10 (Stubbornly Pervasive) Windows XP Myths Debunked

Microsoft support for Windows XP expired a month ago, and yet hundreds of millions of users around the world are still using it. Personally, I think that is a bad idea, but it’s a free world and people are entitled to still run DOS, or use a Commodore Amiga if they choose. However, I do think that a decision to continue using Windows XP should be based on reality, and many of the comments I have seen about Windows XP in the past few months just perpetuate false assertions, and conspiracy theories.

Here are some of the most stubbornly pervasive Windows XP myths, and the reality that contradicts them:

1. Microsoft just pushes out a new OS every couple years to extort money from customers

This is one of the sillier claims, and the easiest to disprove. It is true that Microsoft releases new versions of the Windows operating system periodically. However, not only is it not “every couple years”, but Microsoft is actually significantly slower at releasing new versions than any rival platform, and Microsoft supports its operating systems much longer.

Since October of 2009 when Windows 7 was released, Apple has introduced three major versions of OS X, and no longer supports OS X 10.6 “Snow Leopard” which was launched in 2009. Ubuntu has released eight new versions of Ubuntu Linux since October of 2009, and it stopped officially supporting Ubuntu Linux 9.10 “Karmic Koala” in 2011 after only two years.

Tim Erlin, director of IT security and risk strategy for Tripwire, agrees that it’s silly to assert Microsoft comes out with new versions of Windows too often, and goes a step further to question why it should be considered a bad thing that Microsoft might want to make money. “Is there an argument here that Microsoft should stop running a for-profit business?”

“I could argue this should be a services business with the OS for free (like Office 365 is) but they haven’t made that change yet,” explained Rob Enderle, principal analyst with the Enderle Group. “Think of it this way, you actually are buying a service (actually the PC OEM is who passes the cost through to you). Rather than paying by the month you pay every few years. Strangely folks would likely prefer the monthly system more and it likely would be both more lucrative and better for customer satisfaction if Microsoft moved to it like they did with Office.”

2. Windows XP has 12 years of patches and updates, so it is more secure / stable than its successors

This pervasive myth just makes me shake my head. There is no empirical evidence to support this theory. If this were the case, there wouldn’t still be new vulnerabilities discovered every month that affect Windows XP, and it wouldn’t be true that those vulnerabilities are almost always more critical and easier to exploit on Windows XP than later versions of the Windows OS.

“No, not true,” proclaimed Wolfgang Kandek, CTO of Qualys. “Microsoft fixes what is possible in XP, but cannot undo major architectural decisions (as the memory allocator for example). That can only be done in new operating systems. Vista, Win7 and Win8 are all much more secure than XP, and Win8 is better than Win7.”

“Not true, this is like saying a car that has been repaired massively is more reliable than a new car,” agreed Enderle. “Patches are additive and weren’t understood when the product was created which means the more you patch a product the more flimsy it becomes because of the interdependencies that didn’t take the patch into consideration (which is why they have to do so much regression testing when patching). The product becomes less efficient over time as a result and needs a full refresh to both take advantage of what has been learned in the meantime and to create a cohesive offering.”


3. Windows XP works, so there’s no reason to upgrade or switch

This is subjective, and may actually be true to an extent for some users, in some circumstances. You have to define what you mean when you say “Windows XP works”, though. Just because it “works” doesn’t mean it works effectively or efficiently. A baseball bat will “work” for chopping down a tree…eventually, but there are better tools for the job.

Enderle used a similar analogy to explain why this myth doesn’t really hold water. “A 1940’s typewriter likely still works, if it has been kept up, nearly as well as it did when it was new. It’s just obsolete now and there are other things better. But connected products have to be updated regularly because of threats and computing products become obsolete at a rapid rate. Software doesn’t wear out it ages out.”

Erlin pointed out, “An operating system is more like your lawn than a hammer. While the criteria for whether you should keep using a hammer is ‘does it pound in nails,’ the lawn requires maintenance. Microsoft will no longer mow and fertilize XP, but instead of getting a new lawn service, you have to get a new lawn.”

4. The security concerns are just FUD perpetrated by Microsoft to help sell Windows 8

Make no mistake, the security concerns are real. Microsoft doesn’t need to spread stories about critical security concerns, because the malware developers do enough of that.

TK Keanini, CTO of Lancope, declared “The deal is that security is not a vendor or customer problem, it is everyone’s problem. Microsoft understands that we all face an advanced threat that would love for you to use an insecure system. A system that was completely safe three months ago can be insecure today because the threat is active and—in this context—the defenses must be active also.”

I’m sure Microsoft would appreciate it if Windows XP users would upgrade to Windows 8, but that has no bearing on the reality of the security concerns facing Windows XP.

5. Windows XP is secure as long as you use third-party security software

This is partially true. Certainly using third-party antimalware and security tools will provide more protection than not using them, but it’s a mistake to believe doing so is sufficient protection.
Kandek cautions that third-party security tools often fail to detect or block 50 percent or more of all exploits and attacks in the wild. A 50/50 gamble is not a good solution against the automated attacks that PCs are facing on the Internet.

Erlin agreed that there are a variety of attack vectors that simply can’t be addressed by third-party security tools, but there are even bigger issues. “More importantly, even if third party vendors continue supporting their security products for XP, they will immediately start suffering from a severe lack of security information as Microsoft stops providing it for XP. The vendors will have to choose to either stop supporting XP themselves, or start charging a lot more for their product to fund the necessary research (or sell increasingly ineffective products and cross their fingers that the customers don’t notice).”

6. Microsoft should make Windows XP open source so other developers can patch it

Open source software is not a silver bullet that ensures security. The Heartbleed vulnerability was discovered in the open source OpenSSL software, and flaws have also been discovered recently that compromise the security of OAuth—an open source secure authentication tool.

Enderle said, “People can use Linux and a small fraction of the population does. If this approach worked better the sales numbers on Linux would undoubtedly be higher. Google did fork Linux to create Android, though it is considered the least secure of the mobile OSs.”

“Interesting thought, but it would reveal too much of Microsoft’s proprietary information,” mused Kandek. “I don’t see it happening.”

While there may be some advantage to allowing an open source community to have access to the Windows XP source code, there are two major issues. First, XP shares a lot of code with its successors, so there is no way to make XP open source without also putting Windows 7 and Windows 8 at risk. Second, if the XP source was open attackers would also be able to discover and exploit any existing flaws more easily.

7. Windows XP is faster and better than any other version of Windows

“Better” is a subjective measure for the most part, and hard to argue. It is an opinion, not a fact. Speed, on the other hand, is something that can be measured and proven or disproven. The reality is, XP is not faster than any other version of Windows. Period.

“This is just BS,” exclaimed Enderle. “Even Vista is faster than XP on current hardware. Now XP may be faster on hardware that is 10 years old, but on current hardware all of the newer products are noticeably faster—largely because they make better use of the technology that was developed after XP.”

Erlin summed this up nicely. “This is Stockholm syndrome, plain and simple. Windows XP is a dinosaur of an OS with a myriad problems, most of which users have simply become accustomed to.”


8. Microsoft should offer consumers an inexpensive pay-for-continued support option

We don’t really want to keep Windows XP on life support. I already covered some of why it’s a bad idea when I wrote Microsoft Is Doing Us All A Favor By Killing Windows XP.

Even if Microsoft wanted to do this, it would be hard to make it work. “The problem is the service would have to be affordable and support for a platform that is now over a decade old would likely cost more than we’d be willing to pay,” explained Enderle. “A bigger problem is that programmers typically don’t like working on old stuff so the quality of the support would likely suffer.”

Erlin agreed that it would difficult to continue support in a cost-effective manner, and suggested that Microsoft probably already thought of that. “Microsoft is a for profit business. There can be little doubt that they’ve done the analysis to determine that this kind of paid support for end users is ultimately a money-losing proposition.”

9. Switching to Linux will solve all of the security, updating, and end-of-support issues Microsoft “imposes” on Windows

Taken in whole, this statement is true. It’s a fact that switching to Linux would free you from any drama or issues imposed by Microsoft. However, it won’t do anything about security concerns, the need to patch and update, and the fact that operating systems eventually reach a point where they’re no longer supported.
“So would switching to using a typewriter,” proclaimed Enderle. “However, you still have to patch Linux, pick a distribution (and these fail from time to time), and learn to code because, with Linux, unless you pay someone like Red Hat for support it’s you and the forums and the Linux forums are often not that kind to folks that don’t understand software.”

Erlin explained, “Users who switch to Linux will trade all the issues that they have with Microsoft for a whole set of new issues. There is a reasonable argument to be had that it’s a good trade, but that’s certainly not a foregone conclusion.”

10. Microsoft made Internet Explorer 8 and future versions of IE incompatible with Windows XP to force people off the OS

Things change. This argument is like claiming that it’s some sort of extortion conspiracy that Nintendo Wii U games won’t run on an original NES game console. Microsoft (and Nintendo for that matter) are for-profit companies and are definitely interested in making as much money as possible, but the reason that IE8 and newer versions of Internet Explorer don’t work with Windows XP is a function of changes in technology over the past decade.

Erlin suggested, “It’s far more likely that compatibility is determined by what features the OS is capable of supporting, or by the level of effort required to support older platforms. There’s work involved in supporting software on a particular platform, and very little return on that investment with XP.”

“Arguing these intentions miss the entire point,” stressed Keanini. “The fight here at the most fundamental level are people who get used to a certain OS/Application set and don’t want to change. In the old days, this would not have mattered because there was not a person in a foreign country working all day and all night to figure out how to compromise you. The Internet is about change and it is about co-evolution with the adversaries—continue to evolve or die: that is the point.”

Feel free to continue using Windows XP. Just make sure your decision is based on reality, and not on silly assertions like these 10 myths. If you are going to gamble on Windows XP, be aware of the security concerns and functionality issues you’re likely to encounter, and take responsibility for your choice rather than blaming Microsoft.

http://www.forbes.com/sites/tonybra...e-windows-xp-myths-debunked/?partner=yahootix