Slashdot Mirror
Windows XP Support Deal Not Renewed By UK Government, Leaves PCs Open To Attack
girlmad writes: The government's one-year £5.5m Windows XP support deal with Microsoft has not been extended, sources have told V3, despite thousands of computers across Whitehall still running the ancient software, leaving them wide open to cyber attacks. It's still unclear when all government machines will be migrated to a newer OS.
Maybe the UK consider to take Microsoft to court in case something happens and sue them under product responsibility laws or something.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The Brits aren't dumb. They figured out that whether they throw 5.5M at MS or not, XP will run on regardless. Surely MS don't supply the anti-virus / firewall software? That must be 3rd party, and I'll bet, works out a heck less than 5.5M quid. The posting suggests that the second XP "support" vanishes, billions of malwares will converge on those computers. No. Unless MS pays someone to do it...
Simple answer is just too remove all the pc's from the internet. Do they need it to work out taxes, etc? Of course not.
Hyperbole much? Systems don't suddenly develop security holes the day a support agreement is ended. If it was fine the day before support ended, it's fine the day after. Of course, the moment a new issue _is_ discovered, it's game over.
TFA and the summary make it sound as if it is the lack of support contract which makes these systems insecure. This is complete and utter nonsense - it is the fact that they are running Windows XP which makes them insecure. It's not as if malicious hackers around the world were sitting there rubbing there hands in glee, waiting for the day the support contract expired to plunder the systems, having previously been completely and utterly thwarted in their evil plans by the exchange of funds between the UK government and Microsoft.
But at least a support contract would get them fixes for any newly discovered vulnerabilities, right? Well, maybe. No software is perfect, but the world - and Microsoft's practices - have moved on, and realistically it would take a *lot* of money for MS to spend a meaningful fraction of their resources securing an OS past the end of its useful commercial life.
Assuming that IT pros outside of Slashdot are about as smart as IT pros posting on Slashdot, it's quite likely that those PCs have been replaced, reconfigured (remove network card and USB ports, seal the PC case?) or placed in different areas in their networks to mitigate the risks of running XP. Adding extended support at that price needs to be part of the solution, not the only thing they've done. Hopefully they've used that time for deploying and testing new security measures.
It's well understood that Windows is so flaky it needs constant patching and the minute you stop paying, it explodes into a fireball. The only thing keeping that POS software from chomping on your important data is a constant fee paid to Microsoft to tame it.
What you need is to cloudify the lot, you don't see clouds explode into fireballs do ya! That's the power of the cloud, I learned that at MBA school.
Linux would be a refreshing change. And updates are free!
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Exactly what kind of support are they getting? Just telephone type "my cup holder broke"? Seems like internal IT could handle most of that. Or are they actually fixing Windows XP bugs for them?
"I have never let my schooling interfere with my education." - Mark Twain
Now take that 5.5 million and replace your old machines and software.
Support for the current Government reaches EOL next week and currently seems unlikely to be renewed. However, it looks like an upgrade supported by multiple vendors for five years may be in place shortly after:
http://www.telegraph.co.uk/new...
Good tactic from the MS marketing guys to drop this in the news and get them to sign faster without negotiating too much!
At this late point in the game, no government department is going to waste time and money on migrating to Windows 7 - a 5 1/2 year old OS that hasn't received a service pack in 4 years, whose "mainstream support" already ended in January.
With that in mind, you better hope your IT department has at least been following the Windows 10 beta program, in terms of testing on a few machines. It'll be released by October in time for the Christmas gift period - leaving a slim window of opportunity to be deployed at your office by the end of March (the end of your fiscal year).
tl;dr - you're up shit creek... :(
That'd be a quick way for them to get a lawsuit judgement worth far more than the support contract.
If these computers are within a secured network and particularly if they don't have access to the internet, then there isn't any great risk in continuing to use these XP machines.
SURELY NOT!!!!!
Calling an operating system that persists on a significant percentage of computers to this day 'ancient' is ridiculous, I don't think it even qualifies for the term 'legacy' yet.
There have been no less than three windows releases since, and a fourth is about to drop, it's safe to say that XP is 'legacy'. In Windows land, I like to use driver availability as my gauge. If you go into a store you're going to find that only a small subset of the available printers and scanners (and PSCs) even have XP drivers any more. Lots of new PC games now require Vista or later.
In internet years, XP's release was in ancient times. We still use many ancient inventions.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Do you know anyone running Mac OS X 10.1, or Red Hat 6 with the 2.4.0 kernel? How about Solaris 8? Nope, they're ancient -- and the same age as XP.
This space intentionally left blank
They could retrofit all of these XP machines with Linux and open source software that would meet 99% of their needs, at a cost of some re-training, and development / porting of custom software. Naturally, MS would fight this tooth-and-nail. Who said that bribery won't get you anywhere?
In my world, a sun dial is ancient, clocks are old. A litter is ancient, a Model-T is legacy, a 88 Honda Civic is old. When using ancient to describe objections, to me it means no longer in use and no longer relevant. Legacy means, it still is functional and has use, but is far from current and is costly to keep running or maintain. Old means just that... not new. In the world of many younger people it's 'Oh crap, they released a new iPhone, the one in my hand is now ancient.'.
It's Legacy. For me, it turned legacy as soon as .Net 4.5 wasn't supported. Our in house software started using 4.5 features and will no longer run on XP. The literally two systems with XP we have left, for Legacy reasons to run specialized manufacturing software made for Windows 95, have to remote into a terminal server to run our in house software.
If he was twelve, XP was released before he was born.
In IT terms "before you were born" is old. Very old. Ancient. Dead. Buried. Gone.
I touched my last XP install two years ago when I migrated a school using it from XP to 8 (and all their servers a similar jump).
The prime argument? It was a school, and the OS they were using to teach ICT to the kids was OLDER than the kids. All of them. And, as such, they did not know how to operate it because they were all used to Vista, 7 and 8 at home. We were teaching them BACKWARDS skills to do things on OLDER software than the ICT skills they already had when they entered the school.
What percentage it's on is neither here nor there. Still WinZIP is on millions of computers. But it's old. And versions of WinZIP from the XP era are ancient. I bet I could find a ton of computers with Quicktime and Realplayer on them still. They're old. They're ancient.
And, like XP, they are obsolete.
All XP gets regular updates. They have to or the net would break.
Need Mercedes parts ?
Do you know anyone running Mac OS X 10.1,...
Mac OS 10.1? No. Especially since it was just a free bug fix for 10.0. and improved upon by later dot updates. I've still seen 10.4 in the wild and have my own 10.6 computer for older hardware or Rosetta support. Go out to some still running F5 firewalls, and people would probably be scarred as to what version of Linux is being run.
The hardware cost is irrelevant. It's the cost and time to thoroughly test / migrate / rewrite lots of bespoke software, made to the lowest quality by some company like Accenture on a contract, for which the source code probably wasn't supplied and all the original developers have left. And if the system fails the Daily Mail will write about it. And the tories slashed the budget, so all that's left can just about cover the new thing the new regulation requires.
"You have to consider local, internal attacks..."
... there's no real thing as a limited user in XP because it's basically a cinch to demonstrate privilege escalation using any number of pieces of bog-standard software on XP..."
If you know of an attack that works against a Windows XP limited user, please mention it. It is likely it could be fixed without Microsoft's support.
"XP is dead. It's lifespan is over."
Software doesn't die. Are you saying that, after literally thousands of bug fixes, Microsoft had still not fixed all the vulnerabilities in Windows XP? That's certainly possible; Microsoft makes more money if there are vulnerabilities, since people pay full price for the next version of the operating sytstem.
"we had major difficulty getting drivers for things as simple as SATA controllers for it"
SATA add-on cards.
"If you have ANY significant number of XP machines, it's time to pay the pittance that an entirely new machine would cost"
That's not the problem. The real cost is in all the configuration and teaching people to use new computers. There are programs, lots of them, that don't run on Windows 7.
"And Windows 10 is expected to be free..."
I'm guessing that Windows 10 will be "free" because it will force a lock-in to Microsoft's methods.
"If you have a "network", especially a business one, of any description, you are negligent in sticking on XP now."
What is particularly vulnerable about XP on a network? We use a software firewall on each computer, Windows 7 or XP, and everyone operates as a limited user.
"You can't secure XP.
Look at this video of a "privilege escalation": Windows XP local privilege escalation. It's total nonsense. One of the comments: "When you try this without administrator rights you get an error: Access is denied."
So you try to discredit my scale by substituting in an arbitrary scale of your own? You are also trying to imply that old = ancient, suggesting that you have a penchant for hyperbole. As I stated, XP is still very much alive and kicking, with phase out being forced by Microsoft through a cutoff of support more than it becoming obsolete in the business world. Contrast that with DOS, Windows 3.1, NT and 95. Those I would say are potentially ancient, and only persist to run legacy software with no modern alternative (common in laboratories with older gas chromatographs for example).
I work at a company whose IVR system is still dependent on a pair of Solaris 8 systems. :(
I use Macs for work, Linux for education, and Windows for cardplaying.
deserves the attacks they get. I do not see a reason why anyone should be running XP anymore.
....and learn from their mistakes. It now takes me 20 minutes to load Linux Mint on an ex-XP machine, then back to work.