dr_st wrote:

BushLin wrote:

Microsoft don't release security updates for fun, they create patches as vulnerabilities are discovered and stopped providing this service to regular XP users 5 years ago.

Really? Check DosFreak's post 2 above yours.

Two patches in 5 years after end of life, only for vulnerabilities which threaten the whole internet doesn't constitute being fully patched or secure.

dr_st wrote:

You tell people not to use XP, but think it's OK to surf the web without an ad-blocker? I'm genuinely shocked.

No. I gave you a single example, from first hand experience on someone else's machine. They thought putting their fingers in their ears and being seemingly ok so far meant everything was fine but multiple stages of infection had taken place. Visit a site non-mainstream site offering, er, downloads and your ad-blocker is of limited use.

dr_st wrote:

BushLin wrote:

people nonchalantly using vulnerable systems make their internal networks and the internet at large more dangerous for everyone else

According to your theory, running a "supported" OS automatically makes you safe, no? So what's the problem? As for the safety of my own personal network, let it be my headache, not yours.

I didn't say that, all computer software has vulnerabilities but when they're discovered and widely known you want them patched. I tried to appeal to the idea that getting your XP system infected puts all other systems on your network at greater risk; you might have a thought for your friends and family who care more about their security than you care about yours.

dr_st wrote:

BushLin wrote:

How are you certain you've never been infected with malware/viruses/trojans?
Are you watching all outbound traffic and fully understand what is creating it?

Well, I hope he has better things to do with his time than constantly watch all outbound traffic on his computer. But I suppose that you've been doing exactly that (monitoring and fully understanding all inbound and outbound traffic to all your systems?) Otherwise how can you be sure you were not infected? Surely there are 0-day exploits out there that are unpatched even on the newest OS.

Let's put it this way. If you sleep with all the windows and doors open you should probably pay more attention to the noises of who might be coming in and out of your house. Someone could still be an intruder if you have a secured home, no security is perfect but that doesn't mean you throw your hands in the air and not bother at all.

If you want to fly by the seat of your pants, that's your choice, I can't stop you but I feel it's important to balance such an approach with some facts and simple alternatives that are not much effort for a big difference in attack surface area.

Windows 10 comes pre-compromised, by Microsoft. It has built-in adware, spyware, and DRM, requires massive WAN bandwidth to handle the mandatory updates, and is dismally unreliable due to the associated regular (again mandatory) reboots. With all that funny business it has a larger attack surface too. This is supposed to be more secure?? What a joke.

If you're using your PC to run life support systems on the ISS, then by all means don't run Windows. But I've been running win2k for 16 years and xp for 9 years, with zero infections. (And yes, I run wireshark.)

bakemono wrote:

Windows 10 comes pre-compromised, by Microsoft. It has built-in adware, spyware, and DRM, requires massive WAN bandwidth to handle the mandatory updates, and is dismally unreliable due to the associated regular (again mandatory) reboots. With all that funny business it has a larger attack surface too. This is supposed to be more secure?? What a joke.

That I can definitely agree with, Windows 10 itself behaves like malware. Even just it regularly changing carefully chosen settings to suit their agenda is enough to rule it out. We have one year left of Windows 7, which did have some telemetry backported (although is easier to avoid) and then we're left with...
...
... whatever you choose, just running vulnerable old software isn't the sensible answer even if it does run nicely right now.

Yep, same old FUD, FUD, and more FUD. Well, nothing is new, and I've been through this countless times before, on multiple forums. Let's just agree that you will continue to give your 'good advice' to counter my 'bad advice', and I will reserve my right to point out that, based on my experience, what you see as 'sensibility' I see as FUD. Hopefully most users participating in such discussions have a brain inside their skull and can form their own conclusions.

Wow! Never thought my small posting would start a war! It's fun reading! ... One (or two) more, please: Which virus-artist would be silly enaugh to spend his time on old OSs like XP = with a market-share of less than 1% ? By now nobody has mentioned Androids or iPhones, where you give up privacy by simply switching them on... What about all these payback-discount-cards everybody uses in the supermarked? Where you tell people you do'nt know, who you are, what you when and where buy. Or Facebook etc.: "Hello Friends, look, we're on holiday in x!" = "Rob my house!" or "My daughter on her Pony" = "I am rich" ...

Here is a good security site for non-experts (unfortunately in german only). Among others they teach you what FireFox does in background and how to switch it off https://www.privacy-handbuch.de/

By the way: Which XP-accelerator do you prefere? Is keylogger.sys better than key-logger.sys or key-loger.dll? Or should i use super-key.sys in combination with money-back-free-surf.sys?

Tricia McMillan wrote:

Wow! Never thought my small posting would start a war! It's fun reading! ... One (or two) more, please: Which virus-artist would be silly enaugh to spend his time on old OSs like XP = with a market-share of less than 1% ?

That's not how it typically works these days. There are dozens of known exploits that can install malware. Someone buys a kit that implements multiple exploits and when it launches, it tries them one by one until it finds one that works. On an old / unpatched OS, the chances that it finds one that works are higher than on a modern / patches OS, that's certainly true.

Of course you are right - all of you. And i do'nt want to stress this point too much (so, why am i writing this?) as i think malware / viruses is rather an artificial pushed problem than a real one, exaggerated by Kaspesky & Co. to sell their updates. I'm really not overcautious when surfing www, the only thing i use is uBlock (and a html5-toggle - i do'nt want to see everything). Nevertheless i'm 100% sure that my system was / is not infected in the last 20 years. For a private user with a standalone hobby-computer (that is not controlling his breathing-machine - OMG! - or something critical) it is sufficent to check the booting / running dll sys and exe from time to time (=autoruns from sysinternals), if in doubt monitor regmon and diskmon for some minutes, and to have an eye on outgoing traffic, which should be close to zero when one is inactive. If still in doubt, one should have a registry from last week on hand. That's it. I think everybody can agree to compromise like this: XP is insecure and Win 10 is a virus.

Tricia McMillan wrote:

Wow! Never thought my small posting would [..]

You haven't seen similar Win98 SE or WfW 3.11 threads yet, then.. 🤣
Whereas 3.11 is just being made fun of, emotions run much higher when it comes to 98SE.

Thing is, 98SE has Windows Scripting Host being active by default (and no default firewall at all).
This allows all kinds of scripts (JScript, VBScript, VBA) being executed without warning.

VBA, which is similar to Visual Basic Classic, for example, is still in use in MS Office as a default Macro Language.
In theory, 98SE can still execute this code just fine, as a modern OS would. Also, it has KernelEx, making it similar to XP in terms of application compatibility.

Edit: Sorry for going slightly off-topic. I'll be a good boy for now. 😀

everyone should be using netscape navigator 4.79

Tricia McMillan wrote:

Of course you are right - all of you. And i do'nt want to stress this point too much (so, why am i writing this?) as i think malware / viruses is rather an artificial pushed problem than a real one, exaggerated by Kaspesky & Co. to sell their updates. I'm really not overcautious when surfing www, the only thing i use is uBlock (and a html5-toggle - i do'nt want to see everything). Nevertheless i'm 100% sure that my system was / is not infected in the last 20 years. For a private user with a standalone hobby-computer (that is not controlling his breathing-machine - OMG! - or something critical) it is sufficent to check the booting / running dll sys and exe from time to time (=autoruns from sysinternals), if in doubt monitor regmon and diskmon for some minutes, and to have an eye on outgoing traffic, which should be close to zero when one is inactive. If still in doubt, one should have a registry from last week on hand. That's it. I think everybody can agree to compromise like this: XP is insecure and Win 10 is a virus.

So you're 100% sure? I guess you've done some research since posting.
Which is the best traffic-monitor for XP?
I hope for your sake that you don't already have a rootkit which can hide your traffic from Wireshark, It's not very likely but it's possible. If you've been carefree and now want to really be 100% sure there's no packets to a command and control centre then you can run Wireshark from a laptop (or dual ethernet PC) running Linux, live CD or otherwise, which is sharing a wifi internet connection to your XP machine over ethernet. What wireshark won't tell you is what process is generating the traffic, there are old personal firewalls like Sunbelt (not used this for a long time) or very lightweight monitors like tcpview (which doesn't appear to capture all traffic) which can make it easier to figure out what's normal and what invites investigation.
Still, I don't see any benefits to using XP for browsing, just downsides and looks like it's becoming a bigger PITA to use in practice.

dr_st wrote:

That's not how it typically works these days. There are dozens of known exploits that can install malware. Someone buys a kit that implements multiple exploits and when it launches, it tries them one by one until it finds one that works. On an old / unpatched OS, the chances that it finds one that works are higher than on a modern / patches OS, that's certainly true.

I very much welcome you bringing some facts to the table.

I use Microsoft Message Analyzer along with wireshark to identify processes. Works well.
Alternatively you can use process monitor with wireshark as well

BushLin wrote:

... So you're 100% sure? I guess you've done some research since posting. Which is the best traffic-monitor for XP? ... […]
Show full quote

...
So you're 100% sure? I guess you've done some research since posting.
Which is the best traffic-monitor for XP?
...

Yes, still 100% sure. Maybe I can make it to 110%...
My motivation to install some monitor is not security. I just want to keep my old XP alive = some fresh software other than boring games. I like watching colourful graphs and self-updating statistics and such.
As mentioned in my other posting, Wireshark uses too much RAM = deleted.
I tried tcpview, thanks for your suggestion. Comes closer, but i'm looking for something *fancy* that shows me who is on the other end in "resolved" text = "the owner of 1.2.3.4 is xyz" = what uBlock tells me, but more detailed.... There is the tool "whois", but it wo'nt run on XP.
I'll keep on searching and see what else I find on www = more typical random dls from unknown sources...

Still, I don't see any benefits to using XP for browsing

You're focusing on the wrong thing. XP isn't a browser, MyPal is.

XP is a general purpose operating system for general purpose computers. The benefits of it are utterly huge hardware and software support, and arguably one of the best GUIs on a PC. A web browser is only one of the infinite applications that it can run.

looks like it's becoming a bigger PITA to use in practice.

If by that you mean the Web, then sure but that is the fault of web developers not the user or the user's machine.

I hope for your sake that you don't already have a rootkit which can hide your traffic from Wireshark

I've always loved this speculative assertion that there might be secret malware on one's system that they don't even notice. If malware authors are capable of making something that runs without negatively impacting the usage of the system, why are developers of legitimate software NOT capable of this? Why can't developers improve and build on their product without making unnecessary changes that are not only noticable but blatantly disruptive to the user?

It looks like roytam1 is looking into Palemoon 26 on Windows 98 with Kernelex so that should annoy some people. heh.

BushLin wrote:

... Still, I don't see any benefits to using XP for browsing ...

I forgot to comment on this last time... The benefit is money. Since i started with computig on MZ 800 and C64, I've spent ????? DM / Euros for hardware-trash. My first laptop was a 386SX20, paid 3.000 DM = 1.500 USD for it. Apart from beeing a big dissapointment, it became hazardous waste within two years. And so on. Since there are cheap Androids (my wife uses a 1A-working tablet she bought for 100 Euros in the supermarket), there is no need for people like me (=technophile standard surfers) to own a to-date PC. I'm no longer prepared to follow the "mainstream", e.g. buy new soon-to-be trash every five minutes. My XP is still the original OEM-CD that came with the last new computer I've ever bought +/-2005. Since it *fell apart*, I've never paid more than +/-50 Euros for replacement from ebay or flea-market, and I'm 100% happy with this.

bakemono wrote:

XP is a general purpose operating system for general purpose computers. The benefits of it are utterly huge hardware and software support, and arguably one of the best GUIs on a PC. A web browser is only one of the infinite applications that it can run.

Tricia McMillan wrote:

The benefit is money.

I personally like XP, especially after removing the cruft I don't use with nLite, I understand where it still has uses and advantages. However, a cheapo, 8 years old (or younger) laptop/desktop can securely run Linux for free or can still take advantage of a free upgrade to Windows 10 if it has a Windows 7 or 8 licence.
I personally have many issues with Windows 10 and I recognise that Linux isn't ideal for everyone but a compromise needs to be made somewhere; with XP you're already making compromises on OS security before considering the vulnerabilities and compatibility issues with running an old browser. Not to mention the very unique browser fingerprint you have with such an oddball setup.

I've seen a lot of infected systems, some were fully patched, locked down and had anti-virus but the user clicked on an attachment they shouldn't have; maybe you consider yourself too smart to get infected but savvy users with a vulnerable browser and OS stand little chance when visiting a page which wants to plant software.

You can try Linux Mint from a DVD or bootable USB without installing, it'll take ages to boot that way but you can give it a test drive without impacting your filesystem. There are plenty of good Linux distributions but if all you want is an easy life, a browser and a welcoming start menu, the Mate (essentially Gnome 2) desktop version is lightweight yet feature rich and won't stop you multi-booting XP.
https://linuxmint.com/download.php

EDIT:

Tricia McMillan wrote:

Since there are cheap Androids (my wife uses a 1A-working tablet she bought for 100 Euros in the supermarket), there is no need for people like me (=technophile standard surfers) to own a to-date PC. I'm no longer prepared to follow the "mainstream", e.g. buy new soon-to-be trash every five minutes.

The irony of this situation is that Android devices get at most 2 years, maybe 3 years in rare examples, of security updates before they're waste unless you're wiling to faff with LineageOS and put up with a few bugs; while old Dell Latitude/Optiplex, ThinkPads etc. from Sandy Bridge onwards can be found for less than $100, are built to a higher standard than bargain basement Android devices, are getting microcode updates from Intel and have a wide choice of operating systems which are still getting patched. You get 5 years+ from an iPad/iPhone but you're paying a lot more and the only browser you can run is Safari.

This is VOGONS and one of the things people like to do here is to restore old systems and/or keep them running. When it comes to computers, especially laptops, and especially in the Windows world, hardware tends to run best with the contemporary software of its time. There are many generations of systems that run very well with XP and not so well with newer versions of Windows (7 included).

By now these systems are too old to be useful as a primary computer, but one may still want to keep them around as backup systems, or for specific older games/applications. And it is only natural that once in a while one wants to go online on such a system, typically for something short/specific. This is exactly how I use my still-remaining XP systems (of which right now there are very few).

Everyone is free to make their own choices; for me, personally, the idea that I should go to another PC or reboot into a 'safer' OS just to surf the web a bit is utterly ridiculous. I've learned that people who spread FUD (as in Fear, Uncertainty, Doubt) in regards to OS/PC security are also the people who subscribe to FUD, making it very hard to convince them otherwise, so I stopped trying. What's the point? To each their own.

One metaphor I like is comparing your latest 'patched and safe' OS to a modern highway with two lanes each way and a median, and the older 'unsupported' OS to a simple road with no median and one lane each way. Everyone knows that the first is an order of magnitude safer, but you cannot just tell people to never drive one-lane roads. Sometimes there is no choice. So you just tell them to be more cautious when they do. And it's not like it's impossible to get into a fatal wreck on a multi-lane freeway with a median. Therefore the important thing is to teach people good habits, not tell them that they should avoid one-lane roads or Windows XP like the plague.

BushLin wrote:

You can try Linux Mint from a DVD ... ... multi-booting XP ... that Android devices get at most 2 years ...

Mint is good, i got a DVD and use it to collect and re-compose the pieces of my registry every time I blow up my system. Once I had it installed in addition to XP. BUT I need XP for 10 or 15 standard progs like "WinBirds", "LingoMaxx" or "Das Planetarium" which simply won't run on linux. Re-booting with linux every time for looking up - say - the latest movie of Brad Pitt or other trivia in www is super unpractical.

And no, as long as you're not in the depths of internet, old Androids can be used until their batteries give up for good. The OS-updating-mania is the same artificial = commercial matter as with (useless) virus-scanners "=buybuybuy!". WhatsApping or surfing on KitKat is as safe as on the latest version (is it 8 or 9? Or 10?). For me (resp. my wife) this makes 100 Euros every 5 years for a fresh tablet = a good deal.

dr_st wrote:

... run very well with XP and not so well with newer versions of Windows (7 included). ... By now these systems are too old to be useful as a primary computer, ...

Why? Depends on what you want to do. On my 13yo Amilo Pro V2055 = XP, 512MB, 80GB I can do everything I want. The (somehow) good thing is, that there are no "young" versions of apps I like to use, example: "WinBirds" is a serious multimedia Bird-watching-database that came on DVD. It died (like all other niche-apps) with the uprise of smarties = when the market for Win-apps became too small +/-10 years ago. But birds haven't evolved (too much) since then, a 2010 spanish dictionary is not really old, and (most) stars (another interest of mine is astronomy) are still the same, too. The same not-obsolete-yet applies to the encyclopaedias I use: Encarta 2007, Britannica 2011, Bertelsmann 2008 and Wikipedia on DVD 2007(!) With these I get accurate infos for countless *classical* themes, like (a real-life-example) "Vienna congress of 1815" - everything offline! Apart from that, i use OpenOffice for my letters, can watch DVDs, dl mp4s or stream TV (it works with MyPal!) ... In compact-mode: Old doesn't necessarily mean useless (this applys to computers at least).

dr_st wrote:

... And it's not like it's impossible to get into a fatal wreck on a multi-lane freeway with a median. Therefore the important thing is to teach people good habits, not tell them that they should avoid one-lane roads or Windows XP like the plague.

To stay in this picture: To me Linux is a dim lit tunnel. I don't want to spend (=waste) my time to illuminate it. I use it when I have to, e.g. total crash of XP. But if I have the choice, I'll take the old but picturesque scenic road. MyPal (=the browser-thing we were originally talking about) helps in fixing some of the potholes...

I love XP but I don't use it very often. I have it on my Sandy Bridge machine on a 2nd drive and use it for XP era games. Browsing with MyPal works fine but I just prefer browsing on a newer machine. Just is faster and a smoother experience.

edit: I'll start a new topic for this, sorry.