonymous Coward]

Why am I, a software developer, still using XP on my primary workstation? The only realistic upgrade path is to purchase a new computer.

in place upgrade of XP->Win7 is not reliable, if it works at all. And the licensing DRM on all software I use will ensure that it is impossible even if Microsoft made it easy to upgrade. So everytime this comes up, I look at all the software I have to manually delicense and relicense (assuming the software even allows that), or purchase upgrades since it doesn't fully work under Win7, and I say fuck it. Days of time and $$$ for absolutely no real benefit. As I've gotten older, my increasingly rare downtime has become far too precious for this bullshit.

So why don't I just buy a new machine? Circumstances ( a blown motherboard) forced my to upgrade my current workstation a couple years ago without upgrading the OS and apps (needed to get back working asap). So I have a modern machine running XP which should last me for a few more years.

No applications ...

[golodh]

Because, as will be understood by anyone but the most naive hobbyist, the cost of switching applications for a few million boxes is enormous.

Counter to what some people seem to think, running XP isn't an end in itself. In the real world you run XP in order to run certain applications, right? Applications that typically won't run on Linux (closed-source Windows-only stuff) and may not even run on Windows-7.

Besides upgrading would be really expensive. Ripping out several million boxes, reformatting they disks, installing Linux, dealing with a substantial percentage of cases where the hardware breaks when you unplug them or on which the more recent kernels won't run is very expensive. So expensive in fact that the license cost for a Windows copy will be completely dwarfed by the cost of handling the hardware and installing Linux.

By the time you're done installing the OS you'll find your troubles are only beginning. You'll find that your old applications (that you built into your business) won't function anymore. You might be able to write one single application for ATM's that runs on Linux or or a more recent version of Windows but you won't have time to test that thoroughly (enough) and you'll replicate that application millions of time. Good luck! For ordinary office machines you'll be facing a big bill in reinstalling all the old packages and even more (training !) if you decide to upgrade the applications too. And then you can watch your office performance sag as everyone starts learning their way around the new apps.

Chances are you'll lose a lot more money handling, migrating, training, and pushing updates to all those millions of boxes than dealing with any security problems that may start to arise in the next two years.

That, in a nutshell, is why it makes financial sense to just isolate the, shortly very vulnerable, XP boxes behind firewalls than to upgrade them.

In fact I think you might even be able to insure yourself against cost of problems when you continue using XP at a rate that's much lower than the cost of migrating.

Re:No applications ...

[Anonymous Coward]

We fooled them the first time it should not be hard to fool them a second time upgrading PCs...how hard could it be!

Stockin' up

[Tablizer]

Twinkies, tents, double-barrel'er, and water jugs

Anyone else just a bit slightly worried?

[GoodNewsJimDotCom]

The virus writers who have been holding back XP payload might have vectors that also hit Vista/7/8. With all the juicy XP targets to compromise, they can do more effective random IP address attacks like the days when XP Service Pack 2 wasn't around. So I'm not totally concerned, but just a little bit concerned that this could hose more than just the XP installations.

Not a problem at all

[Gim Tom]

End of support for XP is no real problem at all! Just downgrade to Windows 2000! It doesn't even need activation!

Forever?

[mx b]

I see this response a lot, and I completely understand it. Business needs what it needs, and so if it doesn't see a need to update, it won't. Got it. Perfectly. Crystal Clear.

But an honest question: What happens to that 100k database (maybe 200k in the future?) 5,10,20 years from now, when the computer it runs on breaks and you can't get replacement parts for that old motherboard. When Windows 98 does not have drivers for the hardware being made. When the database grows so large that the HDD in your Windows 98 box can't even handle it. When Windows 98 can't keep up with the network speeds and standards of the future that are required to stay competitive. When the install medium itself gets scratched too many types and stops reading.

I don't feel like I've EVER seen any contingency plan for this. The excuse is always "You're out of touch, business needs to run older systems". Again, I agree and understand. But at some point, maybe not soon, but at some point it WILL stop working, or at the very least, it's age hampers the budget more than helps.

Is there a plan to at least move to VMs to try to preserve the software a little more? (Maybe you are already using the VMs). Are there good backups for the VMs? Can the VMs access the USB ports and what not for your devices? How many of your devices use old ports that don't even come on any computer sold in the past 10 years?

While I understand the reasons for not upgrading immediately (or not even quickly), 15-20 years seems excessive, and I start to think this is a failure of business leaders more so than a misunderstanding of technical people.

Re:Forever?

[blue9steel]

It's pretty simple really:

If cost of upgrade > (benefits + risk) then the upgrade won't be done. (Risk being chance of problems times cost if problems occur)

In most organization what will likely happen instead is that you'll take a good backup and perhaps virtualize or sandbox the system in question.

Of course some bad organizations ignore the risk part of the equation which leads to poor decisions about replacement timelines.

Re:Forever?

[Anonymous Coward]

" What happens to that 100k database (maybe 200k in the future?) 5,10,20 years from now, when the computer it runs on breaks and you can't get replacement parts for that old motherboard. When Windows 98 does not have drivers for the hardware being made"

You do what we've done for the past ~7 years. Run Windows98 as a virtual machine under VMWare. We're only using hardware that 98 doesn't have driver for. It doesn't matter, as long as the host virtualizing OS does. Parallel port hardware dongle? No problem. USB hardware dongle? No problem.

As for install media. We have backups of backups. And so many backups of the virtual machines, I doubt we will ever touch the install media.

Business leaders sometimes don't have much choice in fields where there is specialty software that regulatory bodies like the FDA have certified, and needs to be used. Not every business has the financial option of writing their own from scratch and getting it through every regulatory hurdle. If the choice is using proprietary software you might have to jump through some hoops to keep running, or be out of business, using the proprietary stuff will win every time.

Re:Forever?

[multimediavt]

http://tech.slashdot.org/comme...

Re:Forever?

[bitflip]

If you have a problem, you call the vendor.

There's hundred of thousands, sometimes millions of dollars on the line. It's their problem, they fix it.

Re:Forever?

[Agent0013]

Worrying about what is going to happen in 15-20 years can simply be a waste of time as the business might not even be around then. Plenty of businesses fail, but even just selling it to some larger company puts the problem out of your worry just as well. I have noticed that it sometimes seems that things that should be upgraded or improved aren't, but when you look at it in this light it might be a good policy. Never do anything that isn't necessary right now as it might not even be needed or be your problem later.

Re:Forever?

[Anonymous Coward]

The excuse is always "You're out of touch, business needs to run older systems".That's why you see most of the top management driving 1980's BMWs, Mercedes, and Cadillacs.

Wrong.

[Cammi]

Ummm no. Most people will not change because here is literally no upgrades available.

Running an Ubuntu Installfest at the local library

[gQuigs]

I'll trying to get an Installfest setup at the local library to help XP users migrate to Ubuntu.

This entire discussion sounds exactly like...

[Anonymous Coward]

*** One Giant Major F**cking HUMUNGUS OPPORTUNITY For Every Tech in the world! ***

Now tell me you can't find a gig!

Go For it, guys!

Preparing for Windows XP EOL?

[aynoknman]

That's easy:

fromdos *.txt

"Captain, Iceberg dead-ahead!"

[Culture20]

"What's our iceberg preparedness response again?"

not all bad

[Dale512]

We have a system running Win98 at the office. It is not on the network. The only thing it does is controls the door system. To get the updated software supported by a more current OS would cost $5k. It just isn't worth the headache right now. I did talk them into running on a current machine and we just use a virtual Win98 environment to do the software bits. Overall it is still pointless since the machine isn't on any network. Eventually we'll upgrade the whole door lock system but until then that virtual Win98 environment will get the job done.

No problem, you are your best support

[Anonymous Coward]

Still using DOS, Win98, and OS 7 to support thousands in legacy hardware (vendor did not port their applications to newer OS's) These OS's are not networked and used only for supporting the older hardware. Sure, it would be nice to move the old equipment out to pasture, but it still works.

You can keep an old OS going by keeping working backups, accepting limited functionality, not being attached to an external network, accepting that new peripherals are not supported, using best practices, monitoring your system, and being ready to do your own repairs.

Some may be surprised but companies still sell new copies of DOS programs, for niche markets. Just add your 386 box from ebay. XP will just continue the trend.

Re:No problem, you are your best support

[Blaskowicz]

DOS is also very easy to run on arbitrary hardware. Boot it ; done. That was easy! You don't even need a hard drive or floppy anymore as it will run from flash, USB and other options.
On latest hardware you probably have to turn BIOS emulation on in the UEFI setup.

Also try...

[Anonymous Coward]

http://www.peerblock.com/ plus lists from https://www.iblocklist.com/lists.php (and custom lists of your own...I have 249 lists active right now, almost all from iblocklist.com. Since there's no need for my computer to receive or send data to/from China, Russia, etc., it now cannot.)
http://winhelp2002.mvps.org/hosts.htm
http://www.safer-networking.org/business/
Security Compliance Manager and the rest of "Tools & Downloads", along with regularly checking "Read the latest advisories" under "More Tasks" at http://technet.microsoft.com/en-us/security/bb291012
http://technet.microsoft.com/library/cc700810.aspx (How to Configure Memory Protection in Windows XP SP2, from years ago)
Disable IIS, Remote Registry, Routing and Remote Access, Net Meeting, and SSDP discovery service if you do not need them.

puppy linux

[crazyprogrammer]

for casual web browsing/listening to music on my XP machine I'll boot to puppy linux on a usb drive. Whenever I need to run something in Windows I'll just boot into XP after unplugging the ethernet cable.

oh the language, it editors

[richlv]

or something.

i just came here to make fun of "this remaining ... systems" :)

Banned, as of today.

[funwithBSD]

Word came down today that running any XP images is a security violation.

Security violations are potentially an immediate termination offense.

Company support is overrated

[MXB2001]

I still use my 1982 Atari 800. Atari doesn't exist anymore. So what?

Re:Microsoft ( Score: +5, Dicely )

[CohibaVancouver]

When has Microsoft supported its products?

I ran Windows Update on my XP box last night. Seemed to work fine. So I guess the answer to your question is "yesterday."

Industrial Equipment

[labnet]

We have Surface Mount Asembly Equipment that runs Windows NT4 and Windows 2000.
Suprisingly, it all still networks OK. (But of course on its own isolated subnet)

There is ZERO chance any of this industrial equimpent will ever have an OS update.

Re:Industrial Equipment

[thsths]

And that is exactly the reason for not upgrading: it is not possible. Upgrading means throwing away a perfectly fine machine, and that is just not on.

Of course this is a culture clash. A Windows 98 computer can be attacked by a virus, and turned into a virus / spam distribution machine or worse.

To get a car analogy: that is pretty much a were-car. In an engineering world that would just not be imaginable, because physical safety is actually taken seriously. But for some reasons computer scientists keep telling us that "software has bugs, get used to it".

Cars just have bugs, sometimes they will try to run you over, get used to it. Yeah, right.

just like y2k

[Anonymous Coward]

The real concern is remote exploits. I doubt we'll see any that aren't fixed by running with the firewall enabled. So really, this is all a lot of press about an issue that's going to turn out to be a non-event.

Relatively safe

[Anonymous Coward]

If I had an XP exploit, I'd just sit on it until it goes EoL. It's worth more when you can use it with impunity and not worry about it being patched.

Huh?

[wxjones]

What is this "Windows" of which you speak?

Antivirus

[Chewbacon]

My employer is planning on falling back to antivirus for defense. I work at a hospital with thousands of workstations almost all of which are XP. While I don't do any real browsing at work other than following weather in the event it's severe or big news stories, many people do and lack the "common sense" antivirus suite in their head.

They will have to extend it...

[Sir Holo]

The UCLA Medical System, a gigantic organization, required all hospitals, providers, etc. to standardize on a single, integrated medical record-keeping system. Medical history, diagnoses, prescriptions, appointments — the works. This was within the last 12 months.

It runs on XP.

Happy privacy!

Bummer

[sgt scrub]

I've been dreading having to roll that big'ass barrel of unused XP CD's out the door. That thing is freakin heavy.

Good Point

[Anonymous Coward]

One popular choice among enterprises which use systems for manufacturing or one reason or another must remain on XP would be to use Whitelisting. Application Control or whitelisting does the job of AV and more by blocking execution of anything new that is not on the white list.

Run it in a true VM

[Chirs]

With the parallel port on the host passed through to the guest.

Re:Run it in a true VM

[dbIII]

Some "protection" dongle software uses annoying tricks that VMs don't emulate the hardware well enough for yet. One trick that was fixed with some VM software was ensuring that the parallel port was at exactly the same memory address but there are other tricks from evil bastards such as macrovision that are there merely to punish the honest that haven't gone for a full crack.
One solution a lot of vendors allow is to keep one real XP machine as a licence server and then the virtual machines check out from that. There's some very low end mini pc devices that use very little power, have parallel ports, a network port and can run XP.
So you've got a vunerable POS sitting exposed on your network for anyone to play with if they get in? Why is one more a problem when kiddies can mess around with vunerable VoIP phones and all the rest where vendors think their company name is a good password?

Re:Run it in a true VM

[FlyHelicopters]

It will take real losses and lawsuits that follow those losses before those vendors change their tune.

The old "dongles" need to go away, they go out of date faster than the hardware they run on, sooner or later someone with big pockets is going to suffer a loss traced to such a thing and turn around and sue their vendor.

Lawyers have a funny way of making things move.

Or run it in a VM

[Chirs]

And keep your old working code.

can always use VMs

[Chirs]

Copy the current machine as a VM and backup the image somewhere. When the current hardware dies, run the VM on something newer.

Re:can always use VMs

[FlyHelicopters]

VMs don't always work, some hardware demands direct access.

Hardware security keys being but one example...

Re: can always use VMs

[Anonymous Coward]

Access to hardware can be spoofed effectively. For USB keys: http://www.digi.com/products/usb/anywhereusb

Re:can always use VMs

[Anonymous Coward]

Use a better virtualization host. We have serial, parallel, and USB security key dongles all running on virtual machines. Windows 95 through XP. No issues.

Re:can always use VMs

[Anonymous Coward]

Using VMWare.

not gonna prep at all

[Anonymous Coward]

I'm not gonna prep at all.

I'm just gonna let the damn machines fucking die.

If people don't want to upgrade; fuck-em.

Just format the C: drive, install Ubuntu

[Anonymous Coward]

Just format the C: drive, install Ubuntu (instead of calling it C:\ or something else from 1960, you can call it something like /data (why C: ? why not "homedrive" or something more descriptive?). If you are being abandoned by a company you paid money to, then consider where you spend your money. Or not. Its your money, if you are happy/blissful being abandoned and insist that they are the only one, then go ahead and expect to keep having to pay to have a system that doesn't fall down unless you pay for a new version every few years. Pay and pay and pay; have fun with that.

ReactOS has sterted countdown

[jeditobe]

Looks like they finnaly have a sponsor http://community.reactos.org/?...

Cold spares until entire system is retired

[dbIII]

when the computer it runs on breaks and you can't get replacement parts for that old motherboard. When Windows 98 does not have drivers for the hardware being made.

Haven't hit that yet - take a look at the drivers on some install disks some time. For when we do hit it there is the option of cold spares. For example I got about 10 Sunblade 5 machines second hand not very many years ago to act as spares for antiquated data aquisition systems - and I can see people on the PC side of things doing similar things. It may not be an ideal solution, but it is a solution of a kind which can keep things going until other components reach a point where they can be replaced (eg. the example I gave above is being phased out).

XP gonna be sabatoged?

[Anonymous Coward]

I'd stop getting updates fo XP right now. The ethics challenged folk over at MicroShoddy will probably be putting defects into the final updates to make sure that the XP stops working sometime after the D-Day to propell numerous customers into having to buy those new OS versions.

So save yourself some trouble (as if they (MicroShoddy) have been wasting their profits fixing anything real on XP now or for the recent past...)

So a guess is better than "reality"

[dbIII]

plan and save for replacing it with another desktop in 5-7 years because that's reality

Rubbish. For many requirements the cycle is much shorter, some incremental and some longer. An arbitrary number is not "reality" no matter what bold type and capitals you use to pretend your opinion is some sort of fact.
Also with enough spare machines you can pretend machines are going to run forever and just replace them when you need something quicker. If it dies most people can put up with something slower for a day or two until something with better specs than could be justified with a rapid replacement cycle or standard PCs purchased in bulk every 3, 5 whatever years. More work in budgeting but a job isn't there to make it easy for the person doing it.

I've got some people using pretty old stuff with a new video card, an SSD and 3 screens - to them it's like having a new computer but with XP and all their old apps still on it. Others might have had a machine that maxed out at 8GB two years ago, so they got a machine that can take 16GB last year and looking at 32GB now - putting an arbitrary date on these things instead of considering usability is IMHO wrong (with capitals, bold and a lot of exclamation marks if you wish).

There HAVE been XP privilege escalations recently

[Sits]

It's not entirely clear what you mean when you say "root exploit" but one interpretation is an exploit that when run as a regular user gives you administrator/root permissions. There have definitely been recent XP privilege escalations exploits for XP recently (e.g. CVE-2013-5065 leverages a bug in NDProxy).

Perhaps you meant "remote exploit" but also last year there was CVE-2013-3175 malformed asynchronous RPC request so another machine can attack your XP machine over the network with no user intervention. See this table of 2013 Windows XP CVE entries for a list of what MS have been patching...

If you are no longer able to keep your OS regularly patched it's no longer safe and you are better off using something else for online activities. Save XP for those appliances that have to use it and can be stringently firewalled/quarantined.

Maybe because of that longevity

[dbIII]

The XP users I know have a large menagerie of applications they've collected over a decade or more with very few that will run in Win7. Migration is a matter of replacing a pile of stuff and learning to do things in a new way instead of the quick ways they know from years of use. While current hardware still supports their platform the XP mode virtual machine in Win7 looks like utter crap in comparison and Virtualbox not much better (athough I have a few people on Win7 using that just to run some old AutoDesk software from before they fucked up the interface).
Then there's the stuff locked to hardware that won't run Win7.

To sum up, there's no point people moving unless they get some sort of benefit out of what they move to. More memory that XP can handle was the no brainer for a lot of us, but for some tasks 2-3GB is plenty leaving some people with no problems with the platform.

I think in the future I'll probably end up with people running Win7 (or 9 if it isn't shit) to run MS Office+firefox and for just about everything else they'll VNC to an XP virtual machine on something quick and almost live in that space. People who have been using the same stuff for a decade+ don't want a replacement from a different vendor with a crap metro or ribbon front end, they want the app that they can operate without thinking much about it.

Re:Maybe because of that longevity

[UltraZelda64]

All I got out of that was, "blah blah blah, been using it for a decade, don't want to change." Tough. Maybe I should mention that I was using Windows since Windows 95 (first computer: 1997), so when I finally pulled the plug in 2006 it was not a light move. I had dozens of programs that I was so used to I felt almost as if I couldn't function without them. The landscape was slightly different back then, but yet eerily similar to what people are dealing with these days... just replace a couple OS names and the stories could probably be interchanged. The only difference is, the Linux world is lightyears away from even where it was when I first used it. NTFS-3G? Hah, highly experimental. X11? It was only beginning to truly get simplified. Now it's mostly a cakewalk, I really don't see much room for excuse. Either put up with Microsoft's shit, or get up and do something about it. It's as simple as that.

Then you manage that specific problem ...

[golodh]

ATM's don't need a browser, so in those cases your comment is irrelevant.

For other kinds boxes, just remove the browser and tell people to surf using their tablet or the shared machine down the hall.

Those whose work absolutely requires them to use a browser you can provide with more modern boxes.

Still way cheaper than replacing every single XP box.

This reminds me of...

[Anonymous Coward]

A society which wants privacy in public places and doesn't allow street photographers to take photos of people without permission and publish or sell them as fine art or as photojournalism doesn't deserve to run Windows XP. -- Sofia Koutsouveli

Layoffs did it too

[dbIII]

Often this happens because the original creator of the software has gone out of business or it is too expensive to upgrade

The idea of "let's fire the developers and outsource to India" idea has been going on for a while and left us with a lot of orphened software that only works on XP.
There's a bit of it in the *nix world too, hence a pile of stuff that can't be moved beyond RHEL5 (and for one spectacular piece of shit that needs an old flexlm, Redhat7.2).

no more OS changes means potentially more secure

[LodCrappo]

Since we can assume XP will never change once support is over, can't we then do new things to secure it that were impractical in the past?
Hard coded file checks, read only filesystems, out of band checks and so on.. It wouldn't take much to install Linux on a USB key and have it check the local HDD or even just overwrite the OS files at boot, and that's just the first idea that comes to mind. Maybe a bios that won't boot if any of the xp boot files are changed, etc. I'm not saying it's ideal, but it seems like a once moving target is now static, so maybe that can be leveraged to create some safety, especially for the types of systems that are required to continue using XP (I.e. not consumer desktops).

One Possible Solution

[Anonymous Coward]

One of the local technical schools used software called "Deep Freeze" to lock down the computers. Once the computer is set in a "frozen" state, any changes since the last reboot are lost. So in theory, if you did get a virus on your XP machine after EOL, a reboot would remove it. Extra steps are needed to "thaw" the computer to make changes that will carry across reboots. I do not work for the school or the company that makes Deep Freeze. There are alternatives available also that perform similar functions that you could find with a web search.

Lock-in

[mariox19]

I just left a job where we produced POS and back office software for specialty retailers and saw the same thing. The lock-in is just incredible when you're running a nationwide chain with X-number of registers. I think a customer was running Windows 98 on a box with 128 MB of RAM. In fact, if anything you worry about customers looking to upgrade, because if they're going to have to spend all the money to buy new hardware, they're going to reevaluate their software as well, and perhaps choose another vendor.

My email to management

[Anonymous Coward]

After reading comments in this article I wrote up the following to my managment. In my enterprise we have some expensive hardware that is running on XP. We've just been planning to pull them from the network, but the options below were considerations for the XP computers we just could not replace without great expense (>$50,000 each). Please excuse my formatting, pasted in.

I’ve been giving thought as to what we should do to continue to support XP computers that cannot be replaced before XP EOL.

The idea is to turn these computers from our “normal idea of a PC” into an appliance. By locking down these stations we can make them such that they only do one thing: produce the work as intended in a safe manner.

Configuration Description:
Windows steady state installed/configured
EMET (?) Enhanced Mitigation Experience Toolkit (v4)
o This newer tech is designed to close the methods used in application exploits targeting this platform
o This option is listed for technical completeness, but it is expected that it would cause more problems than it would solve
o This option would be in the case where an appliance required access to Java JRE and a public internet site
Does such a scenario exist for us?

Separate VLAN for appliance PCs
o No access outside LAN (no internet)
o Access to file server
o Access only to required resources

Ghost backup of each machine
o Ghost image
required for easy cloning
Disk clone for restoring a system with replacement disk to take place on separate 'ghost image appliance' PC as USB/CDROM/DVD disabled on target PCs
Per machine replacement plans in writing for each appliance

o Planning for modern replacements
o Planning for repair in the event of failure

File server access
o XP has exclusive write to only one shared folder on server
o XP has NO read access for any other folder shares
o Regular VLANS have read only access to above file share

Preventative steps
o Power supply replacements (or availability)
o Hard disk diagnostics (SMART check, disk integrity check)
o Hard disk replacements (or availability)
Cold-swap cloned disks available in computer for highest priority appliances

Lockdown steps
o Disable unused hardware (ex: FireWire)
o Disable CD/DVD, USB, floppy (no sneakernet)
o BIOS admin, access passwords set

Experience description
From a cold boot
Cannot access BIOS setup without password, even to view settings
Boot into Windows XP
o F8 modes still available
Domain logon still used
o Domain controllers must be accessible on XP VLAN
Appliance software runs
Users have no admin rights
o unless required by app, must be documented, explicitly requires SteadyState
Users cannot make changes to configuration
o changes reset at reboot (via SteadyState)
Users cannot access internet
o no VLAN access to internet
o no HTTP access to internal or external resources
Users may write to one area on file server for this appliance's work files to be uploaded, no read access to any other area
o No read access to other areas means that the only file server data accessible is the data that this machine creates
o Example: an XP computer running a special app would have one specific folder available as a mapped drive, no other read access to any

ATMs are running XP Embedded

[suss]

XP Embedded's support doesn't end when XP does.

Windows XP Embedded (Toolkit and Runtime), all versions - January 12, 2016

From https://www.microsoft.com/wind...

You can't.

[Kimomaru]

It's foolish to try and secure XP after its support ends. So much logic is thrown out the window with this idea. Try to remember that Windows XP was designed and released around the the time of the Tech Boom/Bust. A pretty different technical environment. That it's still being used is, in a way, a testament to Microsoft's dedication to it, but after twelve years - I mean, geeze, who runs the same OS for twelve years? Do you still play games on a Sega Dreamcast? Ok, that's a bad example, even I still play games on a Sega Dreamcast. But that's an entirely different era by tech standards. The larger problem you may be dealing with is that Microsoft can basically pull support when it likes and if your shop doesn't like it, you should focus on alternatives. If you're going to be a Microsoft Shop, you should adjust your upgrade budget and IT Shop's priorities appropriately, not try to keep using XP and O/S2 Warp and Windows Me because the change is too (understandably) painful.

hate to burst your bubble

[Anonymous Coward]

Doubtful, hardware has a finite lifetime and parts fail. Companies literally will not have the hardware to repair it because the chipsets will no longer support it and are no longer being made. Within the next 5 years or so they will need to upgrade whether they like it or not unless your company is absurdly lucky. My company was planning on sticking with XP until we realized the hardware was no longer available, now they are scrambling to get Windows 7 and Linux running on our devices.

Say what?

[fuzznutz]

I'm not even sure what your "salient" point is. We have a $250,000 research NMR with a computer controlling it running XP. The upgrade to use Windows 7 requires a $50,000 investment in new hardware. We don't have that kind of money just hiding in the cracks of the sofa. That NMR doesn't stop running just because Microsoft is tired of playing with XP.

I have one researcher still using Windows 95 on a semiconductor test instrument. That's not getting upgraded either. The cost to "fix/recover" is much cheaper than upgrading. We keep spare drives and drive images and all data is copied off the machine. My biggest concern is replacing a bad motherboard and finding drivers that run the older OS.

Simply slapping a new fresh install of Win8.1 on a research instrument controller is not always an easy or cheap thing to do. Not everybody is just using their computer to surf the web and check email.

Re:no more OS changes means potentially more secur

[terrab0t]

Someone mentioned it above. There is software called Windows Steadystate that keeps the base file system unwritable to regular users and instead lets them write changes to a journaled file system that can be selectively restored from the base.

What Industry are you in?

[Anonymous Coward]

What Industry are you in? It sounds to me like $1M and a couple of young engineers could take a run at your business and take you out in 12 months. No no, don't update, upgrade or for gods sake please don't innovate.

Re:What Industry are you in?

[I'm New Around Here]

You seriously think his company has no competitors? And no competitors that are young and have shit for brains like yourself? There's probably been dozens that have used your business method and failed because they couldn't handle the upgrade cycle of MS Office, let alone the operating system.

Putz.

You see where you went wrong, right?

[Anonymous Coward]

"... and you know what you are doing ..."
#kneeslap
#headdesk

Home use

[brunnegd]

Slashdot readers are much more sophisticated than the average home user, who only uses a computer for e-mail, social media, and web surfing. Why should they be expected to pay good money for a new computer, or to upgrade from XP and install all of the necessary drivers, hardware, etc.

Really....

[Anonymous Coward]

That's an example of abusing your equipment without properly maintaining it. Given the amount of product that vehicle moved, keeping the transmission maintained and throwing a new starter in it would've be such a small fraction of it's overall net cost as to be negligable.

Additionally, it's a 1937, that's just a sweet old ride, especially as a 2 ton truck :)

Know when to abandon ship - The Ship USS Microsoft

[Anonymous Coward]

Yes, you can hobble along, using MS XP for a bit longer. But soon you will start to be frustrated by the lack of driver support for your new (future) hardware devices. Really, make computer life easy for yourself. Switch to some flavor of Linux. I switched on a 100% use basis after Win 98 was dumped. I have never regretted the switch. All my old data files were easily transferrable. With easy-to-use Linux versions such as Mint and Ubuntu you can stay with a GUI-only operating environment if you choose. They are a far sight easier to use than Win 8 and the price is right. ~ VillageElder

Re:Running an Ubuntu Installfest at the local libr

[Anonymous Coward]

That sounds like a good-citizen thing to do. Introduce others to a better way of computing life. ~ VillageElder [See my additional comments below]

You're all missing the point

[Anonymous Coward]

If the OS was bug free, none of this would be an issue. Oh.... but that's too hard, right?

Is upgrade to win7 a fix?

[jago25_98]

Is an upgrade to Win7 in these kinds of situations really any fix? Likelihood is that we'll see the same situation come round again in a few years time.

Sometimes it's possible to skip a whole stage, for example, NT to Win7.

That's the logic anyway, for people who don't trust the upgrade cycle, usually burnt from vendor lock-in.