A couple months ago I installed XP onto a ThinkPad X120e; being the first dual-core AMD ThinkPad the hardware is relatively emaciated, and I wanted something lightweight and productive for it.
I used legacyupdate.net to apply all available important and recommended updates, as well as some nice-to-haves such as updates to the .NET infrastructure. I have been using the Supermium browser, which is an up to date fork of Chromium for older versions of Windows, including XP. All of this has gone off without a hitch, and the laptop has been great to me with its current configuration.
Recently in the tech news sphere I have seen articles exclaiming what a bad idea this is, demonstrating how connecting XP to the internet for just a few minutes leaves it riddled with viruses. Decided to run an MBAM scan with updated databases to see for myself, and it's totally clean.
In other news, this thing is a great little Diablo II machine. I'm maining necro right now.
I can't say if the infections themselves are real or staged, but they clearly and explicitly set the OS up for failure: they give it a public internet IP, enable file sharing, RDP, remote assistance, then disable the firewall for good measures. No modern OS would fare better in those circumstances.
It's not like tons of embedded systems aren't still using XP to this day either.
Go back in time and connect it to a network full of infected hosts, and you'll have a very different experience.
Why is it such a surprise that a machine won't get infected when the common vectors of attack for those OS's no longer exist.
remember malware used to simply crash hard drives, erase everything, sloww your system down, cause bsods... it was mid 2000s when a wise man once said something along the lines of "its amazing that malware can install, auto update, and run flawlessly without the user even knowing - something the OS fails to do"
the browser is not simply safe because the os is safe - certainly the OS helps, but the browser is safe due the latest code techniques and sec folks investing so much time into it. if they solely relied on the os being safe, then we'd all be fools to use a browser - i mean, more than we are in allowing javascript so much power
https://www.theregister.com/2023/07/24/dangerous_pleasures_w...
A key watchword is to not let any MS code access the Internet. Don't use MS email, chat, media players, etc. Use more modern 3rd party ones and you're much much safer.
It's more or less necessary to use IE to get it set up, but you can install IE 8.0.6001 offline before you start updating it, which also saves about half an hour.
What makes this truly devious is that there's a kernel of truth to it: Connecting Windows XP to the internet will indeed give you a bad day.
That's not what happens most of the time now, though: Most computers, Windows XP or otherwise, are going to be connected to a LAN behind a gateway/router and a firewall sitting between the LAN and the internet. Windows XP is therefore isolated from most of the threats that are indeed very real.
Windows XP itself also has a firewall built-in, though the OOTB settings won't provide adequate protection.
The moral of this is, the best lies are those with hints of truth sprinkled in.
Have to try to emulate that by removing the default gateway and adding a proxy to the network.
[0] https://www.youtube.com/watch?v=6uSVVCmOH5w
[1] https://www.xda-developers.com/connected-windows-xp-internet...
Of course they would. Modern Linux, FreeBSD and macOS are totally fine connected to the internet directly with ssh enabled and no firewall. Sure; if you expose samba with write access and no password, you’re in for a world of hurt. But so long as your machine is kept up to date with security patches and has some form of authentication on all remote services, it should (generally) survive just fine on the open internet.
Of course defence in depth is still a good idea. But script kiddies aren’t using 0day attacks to portscan the open internet. But security vulnerabilities in network services get fixed.
All end-user PCs have been behind NAT since the late 90s unless the system was a dialup straggler. Enterprise users raw-dogging the internet only have themselves to blame.
NAT has more benefits - I don't want anyone to know how many devices I have at home, I don't want anyone to know which one I'm using to access their website, I don't want anyone to try guess the OS and version of my devices, etc. And now I'm scared to have a simple DLNA media server because I can't just install WireGuard on the TV. I'm probably going to buy a router and make my own NAT soon (don't have access into the ISP modem).
I felt better when the whole municipality had a single IP address. A lot of bullshit ads - means the targeting wasn't working. Now they're way too good.
And, no, I don't think it's practical for everyone and their grandma to "just set up a bastion"
This is flat-out untrue. Beyond hyperbole. If JavaScript had the system access that literally any piece of malware sought, the world would be an utter shit show in a way it simply isn’t.
Make it available on public IP wait until IP is listed on shodan telling it is XP and then let us know how long it was running without being infected.
The whole security circus is a legend and a paranoïa that mostly serves OS manufacturers. And now that Recall exists, it will be difficult to maintain that Win11 or M$ care about security at all.
Contrast that to using public WiFi in NYC where everybody knows exactly where you are.
And with IPv6 all my devices could be publicly addressed but I've enabled a firewall to block incoming traffic at the router level.
But as far as I can tell, that's only relevant for an attacker who can MITM the connection between the local router and the next ISP router, since clearly the ISP wouldn't know who to forward the local address to. I'd think it isn't within the threat model of the "typical internet user" who'd be running such a poorly-configured network.
And yes, incompetent ISPs are the norm.
Before IPv6 it was a classic internal LAN with IPs like 192.168.0.1.
There is a dramatic difference in effort between ( owning a device ) and ( owning a router, configuring network access to the device, then owning the device ).
Also psychologically: If I was a rock hard piece of shit and I knew I was at the doorstep of a personal device, I would treat it much more aggressively than a router. I suppose maybe that's just me and not the kids and enemy states.
edit: Changing the subject to insulting me is a bad way to conclude. You're creating an illusion the debate is concluded in your favor instead of responding to points. I don't think any of my points had a sound argument against them.
I can't configure anything technical about my internet. Any change is paid, and often simply not possible.
That said: for every idiot who hooks up a Windows 98 machine to the internet, there might be some other idiot checking whether exploits targeting it, still work. Or exploit kits that sniff an OS, and select exploits to apply accordingly.
Vulnerabilities tend to have a long tail...
Even if your ipv6 host or border firewall allows pings through, it's not practical to scan an entire /64. There's just too many addresses in it, and your devices will frequently change them.
> I don't want anyone to know which one I'm using to access their website, I don't want anyone to try guess the OS and version of my devices, etc.
They already do this through fingerprinting that operates with higher-layer protocols.
> And now I'm scared to have a simple DLNA media server because I can't just install WireGuard on the TV.
This is very simple to implement. Ensure it's listening on the link-local address. That's the IP that starts with fe80. These are unrouteable by spec.
It's very hard to distinguish my iPhone and Mac from the other dozens/hundreds people have in my building just through fingerprinting. Very easy if they have separate IP addresses.
Ad link local - cool, I'll look into that, thanks.
I have exactly one machine which needs to be accessible from outside the local network. The rest of them should never be. Do I want to spend extra time ensuring that each and every single device on my network is secure, or do I want to do the inverse and assume all devices are secure and only spend effort to make the one machine exposed?
I can't imagine anyone who would actually want or need their WiFi toaster to be publicly routable, WiFi cameras, every computer. There's absolutely no reason for it. Instead of relying on network isolation, we expect users to just implicitly rely on who knows how many different firewall implementations. Hopefully your router configures it by default.
It doesn't matter if everyone in your building has an iPhone and a Mac as well -- there are things about virtually every single one of them that make them unique.
It is not the address translation mechanism that does the protecting but rather the state tracking.
Until very recently I was with an ISP with IPv6, and things like my home printer had IPv6 addresses—but just because they were globally addressable did not mean that they were globally reachable.
When my (previous) ISP switched on IPv6 none of my internal devices could be connected to because my Asus did stateful packet inspection and only allowed in replies to connections that were previously initiated.
> NAT has more benefits - I don't want anyone to know how many devices I have at home, I don't want anyone to know which one I'm using to access their website
Given that temporary IPv6 addresses tend to rotate every 24 hours it will kind of hard to track individual devices by IP in a 2^64 address space.
You could rotate addresses 10 million times per second, using each only once, and it would take over 5000 years to exhaust a single /64.
> I felt better when the whole municipality had a single IP address. A lot of bullshit ads - means the targeting wasn't working. Now they're way too good.
I now have to use a ISP-supplied router (for GPON), but when I still had my Asus on the DSL/IPv6 ISP I could tell it to reboot every night and I would get a new IPv4 address and a new IPv6 prefix every day.
If you could scan one million addresses every second it would take about 500,000 years to scan just one /64. Not sure how practical that would be.
When I was still with an ISP that did IPv6 my Asus would block any incoming connection attempt unless it was a reply (SPI firewall), though it may have (IIRC) allowed pings in by default.
It's usefulness is limited on XP but you might have applications that are captured. They also haven't closed the door (at least as of last year) to patching any future major-drama events that come up: https://0patch.zendesk.com/hc/en-us/articles/360018274139-Do...
Unfortunately, I'm pretty sure that's all routers I've ever seen. You can protect yourself if you're willing to break web applications and applications built on web technology. Just disable all of the SIP ALGs in your router and you'll have the security of IPv6 on IPv4!
You have a router, it has a firewall, that is meant to be used to control access to the network, you don't have to assign rules to every device you can assign default interface rules that apply to any connection.
Just because you get a publically routable address doesn't mean the internet defines physics and hops over your router and firewall.
Also as an aside - perimeter security is a very outdated way of looking at security, yes the perimeter is still important but if it is your first and only line of defense you are gonna be in for a bad time, defense in depth as it is called where you look at your systems and networks as layers to an onion is the more modern standard and NAT as a security mechanism has never been standard in either because it isn't.
With NAT, it doesn't work because the ports get remapped, and the intermediary doesn't know how they will get remapped on the p2p connection, so they can't coordinate to send on the correct ports to open the firewall.
Or UPnP can work. By default, your router drops incoming packets on all ports. If you want to e.g. run a game server, then on startup, it hits a standard API to tell the router to forward that one port. On shutdown, it can tell it to close the port (you could potentially also have the router require keepalives to keep the forward alive. I'm not familiar with the details of UPnP and related protocols).
Without a public IP, you need intermediate servers to relay all traffic to you, which centralizes the web. With p2p working, you can e.g. have high quality video calls with friends/family instead of dealing with the garbage quality tech companies allow. Or I can share with my mom photos of her grandkids with effectively unlimited storage; for 2 years of 2 TB Google storage, I can buy 20 TB of disks.
1) People looking to play retro games
2) People looking to work with legacy hardware, especially in manufacturing and healthcare
3) People who want the comfort/familiarity of an older operating system
I'm always careful to issue a disclaimer that Windows XP should never be used for anything where you need security, in practice, I don't see much of an issue. The reality is that although XP is a tempting target in terms of vulnerability, it's not widely used enough to be useful to modern malware.
The machines I sell come with Windows XP Delta Edition[1], which as far as I know comes with all the available updates for XP already installed - no Legacy Update necessary. I've been using the Mypal browser [2], but will definitely try Supermium!
[1] https://xpdelta.weebly.com/xp.html [2] https://github.com/Feodor2/Mypal68/releases
If I read that right, I would like two things clarified:
1: what "default installation" means. Do you have any open network ports?
2: What does "get a malware" mean? Do you mean it was possible to get malware because a user downloaded som random binary off of the internet? Or do you mean that entirely passively, some malware remotely exploited some network service?
I would like to contribute my experience: I have been responsive for running many Debian servers on the internet for that last 25 years. During those years I have not once encountered one of my systems being compromised. Of course, you might say that I have just been unknowingly compromised. While this is indeed possible, it is possible for all systems to be compromised without owners knowing it.
You could also just use an old pc...
For software opnsense, pfsense, openbsd, freebsd, Linux (openwrt could be used too if you want embedded)
It is a pain to start ... But satisfying when it works :)
You realize that wasn't the norm though right?
Even then id still rather ensure every device is appropriately firewalled. 'not worrying about it's sounds like a hardened shell with a juicy center. What happens when a device does get compromised and tries to spread to your local network?
And showing a single contraindication doesn't mean it's "crap" just means you haven't been exploited yet.
But it isn't like you are paying bills on it, so enjoy.
I didn't test this with a virus check, but I have a bitcoin wallet with 0.1 BTC and without password on my HDD. Still there.
Probing for obscure OS that isn't there on the other end = opportunity cost.
Both probably. I don't see where the "opportunity cost" is when you can trivially do both. Please describe the opportunity cost in detail; that is what I am asking about.
That said, as there's currently no way to legally buy Windows XP from Microsoft (or any official source), it's not really harming anyone to just install it wherever, in my view.
I also sell Windows 10 machines, and they all come with genuine licenses (often also OEM, or I buy them). I often get questions about whether my Windows 10 systems are genuine Windows, but nobody has ever asked about XP.