Is XP too unsafe to use?

[excal32]

I have XP on alot of airgapped machines. no problem there.

The problems is some of my XP running ThinkPads run best with XP, but seem with MS support being long gone and it being so easily exploitable, there must be other options.

Linux aside, is there nothing that can be done except upgrade Windows?

[RealBlackStuff]

OS/2 or OS-X.
Or stay with XP but don't go online.

[Puppy]

How to get security updates for Windows XP until April 2019
http://www.ghacks.net/2014/05/24/get-se ... pril-2019/

Works on my old R51 and X31 without issues yet. Of course, using a limited user account and SRP is always recommended for proper security. The issue is that both machines (GPU) are too slow for browsing todays web pages full of CSS animations and videos. My X31 is retired and R51 I use as audio player because it has suprisingly good analog audio output quality.

[exTPfan]

I mostly use XP on my work laptop, and have had no problems, but I'm fairly careful, back up frequently, have a clone of the whole hard drive, and run the free version of Malwarebytes every few days. Without the hassle of monthly backups or an antivirus program, it runs fast and free (touch wood).

[brchan]

Linux is the way to go, especially for older machines. Super customizable, fast, secure, free (personal use), no need for AV, easy to use, and the list goes on. The only downsides are that gaming is not supported well, and some specialized apps like adobe Photoshop are not available. However, there often "equivalent" apps like Gimp.

I recommend Linux mint Debian for new users. For those who want a faster and more customized setup, arch Linux wins.

For something really light, tinycore with a custom stripped kernel built for specific CPUs (configurable back to a 486!) will take <15 mb easily.

[MikalE]

I did a fresh XP Pro install on one of my 10 year old desktops earlier this week.

Half of the websites I tried to load through MS Explorer would not load. I couldn't get to a site with an MSIE update or a site to download Chrome or any other browser. It was terrible. There was no support at all at the MS website to upgrade the browser. It was one of the few sites IE would connect to.

Some sites I was able to load did not display properly or crashed IE. I think it was either MSIE6 or 8. Not certain.

I stuck in the Linux Mint disc and it's running well except that Chrome crashes it. I might try Zorin instead. This is just a backup computer and I don't really use it for anything anymore. It was a mid-grade computer when I bought it back in '06.

That computer system was always stable. I can count the number of system crashes on one hand in the eight years I used it, and never once did I ever have to reload XP Pro. It was a great machine in its day and ran three monitors on two video cards with an additional internal power supply for the Sapphire 1950.

[MisterB]

I'm using Xp to post this on a T42p. The dangers of using Xp online are vastly exaggerated as far as I'm concerned. I have two Xp machines, a T42p and a T40, online daily. They are going to be retired soon, not due to security concerns but due to the limitations of 32 bit OSes--mainly memory. My security is similar to Puppy's. I use a limited account with tightening of ACLs and SRP implemented.

Firefox still works in Xp and is the best browser option. All of the Chromium browsers, Chrome, Chromium, Opera Vivaldi, stopped working in Xp a couple of months ago and only older versions of these browsers will work. That is another reason I'm finally retiring these machines. More and more software is no longer supported in Xp.

[dr_st]

Indeed, the risks of using XP online, as always, are greatly exaggerated. The hack to get mostly useless security patches until 2019 is also greatly overvalued.

The bane of XP is web and application support which is fast dwindling. Ironically, Vista, despite being much more advanced, and capable of supporting everything that Win7 supports, is suffering the same fate, because of Microsoft's decision to ditch Vista in the woods for no technical reason, but probably just to reduce support/testing overhead. They would gladly ditch Win7 as well, but the huge installed user base would not let them do it.

[teamde78]

Linux is the way to go, especially for older machines. Super customizable, fast, secure, free (personal use), no need for AV, easy to use, and the list goes on. The only downsides are that gaming is not supported well, and some specialized apps like adobe Photoshop are not available. However, there often "equivalent" apps like Gimp.

I recommend Linux mint Debian for new users. For those who want a faster and more customized setup, arch Linux wins.

For something really light, tinycore with a custom stripped kernel built for specific CPUs (configurable back to a 486!) will take <15 mb easily.

Are there any good tutorials/list of drivers needed for some of the older Thinkpads available? I would like to test drive some of these Linux Operating Systems but don't want to do anything before reading up on the installation process of Linux.

[jdrou]

I couldn't get to a site with an MSIE update or a site to download Chrome or any other browser. It was terrible. There was no support at all at the MS website to upgrade the browser. It was one of the few sites IE would connect to.

If you still want to use XP, the page for full download of IE 8 is here: https://www.microsoft.com/en-us/downloa ... x?id=24488
(That's the last version of IE available for XP.)
Another important download for a new XP install is the Windows Update Agent. On a fresh install I wasn't able to get this through WU itself as you can on newer Windows.
https://www.techpowerup.com/downloads/2 ... -xp-32-bit

[exTPfan]

Pale Moon is the browser to use with XP.

[Puppy]

Indeed, the risks of using XP online, as always, are greatly exaggerated. The hack to get mostly useless security patches until 2019 is also greatly overvalued.

It isn't. There are still kernel (win32k.sys) patches that are mandatory for security. Nothing (including limited user account or SRP) can substitute it because a simple download of vulnerable embedded font or image file processed in kernel mode by any web browser or office application can infect the machine. And no, no AV software can prevent that either. The only solution is to apply patches as soon as possible.

[excal32]

OS/2 or OS-X.
Or stay with XP but don't go online.

I LOVE OS/2 to death but my understanding is getting online or wifi is a complete joke with it?

I still have OS/2 on floppies somewhere.

If not..... warp city here I come.

How to get security updates for Windows XP until April 2019
http://www.ghacks.net/2014/05/24/get-se ... pril-2019/

Works on my old R51 and X31 without issues yet. Of course, using a limited user account and SRP is always recommended for proper security. The issue is that both machines (GPU) are too slow for browsing todays web pages full of CSS animations and videos. My X31 is retired and R51 I use as audio player because it has suprisingly good analog audio output quality.

Good to know.. I actually never used SRP.

[Puppy]

I actually never used SRP.

SRP is essential for any Windows version security, much more than any useless AV software. And it is for free.

[MikalE]

I think after trying to hang on to XP right up until about 18 months ago, I'm finally finished with it. I'll miss it. It was very stable on all the systems I owned.

7 is OK, but I'll miss that too when its time comes. From there on out I guess I will be using Linux.

I do need to load up Win 10 on one of the machines I have so I'm familiar with it when the repairs start coming in.

[dr_st]

It isn't. There are still kernel (win32k.sys) patches that are mandatory for security. Nothing (including limited user account or SRP) can substitute it because a simple download of vulnerable embedded font or image file processed in kernel mode by any web browser or office application can infect the machine. And no, no AV software can prevent that either. The only solution is to apply patches as soon as possible.

You take one example of something very bizarre and obscure (which affected how many systems in the wild?) and of which there is currently no known equivalent, and make it sound like anyone going onto the net without the latest POSReady patches is going to be immediately compromised. As I say, grossly exaggerated.

[Puppy]

(which affected how many systems in the wild?) and of which there is currently no known equivalent

All systems. Similar bugs are being fixed almost every patch tuesday https://technet.microsoft.com/en-us/lib ... y/MS16-090

[dr_st]

Perhaps you misunderstood me. My question was - how many systems were actually infected by an exploit of the mentioned vulnerability, and to what end?

Just because a vulnerability exists and even a known attack vector exists, does not mean that there is an exploit taking advantage of it, and that there is a high enough probability of contracting said exploit doing normal activities.

The example of the Blaster worm, on an unpatched XP, which was so trivial and widespread that any computer with a direct connection to the internet was likely to get infected in seconds to minutes without needing to do anything at all (not even open a single website) comes to mind. But most things do not even come close.

Suppose that an exploit exists, which, such as in this case, can only be fully avoided by an OS patch. If in order to be affected in practice one needs to surf to a particular kind of dubious websites and/or actively download dubious files, then the practical extra threat level of this vulnerability is marginal. Such users are just as likely not not be patching their OS anyways, not running anti-malware software, and will have been infected by dozens of other malicious agents, for which OS patching is irrelevant.

Note that I am not saying that one should disregard any security concerns altogether. That would be foolish. I am just not buying into the notion that the "end of support date" of the OS or any key application you use is some magical date, on which your computer is going to turn into a pumpkin on midnight, which is what one might believe after reading the "serious warnings" all over the web.

[brchan]

Are there any good tutorials/list of drivers needed for some of the older Thinkpads available? I would like to test drive some of these Linux Operating Systems but don't want to do anything before reading up on the installation process of Linux.

Most distros are very installation friendly. Usually you just burn the iso file to media and boot off of it. Next, you will get a menu to try it in 'live' mode without affecting any of your files. If you like the experience, then you can click and run the installer.
http://www.zdnet.com/article/how-to-ins ... indows-pc/

The Arch Wiki has a lot of good information related to linux in general.
https://wiki.archlinux.org/

[MisterB]

This is from the Technet page on kernel vulnerabilites:

A Win32k information disclosure vulnerability exists when the Windows GDI component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.

To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.

Take note of the last paragraph. These are not vulnerabilities that are going to be exploited by a driveby on a website. They require a system to be logged on to and software to be loaded and run on it. SRP will help if it is set up to prevent execution outside of the system and program files directories from a limited account. If remote logons are also disabled, the only way to exploit them is to log on locally or trick the user into downloading and running the software from a local administrator account. And successfully exploiting them would only be step one. The attacker would still need to elevate privilege to do any real damage.

In spite of the dire predictions, the Xp zombie apocalypse has yet to arrive. Instead of going down in flames, Xp is just slowly fading away which is generally what happens to old OSes.

[danikayser84]

I still have XP on my (semi-retired) ThinkPad T43, mainly for the sake of running programs that will not function on Vista and later, and I did use the POSReady patch thing as well as the latest ESR Firefox (45 as of this writing)

Also have XP, 2000, and even 98SE and older on a few other machines that do not (or almost never) see Internet connections; have never been hit on any of them (I actually run a dual boot of 98SE and 7 on my T42, mainly for the sake of experimentation)