Registry Hack Enables Continued Updates For Windows XP

DroidJason1 (3589319) writes "A registry workaround, which tricks Windows Update into thinking you are running Windows Embedded POSReady 2009, allows you to get free security updates until 2019. All you need is a simple 32bit or 64bit registry entry in order to make this work. POSReady 2009 is slated to receive security updates for another five years. Microsoft ended support for Windows XP on April 8th of 2014."

Comments

Excellent

[kefkahax]

Get it while it's good. There's quite a few critical security updates.

Re:Excellent

[Anonymous Coward]

three i only see three

Re:Excellent

[Anonymous Coward]

THERE ARE FOUR UPDATES!!!

Re:Excellent

[ArcadeMan]

I wonder how many people will get that reference.

Re:Excellent

[Anonymous Coward]

The episode aired 22 years ago, average age of Slashdotters is 14, so none.

Re:Excellent

[barlevg]

This is much funnier if you assume that ArcadeMan is all three ACs in this thread.

Re:Excellent

[Zocalo]

Even the older Slashdotters have a blinkered view of culture it seems. The original reference is from George Orwell's "1984", only it was fingers and not lights.

Re:Excellent

[Anonymous Coward]

'Well, there's you and me, plus the parent, plus the parent of that ..etc. So.; at least five :)

Re:Excellent

[ArcadeMan]

I'm not.

I'm also scared by the fact that this was aired 22 years ago.

Re:Excellent

[barlevg]

The new Battlestar Galactica began airing ten years ago.

9/11 was 13 years ago.

The Lion King was 20 years ago.

Face it: we're old.

Re:Excellent

[Anonymous Coward]

The reference is obviously not to the original work. Winston didn't do quite as much shouting as Picard.

Re:Excellent

[Anonymous Coward]

Having just re-read 1984 recently, I still didn't catch it until I saw your post ... ... posting anonymously for shame.

Re:Excellent

[Skuld-Chan]

I think if your a company that relies on XP (not the POS edition) and you haven't isolated them on a special - no internet vlan - you have bigger issues than making sure your XP machine has security updates.

Re:Excellent

[craigminah]

First thing I thought of was that Buggs Bunny episode where Buggs is trying to put the fourth candle into a big child's cake to get rid of him...the candle is a stick of dynamite and Buggs is saying "your four" but the child keeps saying "duh...I'm only three...doi"...good episode...

Re:Excellent

[uCallHimDrJ0NES]

Although I got the 1984 reference, I have no idea what ST:TNG you're talking about. I've still only seen two seasons. http://www.smbc-comics.com/ind...

Re:Excellent

[uCallHimDrJ0NES]

There's a new Battlestar Galactica? Disney came out with their Kimba movie starring Matthew Broderick? Wow, the future is AWESOME! Did they bring back Dr. Who?

Re:Excellent

[Anonymous Coward]

Wow, you'll be devastated when Picard is assimilated.

Re:Excellent

[Anonymous Coward]

THERE ARE FOUR UPDATES!!!

THIS IS NOT BATTLESTAR GALACTICA.. THIS is a quote from STAR TREK by the GREAT Patrick Stewart..

THERE ARE FOUR LIGHTS!!!!!!

Romulan Interrogator: there are 3 lights

Picard: THere... are... FOUR LIGHTS!!!

Re:Excellent

[93 Escort Wagon]

I think if your a company that relies on XP (not the POS edition) and you haven't isolated them on a special - no internet vlan - you have bigger issues than making sure your XP machine has security updates.

I thought all editions of Windows XP deserved the monicker POS?

(Note to the humor-impaired: Chill out, dude. At least I'm not making jokes about your pretend girlfriend, right?)

Re:Excellent

[I'm New Around Here]

I wouldn't be. I only saw two episodes, and both were bad in a ridiculous way. I can't even see a still-shot from that series and think it was serious Star Trek.

FYI: I grew up in the 1970s, watching reruns of the original Star Trek. All the newer series seem lesser to me.

Re:Excellent

[Anonymous Coward]

Not Romulan. Cardassian interrogator, played by the great David Warner.

Re:Excellent

[Anonymous Coward]

And how does the The Animated Series from the 1970s make you feel?

Re:Excellent

[camperdave]

It was a Cardassian, and he was trying to get Picard to say five lights.

Sheesh!

Re:Excellent

[Anonymous Coward]

People born when the original Toy Story was released are legal now.

Re:Excellent

[QuantumLeaper]

Cardassian Interrogator, NOT Romulan. Unless you believe there are three lights...

Re:Excellent

[Anonymous Coward]

By lesser, you mean fewer muppets, right?

Re:Excellent

[avgjoe62]

If you can, watch The Inner Light. It is about the only episode of ST:TNG I will watch whenever it is available.

Re:Excellent

[spire3661]

TNG has some utterly fantastic moral explorations you shouldn't just dismiss. The Drumhead (TNG), In the Pale Moonlight(DS9), The Measure of a Man (TNG) are all brilliant.

Re:Excellent

[Anonymous Coward]

The original reference is from George Orwell's "1984", only it was fingers and not lights.

... so in other words, the version that mentions lights is in fact a reference to Star Trek, not 1984.

Re:Excellent

[I'm New Around Here]

I'll watch it and see how I like it.

Re:Excellent

[I'm New Around Here]

I'll watch these, plus the one avgjoe62 listed, and see how they are.

I'm assuming I can find them somewhere online.

Re:Excellent

[spire3661]

Netflix has all of these.

Re:Excellent

[viperidaenz]

A Kardashian interrogator??

Re:Excellent

[fahrbot-bot]

I thought all editions of Windows XP deserved the monicker POS?

(Note to the humor-impaired: Chill out, dude. At least I'm not making jokes about your pretend girlfriend, right?)

My pretend girlfriend runs Windows XP - sigh.

Re:Excellent

[Anonymous Coward]

Thanks for spoiling my evening.

Re:Excellent

[Anonymous Coward]

Add The Hunted (TNG), Tin Man (TNG), The Best of Both Worlds (TNG), The Wounded (TNG), The Inner Light (TNG), Chain of Command (TNG), The Chase (TNG), The Visitor (DSN), Hard Time (DSN), Far Beyond the Stars (DSN) and The Sound of Her Voice (DSN)

The Pegasus (TNG), Homefront (DSN) and Paradise Lost (DSN) are relevant to what the US government is trying to get away with today.

I warn everyone away from the absolute garbage that is "Voyager". "Enterprise" has some OK episodes, so long as you skip most the third season (all of that Xindi crap).

Re:Excellent

[Anonymous Coward]

lol, TOS. what a joke

Re:Excellent

[Guspaz]

If you were born before 1992, you were born closer to the first moon landing than today.

Re:Excellent

[Cytotoxic]

And if you remember watching the first moon landing.....

Re:Excellent

[Chelloveck]

I was born closer to the first moon landing than to today. That's because I was born on the other side of it. Hell, I was born closer to WWII than to today. And in another year I'll be able to say that about WWI.

Kids. Get off my lawn.

Re:Excellent

[UnknownSoldier]

Oh, please, some of were ~20 when that episode aired. Hell, I've been on /. for ~14 years.

http://en.wikipedia.org/wiki/C...

Re:Excellent

[Billlagr]

Or unless your company has paid out the extra cash to Microsoft for extended support..

Re:Excellent

[Anonymous Coward]

mY pretend girlfriend IS Windows XP

Re:Excellent

[Penguinisto]

So, umm, what if you were born before Apollo 11 launched?

You. My Lawn. Remove Thyself.

Re:Excellent

[I'm New Around Here]

lol, TOS. what a joke

If it was produced today, yes. But back in the 1960s, it was groundbreaking in many ways. If you are too immature to realize that, it's not my fault.

Re:Excellent

[mmell]

I guess remembering Star Trek, Lost in Space, and Land of the Giants fixes my age at just slightly less than dirt, eh?

Now you kids get offa my lawn - I wanna go watch Matlock!

Re:Excellent

[CTU]

I am more then 22 years old and I am only unsure if I got the refrence. If this was a ref to TNG then yes I got it, if not then I got no idea.

Re:Excellent

[Anonymous Coward]

A Kardashian interrogator??

If it were one of those there was definetly 5 lights. The pain the pain make it stop!

Re:Excellent

[johanw]

Yes, and new hard SF series are hardly produced anymore. After the premature cancellation of Stargate Universe it died more or lesss out. :-( (and no, swords and dagger fantasy, while entertaining, is NOT hard SF).

Re:Excellent

[Anonymous Coward]

I did, the proud nerd that I am. +1 obscurity points.

Re:Excellent

[Anonymous Coward]

Um, would having them an a "special no internet vlan" preclude you from allowing them to update? They still have to be update eligible to pull patches from WSUS or the like.

Re:Excellent

[Anonymous Coward]

I was born closer to the first moon landing than to today. That's because I was born on the other side of it. Hell, I was born closer to WWII than to today. And in another year I'll be able to say that about WWI.

Kids. Get off my lawn.

Can't, that's where my bunker is.

Re:Excellent

[JackieBrown]

I blame SGU for killing SF series too. Boy was that an awful show.

It would have been better to have just started a new SF universe than trying to trick fans (and then whining about those same fans) into thinking that this was going to be another Stargate like show - sure they used stargates, but that could have been substituted for any telaportation device. The biggest mistake is they started with characters that were in the same emotionally bitter and exhausted state as BSG, but without the years of buildup that BSG took to get the characters there.

Re:Excellent

[Anonymous Coward]

If course - there is nothing more scary :)

Re:Excellent

[Anonymous Coward]

Stop, Dave.
Please stop, Dave.
I feel old.

Re:Excellent

[operagost]

No; I'M OLD, Captain seven-digit-ID.

Re:Excellent

[CaptSlaq]

There's a new Battlestar Galactica? Disney came out with their Kimba movie starring Matthew Broderick? Wow, the future is AWESOME! Did they bring back Dr. Who?

They call it Dr. Who, but it's not nearly as campy or funny.

Re:Excellent

[Anonymous Coward]

If you are in your 40s and feeling old, all you need to do to feel young again is go to church. They refer to 40-somethings as "kids" there.

Pick a nice mainline church though. The fundamentalist churches are crazy.

Re:Excellent

[halltk1983]

That song is burned into my soul.

Re:Excellent

[cellocgw]

I thought all editions of Windows XP deserved the monicker POS?

(Note to the humor-impaired: Chill out, dude. At least I'm not making jokes about your pretend girlfriend, right?)

My pretend girlfriend runs ON Windows XP - sigh.

FTFY (smirk)

Re:Excellent

[MrNiceguy_KS]

Most of the Kardashians are about 3 additional cosmetic surgeries away from being indistinguishable from Cardassians.

Re:Excellent

[MrNiceguy_KS]

mY pretend girlfriend IS Windows XP

Virus-ridden, goes down regularly?

Re:Excellent

[viperidaenz]

I didn't realise Cardassians' had disproportionately large butts.

Re: Excellent

[Xman73x]

Old? Your considered in my book teens, I'm over 25 and I won't go into details, but it is what it is.

Re: Excellent

[Anonymous Coward]

Another year and I'll be able to say it about the Civil War.

Re: Excellent

[Anonymous Coward]

More THAN! It's more THAN, not then, you fool.

Re:Excellent

[david_thornley]

Frighteningly, my birthday is closer to the Spanish-American War than it is to today. Yay Teddy and the Rough Riders!

Re:Excellent

[Skuld-Chan]

Internal WSUS - duh...

Re:Excellent

[cwsumner]

I remember the Howdy Doody show on TV. I remember Brillcream... and used it. I graduated highschool before the moon landing.

I have -shoes- older than you !! 8-b

He,He...
And get off of my lawn.

Re:Excellent

[Areyoukiddingme]

It was a Cardassian, and he was trying to get Picard to say five lights.

Oh great, now it's five?

What could possiblyæ

[Anonymous Coward]

go wrong?ÃÃÃ

Re:What could possiblyæ

[Joe_Dragon]

a BSOD

Re:What could possiblyæ

[Stumbles]

That's normal.

Re:What could possiblyæ

[Anonymous Coward]

The 1990s called, they want their joke back.

Re:What could possiblyæ

[Anonymous Coward]

Your employer called and suggests you make your shilling a little less obvious.

Are you kidding me?

[ArcadeMan]

There's something called "Windows Embedded Piece Of Shit Ready 2009"?

Re:Are you kidding me?

[Anonymous Coward]

I know you're making a joke, but I believe in this context "POS" stands for "Point Of Sale" - basically cash registers.

The fact that cash registers running Windows XP are still getting updates is probably a good thing. That someone thought making a cash register run WindowsXP was a good idea scares me, though.

Re:Are you kidding me?

[Anonymous Coward]

You're an idiot.

Re:Are you kidding me?

[fuzzyfuzzyfungus]

Unfortunately, in the case of a lot of point of sale systems, the acronym does double duty. At least they are surprisingly expensive.

Re:Are you kidding me?

[Anonymous Coward]

Its XP embedded I have built embedded images for year if don'e right you can strip these guys pretty clean making them fast, secure* & stable* as well as target your system to only use specified hardware with this flexibility it allows one to make very quick to boot.

*if done right lots of testing needed.

Re:Are you kidding me?

[Anonymous Coward]

Have you ever had to deal with cash register software?

Piece of Shit Ready is being optimistic.

Re:Are you kidding me?

[Anonymous Coward]

Understanding sarcasm for what it is... LOL

Re:Are you kidding me?

[Anonymous Coward]

Considering how full of holes Linux based home routers turn out to be, do you think Linux based cash registers would be any better than XP cash registers? I am just flabbergasted that cash registers are on networks with internet access.

Re:Are you kidding me?

[sjames]

That someone thought making a cash register run WindowsXP was a good idea scares me, though.

And justifies the dual meaning of POS :-)

Re:Are you kidding me?

[sjames]

He said duty.

Re:Are you kidding me?

[ArcadeMan]

Cash registers have to be on networks these days. But on the Internet? Not a good idea.

If necessary, it should be POS -> server -> Internet.

Re:Are you kidding me?

[Anonymous Coward]

There's something called "Windows Embedded Piece Of Shit Ready 2009"?
Hey! That's called "Windows Embedded Pile Of Shit Ready 2009".
FTFY

Re:Are you kidding me?

[ArcadeMan]

Not according to Wikipedia. :p

Re:Are you kidding me?

[Brett Buck]

This is forced by "Truth in Advertising" laws.

Re:Are you kidding me?

[barlevg]

That still counts as "on-the-internet" (unless you somehow have a dedicate line going from the POS to the server), so you're plenty vulnerable to spoofing and man-in-the-middle attacks.

Re:Are you kidding me?

[xeoron]

One place I do tech work for have POS's that require Net access because part of the services link into API's for UPS, FexEx, and USPS for realtime transactions. The POS software and shipping software get updates regularly, whether it be bug fixes, feature improvements, or shipping rates updates. The POS, also, can links into a noreply email to send people invoices and tracking. Safe guards: being placed on a separate isolated network from the main one, strict firewall settings, intrusion detection, and a good host file. CCs are not processed on them at all, since there are handled by dedicated machines from merchant services on a dedicated landline.

Re:Are you kidding me?

[future assassin]

Yes they are pretty expensive my current one ACE Retail was around $1400 for one computer. I looked at oithers and the prices were insane if you wanted anything not DOS looking like. I did go with ACE as this is what I was use to for the previous 4 years but its amazing how the same bugs have been in the system for the last 6 years and old bugs just pop up out of the blue even though they were suppose to be fixed.

I now have found a Linux based POS http://linuxcanada.com/ that seems quite good and will be testing it out shortly

Re:Are you kidding me?

[TechyImmigrant]

>Unfortunately, in the case of a lot of point of sale systems, the acronym does double duty. At least they are surprisingly expensive.

I wrote a POS for my wife's yarn store. I named it the "POSPOS".
 

Re:Are you kidding me?

[wiredlogic]

Yep. They also have POSfor.NET library for interfacing with barcode scanners, scales, and receipt printers. Suffice to say it is also a huge, unreliable Piece Of Shit.

Re:Are you kidding me?

[Anonymous Coward]

duty means poop

Re:Are you kidding me?

[The Snowman]

Considering how full of holes Linux based home routers turn out to be, do you think Linux based cash registers would be any better than XP cash registers? I am just flabbergasted that cash registers are on networks with internet access.

Up until a few months ago I worked for a Retail Point of Sale company for more than seven years as a developer. The typical topology goes something like this. Each store has a cable or DSL modem to get to the internet. They have it locked down so the only way in or out is through a VPN to the home office. This essentially gives them LAN access to shared resources such as centralized databases (this is why you can return at a store other than the one where you bought something, or check another store's inventory), payment system gateways, etc. This is a heavily secured and audited network segment due to the sensitive nature of the data. Any "regular" internet access from a register goes through that VPN and a firewall at the home office. Browsers are locked down on each register and regularly patched and updated remotely. They will sometimes use a whitelist of sites, sometimes not: JavaScript and other "features" are typically restricted as much as feasible.

This system works really well, despite having a lot of pieces geographically scattered. The VPN makes it easy to connect to any register in a retail chain since it is essentially a LAN. With the VPN and firewalls, you have a distributed yet secured network. The only times I have ever seen a network intrusion at any customer of my former employer was due to human error: a network technician forgetting to set something up right despite numerous checklists and test environments. Pretty rare in my experience working with 30+ retail customers.

Re:Are you kidding me?

[Anonymous Coward]

unless you somehow have a dedicate line going from the POS to the server

Man, if only people could figure out how to make those packets follow along lines drawn over the floor and around walls instead of flying invisibly through the air where anyone could catch them... oh wait, that's called ethernet.

Re:Are you kidding me?

[cusco]

I always like RKeeper's (large Moscow-based POS system) quick-and-dirty solution: make all the POS machines use NetBEUI. Can't route, the only way to get to the machines from outside is through remote controlling the server.

Re:Are you kidding me?

[mysidia]

That still counts as "on-the-internet" (unless you somehow have a dedicate line going from the POS to the server), so you're plenty vulnerable to spoofing and man-in-the-middle attacks.

There's this thing called a VLAN.

You can use a dedicated Layer 3 switch for your POS network. Setup a Private VLAN (PVLAN) to carry your POS network.
Setup a private promiscuous VLAN for your switch to perform L3 routing on.
Setup a private Isolated VLAN (PVLAN Isolated) for your POS terminals, and enable local Proxy-Arp on your isolated PVLANs.
Place your server on a Server VLAN.

Enable 802.1x wired port security for your POS ports.

Configure routing between your POS Subnet and your POS server's dedicated Subnet. Set it up with Route-maps or ACLs such that; every POS can talk to the server, and the server can talk to any POS terminal, but no two POS can speak to each other, and no other IP address can speak to a POS or the server.

No default route in the routing table of this Layer 3 switch.

No internet connectivity necessary.

Re:Are you kidding me?

[Hognoxious]

I've dealt with the output from them. Horrid. It was a while ago, but IIRC correctly it went like this: because the accursed things have so little storage everything is "compressed", and they were all designed before interwebs were invented so it has to keep the whole shift's crap in there. But not compressed like with gzip, no no no, because it hasn't the CPU or RAM to do that. It's just that every indicator (that tells you if it's a sale or return, or if it's meat or dairy or shoes or flammable or radioactive or whatever) is one char if you're lucky, and because there aren't that many chars to go round they all have multiple meanings that depend on each other.

Like JSON but with less readable tags and no punctuation and written in one unholy block with no fucking whitespace, why the hell would you want that already? Torture.

Still, look on the bright side - at least it didn't use fucking unicode.

Re:Are you kidding me?

[viperidaenz]

Some cash registers need to be on the internet. It's how they process electronic payments. Modern eftpos terminals don't use dial-up connections anymore.

Re:Are you kidding me?

[viperidaenz]

ethernet... those twisted pair cables than can be tapped and intercepted without detection?

Re:Are you kidding me?

[viperidaenz]

No internet connectivity necessary.

No electronic payments can be processed.

Re:Are you kidding me?

[mysidia]

POS's that require Net access because part of the services link into API's for UPS, FexEx, and USPS for realtime transactions.

You don't actually need full Net access for that.

The recommendation here is that you have a proxy server; that the applications required to use these services are configured with. The proxy server should only allow the required URLs.

In some cases, the individual applications can be configured with a unique client-side SSL certificate, username, and password with which to access the proxy server.

The firewall that the POS terminals are behind will then only allow an outbound connection to the proxy server in the middle.

The separate outer firewall that the outside interface of the proxy server is behind, will only allow an outbound connection from the proxy server's outside IP address.

Re:Are you kidding me?

[dcsmith]

Some cash registers need to be on the internet. It's how they process electronic payments. Modern eftpos terminals don't use dial-up connections anymore.

I gave the counter guy at my mechanic a strange look the other day when he processed my payment via credit card and I heard the modem dial out. He rolled his eyes and said, "Yeah, they 'upgraded' us last week. More secure because it doesn't have to go over the Internet."

Re:Are you kidding me?

[mysidia]

No electronic payments can be processed.

Sure they can. Via dedicated proxy server sandwiched between two firewalls that allows HTTP, but to only the payment processor's URL. As discussed in my other post.

Re:Are you kidding me?

[sumdumass]

Https...

Anyways, i agree and have set up CC payment systems specifically like that. Except one system failed using a proxy so i had to lock the routers into the specific IP address of the processor and forbid http traffic because the suit kept defaulting to it with every update and transmitting in plain text.

Needless to say, i had a long talk with one of their developers and CEO and the company i was working for eventually switched packages altogether.

Re:Are you kidding me?

[viperidaenz]

You can't restrict the URL, just the host name.
Unless you want to forego HTTPS...

Re:Are you kidding me?

[Khyber]

"That someone thought making a cash register run WindowsXP was a good idea scares me, though."

I've had no problems with the four XP-based machines I've used as POS systems.

Never needed to reboot, hardware issues got left to me to fix since I typically lived right around the corner so could grab a spare piece of XP-compatible hardware and toss it in and be back in business within a smoke break.

Re:Are you kidding me?

[BitZtream]

Yes, its pretty easy actually. It does require physical access for a couple minutes, but if they run in the plenum its trivial to do it without getting caught. Take me less than 5 minutes to put your ethernet cable on a nicely hidden wireless link for sniffing, though the wireless link wouldn't keep up if you were burning data at a high rate of speed constantly. I could also just break your data off to another ethernet cable as well. I can add a tap in less than 5 minutes. If it has to work for an extended period of time and power isn't readily available (which it generally isn't available as an outlet in the plenum or subfloor/basement, then I might need a half an hour to wire up an outlet.

Tapping ethernet is trivial to say the least.

Unless you're using 802.1x, but lets face it, if you're not aware of how easy it is to tap an ethernet connection in almost every building on the planet, 802.1x isn't going to be something you know much about either.

Re:Are you kidding me?

[Anonymous Coward]

One of our internal networks uses IPX.

Re:Are you kidding me?

[mysidia]

You can't restrict the URL, just the host name. Unless you want to forego HTTPS...

It depends.... HTTPS security is abysmal. We all know (or should know) very well by now, approximately how massive the number of subtle flaws there are likely to be in the SSL protocol, not to mention the known weaknesses.

End to end IPsec would be a better idea than HTTPS (Not that I am recommending end-to-end ipsec).

Ideally the POS would transmit an encrypted HTTP payload. With a random symmetric key sent encrypted with the processors' public key.

And then the payload digitally signed with the POS terminal's secret key.

And inside that HTTPs packet; the actual payment details would have been already pre-encrypted by the card reader into a fixed-length binary blob, and neither the POS workstation nor the server have the ability to decrypt.

In this case, non-HTTPS may very well be preferrable, so the proxy can further verify that what is being sent is conformant --- possibly, even validating the digital signature, before allowing the message..

Re:Are you kidding me?

[Jack Griffin]

Which is how we did it when I was in retail. Store network is private, behind firewall with no internet access, only to dedicated server on dedicated ports. These servers proxy any outside requests, out through a perimeter firewall. Sure it might not be NSA secure, but it works for a small shop with very low resources.

Re:Are you kidding me?

[Jack Griffin]

Ours was similar but there was no need for direct Internet access at the POS. Anything such as payment systems were proxied through head office, so there is no direct link. When the need finally arose for the online store to be available in-store, we put it on an iPad with 3G, completely separate from the POS. Golden rule was never ever allow the POS access to the Internet.

Re:Are you kidding me?

[Anonymous Coward]

Viewed from another perspective, every time I would replace a frame relay or fractional T1 at a retail store with DSL or cable the question always came up: WILL THIS SPEED UP OUR INTERNET ACCESS?

Re:Are you kidding me?

[Anonymous Coward]

define "can't"

Re:Are you kidding me?

[cusco]

NetBEUI is a transport-level protocol. Routing happens at the network level.

Re:Are you kidding me?

[adolf]

Are you saying I can't transmit Ethernet frames over the Internet?

Re:Are you kidding me?

[Anonymous Coward]

Cash registers have to be on networks these days. But on the Internet? Not a good idea.

If necessary, it should be POS -> server -> Internet.

The internet connection is used to communicate with:
-The credit card merchant for transaction processing
-National inventory databases for stock control, shipping, purchasing
-Payroll processors
-Off site backup
-Etc.

It's not as crazy as it sounds. Generally speaking there's nothing at the store level which will respond to outside communication attempts, and connections are done via some type of VPN tunnel. You rarely see direct internet access from the POS terminal itself, in most topologies they run a LAN with one device in the back room acting as a local server/gateway/firewall. Although some small business single-machine solutions would have direct access on them.

Re:Are you kidding me?

[jones_supa]

and a good host file

Facepalm.

Re:Are you kidding me?

[X0563511]

... or offload SSL to the proxy, or use distinct SSL sessions between both sides. Client and Proxy trust each others certs, Proxy and upstream Server trust theirs.

Re:Are you kidding me?

[X0563511]

VFI's "Point" would be right up your alley.

You talk to the device to tell it to do things, and it tells you results. POS however never touches the card data - that is handled in the device and a remote gateway.

Re:Are you kidding me?

[Anonymous Coward]

he said double duty

Re:Are you kidding me?

[cusco]

No, I'm saying you can't use the NBT protocol to transmit over the Internet. There's no routing information so your router has nowhere to forward it to beyond itself. Go ahead and remove TCP/IP and install NetBEUI on your network card and try it. You can't get there from here.

Re:Are you kidding me?

[Anonymous Coward]

Heh-heh, heh-heh, heh-heh.... cool.

Re:Are you kidding me?

[CaptnZilog]

That still counts as "on-the-internet" (unless you somehow have a dedicate line going from the POS to the server), so you're plenty vulnerable to spoofing and man-in-the-middle attacks.

Um, no, what he described is a local network -> server -> internet connection. As long as the POS network is 'in house' only and on it's own switch, with one connection from that switch to the server, then a separate NIC on the server going to another switch with the internet (router/firewall hopefully between) side should be ok. ... of course, that means your server better be protected, firewall setup properly to block anything incoming, etc, but unless you specifically have the server setup to route between two separate NIC's on it, should be safe as long as the server itself stays safe. And, well, if you can't figure out how to have a couple POS terminals setup isolated from another network, then you shouldn't be having anything to do with configuring a network.

Re:Are you kidding me?

[CaptnZilog]

Seriously, if your physical security is so poor that people can tap into your ethernet cabling, then you shouldn't be in charge of any kind of IT security. (And since the POS is probably taking CC data in and sending it to the server for authentication (?), it really should be an encrypted connection to the server anyways). Hell, if your security is that poor why bother with tapping the ethernet cable, you could just pop a couple screws and open the POS register itself and install some hardware/software to wifi the data out. ... though, I do realize that what I just said means most stores I've seen shouldn't be using any IT, since most of the POS registers I've seen have exposed wires hanging off the back. So I really hope the data going to their server is encrypted. :-P

Re:Are you kidding me?

[viperidaenz]

As long as you're fine getting your own PCI compliance for your setup handling credit card information, instead of piggy backing off the system you already bought because you've changed how it handles data.

Re:Are you kidding me?

[X0563511]

I know of several large retailers who have had no qualms about doing exactly that.

(in a past life, I worked in processing industry)

Re:Are you kidding me?

[david_thornley]

Physical security in retail areas is always going to be crap, since the whole point of the store is allowing people in to wander around. The register area is going to be more monitored, so it's probably going to be a lot easier to tap into the ethernet (normally running from the front of the store to the back) than to hack a register.

Re:Are you kidding me?

[adolf]

That's a bad security model in that it relies on the assumption that the local network is physically secure, which is never a good assumption to make.

NetBEUI over the Internet impossible? What are you going to tell me next, that I can't watch TV over the Internet either because the IP doesn't know how to deal with ATSC?

A small SBC running OpenVPN in tap mode will work just fine in a "it's not a router, it's an Ethernet bridge!" sort of way. And...done: NetBEUI, over the Internet, with every bit of untraceable clusterfuck that NetBEUI ever had.

And all you might notice is one or two new MAC addresses lurking around.....if the attacker is sloppy AND if you're paying attention. Which you aren't, or you'd realize that the model is unsound to begin with.

are the people still running XP

[ganjadude]

and who dont have a support contract (example medical and banks) the kinds of people who actually do updates anyway? or are they most likely pirated versions of XP?? also if one did this on a legal version of windows, would microsoft consider it a breech of the TOS? I havent been using XP in a number of years now but im not sure how useful this registry hack is going to be in real world scenarios

Re:are the people still running XP

[mrbester]

My having to make sure sites still work in IE 7 didn't magically stop in April because my clients still run XP with support contracts (though I bet not all of them do).

Re:are the people still running XP

[ganjadude]

if you are testing I assume you are using a VM that is not talking to other machines on the network. Security updates should have nothing to do with that if configured correctly

Re:are the people still running XP

[sillybilly]

I'm using xp too, still thinking about going back to windows 2000 when I'm fully off the internet, when everything on it gets DRM'd and your save buttons are gone, etc, but I have never in my life willingly would use windows update, even download managers for programs where you can't download the whole 50MB program, just some tiny 500 KB downloader/installer, that does the install for you, scare me, as they can upload all your private stuff, and you may get used to the program and will not be able to reinstall it later, it's better not to even get hooked on stuff like that.. I'll take a downloadable 200 MB service pack, that I can store on disk and reinstall in 50 years, but even that reluctantly, as I know it's full of new ways to screw me, like new trojan backdoors and ways to kill off the last non-dotnet version zonealarm, or at least fuck with it, which right now successfully smacks ctfmon, and also igfxsrvc and igfxtray on the head whenever they try to run, as those must be the ways the built in subliminal wifi intel chipset remote control/access ties into my operating system software, to download/modify files on my computer through the OS.. does my computer have a virus or trojan horse backdoor in it? hell yeah, it says right on the packaging, it's called "Intel Inside" though why they don't implement direct disk access and file system drivers in the chipset itself without going through the OS is beyond me.. there are still other things that run and snoop on me anyway, like some undeletable program_files/xerox and /frontpage folders, so when I logon with linux and place a dummy file with those names on the computer so a folder with the same name cannot be created, i find i have to keep reinstalling the OS, from an hp restore cd, and it takes like 8 friggin hours for XP to install plus add/remove all the garbage software bogging the computer down, when with lighthouse puppy 4.1.2rc1 all you gotta do is erase or simply move your personal file, and voila, you got a fresh OS install on a reboot..and all the later versions of lighthouse pup are fucked..

Re:are the people still running XP

[dargaud]

I develop on Linux, and for when I need Windows I use XP in a virtual machine. Plenty good enough for only runnign an IDE. Today I had to touch Win7 for the first time because one of my apps wouldn't install. It felt like being raped by Fisher Price.

Re:are the people still running XP

[Anonymous Coward]

Yes.

Because driver support for things like musical equipment and old SCSI devices often didn't get updated or supported after XP.

I have a fairly expensive SCSI scanner that can handle poster sized sheets but the only software I can find for it runs in XP. I have 3 Windows 7 boxes and one XP, and I'll keep running XP until I can get all my devices off it (MIDI controllers, instrument packages, old scanner, etc)

It's not my fault these old components have no driver upgrade path, so I'm stuck with one XP box probably until I upgrade about $5k worth of stuff that just works

Re:are the people still running XP

[YrWrstNtmr]

It felt like being raped by Fisher Price.

Comparisons to Fisher Price was one of the main initial complaints about XP.

Re:are the people still running XP

[Hognoxious]

XP looked Fisher Price by default, but you could turn that off.

Win 7 behaves Fisher Price and AFAIK you can't do shit about it. Other than installing Linux ...

Re:are the people still running XP

[Anonymous Coward]

If you think WIn7 is that bad...

Man, you haven't seen Win8 yet, do you ?

Re:are the people still running XP

[Manfre]

http://www.modern.ie/en-us/vir...

Get the vista VM with IE 7. There is no excuse for still using XP.

Re:are the people still running XP

[Khyber]

XP and 2000 have been around long enough that if you don't know how to modify/hack it by now, you should give up.

Re:are the people still running XP

[PRMan]

Wait till you try Windows 8... It's like being GANGraped by Fisher Price.

Re:are the people still running XP

[rubycodez]

Windows 8 is like being raped by AOL circa 1996

Re:are the people still running XP

[Anonymous Coward]

Have you tried Vista/Windows 7 running x86 instead of x64? I thought that non-video-card drivers were generally compatible with Vista/7.

Re:are the people still running XP

[Jack Griffin]

I think IOS has clear title when any comparison is made to Fisher Price

Re:are the people still running XP

[jawtheshark]

Have you checked out VueScan? Works with an amazing range of scanners.

Re:are the people still running XP

[PIC16F628]

I have set my Win 7 to show Win98/Win2000 style UI - No more toy UI for me. No rounded buttons, no rounded windows. No additional software installation needed to get this done.
    a) set Win 7 Theme to Windows Classic
    b) Click on the desktop | CTRL+ Scroll mouse wheel down to reduce the desktop icons to desired size
    c) In Control Panel | Performance Information & Tools | Adjust Visual Effects, select Custom and uncheck the following:
        Animate controls and elements inside windows. This removes the undesirable sliding selection box in excel. It will now jump like it does in XP
        NOTE - 'Use visual styles on windows and buttons MUST be checked OFF for XP theme to be retained, as otherwise even though we have chosen Classic theme, the visual effects setting will bring the Win7 stlye windows and Taskbar!

Re:are the people still running XP

[mrbester]

Then you're not using what the client uses. You can't get away with a "works for me / unreproducible" response if you aren't using the same setup.

Re:are the people still running XP

[Anonymous Coward]

I was running XP on my personal PC up until mid February of this year*, and yes I am the kind of person who updates. If I was still running XP then this hack would be something I'd certainly try.

*I was planning to migrate to Windows 7 before Windows XP support ended. I was not looking forward to doing this but figured I might as well bite the bullet. Then my motherboard died and forced migration before I had made all my preparations. And that sucked and made a lot more work for me.

Re:are the people still running XP

[Hognoxious]

I don't have a win 7 machine to hand, the one I did have decided to die so I can't try what you said.

Can I [right?] click on the icon for the LAN connection, then "status" and see what IP it's got? Because I remember that didn't work.

I did specifically mention behaviour but you talk about appearance ... would you happen to be one of those UX berks by any chance? They generally don't know the difference.

Re:are the people still running XP

[Hognoxious]

Oh, I have. Mrs Hog is after a new lappie. Even playing with the sodding thing (the computer, not her) in the shop for five minutes gave me nightmares.

In the meantime I let her use my T40 stinkpad (running Backtrack Linux - it's Ubuntu with a bag on the side) and she had rather less trouble with it than I hoped.

Re:are the people still running XP

[yuhong]

Screenshot of the Visual Effects dialog: http://i.imgur.com/fNQJjxX.png

This act is highly illegal

[Anonymous Coward]

Don't do it. Do Not Do It.

Re:This act is highly illegal

[kimvette]

what's the difference between highly illegal, and illegal? Besides, what is so illegal about changing a registry key or value, or creating a registry key?

Re:This act is highly illegal

[Anonymous Coward]

Felony vs. misdemeanor. ;)

Re:This act is highly illegal

[TWX]

What's illegal about it? Is it illegal to use Microsoft's provided tools to edit my registry, browing to HKEY_LOCAL_MACHINE\SYSTEM\WPA, then creating a new key called PosReady, then creating a new dword in PosReady called "Installed" with a value of 00000001?

Digital:Convergence had much more claim to the cuecat scanner's security than this could ever command.

Re:This act is highly illegal

[gstoddart]

what is so illegal about changing a registry key or value, or creating a registry key?

In the loosest possible interpretation I can think of (and not one I agree with), you are committing fraud by misrepresenting something in order to get a good or a service.

But, if it's something as trivial as a registry key, which is available for users to update (and which sometimes MS themselves suggest) ... then I've got nothing.

I'm having a hard time believing it's perfectly legal to update one set of registry keys, while being illegal to update another. If they're so special and secret, they shouldn't be something you can update.

Re:This act is highly illegal

[fuzzyfuzzyfungus]

I'm honestly a bit surprised that MS didn't bother to tie point-of-sale status to XP's license authentication mechanism, even in some relatively trivial way.

They were certainly willing to do that with some updates (anything where good old 'Windows Genuine Advantage' popped up) and, while the suitably motivated generally bypassed that without too much trouble, I imagine that that sort of wicked, wicked, circumvention made their legal position markedly less pleasant if MS wished to push the issue.

If it's just a registry key, no ties to the activation system at all, the situation starts to look a lot more like spoofing a browser UA to encourage the server to send you the version of the page it sends to some different browser.

Re:This act is highly illegal

[Bob9113]

What's illegal about it? Is it illegal to use Microsoft's provided tools to edit my registry, browing to HKEY_LOCAL_MACHINE\SYSTEM\WPA, then creating a new key called PosReady, then creating a new dword in PosReady called "Installed" with a value of 00000001?

See Aaron Swartz: Federal prosecutors later charged him with two counts of wire fraud and 11 violations of the Computer Fraud and Abuse Act,[12] carrying a cumulative maximum penalty of $1 million in fines, 35 years in prison, asset forfeiture, restitution and supervised release.[13]

Re:This act is highly illegal

[CurryCamel]

What's illegal about it? Is it illegal to use Microsoft's provided tools to edit my registry

... to get a service you don't have a license for. How is that not illegal?

Re:This act is highly illegal

[NoNonAlphaCharsHere]

Yeah. "Felony Registry Hack" will get you 10 to 20.

Re:This act is highly illegal

[InfiniteBlaze]

Changing the key is not illegal. Using that change to access data which Microsoft has explicitly deemed outside your legal access IS illegal.

Re:This act is highly illegal

[Jmc23]

It'll void your warranty and then you won't be able to get anymore security updates!!

Re:This act is highly illegal

[TWX]

If it's outside my legal access, then why does typing in eighteen plain-text keystrokes give me access to it?

If Microsoft didn't want updates to work between different products, then shouldn't those different products have been actually differentiated in their compiled executable files or libraries to make simple maintenance not provide a mechanism to do this?

Re:This act is highly illegal

[TubeSteak]

I'm having a hard time believing it's perfectly legal to update one set of registry keys, while being illegal to update another. If they're so special and secret, they shouldn't be something you can update.

Since Microsoft offers paid updates for WinXP (at least for corporate customers),
it's not very hard to argue that the registry hack (at least for corporate customers) would qualify as theft of service.

For non-corporate users, Microsoft could argue "unauthorized access," but I can't see them taking the trouble to sue random home users.

Re:This act is highly illegal

[TWX]

I'm actually surprised that there isn't something else checking versioning in the compiled stuff that can't be readily changed. That it's a registry entry blows my mind. That's so lazy on their part that I have zero sympathy for them if people extend support for their OSes this way.

Re:This act is highly illegal

[thestuckmud]

What's illegal about it?

"Whoever ... knowingly and with intent to defraud, accesses a protected computer ... exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value ... shall be punished ..." - CFAA (18 USC 1030).

That's what. (Disclaimer: IANAL and therefore don't know what I am talking about).

Re:This act is highly illegal

[GNious]

Perhaps they can include an "update" to WindowsPOS(?) that is not an issue for POSes, but detrimental in non-POS use-cases?

Re:This act is highly illegal

[gstoddart]

That it's a registry entry blows my mind. That's so lazy on their part that I have zero sympathy for them

You know, some of us have felt this way about the registry as long as it's been around.

It has always seemed like a cheap hack done by lazy people.

It's not secure or safe, it has always been subject to corruption and hacks, and looks like something which was grafted on by someone under time constraints that once it was in the wild they couldn't get away from.

Re:This act is highly illegal

[Anonymous Coward]

it's like the difference between "sex" and "anal sex".

Re:This act is highly illegal

[fph il quozientatore]

what is so illegal about changing a registry key or value, or creating a registry key?

What is so illegal about changing 0 to 1 and 1 to 0?

Re:This act is highly illegal

[Anonymous Coward]

"If it's outside my legal access, then why does typing in eighteen plain-text keystrokes give me access to it?"

Well you just go Google some child porn up and see how long it takes you to find out that typing in some plain text shit on your computer can indeed get you into a shit load of trouble. (Hate child porn but it's a good example in this case.)

After all you just typed it in and it was plain text and you got access to it... Why is that illegal?

The issue is your changing a key that grants you access to something you where not intended to get and didn't buy.

To put it bluntly it is theft.

Now excuse me while I go play all my ROM's and cracked copies of games acquired from "sources" lol

Re:This act is highly illegal

[Anonymous Coward]

How many keystrokes would be enough in your opinion to distinguish between legal and illegal access? Ease of access shouldn't make a difference in my opinion, and I hope it generally doesn't in the eyes of the law either.

If you know about the registry change you also know that you'll be getting updates you don't have a valid license for. So the criminal intent is clearly there.

Now if I was still using XP (which I'm very glad I'm not) I probably would try this too, but I wouldn't try to convince myself that I was somehow in the right because it's only 18 keystrokes.

Re:This act is highly illegal

[I'm New Around Here]

But whose anus?

Re:This act is highly illegal

[BilI_the_Engineer]

I wouldn't be surprised if it is illegal, considering how broken our 'justice' system is.

If editing some data on your own equipment is all it takes to get Microsoft to give you service, and that's illegal, then something is indeed wrong.

Re:This act is highly illegal

[wonkey_monkey]

"Whoever ... knowingly and with intent to defraud, accesses a protected computer

Uh... it's my computer.

Re:This act is highly illegal

[fuzzyfuzzyfungus]

It's particularly weird given how touchy XP was about install media: even with a valid key and install medium that provided the same version(home, pro, etc.) it would inevitably whine if you used a retail key with OEM media, the reverse, or any other mismatched combination it happened to dislike, even if the result would be identical to what the poor sucker trying to install had a license key for.

Given that POS probably wasn't sold at a discount, I would have expected it to at least freak out at it being enabled on a system with a different category of license key and quite possibly to be something that would require a fresh install or major surgery to change after the fact.

Re:This act is highly illegal

[Hognoxious]

I'm having a hard time believing it's perfectly legal to update one set of registry keys, while being illegal to update another.

Clearly this is a hypothetical argument that goes beyond the DeVry Juris Doctor syllabus, but replace "update" with "shove your dick in" and "set of registry keys" with "person's bodily orifice".

Re:This act is highly illegal

[Anonymous Coward]

it's not very hard to argue that the registry hack (at least for corporate customers) would qualify as theft of service.

Gee, I wonder what they think about me downloading XP for free off bittorrent?

Wait...are you telling me that's illegal?? OMG!

Re:This act is highly illegal

[Hognoxious]

Yeah, I'm like *sure* they could totally get that right.

Re:This act is highly illegal

[quink]

Since Msoft appears to have sold a product riddled with errors and security holes which has required years of updates to fix, it might be suggested that there is a continuing warranty obligation to provides updates to make the product fit for service? To suggest the customer should now pay money for extra fixes for continuing known faults looks more like blackmail than proper business ethics. Hip replacement recipients have a case against a subsidiary of Johnson and Johnson over defects which poisoned them with cobalt and chrome. Anyone want to suggest they should just charge more for hip upgrades now?

Re:This act is highly illegal

[egranlund]

There is probably more to the whole POS installation than just the registry key.

I think someone just noticed that if you happen to only flip one of the many bits for the POS system that it would cause Windows Update to behave differently.

Re:This act is highly illegal

[drinkypoo]

What's illegal about it? Is it illegal to use Microsoft's provided tools to edit my registry, browing to HKEY_LOCAL_MACHINE\SYSTEM\WPA, then creating a new key called PosReady, then creating a new dword in PosReady called "Installed" with a value of 00000001?

No more illegal than disguising yourself as a legitimate copyright holder and fooling someone into letting you make a copy of a piece of media.

Re:This act is highly illegal

[drinkypoo]

The true mind-blower of the registry is that even though it's API-based and therefore in theory they can replace it with impunity, they didn't and it still sucks.

The true mind-blower of Unix is how so many people defend their flat files unto death even when it makes zero sense, e.g. dpkg. dpkg desperately needs binary databases, perhaps kyotocabinet or hell just sqlite, anything would be better than the big ugly flat files. And even if those files were only caches of the flat files, and the big stupid ugly flat files still had to exist and be read and processed during updates, it would still be a big improvement. There was a thing called tdpkg which did it with a wrapper library (!) but dpkg has changed since it was written, and it no longer works.

A registry is still a good idea. The windows registry is still poo. I am still annoyed that even with stuff around like FUSE to make interim migration feasible, nobody has begun a major flat file replacement project.

Re:This act is highly illegal

[brantondaveperson]

OH come on - just because something is easy to do automatically makes it legal. Is that your argument?

If you're not authorized to receive upgrades and/or support, and you knowingly misrepresent your system in some way in order get those upgrades and/or support. Well of course that's illegal.

If they're so special and secret, they shouldn't be something you can update.

Do you really believe that? If your life is so special and precious, it shouldn't be something I can so trivially extinguish with this here handgun.
Oops - And I told myself I wasn't going to use analogies, which inevitably end up driving the conversation in the direction of whether or not the analogy holds.
Sigh.

Re:This act is highly illegal

[brantondaveperson]

Why do slashdotters find these issues so hard to understand. The law is all about intent. If you intend to access services to which you are not entitled, the ease with which you do so is entirely irrelevant to the discussion of whether or not your actions are legal.

You can type in eighteen "plain text" keystrokes (whatever that means - aren't all keystrokes plain text? Anyway) and log into the Attorney General's gmail account. Well, if you knew the password you could. But the action is trivially simple. And that doesn't matter. And why would it? Would you want the law to be based on how difficult an action is to undertake? It's pretty easy to pull a trigger you know...

Re:This act is highly illegal

[hacker]

Question: How is this any different from typing in a pirated key to a licensed copy of software you have installed in 'demo' mode today?

Answer: It isn't. You're not licensed to use the service, and enabling it on your machine, is a violation of the terms of that license.

Re:This act is highly illegal

[Anonymous Coward]

So when you access Windows Update and download files that you have no right to download..... whose server are you accessing those files from again? I don't think you own it...

Re:This act is highly illegal

[Anonymous Coward]

You can legally walk out of a grocery store with a wad of napkins from the deli. You cannot legally grab a retail package of the same napkins off the shelf and walk out with them. Both are there for you to pick up. It is up to you to behave wisely.

Re:This act is highly illegal

[BitterOak]

what's the difference between highly illegal, and illegal? Besides, what is so illegal about changing a registry key or value, or creating a registry key?

Changing a registry key in and of itself isn't illegal. But doing so to misrepresent that you paid for something you didn't, and obtaining that something through the Internet violates at least two federal laws: wire fraud and the computer fraud and abuse act. You are gaining access to software hosted on a computer that don't rightfully have access to (computer fraud and abuse act), and you are causing false information to be sent on the Internet for financial gain (wire fraud). Both are federal felonies. In addition, you are probably committing several civil infractions including copyright violation and violation of license agreements. If you want to keep getting updates from Microsoft for XP you can pay for them like everyone else.

Re:This act is highly illegal

[Anonymous Coward]

To complete the picture, all you have to do is add in "...and be sure to not install any software that modifies your registry, ever."

Re:This act is highly illegal

[Immerman]

Who gave you that idea? Certainly not Microsoft (or Apple, Google, etc)

But seriously, the server hosting the updates is NOT your computer, and by sending false identification information in order to access them, there is a good case to be made that you are committing fraud.After all, you must be granted access on the server to, at the very least, send the command to send you the update.

Re:This act is highly illegal

[Anonymous Coward]

But then Microsoft put out a tool that let you update the product key with any valid one.

Re:This act is highly illegal

[Anonymous Coward]

"Illegal"?
Immoral, stupid, bad. Maybe. I'm not seeing how it is illegal.

Re:This act is highly illegal

[fuzzyfuzzyfungus]

If somebody were planning a bold replacement, it'd be neat to see something that actually took even slight advantage of the advances in what constitutes an acceptable database. With flat files, you can do some neat stuff by bringing a revision control system into the picture: see who made changes and when? No problem. Roll back a change? No problem. Diff what we are doing now with what we were doing six months ago? No problem. Spinning up a new machine? Just check out the configuration files and you are set. (I'm mostly a dabbler, so this never became my problem; but I imagine that a fully-robust implementation of this would be markedly more difficult, in that you'd need to know what was/wasn't critical to getting a network connection up and running, whether specific files were routinely churned so often as to be overwhelming, etc.; but for a hobby-scale handling of handpicked cases it's very convenient.)

If you went the database route, it'd be nice to see something designed with making querying, setting, and otherwise manipulating configurations (across any tractable number of systems that share enough authentication goo for it to work) something you get 'automatically' because of the fact that the config is in a database, rather than something you get, in bits and pieces, through specific utilities and hacks.

I think that that (aside from the relatively shallow learning curve, at least for applications whose config files aren't utter garbage) is what makes people so fond of text config files. You can modify them by hand; but because it's just text, basically anything that can spit strings and do useful things to them automatically serves as a potentially viable, even powerful, configuration editor. With binary configuration storage, you have a much more impoverished set of tools, in most cases (though a properly chosen binary format would be better off than ghastly legacy junk).

(The other factor, not strictly a consequence of registry vs. config files; but one that still seems to break down substantially, though not exclusively, along those lines, is what software vendors, especially 3rd party ones, choose to store: Even if you are totally satisfied with your registry editor tools, the unpleasant fact is that a lot of common software was clearly designed with absolutely no consideration of its configuration being edited except through the (usually GUI) interface it provides. Is it in the registry? Sure, the first run of the program created 50-odd dword values, each one more cryptic than the last. If you change a setting in the program and look again, sometimes you can see which one(s) changed. Obviously, absolutely nothing prevents an application with a text config file from doing the same, or worse, by just dumping a bunch of cryptic-fuck-you-hex values into its config; but some mixture of historical tradition and the implicit 'It's a text file, a human might read it...' pressure seems to keep that more restrained, whether it be in the assorted .ini files that hang on in dark corners of Windows, or in the Unixlikes.)

Re:This act is highly illegal

[SeaFox]

What is so illegal about changing 0 to 1 and 1 to 0?

You'd be "circumventing an authorization control" or some other BS legal interpretation so they could throw the DMCA at you.

Re:This act is highly illegal

[Anonymous Coward]

There's GSettings and dconf which provides something similar to the registry. Its file(s) breaking or disappearing doesn't cause your whole system to be dead is a bonus.

(Technically, dconf itself is just the storage. You could probably get something to craft plain-text versions of configuration by changing that part out. GSettings is the API that eventually uses dconf on the backend. It's supposed to use the Windows Registry or Mac OS *.plist files on those platforms...)

Re:This act is highly illegal

[tepples]

it might be suggested that there is a continuing warranty obligation

After EOL, the EULA specifies that there is absolutely no warranty.

Re:This act is highly illegal

[tepples]

The Windows Update server is Microsoft's computer.

Re:This act is highly illegal

[quink]

> After EOL, the EULA specifies that there is absolutely no warranty.

Don't know about your country, your laws, but in my country, under our laws, no EULA is valid in attempting to negate an implied warranty under law, and in fact, as I recall it, I think it's actually an offence to say in any sales agreement that there is no warranty... because apart from anything else, that would be misleading conduct...

Re:This act is highly illegal

[bloodhawk]

Where are you from with such good laws? here in Australia we have some laws around it but they are utterly toothless where a simple disclaimer in the EULA that local laws take precedence avoids any legal problems (which everyone puts in) and besides which the warranties under law here are far less than most companies provide for software and many many years less than has been supplied for XP.

Re:This act is highly illegal

[quink]

G'day. I'm up the road from you... Next you'll start telling me we have a "budget emergency"... B-).. Australian laws are actually strong... It's fraidy-cat consumers who are weak. The local laws that have to be mentioned in the local version of the EULA include laws on consumer warranties that contracts don't and can't override. Watch ABC's The Checkout or Google the ACCC and consumer warranties for details.
Besides., I own my entries in my registry if I wrote them. I don't make Msoft start sending me upgrades. I was kind enough to let them fix mistakes that otherwise might have caused me harm. So you reckon they want the publicity involved in explaining exactly how many faults and security holes their software had that threatened paying customers' livelihoods?

Re:This act is highly illegal

[CurryCamel]

How is the "editing some data on your own equipment" relevant here? Unless you do it by mistake, or in research purposes.
But we are here talking about deliberately bypassing a security system, in order to get a paid service you have not paid for. Unless one argues the patches fall under "fair use" (nobody has, that I have seen), I don't understand how applying them is not stealing.
Now MS should have made an effort in the security here (turns out security by obscurity is bad security, after all...) , and I don't suggest any effort whatsoever should be used from the law enforcement side to hunt down the leachers. The only victim is MS, and they are in a position to fix this. But that doesn't make the leaching any less illegal, does it?

Re:This act is highly illegal

[gstoddart]

OH come on - just because something is easy to do automatically makes it legal. Is that your argument?

No, my argument is "which keys are legal to update and which aren't?"

Are they enumerated in advance? Is it only certain values? Does it change on a whim? What if I do it by accident?

So, if I push 6 into a registry key it's legal, but if I push 9 I've committed a crime? But if I touch another registry key it's completely illegal?

If your life is so special and precious, it shouldn't be something I can so trivially extinguish with this here handgun.
Oops - And I told myself I wasn't going to use analogies, which inevitably end up driving the conversation in the direction of whether or not the analogy holds.

You're right, in this case the direction is "are you always such a fucking childish asshole, or just one Slashdot?" and "did the bad man touch you?".

Seriously, go back to screwing your sister.

Re:This act is highly illegal

[Anonymous Coward]

The Windows Update server certainly isn't yours.

Re:This act is highly illegal

[bloodhawk]

please point out any law that would make MS in any way shape or form on the hook for any warranty after EOL of life of XP. none of the Australian laws do anything like that as they only enforce minimum warranties. The original poster you replied to was completely correct, there is absolutely NONE after the EOL of product supplied by the license, EULA or LAW in Australia that would come into play here. Australian laws are only good for preventing ridiculous claims and extremely short warranties, beyond that they are no better than any other country.

Re:This act is highly illegal

[Anonymous Coward]

But changing the registry causes your computer to get unauthorized access to Microsoft's upgrade servers.

Re:This act is highly illegal

[An ominous Cow art]

Hex, or octal?

Re:This act is highly illegal

[Anonymous Coward]

Can you believe it's perfectly legal to sign one name on a check, while being illegal to sign another?

Or to drive one speed on a freeway, but not another? If a speed is so special and dangerous, perhaps it should be something your car can't attain?

This is the attitude that's driving the development of physical constraints in complex systems: the demand by (chronologically adult) users not to hold them responsible to self-constrain within boundaries of what's legal, contractually agreed, or even safe. So the next time you find you can't make a backup copy of the movie you bought, or your car won't start until you fasten your seatbelt, you can take comfort in knowing that your suggestion has been listened to.

Re:This act is highly illegal

[Anonymous Coward]

No, my argument is "which keys are legal to update and which aren't?"

In most jurisdictions, it's probably quite simple. If you *knowingly* do something, anything, involving registry keys or not, with the intent of getting a paid for service (continuing updates for XP) for free, then it's probably classed as some sort of fraud, maybe unauthorized computer access (to the MS servers) as well.
If you could plausibly and believably claim in court that a nerdy friend told you to do this registry change 'to improve your security' and you had no idea what this really meant, then you should have a valid defence and be acquitted (lack of Mens Rea).
Note this may seem like it contradicts the 'ignorance of the law is no excuse' principle, it does not, since this case is about innocent ignorance of the facts that would allow you to see this was a fraud, i.e. buying stolen goods from a legit seeming shop is not a criminal offence.

Re:This act is highly illegal

[CaptnZilog]

It'll only work right if it's set as a 0 or 1 in trinary.

Re:This act is highly illegal

[CaptnZilog]

What's illegal about it? Is it illegal to use Microsoft's provided tools to edit my registry, browing to HKEY_LOCAL_MACHINE\SYSTEM\WPA, then creating a new key called PosReady, then creating a new dword in PosReady called "Installed" with a value of 00000001?

See Aaron Swartz: Federal prosecutors later charged him with two counts of wire fraud and 11 violations of the Computer Fraud and Abuse Act,[12] carrying a cumulative maximum penalty of $1 million in fines, 35 years in prison, asset forfeiture, restitution and supervised release.[13]

And he actually had a legal account to access the JSTOR information, which he was accused of 'unlawfully accessing'. (Hint for them, don't give people accounts if you don't want the data accessed :rolleyes:).

Re:This act is highly illegal

[CaptnZilog]

What's illegal about it? Is it illegal to use Microsoft's provided tools to edit my registry, browing to HKEY_LOCAL_MACHINE\SYSTEM\WPA, then creating a new key called PosReady, then creating a new dword in PosReady called "Installed" with a value of 00000001?

No more illegal than disguising yourself as a legitimate copyright holder and fooling someone into letting you make a copy of a piece of media.

Or no more illegal than me getting his CC info and using it online to go buy things. After all, I'm only using a browser and OS on my own system to access a site with the 'key' (CC info) I got, right? Why should that be illegal?

Re:This act is highly illegal

[Anonymous Coward]

Open almost any program in a hex editor and change one or two things and you crack a program..

Oh wrong serial number, jump to the code for wrong serial.. no wait change that to jump to the right serial code... fixed that..

(yeah a debugger would be needed to find what to change, but same idea)

I could care less what people pirate and do, this is down there with holding shift while inserting a Sony Music CD with a Rootkit (I mean DRM) to stop it from running)...

Re:This act is highly illegal

[BilI_the_Engineer]

How is the "editing some data on your own equipment" relevant here? Unless you do it by mistake, or in research purposes.

Because it's your own god damn property. It's not like you're fucking with someone else's property.

I don't understand how applying them is not stealing.

Simple: You're not taking anything, and despise what Microsoft thinks about changing some data in the registry to 'fool' them, Microsoft still voluntarily sends you updates.

Re:This act is highly illegal

[firewrought]

The true mind-blower of Unix is how so many people defend their flat files unto death

And their scripts. Don't forget the piles upon piles of scripts that preclude any straightforward notion of what's going on. (Coincidentally, dpkg is a good example of this failure too.)

Re:This act is highly illegal

[cusco]

Can't help but think it might well be more deliberate than lazy. The **staff** at MS want to create great products for their customers, it's only the shitheads in management that go out of their way to thwart customers. With Gates and the rest of the actual through-the-ranks programmers being pushed aside by the MBA-types there isn't anyone at the upper levels to speak of who would even know that you could block updates some other way, much less that it's almost trivially easy. And you can pretty much guarantee that none of the programmers want the job of keeping updates out of the wild (although I'm sure they could probably put some H-1B holder to the job if they thought it worthwhile).

Re:This act is highly illegal

[brantondaveperson]

Ha - awesome. You insulted me. Good job.

So the thing is this - the ease with which it's possible to fake your system's credentials to receive support for which you haven't paid is irrelevant. It simply doesn't matter how easy it is - the only thing that matters is whether or not you do it knowingly. If you, with intent and planning, put that number 9 into a registry key with the aim of extending the support beyond its legitimate date, then yes you have committed a crime (*)

Why is this not obvious?

* Now, to be clear, I don't know if it's a crime or just a civil matter or whatever - and it's highly unlikely that you will be pursued for committing this heinous act - but the point I'm trying to make is that intent is the issue, not that it being easy to do makes it ok.

Will those patches actually WORK?

[Anonymous Coward]

I mean, correct me if I am off/wrong (didn't "RTFA" either) - but, those patches aren't FOR XP for the PC are they? That said - how will they work for XP for a PC??

* Last I knew of, Windows XP's codebase isn't the "single unified VISTA/7/Server 2xxx/Tablet-smartphone" codebase MS spent the last X yrs. developing... so, how can those work?

Put it THIS way: I hunted down patches for Windows 7 - SOME you can get online, others no way unless you use Windows update... but, you can find ones for say, Windows VISTA or Server 2008 online (not thru Windows Update) - will they work? No - they get rejected as wrong OS version etc.!

Hence, my question in my subject-line above.

APK

P.S.=> Feel free to "set me straight" here but... that's the ONLY issue I saw with this trick (unless it's no issue)... apk

Re:Will those patches actually WORK?

[Anonymous Coward]

Windows POSReady 2009 is actually Windows XP though, just stripped down and a lot of stuff removed. The same system files exist in the same versions and thus they have the same exploits and can be patched with the same code.

POSReady 2009 is basically a different "distro" of Windows XP that Microsoft is supporting until 2009. By changing that one registry entry, you get Windows Update to realize you're running that special distro, and you get patches.

Re:Will those patches actually WORK?

[Anonymous Coward]

POS versions of windows are almost identical to desktop versions. The difference is more in the license than in the functionality

Re:Will those patches actually WORK?

[Jahf]

And given that most of the people I know who have a machine still stuck on XP are using them for things that the POS version was built for (but before it was made available), this hits the exact audience Microsoft intended for POS. Not all vendors are willing to update to POS, and not all businesses can realistically rebuild their own systems and reinstall everything (or even have license to). This is the lesser of the two evils (use updates for a different version of Windows or have your embedded/POS/industrial PC vulnerable to attack). I strongly doubt Microsoft will go after anyone for this except possibly -vendors- who do the hack commercially. They may find a way around it and stop it from working, but they're not going to go after consumers if the consumer has a valid XP license. If they don't have a valid XP license, they're already breaking bigger laws, and MS would have gone after them if they could anyway.

Re:Will those patches actually WORK?

[Anonymous Coward]

I mean, correct my host files if I am off/wrong (didn't "RTFHF" either) - but, those host files aren't FOR XP for the PC are they? That said - how will they work for XP for a PC??

* Last I knew of, Windows XP's C:\Windows\SYSTEM32\drivers\etc\hosts isn't the "single unified VISTA/7/Server 2xxx/Tablet-smartphone" host file MS spent the last X yrs. developing... so, how can those work?

Put it THIS way: I hunted down host files for Windows 7 - SOME you can get online, others no way unless you use Windows update... but, you can find ones for say, Windows VISTA or Server 2008 online (not thru APK Unified Host File Update) - will they work? No - they get rejected as wrong OS version etc.!

Hence, my question in my subject-line above.

APK

P.S.=> Feel free to "set me off" here but... that's the ONLY issue I saw with this host file (unless it's no issue)... ap "host file" k

Re:Will those patches actually WORK?

[Anonymous Coward]

until 2019*, sorry

Re:Will those patches actually WORK?

[mysidia]

Windows POSReady 2009 is actually Windows XP though, just stripped down and a lot of bug-ridden exploitable and memory hogging code removed. Almost the same system files exist in the same versions and thus they have many exploits in common and frequently can be patched with the same code.

There, fixed it for you.

Re:Will those patches actually WORK?

[Anonymous Coward]

APK needs to be hanged from a light pole and left to rot. The only thing we know is that he likes to rape children and needs to be locked up. I encourage everyone to report that sick fuck to the police and get him removed from society until he stops destroying innocent lives. His name is Alexander Peter Kowalski and he lives at 903 East Division St., Syracuse, NY 13208 (he was born 01/31/1965; his mother is Jan Kowalski, born 12/03/1933. I encourage everyone to call his neighbors and warn them that he may have raped and\or murdered their children and uses HOSTS files to evade police detection when he looks at child porn. If anyone lives in his area, I suggest printing out some fliers and stapling them around his neighborhood with a large "PAEDO WARNING!" on the top.

Re:Will those patches actually WORK?

[Anonymous Coward]

APK flourishes on the insecurities (like the continued existence of HOSTS files) in computers that he uses to exploit children with. The only thing we know is that he likes to rape children and needs to be locked up. I encourage everyone to report that sick fuck to the police and get him removed from society until he stops destroying innocent lives. His name is Alexander Peter Kowalski and he lives at 903 East Division St., Syracuse, NY 13208 (he was born 01/31/1965; his mother is Jan Kowalski, born 12/03/1933. I encourage everyone to call his neighbors and warn them that he may have raped and\or murdered their children and uses HOSTS files to evade police detection when he looks at child porn. If anyone lives in his area, I suggest printing out some fliers and stapling them around his neighborhood with a large "PAEDO WARNING!" on the top.

Re:Will those patches actually WORK?

[craznar]

Yes... but many of the security flaws patched in the past have been in that 'stuff' you mention.

Re:Will those patches actually WORK?

[Zocalo]

And there-in lies the problem, "just stripped down and a lot of stuff removed" means that you almost certainly won't be getting patches for the stuff that has been removed, which is just as likely (if not more so) to be the parts that really need patching when the next 0-day comes along. Also, unless all the system files present truly are identical, then replacing random system files on a desktop XP system for a "stripped down" version might, and probably will, cause some functions to stop working. I can see two not necessarily mutually exclusive outcomes from this; people who deploy this are going to end up with a very false sense of security and a lot of systems are going to get hosed because of an update that isn't compatible with desktop XP.

In fact, I wouldn't put it past Microsoft to "accidentally" push out bad patches to deter this behaviour. I'm pretty sure they'd rather XP just cease to exist at this point given all the bad security press it's got them, and any opportunity to ram another nail into the coffin isn't exactly going to be unwelcome.

Re:Will those patches actually WORK?

[Anonymous Coward]

but BECAUSE it is a 'stripped down' version of windows xp, it will not receive ALL the necessary updates needed for a "normal" windows xp home, pro, or mce edition. if you think you're safe and up-to-date using this registry hack, you're only fooling yourself.

Windows Server 2003?

[Anonymous Coward]

I'd like to run Server 2003 as long as possible, as it's the most lightweight server edition Microsoft still supports.

Re:Windows Server 2003?

[fizzer06]

I installed Windows Server 2003 to VMWare Player just yesterday. The activation server won't work anymore, so I had to make the dreaded call. The Pakistani sounding guy named "Phillip" was helpful but it would have been easier with Internet activation. He was very curious as to WHY I wanted to install Windows Server 2003.

Windows Update wouldn't work until I downloaded SP2 and installed it. Then I was able to "enjoy" several hours of downloading and installing updates via Windows Update

What I wonder about is, when I accepted an update and rebooted there were several patches to the updates. Why doesn't MS build the patches into the update?

Re:Windows Server 2003?

[Billly Gates]

I installed Windows Server 2003 to VMWare Player just yesterday. The activation server won't work anymore, so I had to make the dreaded call. The Pakistani sounding guy named "Phillip" was helpful but it would have been easier with Internet activation. He was very curious as to WHY I wanted to install Windows Server 2003.

Windows Update wouldn't work until I downloaded SP2 and installed it. Then I was able to "enjoy" several hours of downloading and installing updates via Windows Update

What I wonder about is, when I accepted an update and rebooted there were several patches to the updates. Why doesn't MS build the patches into the update?

That is because the certificates were replaced. Remember back in 2011 about one of the root CA servers being compromised. It was only one of the keys used to sign and not the full master but still MS updated its certificates to be safe.

You can download an update (forgot which KB) for both XP & Server 2003. Even XP out of the box wont run updates either without the fix. There is a fixit too that will change them for you.

20 million vets (still alive) not being honored..

[Anonymous Coward]

in real time. many are joining the (r)evolutionary non-violent spirit based new clear options freedom movement http://www.youtube.com/results?search_query=wake+up+freedom to oppose the spiritless psychopathic greed/fear/ego based zionoc nazi self appointed neogod wmd on credit cabals http://www.youtube.com/results?search_query=wmd+weather+cabals

Security risk?

[erice]

Point of Sale systems usually operate under more controlled conditions than end user machines. Would these updates keep your XP machine plausibly secure or highly vulnerable to threats not considered serious to point of sale systems? What about vulnerabilities in components not present in POSReady 2009 but used in XP?

Re:Security risk?

[Anonymous Coward]

Regardless, it's going to be better than not getting updates at all.

Re:Security risk?

[Anonymous Coward]

No, updating to an actually supported operating system would be better.

Re:Security risk?

[0123456]

No, updating to an actually supported operating system would be better.

Not if it's Window 8.

Re:Security risk?

[osu-neko]

Well, you can either take advantage of the PosReady thing or not. If you do, yes, it may be that only some rather than all your security vulnerabilities will be patched. If you don't, it will be the case that none rather than some are patched.

Re:Security risk?

[Anonymous Coward]

Point of Sale systems usually operate under more controlled conditions than end user machines.

Hah!

I'm sure Target will be glad to hear that: http://arstechnica.com/securit...

Re:Security risk?

[Anonymous Coward]

Windows 7 is great and still available and will be supported for quite some time, if I'm not mistaken.

Re:Security risk?

[H0p313ss]

If I had to choose between 8 and XP, I'd choose 8, even with the retarded launcher/start nonsense.

Re:Security risk?

[jones_supa]

Actually even Windows 7 support should end January 2020. It still has some years but hey, time flies fast...

Re:Security risk?

[Agret]

Yeah it was definitely a weird move by Microsoft to stop releasing updates for Windows 8 and only support 8.1.
The 8.1 upgrade has failed for a bunch of people (similar to how SP1 failed for Win7) and now they are left unprotected from new exploits entirely?

I suppose when they get a virus that hoses their system they can use 8.1 media to re-install their system...oh wait, 8.1 discs won't accept Windows 8 product keys for some bizarre reason even though 8.1 is a free upgrade? They have to reinstall Windows 8 and then use the store to upgrade to 8.1 and pray it doesn't fail this time around.

I feel Microsoft have made some strange decisions regarding 8.1, I work at a computer store and when the OEM keys we get are for Windows 8 you have to install 8.1 using a generic KMS key and then use 'slui 3' to enter the customers Windows 8 key after install. Where's the logic in rejecting the key for the install media but then accepting it for the activation?

XP embedded POS....

[clifffton]

Is the same thing Target used. Just sayin. #LinuxFTW

Re:XP embedded POS....

[Anonymous Coward]

Yeah, Linux can't get hacked because you can erase your cookies.

question

[Anonymous Coward]

Am i the only one that thinks that people stil running an OS from Microsoft 13 years old doesn't give a damn about being up to date? If they were, they would at least running Windows 7, or maybe even some real OS like GNU..

Re:question

[Anonymous Coward]

GNU is the best! All hail Stalinmann and HURD.

Re:question

[thsths]

I did not matter one bit when XP was released, it matters when a better alternative was available. Windows 7 is not even 5 years old, and 4 years ago Windows XP was still being sold with new netbooks. Those machines do not even run Windows 7 properly unless you upgrade the RAM.

Re:question

[Billly Gates]

I remember in the good old days when you were told your system is obsolete and to upgrade your OS after 3 years.

5 years is a long time for support.

Re:question

[jones_supa]

I did not matter one bit when XP was released, it matters when a better alternative was available. Windows 7 is not even 5 years old, and 4 years ago Windows XP was still being sold with new netbooks. Those machines do not even run Windows 7 properly unless you upgrade the RAM.

Windows XP SP3 and Windows 7 memory requirements are similar. I'm not joking. Although, yeah, both of them can be quite tight in 1GB RAM.

Yeah not quite...

[craznar]

As someone who works with POS Ready 2009 a lot (I write Point of Sale Software), the catch with this idea is that many (a great many) of the components in normal XP just don't exist in POSReady.

SO you may, or may not get updates for some parts of your OS - because Microsoft will not be writing updates for the rest.

Re:Yeah not quite...

[Anonymous Coward]

A bigger concern would be that MSFT might update something that flat out breaks non-POS2009 editions of XP. You can't expect them to test POS2009 updates against OS components that don't exist & software that doesn't run on it.

Re:Yeah not quite...

[__aanbvm4272]

"because Microsoft will not be writing updates for the rest". Unless you pay them for the extended support right? I mean they WILL be writing updates for the financially connected... So there might be a chance of getting a patch from some where.

New Critical XP Update...

[The Mysterious Dr. X]

"This patch removes an exploit that caused some machines running Windows XP to apply updates for other operating systems. To learn more about the update, read this knowledge base article..."

Re:New Critical XP Update...

[Anonymous Coward]

Ok, so I avoid installing that patch, just like I avoided installing the genuine advantage notifier (as well as that XP EOL notifier), even on systems that I know are legitimately activated. Honestly, I do not need some software to tell me whether it is genuine or not.

Re:New Critical XP Update...

[petermgreen]

They could do it the other way arround, make an update to the updater that (among other things) checks more thouroughly what edition of the OS it's running on, then make it so you have to update the updater to get any other updates.

Re:New Critical XP Update...

[wonkey_monkey]

Yo dawg, I... can't be bothered.

Re:New Critical XP Update...

[keith_nt4]

Honestly, I do not need some software to tell me whether it is genuine or not.

I think that was to tell Microsoft if your windows was genuine. The update just happen to provide you with a convenient output window. But really that was secondary...

Just buy a new computer !!!!!

[Anonymous Coward]

As low as $250 at some places!! And if you don't like the metro stuff, they still have Windows 7.

XP ceased to be available on June 30, 2008. That's approximately six years ago. According to Moore's estimate, that equates to three doubles of computing power: 2, 4, 8. Any computer that you can buy today is at least 8 times better than any XP computer. And, to top it off, the low end of the price range is half of what it was back then. So just go for it. Splurge, man!!!

Re:Just buy a new computer !!!!!

[Anonymous Coward]

What a homo. Just throw money at the problem! Wheeeeeee! What's $250 bucks? Nothing!

Typical American.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

You forget to mention that this eightfold increase in computing power is not becoming available to you, the user, but it is consumed by the operating system.
When you run XP on an eight years old computer you have the same user experience as today on a similarly priced computer.
Sure, Microsoft has 8 times more power to play with, but they used it all up internally. You need 8 times more memory not to store 8 times larger
documents or pictures, no you need it to allow Windows to use 8 times more memory.
That is not what the average user expects from technology advance. But Microsoft fail to see that.

Re:Just buy a new computer !!!!!

[amiga3D]

It's not about you. You fail to understand your place as a consumer. You spend money and they fuck you. I can't make it any simpler for you.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

Computer technology is vastly improved in so many ways readily apparent to the average user.
1) touch screens were not widely available then, they are everywhere now.
2) GPU technology has improved by at least two generations. Ask any gamer what that means in terms of experience and performance.
3) Hard drive space has improved dramatically, and there weren't even SSDs back then.
4) battery and efficiency technologies can keep a notebook running for several hours, instead of maybe one hour.
5) LCD innovations, resolution improvements, and LED back lighting instead of flourescent back lighting.
6) Virtualizable 64-bit multi-core computing, instead of 32-bit single-core computing, let you run multiple OS at the same time.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

It's true, you can't buy a computer with food stamps. If you were injured by the Obama-Pelosi-Reid recession, then I feel your pain. And I would point out, that under redistribution style of government (socialism/communism), you generally have great difficulty buying anything.

Re:Just buy a new computer !!!!!

[jbeaupre]

Yeah, unless you've got thousands of dollars of software that are locked to that PC configuration (hardware and software). Then you're looking at a major expense and hassle of upgrading everything just to do exactly what you were before.

Re:Just buy a new computer !!!!!

[viperidaenz]

4) battery and efficiency technologies can keep a notebook running for several hours, instead of maybe one hour.
My laptop from 8 years ago had 4 hours battery life. It still lasts 15 minutes now that 90% of the capacity has gone.

5) LCD innovations, resolution improvements, and LED back lighting instead of flourescent back lighting.
It's also got a 1024x768 screen, I could have got 1600x1200. Average laptops these days have 1366x768, some have 1920x1080, not much improvement there. It costs a premium to get anything above "Full HD"

6) Virtualizable 64-bit multi-core computing, instead of 32-bit single-core computing, let you run multiple OS at the same time.
AMD64 is 11 years old. The Pentium Dual Core, 2007. Core 2 Duo CPU's are all 64bit dual core, from 2006 onwards.

All around before Windows XP was withdrawn from sale in 2008.

Re:Just buy a new computer !!!!!

[ciroknight]

Or install Linux, since it's free and you can continue using your existing hardware. Then you can just virtualize and continue using your XP license in a nice, safe cocoon.

Re:Just buy a new computer !!!!!

[H0p313ss]

Yeah, unless you've got thousands of dollars of software that are locked to that PC configuration (hardware and software). Then you're looking at a major expense and hassle of upgrading everything just to do exactly what you were before.

Which you had a decade to plan for.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

They fuck you at the drive through!

Re:Just buy a new computer !!!!!

[Anonymous Coward]

A 4-hour battery would've been an optional item for which you would have paid extra.
64-bit CPUs were often sold with 32-bit OS, and possibly with gimped chipsets which would not have performed at a full 64-bit capability.
A 1366x768 screen (1,049,088 pixels) has 33% more pixels than a 1024x768 screen (786,432 pixels).

Re:Just buy a new computer !!!!!

[Anonymous Coward]

I <3 Prostitutes!

Re:Just buy a new computer !!!!!

[jbeaupre]

It's not the planning, it's the expense. When upgrading to new hardware means dropping $20k for new software licenses (for one PC), and the expense comes out of your own pocket, you "plan" to use the system for as long as possible.

Decade to plan. Yeah. Whatever.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

Sounds nice... but, I was laid off a while back and I'm unemployed and looking for a "new" (used, all I can afford) car since my 18y/o truck is falling apart (was working from home for 10yrs so wasn't a big deal), and anything I buy now is hitting my savings, so I'm really not eager to spend money on replacing yet another thing when, as a matter of fact, my dual2.2ghz (physical dual Xeon chips) works just fine other than 32-bit only and XP. So, yeah, I'll probably nuke it and install win7 32-bit at some point, but unless you want to send me some money to buy a new machine telling me I should "just buy a new machine" just makes you sound like an entitled a** who can't comprehend that not everyone can afford to "just buy" things whenever some random vendor decides what they have is "old".

Re:Just buy a new computer !!!!!

[CaptnZilog]

Computer technology is vastly improved in so many ways readily apparent to the average user.
1) touch screens were not widely available then, they are everywhere now.
2) GPU technology has improved by at least two generations. Ask any gamer what that means in terms of experience and performance.
3) Hard drive space has improved dramatically, and there weren't even SSDs back then.
4) battery and efficiency technologies can keep a notebook running for several hours, instead of maybe one hour.
5) LCD innovations, resolution improvements, and LED back lighting instead of flourescent back lighting.
6) Virtualizable 64-bit multi-core computing, instead of 32-bit single-core computing, let you run multiple OS at the same time.

1) I have a keyboard and mouse, and I'm a touch typist (any programmer should be, right?) at 80WPM. What exactly does a "touch screen" do for me? I watch enough people swiping around on their phones all day already.
2) I'm not a gamer, and my "GPU" video card has 512M and works just fine for what I need to do.
3) Agreed, but... why wouldn't I just buy a bigger hard drive for my machine if I needed it? (And I don't need an SSD).
4) Dunno, my laptop rarely gets used (and is max 1GB ram), I mostly use my desktop machine.
5) Yeah, I like my 19" LCD on my desktop, far lighter than the 20" CRT I used to have that was just a beast to move around. Of course, even my 19" LCD is old, 1280x1024 max resolution - but good enough for what I need it to do.
6) Tell me again why your average home user needs 64-bit multi-core virtualizable computers that can run multiple OS's at the same time, to browse the internet, check email, etc? ... oh, wait, I know the answer to #6... because every release of the OS they make it use way more CPU & memory than the last version with foo-foo GUI changes and other stuff that doesn't do a damn thing for the average user, but sells lots of new hardware for their partner vendors. Pretty soon they'll just stop supporting 32-bit CPUs entirely because y'know, they're old... and who cares if it still works fine, we live in a disposable society right?

Re:Just buy a new computer !!!!!

[Anonymous Coward]

OMG, shut the fuck up already. You're a programmer?? Which means if you're any good you make at least what $30/hr, if not much, much more. Yeah, drop in the bucket. Plus, the advancement of technology pays your salary.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

I'm sorry to hear that you're unemployed, but part of your statement is incorrect. No "random vendor" decided anything. Technology advances according to that doubling effect predicted by that Moore guy. If the technology industry were to listen to folks like you, then everybody would still be using Windows 3.11, or possibly some antique version of Macintosh or X System. You'd like that wouldn't you? Well, maybe not. But if you're going to spew commie propaganda, then I'd think you should admit that your old Xeon rig is carbon wallowing hog.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

It's not about you. You fail to understand your place as a consumer. You spend money and they fuck you. I can't make it any simpler for you.

The only justification for profits is PROFIT! muuuhahahahaha

Re:Just buy a new computer !!!!!

[Anonymous Coward]

Thousands of dollars of software? That's nothing. You have an easy problem to solve.

There are enormous quantities of hardware out there running Windows XP. For example, consider test equipment such as oscilloscopes, logic analyzers, network analyzers, signal generaters, and so on ...

If these items were well maintained (and given how much they cost that's usually a given), they work as well today as they did the day they were bought. An individual unit can cost tens or hundreds of thousands of dollars ...

Try justifying to your boss the "need" to replace a piece of equipment that has to be expensed as capital, costs a quarter million, and works perfectly well!

Re:Just buy a new computer !!!!!

[Anonymous Coward]

And if you don't like the metro stuff, they still have Windows 7.

They don't actually have the full Windows 7 anymore. All they have is the OEM versions, which legally can not be moved to a new computer when you upgrade.

Hence, your purchase gets you 3 years of use, instead of the 10+ that can easily be obtained with judicious component upgrades...

If only Microsoft didn't have such a huge monopoly... The source code for operating systems should be made public domain. Fixing this is a job for eminent domain. We wouldn't rent the land under an interstate, why the hell do we rent our operating systems and let companies jerk us around like this?

Re:Just buy a new computer !!!!!

[jbeaupre]

Yeah, we have that problem too. But those systems are air gapped. We even have a system running Win 3.11. But it works just fine.

Re:Just buy a new computer !!!!!

[Anonymous Coward]

I fucking hate touch screens. People are getting to used to their tablets and phones that they come up and put their grubby fingers on my 27" 2560x1440 monitors and I just wanna put their fingers into a cigar guillotine!

Just upgrade cheapskates

[thetoadwarrior]

there is no valid reason to still be on XP.

Re:Just upgrade cheapskates

[Anonymous Coward]

there is no valid reason to still be on XP.

..and, if you had a fucking imagination, you would maybe realise that some of us havee no intention of dropping six figures to replace entire setups for which we have no other hardware drivers outwith XP: And, no, I am not fucking kidding either. Try running "compatability mode.." with hugely expensive (and even more temperamental) large-display custom video cards, furrinstance. I wish you much fun with that.

I would agree insofar, however, remains long overdue that still-running XP's should be disconnected from the net where at all possible.

Re:Just upgrade cheapskates

[Anonymous Coward]

The little old lady next door, who I let piggy back off my internet because she can't afford her own, would disagree.

Re:Just upgrade cheapskates

[tepples]

You had a decade to gather five figures per year with which to replace your six-figure setup.

Hacked the Hack

[Anonymous Coward]

I cut and pasted reg update, it gave me the message support ended 4/2014. They bastards hacked the hack...

Boy the folks whom took other this site are sure fucking it up - You guys still give Brain Teaser and White Board Tests LOL!

Re:Hacked the Hack

[Anonymous Coward]

btw - table changed The to They and Over to Other...

That's why out of 15 boxes - two are Windows...

Thanks man!

[Anonymous Coward]

"Just when you *think* you 'know it all'" etc. - et al, you learn a new thing so it's no wasted day here imo due to your reply!

See subject-line - I've never had to deal with it (don't do work in retail environs is why).

APK

P.S.=> Excuse the trolls around here in other replies - I truly DO have my "share of fans" @ times! apk

"Impersonating me"? Please... apk

[Anonymous Coward]

See subject-line & grow up!

APK

For all of XP?

[viperidaenz]

POSReady 2009 combines the power and familiarity of Windows XP Professional with a smaller footprint and specific features for point of service (POS) computers.

Smaller footprint means fewer files. What ever is cut out of POSReady won't have any issues fixed.

Re:For all of XP?

[drinkypoo]

Smaller footprint means fewer files. What ever is cut out of POSReady won't have any issues fixed.

OK, let's figure out which parts those are, so we can not use them, and replace them with OSS alternatives. Some of us need XP for various applications for which there are no replacements.

Re:For all of XP?

[viperidaenz]

Unless one of your applications that must run on XP require parts that aren't included in POSReady.

Re:For all of XP?

[Anonymous Coward]

OK, let's figure out which parts those are, so we can not use them, and replace them with OSS alternatives. Some of us need XP for various applications for which there are no replacements.

Name one.

Re:For all of XP?

[NJRoadfan]

If one looks at the past year or so of XP updates, only one part of the OS constantly received updates month-to-month. That same OS component is included with POSReady 2009..... Internet Explorer. By default it comes with IE7 installed, but it can be updated to IE8. Most of Windows XP is there, some of the stuff totally removed is the games (we all know Solitaire has a long list of exploits!) and fluff like Windows Movie Maker. They added some stuff like .NET Runtime for Embedded in its place. DirectX is still intact and working. It can be updated to 9.0c with the latest redistributable. You really can't chop out much of "Windows" without breaking binary compatibility. Most of the applications POSReady 2009 is supposed to run were designed for retail XP initially.

Re:For all of XP?

[drinkypoo]

Name one.

Why should I, when you're too cowardly to have a name? What a waste of CHON you are. Regardless, I use various automotive manual packages, I have several which will only run on 2k or XP.

Re:For all of XP?

[Areyoukiddingme]

Regardless, I use various automotive manual packages, I have several which will only run on 2k or XP.

The compatibility settings don't work? Probably worth a try, since fiddling with compatibility settings can get even old DX5 games to run in Windows 7.

Re:For all of XP?

[drinkypoo]

The compatibility settings don't work? Probably worth a try, since fiddling with compatibility settings can get even old DX5 games to run in Windows 7.

Fiddling with compatibility settings can't even get Civ 2 to run on Windows 7, neither 32 nor 64 bit. And even more pathetically, it also crashes in XP Mode, AKA Virtual PC with XP. It of course runs flawlessly under vmware player running XP. Windows Vista is where Microsoft finally broke compatibility.

Anyway, no, a bunch of these manual programs only run on up to XP, and even then some of them only run with 2k compat mode. I have some other software which I can't get to run correctly even by following guides, like Acrobat Pro 8. (So sue me, I don't have a newer version.) So I have Adobe CS2 suite in an XP VM, also under vmware. As an added bonus I get to use it under Linux.

Like dot updates

[yxyband]

The more updates the crappier it gets. Must of been the Brainteasers and White board tests fault. lol

Re:Like dot updates

[Anonymous Coward]

It's "must have", not "must of".

I hope something bad happens

[Anonymous Coward]

More Entertainment for me

Maybe not a good idea

[ayesnymous]

What if XP and POS share a DLL, but in POS they remove some functionality from the DLL. Then when there's a security update for the DLL, your XP system will end up downloading the updated DLL with missing functionality, and your XP system might become a doorstop.

Please don't

[Hamsterdan]

This will only give a false sense of security. How many files are present in standard XP that *will not* be patched?

Windows server 2003R2 32Bit Hack

[williamyf]

As things stand, the POS editions have a lot of components that will not be fixed (because they are not there) that the main version has/needs.

Wake me up if/when a hack is released to make an XP install pose a a server 2003R2. That will buy me/us a full year of patches., nost likey illegal.

Re:Windows server 2003R2 32Bit Hack

[Quietust]

Considering that Server 2003 is a different underlying OS version (NT 5.2 / build 3790 instead of NT 5.1 / build 2600, having a completely different set of service packs), this might be easier said than done. The only way you could "safely" accomplish something like this would be to install Server 2003 [R2] and then somehow hack it from Server mode to Workstation mode. Now, if you were running Windows XP x64 Edition (which is NT 5.2), this would be much more plausible (because it takes the same updates as Server 2003 x64, including the service packs).

Classic Shell puts the S back in Windows

[tepples]

Not if it's Window 8.

That's why I install Classic Shell, which puts the S back in Windows.

Display profanity

[tepples]

How about displaying profanity on a Windows system configured to use the POSReady updates but obviously not a genuine POSReady installation? During startup, it would identify as "Windows XP: PIece of Shit Ready".

History repeats itself

[Anonymous Coward]

Registry... ah.

These days we get that in Linux with all this GConf/DBus crap. Only that its serialization on-disk is *gasp* XML!

Bad design + bad taste. What could possibly go wrong?

MS trying cripple remaining XPs

[Nightlight3]

This is probably Microsoft leak, trying to cripple into unusable state the remaining XPs they didn't get to previously.

Good way to brick your XP box

[Gazzonyx]

Seems like MS would make a lot of dough if you were to enable these non-XP updates and then one of them bricked your box. Maybe it's a bit of a tinfoil hat idea, but I'm sure they're not going out of their way to make sure that enabling this registry key isn't going to make you a potential customer again.

You must truly be "butt-hurt"

[Anonymous Coward]

Between this set of libelous lies I am replying to now & this too from you http://tech.slashdot.org/comme... ? See subject-line above: You must have TRULY had your fragile ego 'bruised' in vainly *trying* to "take me on" in some technical discussion & I handed you your ass... must be - it's the ONLY thing that makes flimsy "wannabe geek/wannabe computer scientists" react the way you have - with libel & lies, nothing more.

* Grow up - get over it + MOST importantly, learn to respect your BETTERS (in myself) next time!

APK

P.S.=> Truly pitiful... apk

Implied warranty for how many years?

[tepples]

Windows XP was withdrawn from retail sale years ago. Typically, after Microsoft publishes Windows x+1, Microsoft keeps Windows x available for about one more year, continues to provide "mainstream support" for an additional year after end of sales, and provides security updates for five years after that. This is a total of seven years after the successor's introduction. How long does your country's implied warranty last?

Re:Implied warranty for how many years?

[quink]

Legislation in Australia doesn't specify a time limit: if a product is defective when sold, it's defective when sold.
That's logic, surely.
I haven't noticed an operating system or other consumer item that heals itself. Certainly XP shows no signs of doing so without help.

Nor have I noticed software companies that sell stuff with holes in it offering freely as other suppliers do, to replace the product with one that works. (Options available are fix it, replace it, refund its cost).

Are you suggesting it's acceptable to have something like: "Oh, defects in our car kill people but on average it only kills them 2 years after they buy it, so let's just move on, folks" ?

The main time limit that applies under our law in Australia is whether you raise with the supplier the issue of it being defective in a timely manner -- that is, when you find out it is defective.

But of course, in a reverse Catch 22 or 23, when software companies keep source code secret and lobby and get laws against disassembly of their code by an "owner/renter", they prevent the buyer obtaining information about the defect anyway! And they use intellectual property legislation aggressively to make sure there's no competition for their defective products.

I think you'll agree that they also often keep defects secret and don't inform the purchaser of them -- something that doesn't look good in most consumer law. Or for that matter, in many ethical systems. (Check yours.)

So: "we own it, we sell it to you, all our previous versions have had defects so this one probably has too, but you can't explore that yourself, and we won't give any fixes after x years anyway because that wouldn't be profitable, regardless of what it does to you, and you can't get a product that has defects fixed from someone else..."

This is a civilised way to behave? Ethical, legal business? Good-for-you free competition ? Lol.

Re:Implied warranty for how many years?

[tepples]

Legislation in Australia doesn't specify a time limit: if a product is defective when sold, it's defective when sold.

Does this apply even if a defect is discovered in a 30-year-old car?

That's logic, surely.

I believe there's something called a statute of limitations.

If the author of a computer program and his heirs are obligated in perpetuity to fix any and all defects discovered in the program, and this perpetual obligation holds up in an Australian court, this means that being the author of a computer program (or the heir of such an author) brings about an indefinite liability. Such liability would in my estimation cause a lot of companies to leave the Australian market.

Re:Implied warranty for how many years?

[quink]

Yes, of course there's a statute of limitations... And statute of repose....

And there are exceptions...

For example, there's the problem of asbestos and asbestosis, for example, where results don't emerge until 40 years later ... And many issues in that area are still being litigated.

The main point is that there's no reason to accept the supplier's self-interested denial of any responsibility beyond a year or two or some fictitious "warranty period". Attempts to define such "warranty periods" that pay no attention to legislated rights are actually illegal in Australia, have been for some time, and don't seem to have scared off all commercial software dealers. As someone pointed out: the EULAs have to quietly admit that (usually unspecified) aspects of Australian law still apply. ie, no specific "warranty period", no no-refund policies, no no-replacement policies, no no-guarantees policies. Of course, there is the problem of who the court-trolls are...
Meanwhile, back at the ranch....where software suppliers are going to rushing away in droves....
Adobe and Microsoft have been charging Australian customers such huge amounts for (usually downloadable) software that it has been calculated it is better with some popular products to pay for a return trip to the USA, stay at a nice hotel, have a few good meals, buy the software at $US prices and return (with frequent flier points) and have change left over, compared with the price demanded for the same software in Australia. Try checking comparative prices in the different territories for software and airfares. Signal that you want to download at US prices from a US site with an Australian IP address and you are usually turned away. (Hence a growing interest in proxies...)
All this and a Free Trade Agreement ?

I don't see Adobe and Microsoft rushing away from that, do you ? Hasn't exactly happened with a rush yet -- and the consumer laws have been in place for about half a century. I guess they could rush to China, where the copyright protection on their product is so strong..

Re:Implied warranty for how many years?

[tepples]

Perhaps the prices are higher in Australia specifically to pay for the cost of indefinite implied warranty service.

Re:Implied warranty for how many years?

[Anonymous Coward]

Nonsense.

  If so, no doubt Microsoft and Adobe representatives called before a Parliamentary committee last year would have mentioned that specifically. They'd have been all over it ... looking for all kinds of excuses. They talked about lots of other things, but no-one was opening that little box, thank you, because it's a joke. And in fact, Microsoft were pretty forthright in their reasons for price differences: they asked for them because they could.
The only cost involved for "implied warranty service" is the same as it is in other countries -- it's amortised, and they haven't given unlimited service anyway. We're mostly talking about downloadable software for an English-speaking country. Big deal.

And you haven't been reading very closely. The warranty here isn't infinite. The legislation simply doesn't put a limit on it, while preventing suppliers from purporting to set their own. As I mentioned, there are general limits set by the common law -- and as interpreted by the courts. But it's not as though the case of the 30 year old car is any sort of equivalent. There are allowances for normal wear and tear in the law which preclude that.

But I haven't noticed a lot of wear and tear on compiled code recently. Do you see a lot of that ?

To quote one reporter:

"Adobe said it offered a specialised "bespoke" experience for Australian customers.
Apple blamed local copyright holders for higher prices on its local iTunes store.
Microsoft said its prices were set and customers could vote with their wallets.
Except customers couldn't exactly do that because of geo-blocking."

I can assure you, as a license-holder, the "bespoke" experience is smoke more than spoke.

And I wonder if anyone has seen a fix yet for all the versions of Microsoft Word where simple paragraph numbering was continually broken and master document mode a running joke working to corrupt all your component files... ?

Don't make me laugh.

"Rinse, Lather, & Repeat" troll... apk

[Anonymous Coward]

Grow up above all else (get over being "butthurt" after I obviously thrashed you before) -> http://tech.slashdot.org/comme...

APK

P.S.=> It's incredibly obvious I've "spanked you" before & you're "butt-hurt" over it - odds are, you BROUGHT IT ON YOURSELF, vainly *trying* to "take me on" in some tech discussion & losing badly on YOUR part - hence, your reprehensible attempt to spread libelous lies/rumors about me that are untrue... pitiful of you! Truly pitiful...

... apk

Wait! XP, has a registry?

[Anonymous Coward]

Wait! XP, has a registry? This is a trick. I bet Bill Gates is behind this dirty stinkin' rumor.

Works for me!

[BoFo]

I had been running Easy Peasy on my Asus Eee 1000H, but I was having trouble maintaining a connection via 803.11n. To fix the problem, I fell back to Windows XP, but from the very beginning I was having troubles using Windows Update from even before the expiry date.

I installed this hack and was able to fix all my problems and my Asus is almost back and up to date. The final problem was Microsoft Security Essentials that refused to operate after April 18th, 2014. I uninstalled it and installed the free version of Avira -- problem solved. Plus, I have some applications that will not run on Windows 7, so this hack was a great boon.

Anonymous

[Anonymous Coward]

This is how you do it:
1. Create a text document, and call it XP.reg. Be sure that the ending is Ã.regÃ(TM) not ÃXP.reg.txt.Ã(TM) (check this in Windows Explorer by going to Tools > Folder Options > View and uncheck ÃShow hidden files and foldersÃ(TM))
2. Right click the file, select ÃEditÃ(TM) and type in:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\WPA\PosReady]
"Installed"=dword:00000001
3. Save it and double click the file twice with the left mouse button which will add it to the registry.