Why Microsoft really patched XP

http://nothingjustworks.com/why-microsoft-really-patched-xp/

by drzaiusapelord • 12 years ago

48 57 12 years ago

Piskvorrr3• 12 years ago

Interesting idea, yet it doesn't quite line up with the facts, IMNSHO: IE on XP only goes up to 8, yet this CVE goes up to 11, and it's what, two weeks old? http://www.symantec.com/connect/blogs/emerging-threat-micros... - and guess what, the recommendation is "Do not use IE, at all, not even the new versions." Both the browser and its brand are broken beyond any repair.

higherpurpose• 12 years ago

Sure it does. The moment I saw headlines like "US government recommends against using Internet Explorer" because of that bug, I thought "Chrome and Mozilla guys must be over-joyous with this". Google already promised enterprises that they'd support XP a year longer than Microsoft, for Chrome. This made it even easier to convince them to switch to Chrome. And I don't think Mozilla plans on ending XP support anytime soon either. I think they only ended Windows 98 support a few years ago.

omh• 12 years ago

But after the patch the advice wouldn't hold any more, everyone could go back to happily using IE.

If XP wasn't patched then the news articles would be more nuanced. The "Internet Explorer is dangerous!" theme from earlier articles might have continued and left the average consumer thinking that IE was broken everywhere.

(I'm not sure if I totally agree, but this seems to be what the article is suggesting. And I think it still makes sense even with IE on XP stuck at IE8)

jevinskie• 12 years ago

"Do not use IE until a patch is released" is what it really said. The browser has been steadily improving its standards compliance with each new version. Yes, many people are using alternative browsers nowadays but I don't think that means IE is hopeless.

Piskvorrr3• 12 years ago

"Until a patch is released - sometime, eventually, hopefully: no clear date is given, and the track record says this same situation will repeat within six months."

unistdh• 12 years ago

Off topic - but I can't decide if I love or hate the theme used on this site..

mixedbit• 12 years ago

I like it, although colorful banner ad at the bottom does not fit well with this design. On the other hand, banners ads rarely fit well with any design.

nandhp2• 12 years ago

It bugs me that the font is off...

Jehar• 12 years ago

It has promise, but it irks me that trouble was went to to include the iconography, but they aren't interactive - only the labels are.

buckbova• 12 years ago

http://theme.wordpress.com/themes/retro-mac-os/

It's a fun theme for a personal site. I see the theme reference was removed from the site though.

BlakePetersen• 12 years ago

Looks like their WP DB borked...

Piskvorrr3• 12 years ago

HN effect, I suppose. Reposting here (let me know if I'm stepping on anyone's toes):

Why Microsoft really patched XP

Long story short, it hurt their IE brand. MS no longer has to worry about reputation management for the XP brand, but they sure do for IE.

Can you imagine the conventional wisdom for IE being, “Don’t use it, ever. It has known holes that MS refuses to fix.” Even with the qualifier, “Only on XP,” it would be a PR nightmare for a browser that isn’t exactly well loved.

So where does this leave MS now? Arguably, they’re going to continue to patch XP for non-paying extended support customers depending on the severity of the exploit and especially if it affects IE. We probably won’t see anything patched outside of serious IE vulnerabilities or maybe a conficker-type vulnerability that can be exploited remotely. Serious vulnerabilities like privilege escalation that crop occasionally will remain unpatched.

What does this extended support mean for web developers? IE8 on XP is alive and well apparently. This is a five year old browser with a poor feature set compared to modern browsers. I remember watching my remaining IE6 traffic disappear almost completely in a 12 month span about three years ago only to be replaced with IE8. Is IE8 the new IE6? Maybe, but whats for certain is that this kind of extended support is just going to make the problem worse.

Of course, the larger question is why aren’t we all using EMET, which thwarts this, and other, vulnerabilities without patching? I tested it in my environment, and Sophos refused to let IE run when EMET was running. Sophos support had no resolution. If third-party AV companies can’t work with first-party utilities, what hope is there of Joe User or Joe Corporate Admin rolling this stuff out and expecting it to work without major issues?

The protections EMET offers are pretty impressive. I wonder why these protections aren’t enabled by default. This would be a good differentiator for Windows9. I could see a business friendly version of Windows with less focus on the Modern mobile-like UI and a return to the full features of the Start menu. Now, imagine it with EMET on by default with an option for admins to disable it via a whitelist. One can dream.

immoderate• 12 years ago

Here is a link to the google cache of the post: http://webcache.googleusercontent.com/search?q=cache:xhJHpCh...

coldcode• 12 years ago

#1 on HN on Saturday was about 150/min sustained. That's not even 3 per second. What in WP makes this an issue, or is it just running WP on a shared instance on a wimpy server. Or is it some config in WP that you need to change?

mnw21cam• 12 years ago

Some web sites are limited by a fairly paltry network usage limit, not by throughput of the server. I don't think you can ever assume that a privately-held domain can cope with unaccustomed traffic, even if it is only 3 per second. Seems to be responding well now, anyway.

ezreal420• 12 years ago

It's actually much simpler than you think. Microsoft have some big customers that pay them to maintain XP. Microsoft like making money, so they maintain XP for them. If these patches make it to general availability is up to Microsoft however, and it looks like they are still doing that.

aninteger• 12 years ago

Big customers like Target that would prefer to run their POS machines on Windows XP. So sad..

jobsquad• 12 years ago

I assume these are Windows XP Embedded machines, which have support as far out as 2019[1].

[1] http://www.zdnet.com/microsoft-remember-some-xp-based-embedd...

ConceptJunkie2• 12 years ago

It's not sad at all when XP does the job and it would cost ridiculous amounts of money to update for no benefit. Now, waiting until the product fell out of support was a mistake, but Microsoft failed to produce a compelling upgrade for XP, period. Even Windows 7, which people generally like, doesn't run on the same hardware as well as XP if that hardware is older, which XP computers are going to be. And Windows 8? Aside from whatever bug fixes or improvements to the kernel might be involved, there is not one thing in Windows 8 that does not exist solely to serve Microsoft's interests, regardless of what customers want.

You can't blame MS when the customers don't see the value in upgrading, because from their point of view, there wasn't one. Now that XP has been sunsetted, everyone is worried, and there are a lot of companies that were very foolish in not moving to a viable and supported solution... except that in some cases, there literally isn't one.

There's a tremendous amount of legacy software out there that does the job and doesn't need a newer OS. A few years ago, one of my kids had use a portable brain wave monitor for a couple days, and was issued a device that he would be hooked up to, and guess what? It ran Windows 2000. I wasn't surprised at all. Windows 2000, as an OS, was one of the most solid releases Microsoft ever had (not necessarily the userland stuff, some of which was horrible, but the OS itself was fine).

By the way, the monitor found that everything was normal, my kid's just weird. ;-)

I would imagine those devices are probably still in use, and why not? Windows 2000 was a perfectly solid OS and was very secure on a non-networked device. XP didn't suddenly become not a good OS, Microsoft just pulled the plug without offering a good option for people with old hardware that didn't want to (or couldn't afford to) replace it.

davidgerard• 12 years ago

Site is being hammered. Cache: http://webcache.googleusercontent.com/search?q=cache:xhJHpCh...

benjaminpv• 12 years ago

I wonder why these protections aren’t enabled by default.

Because bugs exposed by a change in Windows are used to denigrate Windows, not the developer of the buggy app[1].

[1] http://blogs.msdn.com/b/oldnewthing/archive/2003/12/23/45481...

mikeash2• 12 years ago

Unfortunately, this sort of thing seems to snowball. MS bends over backwards to preserve backwards compatibility, so third-party vendors basically have free reign to abuse the OS, requiring MS to bend over backwards even more to accommodate them, and on and on.

Apple, for example, had much less of a problem with this even before the days of the App Store and the accompanying restrictions, because developers largely knew that if they depended on undocumented behavior there was a good chance that their app would break and Apple wouldn't fix it for them.

ntakasaki• 12 years ago

The other side is that Apple is not preferred in many corporate shops exactly because of that.

twistedpair3• 12 years ago

There are many stories to MS doing this. There are actually tons of conditionals in the MS source and kernel explicitly to fix broken vendor code. Look up the SimCity fixes they put in the Win Malloc to fix bugs Maxis wouldn't so that upgrades wouldn't break the game, despite the bug being entirely Maxis' fault.

chasing• 12 years ago

"Long story short, it hurt their IE brand. MS no longer has to worry about reputation management for the XP brand, but they sure do for IE."

Maybe I'm being a little off-topic, here, but I don't think it can be overstated how much Internet Explorer has destroyed Microsoft's brand. Apart from it being their largest consumer-facing brand apart from Windows (I think), I suspect that more people came into programming through web development between 1995 and 2005 than via any other path -- and for that decade IE was basically a big advertisement for the worst sides of Microsoft during those years -- the side that steamrolled competition with their lower-quality software, the side that tried to destroy open source and open standards, the side that attracted customers by manipulation and force.

Arainach• 12 years ago

Huh? I think you're off by a decade. Microsoft burned a lot of reputation by letting IE stagnate between 2001 (IE6) and 2011 (IE9), but at the time IE5 and IE6 shipped, they were legitimately faster, more compliant, and all-around better browsers than the Netscape versions of the time. I don't remember IE4 to comment on that, but there was certainly a time where IE was the best browser, both to users and developers. They simply failed to keep innovating on it.

drblast• 12 years ago

When IE4 came out there was no comparison. Netscape Communicator was already a bloated, unstable mess. IE4 was a giant leap forward at the time with a cohesive DOM.

And IE 5 brought xmlhttprequest, which became kinda popular.

aleem• 12 years ago

They simply failed to keep innovating on it.

This was not a failure. Web browsers are a direct threat to the Windows platform and Microsoft consciously chose to drop out of the browser wars.

nivla3• 12 years ago

I wouldn't go as far back as 1995. I remember using Netscape those days and IE was considered the "hip & modern browser" just like we do now for Chrome. It was the best viewed in IE days and since there were no real standards or committee back then, everyone wrote their own feature set including MS. It did sure give us the annoying <blink> and <marquee> tags but remember it also gave us Ajax. The shit only really blew when Firefox came into scene with a faster, secure and more progressive browser than IE.

Although, I personally feel if firefox doesn't catchup with the webkit browsers, we will soon be taking a full circle.

ConceptJunkie2• 12 years ago

Yeah, MSIE was the best browser through version 4. The real reason Netscape lost the browser wars was that it became a huge bloated mess. Now it probably couldn't have beat IE regardless of how good it was because of Microsoft's monopolistic practices, but IE was the best browser for a few years in the mid-90s.

Of course, they then proceeded to let it stagnate for the better part of a decade...

nandhp2• 12 years ago

<blink>

<BLINK> was from Netscape. http://www.montulli.org/theoriginofthe%3Cblink%3Etag

In related amusements: https://www.google.com/search?q=%3Cblink%3E+tag

twistedpair3• 12 years ago

Oh, but let's not forget page transition animations introduced by IE. Thank God those died a rapid death.

The other thing that killed NetScape Communicator is that it had been costing $70 per copy. Remember... people used to pay for browsers.

masklinn• 12 years ago

the side that steamrolled competition with their lower-quality software

That's not true at all, IE was the superior alternative (and the "standard-following" browser) when it steamrolled Netscape. The problem came after that and was a great demonstration of what happens when you give the keys to the kingdom to a single profit-driven entity.

I doubt anybody's learned shit though, considering how fast people jumped to a Chrome-based monoculture and started arguing for the blessing of any and all Google proprietary dropping.

FollowSteph3• 12 years ago

You're thinking techies vs the average user who just uses IE cause it's there. The average user barely knows there's other browsers, or even that xp is no longer supported. How many people still use xp :(

kyberias• 12 years ago

There's this particular style of writing blog articles that assumes that the reader knows all about the context of the topic (here: Microsoft has patched something, have they?) and the relevance to something (what, really?). It's a 5 minute brain dump for the author himself.

dublinben• 12 years ago

That's pretty much a pure example of what a blog entry originally was. Since the author is directly responding to an earlier story, he can assume that the reader is familiar with the context. Especially within the HN community, this is a reasonably accurate assumption. This isn't an article for Time magazine or CNN.

geekster2• 12 years ago

The irritating thing is: While IE is the most veulnerable, the most slowest and the clunkiest internet browser in the universe, it still manages to be the most used browser.

ema• 12 years ago

https://en.wikipedia.org/wiki/Browser_usage_share says chrome overtook IE already 2 years ago.

geekster2• 12 years ago

Ahh, my bad! But I think it overtook in 2013, cause many websites claim that. Cheers!

tormeh• 12 years ago

Just a nitpick: What features were lost in the transition from the start menu to the start screen? The start menu closes if it loses focus anyway, so you can't do other stuff with it open. Arguably, the start menu not being full-screen is a bug. I suspect this is just a case of people not liking change, no matter how trivial.

Well, it did lose the off button, but other than that I can't come up with anything.

the_hangman• 12 years ago

Arguably, the start menu not being full-screen is a bug.

A bug introduced in Windows 95 that they waited until 2013 to patch? I think after a certain number of years it might have moved from a bug to a feature.

For me, the problem with the new start screen is exactly what you describe. I'm fairly scatterbrained. When I'm going to open a program, file, etc., it's usually because of something else I have open, like an email with a request from a co-worker. When the start screen takes up the whole screen, I get distracted from the reason I opened it in the first place and have to go back to my email before I remember. I know that it's my problem, not Microsoft's, but at least having the choice between overlay or full screen would be nice.

jackvalentine• 12 years ago

I consider the context-switching of the huge fullscreen start menu the same as the "forget why you entered a room when you walk through a door" phenomenom.

http://www.scientificamerican.com/article/why-walking-throug...

fragmede• 12 years ago

Can you imagine the conventional wisdom for IE being, “Don’t use it, ever.

That is accepted conventional wisdom among most techies I know.

joesmo• 12 years ago

Yup. No need to imagine at all.

Why Microsoft really patched XP

Related Stories