zlacker

[parent] [thread] 16 comments
1. tasuki+(OP)[view] [source] 2026-02-02 07:21:44
> So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?

Is this surprising? My model is that keeping with the new versions is generally more dangerous than sticking with an old version, unless that old version has specific known and exploitable vulnerabilities.

replies(2): >>illiac+61 >>slumbe+0t
2. illiac+61[view] [source] 2026-02-02 07:34:44
>>tasuki+(OP)
Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that running an old software version. Try exposing a windows XP to the internet and watch how long it takes before it‘s hacked.
replies(5): >>card_z+m2 >>tasuki+NI >>bulbar+al1 >>pibake+Qn2 >>thegri+7l3
◧◩
3. card_z+m2[view] [source] [discussion] 2026-02-02 07:48:06
>>illiac+61
Debatable. "I connected Windows XP to the Internet; it was fine" - >>40528117

One comment there points out that XP is old enough for infected attack vectors to have all died out. I dunno.

replies(3): >>illiac+k4 >>bigfat+w6 >>expedi+vo
◧◩◪
4. illiac+k4[view] [source] [discussion] 2026-02-02 08:09:52
>>card_z+m2
https://www.tomshardware.com/software/windows/idle-windows-x...

But good we are talking about my point rather than than the example.

replies(1): >>badsec+H8
◧◩◪
5. bigfat+w6[view] [source] [discussion] 2026-02-02 08:34:01
>>card_z+m2
I experienced this first hand in 2014. We got to a point where drive-by exploit kits just weren’t shipping IE8, Java 6 or Windows XP payloads anymore.
◧◩◪◨
6. badsec+H8[view] [source] [discussion] 2026-02-02 09:02:03
>>illiac+k4
> YouTuber Eric Parker demonstrated in a recent video how dangerous it is to connect classic Windows operating systems

The video referenced in that article explicitly connects directly to the internet, using a VPN to bypass any ISP and router protections and most importantly disables any protections WinXP itself has.

So yeah, if you really go out of your way to disable all security protections, you may have a problem.

replies(2): >>conorc+Yk >>illiac+bs1
◧◩◪◨⬒
7. conorc+Yk[view] [source] [discussion] 2026-02-02 11:06:40
>>badsec+H8
Like leaving the lid off of my typewriter at lunchtime :-o
◧◩◪
8. expedi+vo[view] [source] [discussion] 2026-02-02 11:42:55
>>card_z+m2
Anyone else noticed that we don't even GET patch notes anymore?

"Fixed some bugs" Yes thank you very helpful that! Now I can make a very informed decision.

replies(1): >>latexr+332
9. slumbe+0t[view] [source] 2026-02-02 12:23:00
>>tasuki+(OP)
Steve from Security Now podcast has been specifically using Notepad++ as an example of not being able to leave good enough alone for years now. Can't wait to hear him claim his told you so next week.

Love notepad++ and will continue to use it.

◧◩
10. tasuki+NI[view] [source] [discussion] 2026-02-02 14:01:44
>>illiac+61
I don't know about Windows, but I've been running all kinds of outdated Linux (Debian mostly) and it never once caused a security problem.
replies(1): >>pxc+OQ
◧◩◪
11. pxc+OQ[view] [source] [discussion] 2026-02-02 14:46:58
>>tasuki+NI
Debian backports security patches.
◧◩
12. bulbar+al1[view] [source] [discussion] 2026-02-02 17:20:27
>>illiac+61
It depends if the application itself touches the Internet or only when conducting updates.

The threat model for a server and for a personal computer are very different. On a consumer device, typically only the OS mail app and browser have direct contact with the outside world.

◧◩◪◨⬒
13. illiac+bs1[view] [source] [discussion] 2026-02-02 17:54:16
>>badsec+H8
That’s still the example, not my point.

My point is, statistically, it is more secure to install updates as fast as possible.

We can take another example: search for “shitrix”, there’s thousands more CVEs out there to use as example.

◧◩◪◨
14. latexr+332[view] [source] [discussion] 2026-02-02 20:42:45
>>expedi+vo
I hate that. “Bug fixes and improvements” every time. And then there are the ones who think they’re being cute with “our bird Fernando has been hard ar work eating those nasty bugs and flying over the rainbow to bring you an ever delightful experience”. Just, no. I don’t mind you flexing some creative writing muscles in your release notes if you provide actual clear information, but if you’re going to say nothing like everyone else, might as well use the same standard useless message so I can dismiss it quick.
◧◩
15. pibake+Qn2[view] [source] [discussion] 2026-02-02 22:11:21
>>illiac+61
To be fair I doubt there are that many people scanning for internet facing XPs in 2026.

On the other hand, any server running old, unpatched versions of apache or similar will get picked up by script kiddies scanning for publicly known vulns very, very fast.

The notepad++ attack is politically targeted and done through unconventional channels (compromise in the hosting provider). I don't think 99% of the people reading this thread has a comparable threat model.

◧◩
16. thegri+7l3[view] [source] [discussion] 2026-02-03 03:44:37
>>illiac+61
You assume that the old software version has critical vulnerabilities. If it does not, then yes, updating is more of a risk since the new versions are unknowns.
replies(1): >>illiac+xl3
◧◩◪
17. illiac+xl3[view] [source] [discussion] 2026-02-03 03:48:42
>>thegri+7l3
My assumption is statistical. All software has critical vulnerabilities, not just the old ones. It’s just that these vulnerabilities are known, in the case of the old ones, which significantly increases the risk.
[go to top]