Free W10 upgrade !!

[Mark Hennessy]

I remain open-minded, but unless I have some sort of epiphany in the future, my advice is going to remain neutral: upgrade if you like, but if you're happy with W7, stick with it. It's no big deal either way...

I have to disagree completely with that, sorry

I respect that, of course, but surely you're not going to leave it there?

So far, you've largely focused on the security/malware; earlier you said that "its underlying architecture is potentially vulnerable and the attack surface is large". So what has changed about the underlying architecture in Windows 10? Genuine question, as I can't find a good reference that describes the differences down at the kernel level - which leads me to wonder if the underlying architecture is significantly different after all. Indeed, why change it, as it's been sorted for many years. Yes, there is more security at a higher level, and (to pick one at random) there is Device Guard, which looks interesting, but these sort of things don't seem to be an "underlying architecture" thing to me - and as a result, it won't be impossible to target them in future. Certainly, I haven't yet seen anything that causes me alarm about W7.

To be honest, all this talk of security could be regarded - to some extent - as FUD. If I was to raise the issue of privacy in W10, no-doubt I'd be accused of the same - which is why I didn't. However, it is a concern that I have - probably my biggest one in all honesty.

So, being absolutely pragmatic about the folk here reading this conversation (i.e., we're not in a corporate environment; we're not dealing with teenage "script-kiddies", we're not dealing with completely non-technical people), and bearing in mind that we're all behind NAT routers and don't visit dubious websites, or fall for phishing emails or cold-called technical support scams, and also bearing in mind that a lot of us here need to run old versions of software for CAD or design work, for example, and also bearing in mind that we naturally like to hang on to old hardware, what is wrong with the "if it ain't broke" approach? What is the compelling reason to make that switch, ignoring the fact it's "free" until the end of July?

Believe me, I've been thinking this through ever since the upgrade files landed on my main machine last year, and I've read a lot about it over the months - I haven't just arrived at my position as a result of reading nothing but complaints about it (although there are no shortage of those!). Based on what I saw on my work machine, I'm holding off installing it at home, but the "free" upgrade is very compelling (you have to hand it to Microsoft for their extremely clever marketing here), even to a hardened cynic like me. I know that once the deadline has passed, I will feel in my heart that I have somehow "missed out", despite knowing in my head that the benefits were - to me, at least - marginal at best. So go on - convince me. I'm stood at the edge - push me over

Actually, there is one thing that might tip the balance: if Firefox stopped being supported within W7. Because let's face it; with all this talk of security, security is much more about the web-browser than the OS today. However, FF is still supported on this old XP machine and is likely to be so until the end of this year, so I'm not too worried about that one

[ppppenguin]

Or we could bypass all of these problems by using Linux. Which opens a up a whole new set of arguments: Which Linux?

Anything that really needs Windows can then run in a VM or using WINE.

Or bow deeply to Cupertino

Again Windows stuff can be run in a VM or using Parallels. Darryl ( the guy who designed the Aurora standards converters) uses an Apple Mac. He uses Parallels to run the Xilinx software which is Windows only. (Actually it can run in some versions of Linux too but that's a separate argument)

[Joe]

I'm certainly not changing from Vista while ever I can keep it going — I still use XP a but as well. When I can't I'll go over to Linux, though that is also a sod at not only updating the OS but the programs you've installed as well.

I don't know about Windows 7 and on but certainly on Vista you can set the updates to download but not install without permission so you can decline and you don't want and tell it to not offer them again.

I've used W98se, Vista and XP and each seems to have only slight enhancements over their predecessors and these are often off-set by problems. For instance Vista has a far better image viewer built-in that the one on XP and it includes basic editing functions (though I see these have been removed on W7) but the Cut, Copy, Paste short-cut icons were removed from Windows Explorer.

As for the potential of loosing data I can't say it bothers me; I'm not running a business or writing some great work of literature. I've always thought that if I could create or download something once I could do it again. Data you've only one copy of is data you don't care about and anything really important is on paper.

— Joe

[Nick]

I guess we'll have to agree to differ

I fully respect other folks' views, however I spend a substantial part of my professional life at the very sharp end of the security world and I see, day to day, the evolving threat landscape. And it's not pretty...

"Security through Obscurity" (I'm only a little person on their home PC - no one is interested in me), is, at best, naïve. At worst, it's irresponsible.

Just because you seem to be OK now, does not mean that you will be in the future - some of the threats that we see are so subtle it's astonishing - you have to admire their thought processes - Edward de Bono would be proud

These are (mostly) not theoretical risks - they are "in the wild" - there are also catalogues of "zero day threats" for sale - these are exploits that are discovered, kept private, and sometimes sold to the highest bidder (malware writers, governments, vermin etc.) - a recent example (though not Windows-related) that made it to National News is the exploit that the FBI allegedly paid $1M for to access the iPhone of a terrorist - many others are never reported nationally but are well known in the InfoSec community - some known ones are available for public access on the CVE  (Common Vulnerabilities and Exposures) List - most of these you'll never have heard off and many will not be directly relevant to you, but they are very real and there have been many 1000s this years with several 100 more waiting on confirmation as of today - The ZDI (Zero-Day Initiative), one of many bodies that pays (White Hat) researches to hand over exploits so that they can be fixed, has had 353 reports this year to date and 665 last year.

I hate FUD in every form, but accusing folk of spreading FUD is not an argument, not even a weak one - it doesn't address the issues - it simply attempts to deny that they exist or that they are relevent.

This is NOT a FUD issue - its a basic fact that the architecture of earlier versions of Windows was developed in a time when the current range of sophisticated threats simply did not exist and it's difficult to retrofit protection into systems that were never designed for it - their attack surface is simply too large and porous.

As we become more and more on-line dependant, the need to keep up to speed on security is vital - burying one's head in the sand is an extremely poor option. It really isn't that bad to upgrade, and once done, it's pretty painless going forward.

Do what you like - it's your life (and identity)

[Nick]

Or we could bypass all of these problems by using Linux. Which opens a up a whole new set of arguments: Which Linux?

Anything that really needs Windows can then run in a VM or using WINE.

Or bow deeply to Cupertino

Again Windows stuff can be run in a VM or using Parallels. Darryl ( the guy who designed the Aurora standards converters) uses an Apple Mac. He uses Parallels to run the Xilinx software which is Windows only. (Actually it can run in some versions of Linux too but that's a separate argument)

Linux (or more correctly, implementations of the Linux kernel plus the GNU tool-chain plus whatever versions of whichever layered applications you may install from Apache, GNU, OpenSSL or whoever depending on the packaging vendor [Debian, Red Hat, Ubuntu ...] and the version of that package) are most certainly not exploit-free.

Some of the most appalling and overtly dangerous exploits of recent times have been "Linux" security based, e.g. the many well documented issues with the ubiquitous OpenSSL package ("heartbleed" et al) and with the various implementations of Apache web servers etc.

Apple are also far from protected, cf. the FBI-used exploit to unlock the IOS iPhone and many many issues with Apple software. Its a common (and dangerous) misconception to think that you are safe simply by using Apple products - this is not the case - less noise is made about Apple-related issues as the number of Apple OS X desktops/laptops etc. is tiny compared with the number of Windows boxes, so its a cheaper and more profitable win to (attempt to) attack the far larger target - this does not mean that IOS/OS X & their applications have not had their fair share of problems.

[Joe]

I had to Google FUD.

I don't wholly disagree with you, Nick. Of course old OSs either can't be patched against modern threats of there are so few users of them left that it wouldn't be worthwhile. I just wish that when new version came out the backwards compatibility was better. At the very least it should be difficult to implement some sort of 'Heritage Mode' where Apps are called "Programs" and the system feels the same to the user no matter what's changed under the hood.

I really can't see why David's Autoroute (which was a blast from the past when I read it) won't work on W10 but would on W7. OK, it's nine years old but I regularly use old DOS software from the 1980s under XP or Vista. That's one thing that would put me off a more modern version of Windows: it would odds-on be 64-bit so couldn't run 16-bit software. Yes, there are ways to do it with VMs or emulators but being able to double-click the .EXE file is much easier.

I don't think I'm worth hacking but a hacker would have to hack me to find that out by which time the harm is done.

As you say, we all make our own choices and must live with the consequences thereof — I can't say I wasn't warned.

— Joe

[ppppenguin]

I don't think I'm worth hacking but a hacker would have to hack me to find that out by which time the harm is done.

This is similar reasoning to why you shouldn't leave a bag or jacket on view when you park your car. YOU know there's nothing of value but the oik who's breaking in to your car doesn't until it's too late.

I would recommend using using Shields Up to see if you have ports on computer exposed to the internet. Most of us at home will be conencting via NAT (Network Address Translation) routers. These translate between an external IP address (eg 212.159.4.56) to an internal address. This will be in the range 10.x.x.x or 192.168.x.x or a couple of rather uncommon ones. As a result your PCs are much less exposed to the big bad world. For example they can't be PINGed. Normally a domestic modem/router is configured not to respond to a PING.

https://www.grc.com/x/ne.dll?bh0bkyd2

I'm sure that Mark and/or Nick will explain the holes in my argument.