Should I still be getting XP updates?

Mr_Toad

securityguy wrote: »

"until MS ends support."

Oh, it's going to be such fun.

http://www.theregister.co.uk/2014/01/14/win_xp_uk_gov_hacker_deadline_miss/

Oh yes

I'm glad I'm out of it. I struggle to understand home users hanging on to an unsupported OS, even on money saving grounds, when the sharks are circling but the government and the NHS just beggars belief.

I imagine there'll be a lot of extra traffic on here from people who have got something nasty after April.

There's room on the couch, don't forget the popcorn

John_Gray

Microsoft has just announced that Security updates will be available for Windows XP until July 2015.

http://www.bbc.co.uk/news/technology-25758308
http://www.theregister.co.uk/2014/01/16/microsoft_xp_security_updates_extended/

securityguy

John_Gray wrote: »

Microsoft has just announced that Security updates will be available for Windows XP until July 2015.

Actually, that's not quite what they have actually announced. It's worth reading the actual announcement while keeping a fine tooth comb and a lawyer to hand. All they've announced is that they'll continue to provide updates for pattern files past April, so that Security Essentials and its enterprise equivalents in the Forefront range continue to function.

Microsoft has announced the Windows XP end of support date of April 8, 2014. After this date, Windows XP will no longer be a supported operating system. To help organizations complete their migrations, Microsoft will continue to provide updates to our antimalware signatures and engine for Windows XP users through July 14, 2015.

This does not affect the end-of-support date of Windows XP, or the supportability of Windows XP for other Microsoft products, which deliver and apply those signatures.

For enterprise customers, this applies to System Center Endpoint Protection, Forefront Client Security, Forefront Endpoint Protection and Windows Intune running on Windows XP. For consumers, this applies to Microsoft Security Essentials.

That won't cost MS much, if anything, to do, given they'll still need to provide the patterns for Security Essentials on Vista and 7. It also doesn't make much difference on the ground, because the number of people using the MS scanners (as opposed to running the various free and commercial third-party AV packages) is probably quite small. "Security Essentials" came very late in the XP lifecycle; it wasn't released until late 2009, long after XP had stopped being sold on new systems. Similarly, I doubt Forefront is a major player in the enterprise XP space, for much the same reason. I can't imagine organisations stuck on ancient versions of XP (often because they're stuck on IE6 because of !!!!!! non-conformant applications) are using Microsoft's shiniest AV package.

So people that are using XP plus some commercial AV package are no further forward: their commercial provider was probably going to continue to ship pattern files, and Microsoft still aren't going to fix any underlying vulnerabilities. People using XP with Microsoft's own AV suite are now no worse off than people using Symantec (or whatever).

dogmaryxx

The End Is Nigh for Windows XP: These Anti-Virus Software Products Will Continue to Protect XP after the End of Support

http://www.av-test.org/en/news/news-single-view/artikel/the-end-is-nigh-for-windows-xp-these-anti-virus-software-products-will-continue-to-protect-xp-after/

Uxb

I still wonder what would happen if some humdinger of a loophole/hack was found in XP after support ends.

MS would be under enormous pressure to issue a fix - particularly as they would already have done the work on closing the hole for those who are electing to pay MS a great deal of money to continue supporting XP for a year or so just for them.

securityguy

Uxb wrote: »

MS would be under enormous pressure to issue a fix - particularly as they would already have done the work on closing the hole for those who are electing to pay MS a great deal of money to continue supporting XP for a year or so just for them.

The people who have actually paid might not be happy about that.

Having also been on the receiving end of "extended support", it's also not exactly done by the A Team, and often the fixes are _very_ hacky. They're not tested on anything approaching a full range of systems, just the systems and applications being used by the customer who's paying for the work to be done. There is a massive difference between a customer specific fix issued to a single customer to fix a single problem in a particular configuration, and a general fix usable by everyone.

Lum

Mr_Toad wrote: »

I'm glad I'm out of it. I struggle to understand home users hanging on to an unsupported OS, even on money saving grounds, when the sharks are circling but the government and the NHS just beggars belief.

The problem for a big org such as the govt or NHS is simply the sheer number of different systems that are out there, and the number of applications that are depended on day in, day out, that either haven't been updated to work on newer systems, or that are too costly to upgrade.

A general rule of thumb I've found in my years doing the sysadmin thing, The more specialist the industry, the more terrible the software. Partially because finding people who are competent programmers who also know the industry is basically impossible and partially because when you have little or no competition you can get away with putting out any old piece of barely functional crap.

So yes we see apps out there providing critical functions that require ancient insecure versions of Java running under IE6 in order to work, and anyone stuck with one of these is going to have to either stick with XP or find some alternative way of doing things.

The latter is a massive undertaking when you're a huge org full of people who are doing things by rote and resistant to change. It will generate huge retraining costs. Even things like the Office 2007 ribbon are hugely disruptive! and then it ends up all over the papers as yet another expensive failed government IT system.