So Much For "No More XP Patches"

Remember three weeks ago when Microsoft made a huge deal out of Windows XP finally being retired? April 8th, circle it in red, thirteen years of support, done, over, go buy a new computer. I wrote a little bit about it here at the time (or at least I meant to, I think it ended up as a draft I never finished, which happens more than I'd like to admit).

Well. Turns out "no more patches, ever, we mean it" lasted about three weeks.

On Thursday Microsoft shipped an out-of-band patch, MS14-021, for a nasty Internet Explorer bug that's been going around since a security firm called FireEye flagged it late last week. Its the kind of hole where just visiting the wrong page in IE can hand an attacker code execution on your machine, no download or click required beyond loading the site. It hits IE6 all the way through IE11, which is basically every copy of Internet Explorer that has ever existed, and it was bad enough that the Department of Homeland Security put out an advisory telling people to just not use IE until it got fixed. That's not a normal Tuesday. Government agencies telling citizens to avoid a specific piece of Microsoft software by name is the kind of thing that makes actual front-page tech news instead of just the usual "critical update available" shrug.

And buried in the patch notes: it covers Windows XP too. The same XP that got its official death certificate less than a month ago.

I get why they did it. There are still, depending whose numbers you believe, something like a quarter of all desktop computers on earth running XP, and a chunk of those are hospitals, banks, ATMs, and government offices that aren't upgrading on anyone's timeline but their own. Leaving all of those machines wide open to a drive-by IE exploit right after publicly declaring the platform dead would have been a genuinely bad look, maybe even a "congressional hearing" bad look. So they blinked. Fine. Reasonable, even.

But it does kind of undercut the whole "seriously, we are not kidding, upgrade now" messaging campaign they'd been running for a year. If the retirement date is soft enough that a sufficiently scary bug gets you one more patch anyway, then some percentage of the people still dragging their feet on XP are going to read this exact story and conclude they can keep dragging them a little longer. I don't think thats wrong of them either, honestly. Humans respond to incentives and Microsoft just handed out a pretty clear one.

Small tangent, since I can't help myself: I've got an old Dell in the closet at my parents' place that's still running XP, still doing exactly one job (printing boarding passes and the occasional recipe, as far as I can tell), and nobody in that house has any intention of touching it until it physically dies. Multiply that by however many tens of millions of households and small offices and you start to understand why "just upgrade" is a much smaller ask on a whiteboard than it is in reality. My dad's response when I told him about all this was basically "it still works though," which, sure, until it doesn't.

Anyway. If you're one of the XP holdouts, go get this one, it's rolling out through Windows Update same as always even though you're not supposed to be getting those anymore. If you're on a newer version of Windows it should already be queued up too. And if you've been putting off switching away from IE as your default browser, I'd say this is as good a nudge as any, not because IE is uniquely terrible (every browser has had its share of ugly zero-days) but because right now, this week, its the one with a known hole and a patch that's maybe twelve hours old.

Also, small aside totally unrelated to security: Facebook's developer conference was earlier this week and they spent a good chunk of it walking back some of their own login and permissions stuff from a couple years back, letting apps ask for way less info up front. Funny how much of this industry, this month especially, seems to be people quietly undoing decisions they were extremely confident about eighteen months ago. Might be a theme I come back to.