when you don't update your router - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: February 10, 2025, 02:44:37 pm
content: things like this happen:Massive brute force attack uses 2.8 million IPs to target VPN devices (https://www.bleepingcomputer.com/news/security/massive-brute-force-attack-uses-28-million-ips-to-target-vpn-devices/)Quote

author: Halcyon
author_rank: Unknown
timestamp: February 17, 2025, 07:49:16 am
content: This shouldn't really come as a shock to anyone, cyber security experts have been tracking these sorts of attacks for many months.It doesn't matter how much awareness there is, people will still never update their home routers, continue to buy cheap junk, and expose services to the internet because they don't know any better. Sadly, it's not just limited to consumers, but you have cowboy MSPs out there, who think it's still OK to run Windows Server 2008 R2, and port forward RDP services because "that's the way they've always done it".It's the same as there will always be those who drink/drug drive, exceed the speed limit, and use mobile phones while driving.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 18, 2025, 02:39:20 am
content: Selling devices that aren't safe unless you let the manufacturer modify them semi-regularly after the purchase doesn't sound right to me.Blaming the users seems bass-ackwards, too. When did regular updates become standard maintenance, and expected practice for both businesses and users? Ah. Microsoft. Nevermind. Don't let me interrupt the all-important race towards the very bottom.

author: wilfred
author_rank: Super Contributor
timestamp: February 18, 2025, 04:14:13 am
content: Quote from: Nominal Animal on February 18, 2025, 02:39:20 amOn the other side it is regarded as a good thing if you can get ongoing updates to your phone OS. In a rapidly changing world consumers want to keep up so their device, an expensive device, doesn't become obsolete too soon. They do it because a majority of consumers want it or if they don't know they want it will protest if they feel left out.Your cynical view, which I am sympathetic to, is a minority view.My router which is just the one my ISP gave me until it became unreliable and they replaced it, is probably updated regularly without my awareness. And I don't really care. Perhaps I should but I just don't.

author: ivan747
author_rank: Super Contributor
timestamp: February 18, 2025, 04:37:12 am
content: Quote from: wilfred on February 18, 2025, 04:14:13 amIf the ISP is even slightly competent they will keep their home routers updated. If all of their CPEs fall victim to a botnet is can be very bad: they have to pay for internet too, and their equipment also gets overloaded just like yours. So really the same reasons, just 2000000x the scale.

author: madires
author_rank: Super Contributor
timestamp: February 18, 2025, 12:01:25 pm
content: Quote from: Nominal Animal on February 18, 2025, 02:39:20 amOf course it would be great if the routers would be secure from the get-go. But the current reality tells a different story. As a user you should check regularly for updates or enable auto-update (hopefully implemented correctly).Quote from: Nominal Animal on February 18, 2025, 02:39:20 amThe first to blame is the manufacturer because he sells routers with an insecure firmware. However, have you ever seen any complex software/firmware which is 100% secure? I haven't. So we have to live with updates, no matter whether you like it or not. Therefore users are responsible for updating their routers or for replacing them in case of EOL. The problem is that insecure routers harm not just their owners but also others.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2025, 12:08:38 pm
content: Quote from: Nominal Animal on February 18, 2025, 02:39:20 amI blame the internet, it's designed to trust the end points and it shouldn't be. This is how the internet should be designed :- ISPs and backbones should be mandated to do ingress/egress filtering (in the same way modern CAs are mandated not to abuse their signing rights, ie. bankruptcy is a real threat for screwing up).- ISPs should be able to upstream filter rules if they have a bona fide reason to suspect traffic is malicious.If this were true, ISPs with malicious devices would have their router swamped with filter rules ... they would kick off the users with compromised devices till they fix their shit ... all is good in the world.

author: madires
author_rank: Super Contributor
timestamp: February 18, 2025, 12:14:29 pm
content: Quote from: ivan747 on February 18, 2025, 04:37:12 amHappened several times already. And ISPs are usually quite slow in providing updates (because of the customization). Their routers are typically customized versions of OEM models or regular models. IME, the ISP releases updates a few or several months after the manufaturer has provided the original update.

author: madires
author_rank: Super Contributor
timestamp: February 18, 2025, 01:41:48 pm
content: Quote from: Marco on February 18, 2025, 12:08:38 pmLet's say that the original design was based on the idea that everyone is nice to each other and behaves well. Since then many things changed. Not just users, but also the network from a technical perspective.Quote from: Marco on February 18, 2025, 12:08:38 pmWhat you're suggesting is already partly done, some isn't feasible, and some would be illegal in many countries.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2025, 08:33:47 pm
content: Quote from: madires on February 18, 2025, 01:41:48 pmIt's been cobbled together and is now completely dependent on using content delivery networks or major clouds, because they are the only ones capable with the non stop DDoS flying around. From devices which just stay connected to the internet unpunished.QuoteIf you are the size of Cloudflare you can call up a backbone provider and ask them to program some filter rules upstream, otherwise you are shit out of luck.It would have been feasible, if there were some benevolent dictators in charge when the problem was realized, instead of a dysfunctional hodge podge of interests. Unfortunately it was realized far too late and even then the few peoplewho didwere almost completely ignored.

author: madires
author_rank: Super Contributor
timestamp: February 18, 2025, 09:37:15 pm
content: Regarding DDoS attacks, some networks use BGP FlowSpec plus detection and automation tools to filter DDoS traffic if needed. A few provide APIs for trusted BGP peers to send FlowSpecs to be (semi-)automatically deployed.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2025, 10:04:28 pm
content: Yet clearly it's getting through the backbones ... cause they don't really care, traffic is traffic.The contractual design of the internet should have made everyone care, through monetary incentives. Then they would have rushed to the technical means to actually stop it, instead of the Cloudflare mafia offering protection services and the backbones eagerly selling the weapons to make it necessary.

author: PlainName
author_rank: Super Contributor
timestamp: February 18, 2025, 10:10:23 pm
content: QuoteYou realise that was not quite 10 years ago. The internet, and the protocols supporting it, were designed an eon ago and were perfectly sensible for that time.The problem isn't the technical protocols. It's the fuckwits that want to break it. Maybe blame them rather than do the victim-shaming thing.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2025, 10:20:54 pm
content: Quote from: PlainName on February 18, 2025, 10:10:23 pmAs I said, far too late.QuoteFirst worm was 1988.QuoteThe only solution, other than accepting the massive centralization of the internet by a handful of CDNs and Clouds, would be by changing the contractual structure and technical protocols of the internet.Even though it's practically impossible, changing fuckwits is far less possible.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 18, 2025, 10:38:18 pm
content: Quote from: madires on February 18, 2025, 12:01:25 pmOn the software side, I have. The trick is to trust nothing, instead of just minimizing cost and maximizing profit.For close practical examples, look into DJB's qmail, djbdns, and so on. Compare to Sendmail and BIND. Then ponder on why software with more security holes than Swiss cheese is considered "best of the best" by most people, when the historical record indicates the opposite.However, I don't actually expect 100%, because to err is human; just killing the culture of "we'll fix those bugs in the next version", "we'll do it this insecure but easy way first, and if we have time later on, fix it afterwards", "just ship it, we'll take care of that later", and so on, would do for me.I claim this would lead to reduced security updates, and fewer problems for everyone, albeit higher up-front costs for developing appliances and firmwares because you no longer could justify setting an inexperienced team of highschoolers at it, just because they were the lowest bidder.Until we consider security a necessary part of the software and firmware development culture, we're doomed to repeat the failures over and over again. Everyone except the companies producing the insecure crap pays; the companies and their shareholders just laugh all the way to the bank.

author: PlainName
author_rank: Super Contributor
timestamp: February 18, 2025, 10:39:41 pm
content: I'm not disagreeing that there should be prevention in place. What I am arguing against is the trial by hindsight.

author: Siwastaja
author_rank: Super Contributor
timestamp: February 19, 2025, 07:00:41 am
content: The idea that random laypeople including your grandma should be manually updating their home devices is completely ridiculous. Even the knowledge that this "should" be done does not reach 99% of the population. We can masturbate about the importance of end-user updates and victim-blame in our small nerd circles as much we want, but it does not go anywhere.Really the only way to deal with this matter is to first decide if this is important, and if it is, legally require manufacturers to sell only safe stuff, proactively fix broken stuff as soon as it is found, or require sanctions if unable to do this. This is how it works in every other market. If an electric device is found to be in violation of any other kinds of safety or EMC standards, manufacturers/importers need to recall them (for repairs, or for money-back). Why does this not apply to security issues of home routers is the big question.It would be ridiculous to suggest that a grandma should be desoldering and swapping an Y capacitor in a noncompliant power supply, and that manufacturers would put instructions how to do that on their website and maybe mail a new Y capacitor to the end user. Yet this is exactly what we hear being suggested regarding router updates.Phones do not compare, they pretty much autoupdate. Even grandma can press the "accept" button.

author: madires
author_rank: Super Contributor
timestamp: February 19, 2025, 09:31:07 am
content: Grandma can buy a router supporting auto-updates (routers providedf by ISPs usually come with auto-update), ask her grandson to do the update, or pay some IT guy. It's not much different from car maintenance. Or do you drive with broken brakes?

author: Siwastaja
author_rank: Super Contributor
timestamp: February 19, 2025, 12:39:08 pm
content: Quote from: madires on February 19, 2025, 09:31:07 amIt is very different from automotive. Car manufacturers cannot legally sell cars with broken brakes from get-go. Cars are legally required to autodiagnose and complain to user if maintenance is needed. Cars are legally required to be inspected (e.g., older cars every year). If defect is found, manufacturer is mandated to do a recall campaign, and if users do not respond to recall letters, it is not allowed to drive the car, and police will stop you.Plus, broken brakes are likely obvious to the user (weird noises, poor braking performance...). Susceptible router is not.You must be trolling; I mean you are seriously not saying this?

author: madires
author_rank: Super Contributor
timestamp: February 19, 2025, 01:21:26 pm
content: What I mean by 'driving with broken brakes' is that you endanger yourself and others. When you run a router with known security issues you endanger yourself and others. And car maintenance means that you're responsible to keep your car in a good working condition to safely drive on public roads. Maybe you can do some maintenance yourself, otherwise you pay a car mechanic for doing that job. Do you get my point?

author: Siwastaja
author_rank: Super Contributor
timestamp: February 19, 2025, 07:04:53 pm
content: Quote from: madires on February 19, 2025, 01:21:26 pmAnd how are you supposed to know that? It is shortly mentioned in mainstream media once or twice a year in a small article, that's it. I'm sure 99% of people have never heard about it, never thought about it.Because faulty brakes are dangerous to others, society takes means to prevent driving with faulty brakes with clear legislation and supervision. If insecure routers are dangerous to others, something similar, toanydegreeat all, should be done. Currently there is absolutely nothing being done. We blaming the end-users here has no effect whatsoever. Do you get my point?

author: madires
author_rank: Super Contributor
timestamp: February 19, 2025, 08:12:08 pm
content: We should end this discussion as there's no point in continuing it any further.

author: DimitriP
author_rank: Super Contributor
timestamp: February 19, 2025, 08:57:25 pm
content: hey...my IP address is 192.168.0.183, the password I use on my machine is 1234 . Show me what you can do...

author: madires
author_rank: Super Contributor
timestamp: February 19, 2025, 10:12:33 pm
content: Mine are 127.0.0.1 and ::1 (I have IPv6).

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 19, 2025, 11:21:52 pm
content: Quote from: madires on February 19, 2025, 08:12:08 pmThere are two aspects of this discussion thatseemlike they are in conflict, but in reality are not. See:Sensible people should always keep the firmware of their networked devices up to date, because the current device manufacturers don't bother to make their firmwares safe; they simply fix whatever issues get noticed by users and expoited by criminals, script kiddies, and alike, as long as they feel they need to. After that, you're on your own.One aspect is the current culture and vendor behaviour, which is reprehensible. The other aspect is that the world is what it is, and keeping our networked devices updated is a rational, considerate, sensible thing to do that is in our self-interest –– even if the vendors behave differently.See? There is no conflict here, just focus on the twoapparently oppositesides of the issues. When you consider the whole picture, the conflict vanishes, and simplifies to the fact thata rational person will do the updates, even though others do not, because of enlightened self-interest. While perhaps pointing out how destructive this pattern is, globally and culturally.I was hoping someone else would realize this also and post about it, but I'll do it if nobody else will. Guess why?

author: Halcyon
author_rank: Unknown
timestamp: February 20, 2025, 05:05:21 am
content: Quote from: Nominal Animal on February 18, 2025, 02:39:20 amLook at it from this perspective:Firstly, how do you define "safe"? To me, "safety" in the digital world is a sliding scale. It's no different to comparing a 2001 Holden Commodore to a modern Volvo S60. Both of which are still allowed on the road. When does a car (device) stop being safe... When it gets superseded? When the owner decides to use it contrary to advised practice?Secondly, products are typically released to market with few to no known vulnerabilities, those come with time as attackers improve their methodology, or discover that the manufacturer screwed up. An old Fortinet firewall that was once considered "safe" might now have more holes than Swiss cheese.I think some blame does need to be on the user. No one is saying they should become networking experts and systems admins overnight, but some degree of onus should be on the end-user. Most users should already understand how to, and the importance of updating their devices. How is that any different to maintaining a car, ensuring correct tyre pressures, etc... Should that extend to routers? Perhaps not, but who else will take responsibility? Particularly with some many end-of-life devices out there. What happens to those devices that are old but "just work", do you force people to upgrade?Then there is the flip-side of the coin. Over in Australia, end-users will typically have complete, administrative access to their routers and networking equipment, even if it's supplied by their ISP, or, they can elect to use their own equipment if they want to. There is no vendor/carrier lock-in. I would be pretty pissed off if I wasn't allowed to configure and modify my own networking equipment that connects to the internet and I shouldn't be prevented from doing so, considering I have the knowledge.The other problem you have are manufacturers based in countries like China, who really have no desire to make their products secure, pumping out cheap products for the masses. They are compelled to act, when directed by the CCP/CPC, and they can't say no.What's the answer? Buggered if I know. The biggest issue you have are threat actors operating across borders, where jurisdictions are unable or unwilling to reach.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 20, 2025, 06:36:36 am
content: Quote from: Halcyon on February 20, 2025, 05:05:21 amThat is the gray area: exactly how much blame should be put on users, and how much on the vendors?I do not actually care about the individual opinions on that, even my own; it is the reasoning, the basis behind the opinion that is valuable, because one can then reflect and compare those to their own. (At least my own opinions change as I get new information and see things from a different perspective; they're never set in stone.)If we look at the thread thus far, we'll see that some members focus on the individual scale and treat companies as unaffectable, whereas some ignore the individual scale and treat companies as fully to blame. They're not mutually exclusive!In my opinion, although individuals should be responsible for now in the short term, the only true sustainable change will happen if we manage to convince users to reject buggy software. Already gamers are rejecting initial published versions because they know the experience will be shitty until the major bugs are fixed in the first patch, and wait for that. And if we don't change things, software quality will just drop further.Do not forget: Microsoft Patch Tuesday wasn't always a thing. There was a time when you could expect several months between OS updates, and enough testing so software would actually work at release. Appliances needing firmware updates is an even later invention.(The router firmware sources I've seen from commercial vendors, based on Linux, have all been utter crap. Like put together by a high school hobbyist. In an era when OpenWRT exists. This is the main reason I so heavily blame vendors: they're cheaping out, making money off open source projects they don't contribute to, and putting together a "product" whose security only a Windows enthusiast can be happy with. You know, the afterthough-bolted-on kind of security, that doesn't really work, and only hinders the users. And the same people happy with that, complain about low-quality one-hung-lo stuff. Me not happy.)

author: madires
author_rank: Super Contributor
timestamp: February 20, 2025, 08:57:35 am
content: It's not just the cheap stuff. Carrier-grade routers from Cisco or Juniper for several 100k bucks or more aren't much better either (security-wise). It's frustrating to see the those vendors regularly posting security advisories with basically the same old mistakes over and over again.

author: Marco
author_rank: Super Contributor
timestamp: February 20, 2025, 11:28:03 am
content: Buffer overflows and inline signalling (ie. escape sequences and zero terminated strings) responsible for the majority of them. Again some early decisions hanging around to haunt us and supposedly impossible to fix, again almost no one who even recognizes the problem (inline signalling as a fundamental cause is truly almost completely unrecognized, even though not a day goes by without a zero day from faulty input sanitizing).I find it frustrating to see that people can't recognize the real problem, requiring inhuman rigor from humans. Everything needs to be designed around human failure modes.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 21, 2025, 12:34:41 am
content: Quote from: Marco on February 20, 2025, 11:28:03 amOne of the web engines (application server for HTML pages) I created sanitized the entire URI (except for the query part, following the question mark) before any processing. As Finnish and Swedish use some non-ASCII accented characters, I converted those first (from a few different encodings, as they do not generally overlap; and back then there was no agreement at all as to what encoding browsers used for URLs) to nearest ASCII equivalents, allowing native-language URIs to just work. The end result of the sanitization was an URI consisting of ASCII alphanumerics, dashes, underscores, slashes, and dots, with no two consecutive non-alphanumeric characters in it. It's surprisingly effective, that kind of "paranoid" filtering and conversion. (To me, it wasn't paranoid because I remember the known exploits especially on early Microsoft IIS, just sensible; but that's what others told me they thought it was.)Having worked quite a lot with untrusted inputs, and had to work with cases where the input is escaped multiple times, I'm also convinced that the standard method of escaping characters by just preceding the escaped character with a mark (like backslash, \) is incorrect. For one, it cannot be unambiguously parsed backwards. Instead, the escaped characters should be represented by a different one in the escape sequence; for example,\/→\and\,→"and\(→{and so on. These are unambiguous, backwards-parseable, and nested-escaped without quadratic length of consecutive escape characters. You can even apply escaping to potentially already escaped data without adding a new nesting layer!Even the Linux kernel pseudofile interface suffers from this, withdrivers/md/md.c:md_bitmap_status(),fs/proc/nommu.c:nommu_region_show(),fs/proc/task_mmu.c:show_map_vma(),fs/proc/task_mmu.c:show_numa_map()andfs/proc/task_nommu.c:nommu_vma_show()stillfailing to escape backslashes in file names, while in most cases still escaping other characters with a backslash. (This is because the underlyingseq_file_path()andseq_path()functions do not by default escape backslash itself, it must be specified in the escaped set itself, which the aforementioned functions fail to do.)Quote from: Marco on February 20, 2025, 11:28:03 amYes, exactly.On the software side, my perennial complaint is how applications ignore error checks, "because they almost never happen, and when they do, you have bigger problems at your hands", which causes silent data corruption and hardware issues to not be noticed until it is too late, and important data lost or garbled. I've heard the "I'll add the error checks later when I have more time" countless times, seen the TODO comments exhorting rewrite of hacks and to at least check for errors, to know that these will never get done. To me, software that ignores errors and does not tell me, the end user, when they occur, is utter crap and needs to be burned in a fire, and their authors ridiculed and shamed. It should be a crime punishable by death to teach humans to program without teaching them to implement proper error checks and how to write useful comments, because learning those later on is almost impossible, requiring utmost self-control, which most humans just are not capable of. I myself still struggle a LOT with writing useful comments, the kind explaining the developer intent and rationale behind the code, instead of what the code does (which the code itself already tells anyone willing to look, unambiguously).

author: DiTBho
author_rank: Super Contributor
timestamp: February 21, 2025, 01:52:43 pm
content: I don't know if it deserves a mention or not, I also have zero personal experience with this,I just know there are "day zero exploits" (akad0e) for sale on the dark web."day zero" means "newly discovered, not yet patched, you can use it for an attack"and people on the dark web are willing to pay a lot of money for that stuff.

author: coppice
author_rank: Super Contributor
timestamp: February 21, 2025, 01:57:35 pm
content: Quote from: madires on February 20, 2025, 08:57:35 amScrewing up is kinda inevitable in the real world. A big issue is how responsive people are when these problems are discovered. The recent advice against TP-Link kit in the US was not based on them screwing up, but on their lack lustre speed of responding to a discovered problem. Its not just them, though. The purveyors of high priced systems are pretty hit and miss about their responses.

author: DiTBho
author_rank: Super Contributor
timestamp: February 21, 2025, 02:03:24 pm
content: Quote from: Nominal Animal on February 21, 2025, 12:34:41 amme, toothe reason my I implemented the "lib_filename_utils_v12" module, and then used it even in myHTTP server.Code:# ls testcase/*myfilename_adjust.test myfilename_deextendR.test myfilename_desubfolder2.test myfilename_getroot.testmyfilename_adjust_double_slash.test myfilename_delocal.test myfilename_diff.test myfilename_is_acceptable.testmyfilename_adjust_to_url.test myfilename_depath.test myfilename_doclass.test myfilename_level.testmyfilename_adjust_url.test myfilename_derel.test myfilename_getextL.test myfilename_level_get.testmyfilename_declass.test myfilename_deroot.test myfilename_getextR.test myfilename_majorchar.testmyfilename_deextendL.test myfilename_desubfolder.test myfilename_getleaf.test myfilename_upchar.testspecifically these { myfilename_is_acceptable, myfilename_adjust_to_url, myfilename_adjust_url }

author: Marco
author_rank: Super Contributor
timestamp: February 21, 2025, 02:23:21 pm
content: Quote from: Nominal Animal on February 21, 2025, 12:34:41 amEvery form of escaping requires inhuman rigor, escaping is simply wrong except for wire coding.Metadata should be completely separate from data and data should be encoded with length and be allowed to contain anything. Always.SQL is wrong, HTML is wrong, C strings are wrong, printf is wrong ... everything is wrong and thus the exploits won't stop. There are more ways for humans to screw up escaping than can be conceived of in your linter, humans are still discovering new ways to do it wrong.

author: Sassy Taste
author_rank: Contributor
timestamp: February 28, 2025, 01:43:45 am
content: The iPhone or Cable company always lets you know when there's new machines or softwares to be added. Some people just pay the cost to an internet and get any kinds of service there is. So they automatically recommend changing the router. Like if you're on snapchat, or Facebook using their chat sessions all the time, those guys just pay for it. And they go at it with writing programs to their new network. So the company sends them update news all the time. They use all services.I am in a hallway that leads between two rooms. One to the electronic, engineers building it, and the one that is writing the programs on the computer. I just took up radios, DVDs, TVs, as a hobby. I'm beginning to think many engineers are on this blog or forum. I'll just stick to the math part and electronics, I'll be there too in electronics.

author: madires
author_rank: Super Contributor
timestamp: May 10, 2025, 04:40:47 pm
content: Police dismantles botnet selling hacked routers as residential proxies -https://www.bleepingcomputer.com/news/security/police-dismantles-botnet-selling-hacked-routers-as-residential-proxies/EOLed routers were targeted and used for a paid proxy service.

author: gmb42
author_rank: Frequent Contributor
timestamp: May 10, 2025, 08:28:10 pm
content: Quote from: madires on May 10, 2025, 04:40:47 pmTo think also there's a few folks around these parts that advocate running older versions of Windows and will ignore the Win 10 EOS because it won't be a problem (for them).

author: PlainName
author_rank: Super Contributor
timestamp: May 10, 2025, 10:17:05 pm
content: There is quite a difference between an OS on a PC behind a firewall and a router direct connected to the internet. If you don't understand that, best not connect your W11 to anything, just in case

author: gmb42
author_rank: Frequent Contributor
timestamp: May 11, 2025, 10:53:42 am
content: Are you are that even behind a router and a firewall, devices can access the internet? And when doing so, they can inadvertently download malware which will exploit the issues with unsupported devices?

author: PlainName
author_rank: Super Contributor
timestamp: May 11, 2025, 02:10:01 pm
content: They are all much of a muchness. If you insist of downloading random word documents from nefarious websites you'll probably suffer. If you don't download, don't visit, you are much safer. With an appropriate AV there is little difference between systems. Oh, except every week you don't have to wonder if your PC will boot after another forced update.Most of those users here who run the stuff you're afraid of, and spreading FUD about, are not unwitting and clueless pensioners, you know.

author: Monkeh
author_rank: Super Contributor
timestamp: May 12, 2025, 12:36:18 am
content: Quote from: gmb42 on May 11, 2025, 10:53:42 amAnd so one has to make the decision between the possibility of malware and the OS itself being malware.

author: gmb42
author_rank: Frequent Contributor
timestamp: May 12, 2025, 09:29:11 am
content: Quote from: PlainName on May 11, 2025, 02:10:01 pmHow on earth is it FUD to point out unpatched, unsupported systems are insecure? All your hand-waving about allegedly managing to run such systems "securely" is just hot air.Quote from: Monkeh on May 12, 2025, 12:36:18 amAgreed. I make sure my linux hosts are up to date using various methods, noting articles such asthisto maintain awareness of trends.

author: PlainName
author_rank: Super Contributor
timestamp: May 12, 2025, 01:28:12 pm
content: QuoteThey are patched, just not supported. However, the implication of your rant is that supported systemsaresecure.

author: gmb42
author_rank: Frequent Contributor
timestamp: May 13, 2025, 09:33:47 am
content: Quote from: PlainName on May 12, 2025, 01:28:12 pmSemantics, maybe I should have saidlesssecure. Security is a process, it's neverdoneand continuing to use unsupported, unpatched systems is a risk that has to be taken into account, either personally for a home user or as a management decision for businesses.