Windows XP Support Deal Not Renewed By UK Government, Leaves PCs Open To Attack 137
girlmad writes: The government's one-year £5.5m Windows XP support deal with Microsoft has not been extended, sources have told V3, despite thousands of computers across Whitehall still running the ancient software, leaving them wide open to cyber attacks. It's still unclear when all government machines will be migrated to a newer OS.
Maybe they will move to court instead? (Score:2)
Maybe the UK consider to take Microsoft to court in case something happens and sue them under product responsibility laws or something.
Re: (Score:2, Insightful)
Maybe the UK consider to take Microsoft to court in case something happens and sue them under product responsibility laws or something.
Take them to court over what? It's not like Microsoft hasn't been perfectly open about support ending last April.
Re: (Score:3)
It's Whitehall. They'll pass a law through Parliament to make sure they have grounds for the suit ;-)
Re: (Score:2)
Retroactive legislation like this would be likely contested up to the constitutional courts and then if necessary ICJ and declared illegal.
Re: (Score:2, Interesting)
Re: (Score:1)
Re:Maybe they will move to court instead? (Score:5, Informative)
Microsoft hasn't been perfectly open about support ending last April.
Well, not quite open. They have consistently portrayed the situation as being one of support ending last April. The truth is, support for XP did not end last April, and was never planned to. What actually happened is that support went from being free (or at least included in the price of the product) to being a very expensive add-on.
Re: (Score:1)
Hardly just semantics, and you seem to have missed the point of what I said - indeed, you've made up your own quite different message.
I didn't say anything about the GP not being comprehensible, or what he said differing from Microsoft's line. In fact, he simply repeated Microsoft's line.
My point is that Microsoft have not been open about what is actually happening. Support for XP is not ending, it just costs a lot now where previously it didn't.
Re: (Score:1)
A prison built especially for all the computer programmers in the world... Hey, at least no jocks will be allowed inside to bully us :) But we'll still have a large population of idiots.
Re: (Score:3, Insightful)
Re: (Score:2, Informative)
XP is 14 years old, and they gave plenty of warning when support would end. MS is under no obligation to support anything indefinitely. Seriously, why is your first response to sue? Is personal responsibility that hard?
Because it should be the case. Those government agencies had contracts with Microsoft since 2002 where they paid 50 dollars a year extra per computer to Microsoft after Windows XP was released in exchange for a safe/free upgrade path to the next version of Windows. Microsoft's part in the contract was to provide them a new version of Windows by 2003 or free XP support till the hardware dies. But that did not happen. Instead, Microsoft screwed them over and kept releasing service packs for XP instead. They n
Re: Maybe they will move to court instead? (Score:2)
Just so you know, Microsoft did a lot of shitty deals back then and screwed over a lot of people.
Why wasn't the contact enforced when Vista or 7 came out? One party is a nuclear-armed sovereign - don't tell me Microsoft refused... the courts would surely order cooperation if that were the case.
Re: (Score:2)
That's one of the reasons that many of these contractual obligations are now litigated on EU level. A single European sovereign country is often too weak to counteract pressure from international corporation on the scale of microsoft/google/apple. See the support debacles with apple all over Europe where apple is straight up breaking the law and national courts lack the ability to impose large enough penalties for them to matter.
Sovereign power has been severely weakened on this front during last couple of
Re: (Score:1)
XP is 14 years old, and they gave plenty of warning when support would end. MS is under no obligation to support anything indefinitely. Seriously, why is your first response to sue? Is personal responsibility that hard?
Because it should be the case. Those government agencies had contracts with Microsoft since 2002 where they paid 50 dollars a year extra per computer to Microsoft after Windows XP was released in exchange for a safe/free upgrade path to the next version of Windows. Microsoft's part in the contract was to provide them a new version of Windows by 2003 or free XP support till the hardware dies. But that did not happen. Instead, Microsoft screwed them over and kept releasing service packs for XP instead. They never got a free upgrade to a new OS. Why should they pay for upgrades when Microsoft broke the contract? As much as "teh internet" hates to hear this, Microsoft should be legally forced to abide by the contacts they signed and keep supporting Windows XP till the last contracted government agency replaced their hardware even if till 2030.
This sounds like a very strange contract clause if formulated this way -- any citations on this?
Re: (Score:2)
Was the year 2003 specifically mentioned or did you just pull that out of your a... hat?
Last I checked, there have been 3 new versions of Windows since 2001: Vista, 7, and 8. If you choose not to use them, that's not Microsoft breaking the contract...
Re: Maybe they will move to court instead? (Score:2)
There is. It is called Windows 7 and by the way even that is over half a decade old!
Why is it Microsofts fault that they bought software with IE 6 specific rendering probably purchased 6 or 7 years after IE 6 came out! Poor us we are the victims yada yada.
No sympathy and someone or somebodies need to be fired. Talk about bad management.
Re: Maybe they will move to court instead? (Score:2)
Microsoft's part in the contract was to provide them a new version of Windows by 2003 or free XP support till the hardware dies. But that did not happen. Instead, Microsoft screwed them over and kept releasing service packs for XP instead. They never got a free upgrade to a new OS.
You're shifting goalposts here. In lieu of a new OS in 2003, MS provided XP support (including service packs, which were free) long past the service life of the 2001-era hardware we're talking about. Sounds like they complied with the second part of the contract, which I bolded above.
Re: (Score:2)
Is the hardware dead/retired? Is the support still free? If you answered no to either question, then they *aren't* honoring the deal. Unless the contract specifically said "service life" AND gave a definite maximum duration for that term, then the life of the hardware is until its owners decide to retire it. Running 15 year old hardware that still gets the job done is hardly an unusual scenario.
Re: (Score:2)
Sorry, that should be "if you answered no to both questions"
Perhaps Microsoft was counting on Moore's Law rendering the hardware unable to "get the job done" by now rather than performance improvements pretty much stalling out for the last decade, but that's their problem. If you want to bet on unstated "gotchas" crippling a contract in your favor, you've got to also be willing to have that bet turn sour.
Re: (Score:2)
Vista was released 8 years ago, and it was crap. Windows 7 was 6 years ago, and IIRC you could get XP on new netbooks through 2011, although a quick look didn't find any verification. In other words, any 8-year-old hardware probably came with XP, and XP remained the best Microsoft OS up to 6 years ago. Six years old isn't essentially dead.
Re: (Score:2)
Re: (Score:2)
This reminds me that the reason Server 2003 got an extra year of support is that they waited until after Vista SP1 to release Server 2008, and Vista RTM had many well-known problems.
Re:Maybe they will move to court instead? (Score:5, Informative)
Re: (Score:3, Interesting)
Probably more worrying is the fact that much of our military are still using IE6.
Re: (Score:2)
The Surface to Air missiles are programmed via a web interface using Active X controls written in Visual Basic 6.
Re: (Score:1)
Based on launch trajectories calculated via a macro in an Excel 95 spreadsheet that is sent from personal Hotmail addresses?
Re: (Score:2)
Maybe the UK consider to take Microsoft to court in case something happens and sue them under product responsibility laws or something.
Uhhh.. no one is forcing them to continue to use ancient software. They're quite welcomed and encouraged to upgrade to something newer and better. Certainly not Microsoft's problem. Microsoft and most of the rest of the world have long since moved on.
Re: (Score:2)
or maybe they've taken the time during extended support to replace all vulnerable PCs with Win7 and unplug the rest from the internet.
Re: (Score:2)
Many computers running Windows XP can not be upgraded to Windows 7 because Windows 7 has additional hardware requirements. I own one of these type of computers. There is no way for me to upgrade my Windows XP computer.
Its not like Microsoft "secure" XP anyway? (Score:3, Insightful)
The Brits aren't dumb. They figured out that whether they throw 5.5M at MS or not, XP will run on regardless. Surely MS don't supply the anti-virus / firewall software? That must be 3rd party, and I'll bet, works out a heck less than 5.5M quid. The posting suggests that the second XP "support" vanishes, billions of malwares will converge on those computers. No. Unless MS pays someone to do it...
Re:Its not like Microsoft "secure" XP anyway? (Score:5, Informative)
Pretty much this. Most likely someone with a clue finally realised that as long as you have a working firewall and anti-virus that will block outside executables, your XP machine is quite safe from "omg internet viruses". Especially if like most computers in major organisation, it's also sitting behind a NAT.
Re: (Score:2)
Problem is they also need to be very careful about any files with scripts, like office docs, PDFs, etc. Then anything that uses built in OS libraries, such as image files, SSL connections, etc.
That gets hard, anti-virus is severely limited unless it does proper heuristics which seems to be rare, there are whiteboxing technologies but they are expensive and not foolproof. At some point you need to either isolate those legacy systems from the rest of the world or upgrade them.
Re: (Score:2)
You appear to be talking about security holes in third party software. How is microsoft responsible for it?
Re: (Score:2)
Have you ever realised that government actually does things that aren't top secret?
As in low level bureaucracy, crunching numbers needed to generate statistics, writing largely pointless reports that are necessary for archiving in case they are needed at a later date and so on?
I see those computers all the time. They're usually workstations sitting in places like watch booths of grassroot sports fields and such. They're rarely used, very old and completely irrelevant as they contain no data interesting for
Re: (Score:2)
So your argument is that poor protection on OTHER machines is the problem?
Okay. Make a thread on the subject and stop shifting goalposts to jury-rig the argument to fit your "you must update or else you get raped, no really" agenda.
good - waste of money. (Score:1)
Simple answer is just too remove all the pc's from the internet. Do they need it to work out taxes, etc? Of course not.
Wide open to attack? (Score:1)
Hyperbole much? Systems don't suddenly develop security holes the day a support agreement is ended. If it was fine the day before support ended, it's fine the day after. Of course, the moment a new issue _is_ discovered, it's game over.
Re: (Score:2)
XP SP2 changed so much, it was effectively a new OS by the time it came out if you want to go down that road. Especially by Apple PC OS standards.
Supported != Secure (Score:5, Insightful)
TFA and the summary make it sound as if it is the lack of support contract which makes these systems insecure. This is complete and utter nonsense - it is the fact that they are running Windows XP which makes them insecure. It's not as if malicious hackers around the world were sitting there rubbing there hands in glee, waiting for the day the support contract expired to plunder the systems, having previously been completely and utterly thwarted in their evil plans by the exchange of funds between the UK government and Microsoft.
But at least a support contract would get them fixes for any newly discovered vulnerabilities, right? Well, maybe. No software is perfect, but the world - and Microsoft's practices - have moved on, and realistically it would take a *lot* of money for MS to spend a meaningful fraction of their resources securing an OS past the end of its useful commercial life.
Not true (Score:3, Funny)
It's well understood that Windows is so flaky it needs constant patching and the minute you stop paying, it explodes into a fireball. The only thing keeping that POS software from chomping on your important data is a constant fee paid to Microsoft to tame it.
What you need is to cloudify the lot, you don't see clouds explode into fireballs do ya! That's the power of the cloud, I learned that at MBA school.
Re: (Score:2)
Clouds don't explode into fireballs, but they do drift away, leaving them back at square one.
Re: (Score:2)
True, but if you had a working exploit that was no patch to fix, and you knew that your target was about to go off support and loose the ability to submit issues and expect a fast fix turnaround, would you:
A) Go for it the moment you have a working sploit grab all you can.
B) Wait a little while before you take the big risk of using it widely and trying to ex-filtrate the loot to avoid discovery. Then after the support is up and you know the response will be hampered make your move. You know either it will
Re: (Score:2)
Re: (Score:2)
Is there any alternative to Microsoft for getting XP support? If another company said, hey, we'll give you equivalent support at 1/10 the cost MS asks, would that be legal or would MS sue them into oblivion?
No, of course there isn't. Microsoft owns all the code, and they have never delivered all of it to any party. Further, even Microsoft doesn't really understand the code, which has bits and pieces from various legacy codebases grafted onto it, forced into it, et cetera. Some of that stuff went away in Vista, but XP is still crammed full of it.
In order to support XP without making it worse you'd have to first a) secure licensing from Microsoft to permit you to do that and b) hire much of Microsoft to get the
Re: (Score:2)
Re: (Score:1)
I don't know why they should be allowed to keep the patents and copyrights then.
1 year may have been enough (Score:2)
Assuming that IT pros outside of Slashdot are about as smart as IT pros posting on Slashdot, it's quite likely that those PCs have been replaced, reconfigured (remove network card and USB ports, seal the PC case?) or placed in different areas in their networks to mitigate the risks of running XP. Adding extended support at that price needs to be part of the solution, not the only thing they've done. Hopefully they've used that time for deploying and testing new security measures.
Re:1 year may have been enough (Score:4, Informative)
Re: (Score:1)
Re: (Score:2)
have there been released since ? To me it sound as a very expensive extra insurrance for when the house burns down and
people above you start to look for someone to blame.
Re: (Score:2)
The standard rules are set out here: https://support.microsoft.com/... [microsoft.com]
A special customer like .gov.uk may have had a special contract.
Re: (Score:2)
I forgot to add that yes, probably there is a strong element of CYA policy. My company is not as important as MS or .gov.uk and we still have "you must have the servers and workstations running supported versions" in exchange of our SLA for support.
Re: (Score:3)
Windows 10 (Score:2)
At this late point in the game, no government department is going to waste time and money on migrating to Windows 7 - a 5 1/2 year old OS that hasn't received a service pack in 4 years, whose "mainstream support" already ended in January.
With that in mind, you better hope your IT department has at least been following the Windows 10 beta program, in terms of testing on a few machines. It'll be released by October in time for the Christmas gift period - leaving a slim window of opportunity to be deployed at
Go Linux! (Score:1)
Re: (Score:2)
Running things without support agreements brings managers out in hives, particularly an arena as risk-averse as a health service.
Something you paid for fucks up? It's the supplier's fault.
Something you didn't pay for fucks up? It's YOUR fault.
Therefore there's no real advantage, from the POV of licensing costs.
The real reason they've not migrated from WinXP has to be considered. The NHS is a mire of vast depth full of crufty software. They have so many pieces of old software it's not true. It's really diver
Re: (Score:2)
Even if you have the source, you need a team of people who are capable of updating it. If they were running linux, they might well still be on a 2.4 kernel because of a custom made third party app that requires it that nobody could make sense of.
Re: (Score:2)
If you have the source, you have the option of hiring a team to update it. The NHS is large enough that they can afford to hire their own. Indeed, many hospital trusts do already have their own in-house teams of developers maintaining home-grown applications.
OTOH I've seen in-use hospital systems where the source code has actually been lost and the last person who worked on it died some time ago. That should be illegal. On products I've worked on in the past, there have been source escrow agreements. These
Re: (Score:2)
It's gone this way for as long as it has because like everything else in the NHS, the budget has been cut to the bone.
How is this when NHS funding has been ring-fenced and gets increased every year? Are UKIP right about vast waste in middle management?
Re: (Score:2)
Firstly, the thing about NHS funding increasing every year is a lie, and our politicians have been told to stop lying about it [telegraph.co.uk] repeatedly (that link is to the Telegraph which is usually considered to be a Tory paper, so extra truthiness points).
Secondly, we have a rate of about 4% inflation for healthcare costs. Even if they are increasing funding, are they doing it 4% year on year? No.
Thirdly, a lot of the money is going on the stupid PFI contracts which bleed money away from clinical services and go to de
Support? (Score:2)
Re: (Score:2)
Just telephone type "my cup holder broke"?
Look, those things are really flimsy, and while they may have barely held the Super Big Gulp in 2001, cups today are more robust. I daren't put my Double Gulp in there anymore, as it's barely hanging on. Heck, even the X-Treme Gulp came out in 2001! Microsoft should replace all the cup holders with ones not only capable of holding the Team Gulp, but also those Gulps anticipated to come out in the next 5 years.
Re: (Score:2)
Exactly what kind of support are they getting? Just telephone type "my cup holder broke"? Seems like internal IT could handle most of that. Or are they actually fixing Windows XP bugs for them?
They were probably getting the same thing that my company is paying and getting which is security fixes. They are still being created and sent out to customers that pay. Windows update is not working, they'd have to be installed individually or via the domain management.
Good decision (Score:2)
Re: (Score:2)
Hahahahaha.
£5.5M won't even scratch the surface.
We're talking an enterprise with around a million computers, running a vast swathe of different, obscure, an
Re: (Score:1)
Sorry, but what tosh.
Microsoft is a convicted monopolist in the EU. Your problems in the US are your problems.
And Windows XP is not "secure". It's like saying that a door you have laying in the shed is "secure" just because you're not using it so nobody would bother to break into it.
You have to consider local, internal attacks (especially if you're dealing with government, NHS, police, etc.) as well as anything from the outside. And you can't isolate XP enough to be secure and work in a networked fashion
Re: In many situations, Windows XP is secure. (Score:2)
The hardware cost is irrelevant. It's the cost and time to thoroughly test / migrate / rewrite lots of bespoke software, made to the lowest quality by some company like Accenture on a contract, for which the source code probably wasn't supplied and all the original developers have left. And if the system fails the Daily Mail will write about it. And the tories slashed the budget, so all that's left can just about cover the new thing the new regulation requires.
Limited user privilege escalation? Tell me how. (Score:2)
If you know of an attack that works against a Windows XP limited user, please mention it. It is likely it could be fixed without Microsoft's support.
"XP is dead. It's lifespan is over."
Software doesn't die. Are you saying that, after literally thousands of bug fixes, Microsoft had still not fixed all the vulnerabilities in Windows XP? That's certainly possible; Microsoft makes more money if there are vulnerabilities, since people pay full price for
In other news... (Score:5, Funny)
Support for the current Government reaches EOL next week and currently seems unlikely to be renewed. However, it looks like an upgrade supported by multiple vendors for five years may be in place shortly after:
http://www.telegraph.co.uk/new... [telegraph.co.uk]
Re: (Score:2)
Think of the monies! (Score:1)
Good tactic from the MS marketing guys to drop this in the news and get them to sign faster without negotiating too much!
risk is low (Score:2, Funny)
If these computers are within a secured network and particularly if they don't have access to the internet, then there isn't any great risk in continuing to use these XP machines.
Re: (Score:2)
Seriously? (Score:1)
Re: (Score:2)
Calling an operating system that persists on a significant percentage of computers to this day 'ancient' is ridiculous, I don't think it even qualifies for the term 'legacy' yet.
There have been no less than three windows releases since, and a fourth is about to drop, it's safe to say that XP is 'legacy'. In Windows land, I like to use driver availability as my gauge. If you go into a store you're going to find that only a small subset of the available printers and scanners (and PSCs) even have XP drivers any more. Lots of new PC games now require Vista or later.
In internet years, XP's release was in ancient times. We still use many ancient inventions.
Re: (Score:3)
Do you know anyone running Mac OS X 10.1, or Red Hat 6 with the 2.4.0 kernel? How about Solaris 8? Nope, they're ancient -- and the same age as XP.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Do you know anyone running Mac OS X 10.1,...
Mac OS 10.1? No. Especially since it was just a free bug fix for 10.0. and improved upon by later dot updates. I've still seen 10.4 in the wild and have my own 10.6 computer for older hardware or Rosetta support. Go out to some still running F5 firewalls, and people would probably be scarred as to what version of Linux is being run.
Re: (Score:2)
I work at a company whose IVR system is still dependent on a pair of Solaris 8 systems. :(
Re: (Score:2)
Re: (Score:2)
If he was twelve, XP was released before he was born.
In IT terms "before you were born" is old. Very old. Ancient. Dead. Buried. Gone.
I touched my last XP install two years ago when I migrated a school using it from XP to 8 (and all their servers a similar jump).
The prime argument? It was a school, and the OS they were using to teach ICT to the kids was OLDER than the kids. All of them. And, as such, they did not know how to operate it because they were all used to Vista, 7 and 8 at home. We were t
Ever heard of LInux? (Score:1)
They could retrofit all of these XP machines with Linux and open source software that would meet 99% of their needs, at a cost of some re-training, and development / porting of custom software. Naturally, MS would fight this tooth-and-nail. Who said that bribery won't get you anywhere?
Nope. (Score:2)
All XP gets regular updates. They have to or the net would break.
Anyone running XP at this point... (Score:1)
Go to Munich (Score:1)
....and learn from their mistakes. It now takes me 20 minutes to load Linux Mint on an ex-XP machine, then back to work.