Slashdot Mirror
Slashdot Asks: In the Wake Of Ransomware Attacks, Should Tech Companies Change Policies To Support Older OSs Indefinitely?
In the aftermath of ransomware spread over the weekend, Zeynep Tufekci, an associate professor at the School of Information and Library Science at the University of North Carolina, writes an opinion piece for The New York Times: At a minimum, Microsoft clearly should have provided the critical update in March to all its users, not just those paying extra. Indeed, "pay extra money to us or we will withhold critical security updates" can be seen as its own form of ransomware. In its defense, Microsoft probably could point out that its operating systems have come a long way in security since Windows XP, and it has spent a lot of money updating old software, even above industry norms. However, industry norms are lousy to horrible, and it is reasonable to expect a company with a dominant market position, that made so much money selling software that runs critical infrastructure, to do more. Microsoft supported Windows XP for over a decade before finally putting it to sleep. In the wake of ransomware attacks, it stepped forward to release a patch -- a move that has been lauded by columnists. That said, do you folks think it should continue to push security updates to older operating systems as well?
No. You can't support legacy software forever. If your customers choose to stay with it past it's notified EOL then they are SOL. Any company using XP that got hit by this can only blame themselves.
Should they go back and patch Win95 while they're at it? Make Win386 rock-solid in the face of current virii and ransomware?
By that same logic, you could insist that Ford go back and install safety glass and airbags on any existing Model T's still running.
The simple fact is that OS's are a treadmill. It's a not a typewriter that you buy once and use until it breaks.
Look, I think OS firms *should* support 'the last few versions' - say whatever was current 10 years ago (ie in MS's case, Win2007). But to go back further, or to MANDATE that?
If you can't be bothered to run reasonably current OSs, then you're going to be as safe as you deserve.
-Styopa
I honestly can't figure out where I fall on this. I would say for major security issues, yes, though the cutoff should be when production use of that OS get below a certain point, which should be easily monitored, and I don't think XP went below that.
In any event, that an organization the size of NHS, quite literally one of the largest employers on the planet, did such a poor job on security is disgraceful, especially considering how internetworked all their stuff was.
Indefinitely? No, only as long as they want to keep their copyright/patent privileges on those systems.
“He’s not deformed, he’s just drunk!”
I've installed Windows 10 on my PC and TRY BING TODAY it's not that bad.
#DeleteFacebook
Abandoning Operating Systems is a cruel trick played by vendors who want the new revenue from upgrades...no matter what the cost in lost-business, learning-curves, and incompatibilities with existing practices may be to the customers.. Spending money on maintaining the security (even excluding features) of superceded products distracts from development of improved products, and is not in the vendors' self-interest.
Given that a new Operating system (retail) is in the $100-$150 range, I'd propose "Life Extension" service subscription, solely for security updates in the $30-35/year range...with a required minimum of 10,000 customers to keep maintaining the service. That provides enough revenue ($1,000,000+ per annum) to support a small, dedicated staff.
Frankly, there's no reason that a M$ couldn't engage in a Joint Venture with a small qualified, independent security firm to provide the service, with special access to proprietary information within the O.S. vendor.
It would be an investment in the rehabilitation of the O.S. vendors' reputation, because M$ has gotten quite high-handed in recent years, dictating (or even forcing) software on unwilling customers.who have existing businesses to run.
Because crooks keep being more inventive, finding new -- heretofore unanticipated -- ways of tricking users and software.
You might as well ask, "How many law enforcement officers are out there?" There will always be some to invest their inventiveness in making a quick "killing" instead of engaging in honest, hard work of designing products that people want. Computer criminals are not interested in the niceties of business, like marketing, and advertising, and customer satisfaction...they're only interested in finding an easy way to make lots of money in a hurry.
Solve THAT problem, AC!
Slashdot generally doesn't like ludicrously-long copyright terms, right? What if we made maintenance a requirement for retaining copyright over software? If Microsoft (or whoever) wants to retain a copyright on their software for 70 years, then they'd better be prepared to commit to 70 years of support. If they want to EOL it after 5 years or 20 years or whatever, and wash their hands of responsibility, that's fine, but then it's public domain. Why should we let companies benefit from software they don't support anymore?
This could also work for art works, as well -- because copyright exists "To promote the Progress of Science and useful Arts," we could make it a requirement that an author (or company, or whatever) needs to be distributing (or licensing for distribution) a work to have copyright on it. When it's out of print, it enters the public domain.
What I want to know is why Samba wasn't disabled already. Isn't this something that can be done with Group Policy?
If God forks the Universe every time you roll a die, he'd better have a damned good memory.
You're confused, virtual machines can become infected and spread infection and clog networks too. That is not a solution. Having backups and archives of infected files is not a solution either. Guess again.
They already exist. They're called routers. Network routers can be configured to provide great deal of protection to machines that are older and cannot be patched. Many contain firewall software. Even simple ones can be configured to block traffic on vulnerable ports.
In this case, a router could be configured to keep the SMB port (445) blocked. A router, with updated software, and a firewall gateway can help protect even older devices with embedded code that may no longer be supported.
Of course, it goes to say, that you must keep the router's software updated and not use default credentials on the router.
The NHS decided to not upgrade many old systems because the threat was deemed minimal. Offices were urged to upgrade but funds were not made available and infrastructure budgets were cut again and again. Multiple bad decisions led to this result.
Many things could have prevented it. Better funding, better threat assessment, the NSA informing Microsoft of the vulnerability so it could have been patched years ago, and on and on...
In the end we are here, and hopefully threats will be re-prioritized and better protections will be put in place in the future (I could not keep a straight face while typing that and finally burst out laughing).
" Honestly a simple backup will prevent most ransomware attacks"
Uhhh, what? In fact, more attacks have encrypted user files recently, so you're not going to stop this any time soon.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Not to mention that often the reason why a legacy OS is still being used isn't so much software as hardware, and drivers for same. Sometimes that stuff can be connected to a VM, sometimes not.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
windows 10 enterprise let's you turn that stuff off but it's to bad that smaller places can't really get windows 10 enterprise. Unless they get into a long term contract for software
they only way forward for me was running a USB hub to allow switching between computers piled on my desk and keeping my old XP box at the ready in case there was some critical app to which I had lost the installation. media that I needed.
You do know that you can have XP in a virtual machine, don't you? Or for that matter, other obsolete OSes such as 7 and 10.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
The secrets will always get out.
To be fair, this would have happened either way. Maybe (and this is a big maybe) that it would be found out so far down the line a lot less people would be affected, but odds are that someone would have found it anyway. Also, if you think the Chinese and other nations with big cyber divisions aren't sitting on their own vulnerabilities I think you're kidding yourself.
Not only that but the fact that they released the "patch" as soon as the word was out that the NSA toolkit had been leaked into the wild is damning evidence - they knew about it all along and this patch is damage control. The REAL damage is letting them get away with shit like this for decades.
Seven puppies were harmed during the making of this post.