I’ve written a bit about the end of XP lately, and several commenters in various venues have called me to task for calling the OS “obsolete.”
It is obsolete. Get over it.
It isn’t obsolete because it no longer serves a purpose. It isn’t obsolete because it’s broken. It isn’t obsolete because I say it is. It’s obsolete because Microsoft says it is.
Now, maybe Microsoft shouldn’t have done that. Maybe they should continue supporting the operating system. Maybe it’s wrong that the software industry drops support for software despite many customers’ wishes. Those are all excellent arguments, and there are a number of productive discussions that I think could be had around them. The way the software industry currently works isn’t optimal for its customers.
But none of that changes the fact that Microsoft has declared XP to be obsolete. They’ve dropped support for it – and that’s important.
And calls for guys like me to “get out in the real world” completely miss the point. “Why should we move off of XP? It still works. You don’t know what the real world is like, it’s difficult to roll out a new operating system.”
I do work in the real world. Yes, I know a lot of companies don’t want to move off of XP. Yes, I know it’s difficult and expensive to roll out new operating systems – although I’d argue it’s less difficult, and less expensive, than in the past. I’d probably argue that being able to roll out client operating systems, service packs, and hot fixes is a core IT competency, and that if you find it challenging, you might not be very good at your job. I might argue that.
But none of that changes the fact that, by dropping support for XP, Microsoft has literally dropped a bomb in your organization. A time bomb.
Again, let’s be clear about something: I’m not defending Microsoft’s action, here. I’m not making a case for what “should be” or what’s Right and Just. I’m trying to make a point about what’s really here, right now, in the real world everyone claims to work in. If you think there’s no problem continuing to run XP, you’ve got your head in the sand. You don’t work in the real world.
And that problem has nothing to do with me drinking flavored soft drinks issued by Redmond. The problem has nothing to do with XP’s ability to function in an organization. The problem is that attackers are now free to unleash exploits in XP that they’ve probably already discovered, knowing that Microsoft will no longer move to patch those vulnerabilities.
The problem is that attacking organizations isn’t just something script kiddies do for fun, any longer. It’s a business. It’s a big business, with a crapload of money on the line. And like any big business, tech attackers can think long-term. They can identify OS vulnerabilities and then sit on them, waiting until they know those vulnerabilities will remain open and un-patched.
That XP-based point of sale system your restaurant uses? Yeah, I know it’s stupid expensive to replace. I used to build those things. I get it. But it’s a time bomb waiting for someone to install malware on it and start skimming customer credit card information. And it’ll never get an OS patch, ever again.
And for the haters, I want to make it perfectly clear that I’m not saying you have to immediately replace all your XP stuff. I know exactly how impractical that is. I do wish people had planned a bit more in advance for this situation, but where we’re at is… well, it’s where we’re at.
But you have to acknowledge that XP is obsolete. “Obsolete” doesn’t mean “you have to get rid of it immediately.” “Obsolete” means “you have to acknowledge that it’s a time bomb, and you have to manage it differently than you used it.” Anti-malware software becomes vastly more important than before. Locking down the local firewall for both incoming and outgoing connections becomes more important. Locking down the software that can run on the machine becomes more important.
My frustration with the “XP situation” – a frustration I’ve tried to express, with only limited success so far – isn’t that people are still running XP. Believe me, I know a lot more about business realities than you might think. My frustration is the folks who think keeping XP is “business as usual.” It isn’t. Those XP machines just became massively attractive targets. The businesses I work with every day have, frankly, terrible security on a good day. Yeah, they talk the security talk, but they don’t walk the walk.
So look… XP is obsolete. It’s obsolete because MS dropped support for it, whether or not that was the right thing for them to do. You can continue running it, obviously, and in many cases you’ll be stuck with it for a long time. Hopefully, you expected that was going to happen – and you’ve planned to put appropriate protections on those machines. Rely on XP still having OS-level exploits that haven’t yet been abused in the wild… and rely on that abuse coming to a network near you. Just plan for it, is all I’m saying. Don’t treat the old OS like you used to – give it a little more bubble wrap. A little more coddling. Get off it when you can, and take extra measures when you can’t.
It’s obsolete, but that doesn’t mean it’s going away. And that makes attackers giggle with delight.