Hacker News Reader

Comment by davidf18 | Hacker News Reader

The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10.

The only people to blame are those that don't follow manufacturers instructions.

They were warned ahead of time. There were even news reports about this.

Target and Home Depot both had credit card hacks precisely because they did not follow manufacturer (again Microsoft) instructions of upgrading Windows XP embedded to a supported version of the OS.

I don't understand how hospitals can get accredited if their IT systems are not up-to-date and verified by cybersecurity experts. Since the companies and the NHS can't be counted on to follow manufacturer instructions, this is extremely important.

May 11, 2017: British Medical Journal: The hackers holding hospitals to ransom - Hospitals need to be prepared to avoid shutdowns http://www.bmj.com/content/bmj/357/bmj.j2214.full.pdf

Also: Hospital accreditation http://www.uktreatment.com/why-the-uk/hospital-accreditation...

EDIT: The computer systems are capital equipment and like any other form of capital equipment (eg, vehicles in the motor vehicle pool) they must be maintained. Complex machines undergo changes over the life of the equipment and manufacturers issue updates (eg, field change orders) that should be followed by the purchasers of the equipment.

Regarding proper cybersecurity, that would include hardware upgrades since later Intel CPUs incorporate hardware that assist with proper security that is taken advantage of by later versions of the Microsoft OS.

The problems of hospitals both in the US and in Britain were because of a refusal to follow the manufacturer's (Microsoft's in this case) instructions.

Those familiar with the hacks of Target and Home Depot would know that they were hacked because Target and Home Depot refused to follow Microsoft's instructions to upgrade their point of sale software from unsupported Windows XP embedded to a later, supported version of the OS.

View on HN

> The reason the attack happened ...

A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it.

And, of course, the NSA could have disclosed the bug when they found it instead of hoarding it. Or better protected their tools from theft. Or the Shadow Brokers could have better audited their disclosure to avoid spilling active hacks into the public.

Almost all of these things were required to get to where we are, and all of them are "simple and expected" from at least someone's perspective.

Lots of blame to go around, basically.

> "A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it."

No machines are built perfectly from the start and there are changes made over the capital equipment's life be it airframes, jet engines, or computer systems.

When purchasing capital equipment or buildings, bridges, etc, part of the responsibility of the firm is to follow the manufacturer's or builder's instructions and including maintenance upgrades. In the case of Microsoft, they gave warnings for years that the Windows XP software would not continue to be maintained.

The issue was not Microsoft, but NHS (and other governments, firms) decisions not to budget for and perform maintenance for the capital equipment that they purchased.

I agree this should be upvoted more than ten times.

It's staggering to me that so many recent revelations have shown that in their efforts to protect us, the 3 letter agencies have allowed vulnerabilities to exist on our machines -- and considered them assets -- without warning us.

I don't think it's that easy though. For example, if your CT scan software was made for Windows XP and you randomly update to Windows 10, then if you have any problems, the company making the software can blame you for not using Windows XP and you're on your own, since that's what the software has been tested/accredited for?

That's what I read somewhere, not sure how accurate it is.

I imagine the ideal solution would be to have a clause in the contract with the software company that they have to test and re-validate their software on new versions of windows and updates in a timely fashion so that the computers running the software can be updated? That would probably increase costs though

It is a terrible business and business arrangement (eg, the original contracts to purchase said software or equipment that uses software) that doesn't insist that the purchased software/machine run on manufacturer (in this case Microsoft) approved OSs. If the manufacturer says upgrade, then upgrade. When you purchase software and equipment, this should be part of any standard contract.

People in the know have been complaining about this for many years, and it's corporate bean counters that collude with a sclerotic corporate IT mentality to be conservative in all things including software.

And the reality is, the overwhelming majority of IT people have no training or background in risk assessment, they are not computer security people. But the bean counters, always optimizing, without good information let alone perfect information, have assessed risk incorrectly. And now there's a wildfire in progress, and basically being incompetent at the task they were handed, are all surprised.

Many other people who have considered this eventuality are not surprised.

> "And the reality is, the overwhelming majority of IT people have no training or background in risk assessment,..."

But in this case, as in the case of credit card hacks of Target and Home Depot, it was simply a matter of following manufacturers maintenance instructions and upgrading the OS version from an unsupported version to a supported version.

As many have pointed out, in the case of Windows 10, the upgrades had been free at no charge from Microsoft.

As many others have pointed out, the software company needs to run on that OS may not run on Windows 10, may not be supported on Windows 10, or maybe require a whole new licensing scheme and fees to move to a version of the software that will run on Windows 10. And IT and bean counters have very typically taken the position of "if it's not broken don't fix it" and do not consider constant migration in their best interest.

Also, that it was free for consumers doesn't mean it was free for enterprises. That licensing is different. And even if the licensing is free, the cost to know how by your IT staff is not free. Either you're getting new staff who can support it, or you're sending the staff to currency training. Doctors, lawyers, pilots, have done such recurrency training for decades, but in IT it's not a given it's very much driven by the CTO. And some of them do not care to have a staff more capable than minions. They're cheap. That's all they care about. And then this happens and they quickly will have to look for someone to blame.

The bean counters ultimately work for the shareholders if a public corporation or the public if it is government. The shareholders empower management and the public elects their leadership.

The CEO of Target got fired for not upgrading their point of sale software from an unsupported version of Microsoft Windows embedded (XP) to a later version which caused their system to be hacked.

Ultimately, this is going to be a problem as long as firms don't treat computers as any other form of capital equipment (such as repair vehicles) that need ongoing maintenance. Boards need to be asking their management about keeping their capital equipment under maintenance.

As for software that doesn't run on Windows 10, perhaps it is best to avoid firms that produce software where they don't upgrade it to the most secure version of the OS. I think this is mostly a hypothetical for most and it is probably important that firms change vendors if the vendor isn't willing to upgrade to the latest version of the OS.

There are a class of bean-counters that specialize in assessing risk quantitatively. They would be found in the insurance industry. Though I would caveat that with the guess that the vast majority of that assessment is with models of risk attached to lines of insurance that have been long established and change fairly slowly.

So your answer to the difficulty in making an OS secure is that anyone writing an application to run on that OS should instead be contractually required to support that application on arbitrary future OSes that don't even exist yet?

Good luck getting anyone to supply anything on that basis. You'll need it.

> So your answer to the difficulty in making an OS secure is that anyone writing an application to run on that OS should instead be contractually required to support that application on arbitrary future OSes that don't even exist yet?

A piece of software that is operating on an non-supported OS is not a functioning piece of software. Usually, when software in the corporate environment is purchased, it is with a maintenance agreement or it should be. Part of the maintenance agreement should be for future versions of the OS from the same software vendor (eg, Microsoft in this case).

Perhaps in the future with more and more apps going from Desktop to SAAS or mobile this might be less of a problem. Don't know.

A piece of software that is operating on an non-supported OS is not a functioning piece of software.

Why not, exactly? What is mysteriously going to stop working just because someone's legal arrangement expired?

Or to be blunt, how many people do you think we should kill by not using medical technology bought at great cost just because some lawyers would like a bit more money please?

Usually, when software in the corporate environment is purchased, it is with a maintenance agreement or it should be. Part of the maintenance agreement should be for future versions of the OS from the same software vendor (eg, Microsoft in this case).

That's a lovely theory, but in the real world organisations buy very useful, very expensive equipment all the time with the expectation that its useful lifetime will be longer than any currently available OS is officially supported for. Moreover, in many cases it might not be economic to purchase at all without that. This is why standards and compatibility are so important.

Perhaps in the future with more and more apps going from Desktop to SAAS or mobile this might be less of a problem.

Heaven help us if anything important ever moves to SAAS, because no-one else will. SAAS is sometimes useful for convenience or short term flexibility. Self-hosted is for professionals who need guarantees.

> "Why not, exactly? What is mysteriously going to stop working just because someone's legal arrangement expired?"

No, it is about engineering and resiliency as opposed to just getting something to work. Would you fly on a plane with unsupported software?

Firms can choose to use unsupported software at their own risk (at least in most situations -- there may be situations where it is illegal to do so such as mission critical safety systems).

> "That's a lovely theory, but in the real world organisations buy very useful, very expensive equipment all the time with the expectation that its useful lifetime will be longer than any currently available OS is officially supported for."

First, I don't know if that's true about the expectation that a very expensive piece of equipment is expected to run on unsupported software. If it truly an expensive piece of equipment that usually comes with maintenance agreements (eg, MRI scanner, CT scanner) and in that case, the vendor can't be using unsupported software. It should be part of FDA approval process that that be the case, but I don't know for certain.

Regarding SAAS, it might be a private firm server (farm) but one that is a server none-the-less which is easier on upgrades than entire sets of desktop systems.

I believe that firms that use unsupported, outdated software open themselves up to various liabilities.

>For example, if your CT scan software was made for Windows XP

There are best practices for dealing with out of support equipment that are exceptional edge cases. Segregation and isolation from the network being the top ones. Having them sit with the smb service listening on the local subnet is completely inexcusable and a sign of incompetence.

How do people get their files out of isolated computers? For example if someone does a CT scan and needs the upload the results to the patient's file? Use a USB key? I think that's what my boyfriend does with his driving simulator at work that still runs Windows XP. But aren't USB keys just another vector?

There are unidirectional security gateways that only allow data to flow in a single direction. The legacy hardware creates a file, and copies it to a directory managed by the gateway. The gateway then copies it to some data dump on the other side, onto an updated and centrally managed part of the network. Barring some vulnerability in the gateway, passing data in the other direction is impossible.

cool, thanks

You just have those files rsync to a file server and then the client PCs connect to that file server. They should never ben connecting to the XP box directly as its firewall'd off to only be able to speak to the file server.

In engineering, we should assume the users will not adhere to instruction. This is why in physical engineering, tolerances for usage are often 3x their advertised value.

In Microsoft's case, they have the means to know who their users are and ensure they upgrade. Forced upgrades should be an opt-out feature, especially with an OS as prominent as Windows.

The NHS had already opted out - because of the difficulties in upgrading.

The NHS had warned hospitals several years in advance that Windows XP would be discontinued and that they would have to upgrade the OS. The NHS took out a 1 year contract on Windows XP updates at great financial expense which gave responsible authorities plenty of time to do the system upgrades.

Don't know what kind of engineer you are, but I have BS EE with minor CS from top engineering school.

Airplanes have to undergo preventative maintenance. We don't count on airplanes not being maintained. Sorry.

Highway bridges and other structures undergo constant inspection.

It is one matter for individuals in their homes choosing not to update a computer or for a privately held firm.

But firms with stockholders, or governments must follow manufacturers instructions when they purchase equipment and that includes maintenance whether for their vehicle pool or other equipment.

> Highway bridges and other structures undergo constant inspection.

They are supposed to, but underfunding/mismanagement can abuse the overengineering (which thankfully existed in the first place!) and skip regular inspections, sometimes with fatal consequences.

http://www.nbcnews.com/id/22300234/ns/us_news-bridge_inspect...

Yes, you are absolutely correct. There was the collapse of an Interstate Highway bridge near Albany NY, the collapse of a bridge in Minneapolis, MN, and other cases. Since people die because of the lack of proper inspections, I wonder why management isn't held accountable for manslaughter or whatever charges.

And in Windows 10, forced updates are opt-out, and yet, prominent tech sites like C|NET publish crap like this without tons of caveats about why it's a terrible idea for most everyone who needs a C|NET article to tell them how: https://www.cnet.com/how-to/stop-windows-10-from-automatical...

They kind of acknowledge how bad this advice was:

"Update, May 15: With the Windows 10 Creators Update, Microsoft has largely addressed the forced updates that often resulted in lost work. And, while the the recent WannaCry ransomware does not (thus far) appear to affect Windows 10, you need to make sure your PC is kept up-to-date with security patches to avoid exactly those sort of attacks. To that end, consider the information below to be out of date, with a more thorough update to come."

> The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10.

Well, on one side, you have the OS manufacturer's instructions to update to Windows 10.

On the other side, you have the software manufacturer's instructions to stay on Windows XP at all costs.

Which instructions do you listen to?

(Arguably, before this week, it would have been empirically correct to listen to the software manufacturer; upgrading from XP would have definitely broken the system, but staying on XP didn't break it so far.)

> "On the other side, you have the software manufacturer's instructions to stay on Windows XP at all costs."

It is one thing for an individual to purchase software for their own needs, but any firm or government should not purchase software that will not be upgraded to the current versions of the Operating System. That is simply irresponsible and should have been rectified in the purchase contract.

As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?

> That is simply irresponsible and should have been rectified in the purchase contract.

Have you heard the expression "captive market"?

It's not like they can buy equivalent software from a company that guarantees upgrades.

> "As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?"

Sounds like a hypothetical. What applications software is being purchased for which there is no equivalent and only a captive market?

Even common hardware devices as plain notebooks don't run properly with the "newer" OS. I have one notebook for which the drivers break with anything above Windows 7. I have another which can't be upgraded over Windows 8.1. For both Microsoft's "Get Windows 10" claimed they "will work" with Windows 10 (there were ads running on both which do the "check" before).

I've tried the upgrade for both. The Windows 7 one has problems with the WiFi card -- reason: Intel never made newer drivers, the old aren't actually compatible with the newer systems. The Windows 8.1 one has problems with the touchpad: reason: the newer drivers are broken for that model. It also has some display issues on the Windows 10. The WiFi card, the touchpad and the display effectively aren't replaceable. But the computers, apart from not running the newer OS, work without a flaw.

If I as a consumer with only a few computers have such problems, I can't see how you don't understand that the whole companies can have immense number of computers that work perfectly with their current OS and would simply break with the newer one.

They would not upgrade, but they would install the security updates. But guess what, Microsoft doesn't want to give the security updates to everybody who has Windows XP. Only after this failure they "exceptionally" did it.

So Microsoft is absolutely responsible. They can say "we'd prefer to motivate people to buy new" but they are still morally responsible for not releasing updates when there are so many actively used systems.

I think many firms have a two or three year cycle for upgrading their desktop/notebook computers. Honestly, they are far less expensive these days than they used to be. The biggest cost might be retraining people to use the new systems in many cases.

Windows XP is an OS from 2001. It is way out of date and does not include with it all of the security of a newer OS such as Windows 10.

In the case of most firms they upgrade every few years anyway. It might be different for some non-profits or government. But at any rate, I feel it is totally unrealistic to expect MS to support software from 2001.

> That is simply irresponsible and should have been rectified in the purchase contract.

Simple does not exist in even smaller private organizations, let alone large government organizations.

> As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?

There is code written 60 or more years ago running on today's mainframes. The cost of rewriting even a fraction of this code can be staggering. This is precisely why COBOL programmers get paid big bucks and why Microsoft gets paid by large clients to provide support past end-of-life. If it works, it works.

You can't blame one person for something going wrong in an increasingly connected world.

Not advocating that software be converted from IBM mainframes (which IBM still maintains and still releases new hardware) to be converted to Windows.

How much software that is generally available only works on XP and that can't run in XP running on a VM?

If the software manufacturer's instructions are to stay in Windows XP, then they should be held responsible for patching the security flaws in the system they delivered - if they choose to use obsolete components, maintaining them should be their problem.

In theory you might be right, but pragmatically (and from an engineering perspective) it isn't going to happen and it is just fraught with possible problems. Best not to deal with an OS from 2001.

In many cases, they can probably upgrade using Win XP running on a VM in Windows 10.

>The only people to blame are those that don't follow manufacturers instructions.

And even then if you absolutely can't upgrade that XP machine running an MRI then there are best practices to segregate and isolate it from the network properly.

I'm getting a little sick of the people with an anti-whatever axe to grind pretending this was some big sophisticated attack that only nation states can do. This patch was released months ago, there's no excuse not to have it. It was just one of the hundreds of Windows exploits found per year. If admins aren't upgrading their equipment or segregating them properly then that's on them. Note, there was no NSA leak for Conficker, codered, heartbleed, slammer, etc. This stuff will not stop unless admins and management take security more seriously.

No admin, myself included, had any issues this weekend. It was completely avoidable.

Similarly, all of the brouhaha about Clinton campaign chairman John Podesta getting his gmail account hacked. He was in a very sensitive position and he should have had 2-factor authentication turned on. Gmail has great support for that.

If you look through Wikileaks, only after the email hack does he get the recommendation to turn on the 2FA which presumably happens.

There's plenty of blame to go around, if you want to play blame games. The "free market" has no mechanism for 3rd parties to affect the decision making process. Microsoft has its policies, well known to the buyers, and the buyers accepted this as well as their own policy to delay recommended upgrades. A completely neutral person, a patient, is put at risk through no fault of their own, had absolutely no say in either transaction (either the original point of sale of the OS, or the policy to not keep software up to date) is injured.

This person arguably has an injury claim against Microsoft (their bug, their policy to stop updating software without disabling it thereby permitting the broad weaponization of their software). And they have an injury claim against each medical service institution who refused service because their systems were fully or partially non-functional due to their negligent choice to run old software; to not have their own user space programs on a constant "everygreen" cycle so that, without any gaps, it's possible to run their mission critical software on a currently supported and secure OS.

Basically, these injured 3rd parties have to sue or legislate. Either way it requires a sovereign to intervene in the market.

And what role and blame do millions of non-business end users running outdated software, and their computer was part of a web enabling such prolific spreading of malware? Do they get sued or billed their incremental share? What if it's $1000 per person running Windows XP? And now that they have liability, maybe they can all sue Microsoft because Microsoft permits them to run outdated software?

This shit really needs to be engineered better, and really where we're at is, we're monkeys playing with computers and reveling in our own self-importance, when in reality we still sometimes suck. And this is an (yet another) example of how primitive we are still.

> There's plenty of blame to go around, if you want to play blame games. The "free market" has no mechanism for 3rd parties to affect the decision making process. Microsoft has its policies, well known to the buyers, and the buyers accepted this as well as their own policy to delay recommended upgrades."

Nobody forced people to purchase Microsoft software. There are other vendors (Apple, Linux based systems). But if they choose to purchase the software, they need to follow the vendors maintenance instructions if they want properly operating equipment.

Does United Airlines ignore the maintenance instructions of Boeing or Airbus? If they even thought about it, the FAA would be all over them.

In the case of hospitals in the US and the UK there are accrediting agencies. In the US it is The Joint Commission. In the UK it is Care Quality Commission. If the people running hospitals are irresponsible and choose not to follow manufacturers instructions for maintenace for any capital equipment, then the accrediting agencies should refused accreditation.

One thing that comes to mind is that while dropping XP might be the manufacturer's recommendation for the OS, it's not the only manufacturer's recommendation in play here. Only geeks like us and the ones in IT departments care about the OS. Most of the rest of people don't care about the OS -- they care about the applications and devices they can use with it. The OS only matters to the degree it enables or hinders that.

So when it comes to the computers used by hospitals and doctos and the like, OS manufacturer instructions are lower down on the priority list, below the manufacturer instructions for the applications and medical devices they use. And if $MedicalRecordsApp or $MedicalEquipmentController is only certified by the manufacturer to run properly under Windows XP, then you can bet that the hospitals and doctors offices are going to continue to run Windows XP.

> "One thing that comes to mind is that while dropping XP might be the manufacturer's recommendation for the OS, it's not the only manufacturer's recommendation in play here. Only geeks like us and the ones in IT departments care about the OS."

The OS is simply a part of a piece of capital equipment. Like any other form of capital equipment (think trucks that need their oil, brakes, and tires replaced) the computer is also a piece of capital equipment that must be maintained. The fact that it is not maintained is a function of poor management that should be replaced with management that is more responsible. Nobody would settle for a truck not having brake jobs and tires replaced. That same standard should apply to any form of capital equipment.

In this case, MS said that the OS was no longer supported. End of Story. Responsible boards need to start hiring CEOs that understand that it is important to maintain capital equipment.

The piece of capital equipment as far as a hospital or doctor's office is concerned is the medical application software or the MRI machine, not so much the OS, IMO.

If Cessna says the only powerplant that your Cessna 172H is certified to use is the Continental O-300, then that's what you run. Continental doesn't make the O-300 or parts for it anymore? Too bad, you fly with an O-300, or you don't fly. Guess it's time to turn to the secondary market for parts and support for that engine.

Get a newer airplane with a newer, better engine that's still being supported by the manufacturer? Hmm, the presently-owned 172H is paid off, still flies and still makes money. Buying a brand new 172S requires taking out a new mortgage and isn't going to make any more money than the 172H does. Seems like we're going to keep the 172H for the time being.

I don't disagree with you that capital assets should be maintained. However, the companies running these older applications that require older OSes aren't the only ones at fault here. The manufacturers of the medical devices and software themselves are just as much to blame. This situation didn't come about solely because CEOs were being slackers about maintaining capital assets.

> "The manufacturers of the medical devices and software themselves are just as much to blame."

Yes, they are, but when purchasing high value pieces of capital equipment, people need to have this maintenance as a part of the purchase agreement. In cases such as MRI, CT, many of these firms are generally very large and have the capacity to do so.

And what happens if some of the software or equipment used with that system is not compatible with Windows 10? I can make a very secure house if I give it solid, metre-thick concrete walls, ceiling and floor, but it won't be very useful as a house without things like doors and windows.

You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product.

> "And what happens if some of the software or equipment used with that system is not compatible with Windows 10?"

It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS.

> "You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product."

What defect are you referring to exactly? That Microsoft years ago couldn't predict every way that cybersecurity attacks happened to their OS? Or that users of versions of Microsoft software still under support contracts (including firms and governments) did not run software update tools for a patch released in mid-March?

It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. Later versions of OSs include not only different architectures to fix cybersecurity flaws but take into account changes in the Intel hardware that help to combat cybersecurity attacks.

It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS.

We're talking about things like medical equipment, often in regulated fields. There may be no such contract available, and even if there is, upgrading to a totally new OS may or may not be acceptable. The idea that you should throw out millions of pounds of high-tech medical scanner every few years because a hundred buck OS that it was supplied with couldn't be kept secure is laughable.

What defect are you referring to exactly?

They supplied an OS that was not secure. The rest is just rationalisation and apologies.

It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks.

It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place.

Perhaps the problem here was that such systems should never have been built on such an insecure platform and then connected to a network, but that too is on the device manufacturer and not the hospital. There are basic standards of fitness for purpose that are reasonably expected with such devices, even without more specific regulation. Particularly in this sort of field, those devices should then be supported for their entire working lives, not some arbitrarily shortened version of their working lives dictated by one software development organisation.

Firms that implement software using software from a vendor (eg, Microsoft) have to follow the manufacturers instructions. If they feel they cannot do that, then they should use a different OS vendor (not Microsoft). That goes for proper, documented uses of the API but also for not using unsupported versions of the OS.

When people purchase equipment, there are equipment contracts. Medical equipment, depending on the type, needs to follow FDA approval guidelines. Clearly, not piece of equipment should allowed to be running in a hospital based on an unsupported version of an operating system. That is simply irresponsible.

Each newer version of Microsoft OS implements security features not in earlier versions. In some cases, there are changes to the Intel hardware for additional security that later versions of the OS take advantage of.

Again, firms and governments should not be using unsupported versions of hardware or software.

> "It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place."

The longevity is mostly the supported API across different versions of the OS, and not the OS itself. Each version of Microsoft OS comes out with additional security features and vendors who use Microsoft OS (or any OS) need to plan for upgrading their application software that uses the OS and purchasers of application software should insist on it.

Clearly, not piece of equipment should allowed to be running in a hospital based on an unsupported version of an operating system. That is simply irresponsible.

You keep writing things like that, as if the only practical alternative in many cases was not turning the equipment off altogether.

Each newer version of Microsoft OS implements security features not in earlier versions.

And more spyware, too. What should a hospital do if Microsoft decides to instruct them to update to a new version of Windows that will automatically upload all of the data on the local hard drives to a Microsoft-cloud-hosted backup system, complete with all the legally protected sensitive personal information? Again, this issue can't just be as simple as suppliers getting to move the goalposts however they want after the sale.

The longevity is mostly the supported API across different versions of the OS, and not the OS itself.

Then why are so many healthcare providers who were caught last week saying they couldn't upgrade from Windows XP because some essential functionality of other software or equipment no longer worked on Windows 10?

> "Then why are so many healthcare providers who were caught last week saying they couldn't upgrade from Windows XP because some essential functionality of other software or equipment no longer worked on Windows 10?"

In the US, they might possibly be in violation of HIPAA health data privacy laws because by running on an unsupported OS they are leaving themselves open to cyber attacks and stolen health care data.

Best to deal with vendors of software that upgrade their software to the newest OS versions, especialy if it has anything to do with health data.

> "You keep writing things like that, as if the only practical alternative in many cases was not turning the equipment off altogether."

Microsoft had been warning for years that they were going to discontinue service and they have done it with previous OSs, so no surprise there really. Software vendors and their customers need to prepare ahead of time.

If properly maintained by their IT Depts, these Windows 10 Upgrade messages never come up.

While that's true, there is a flip side that there were likely a lot of custom-made or proprietary systems that only worked on XP. Even worse, there were likely various medical hardware that only had drivers for XP. So upgrading from XP is not necessarily an easy project, and definitely not cheap. It's likely a huge project that would be like doing a complete circulatory system transplant, not a simple isolated heart transplant.

As far as I recall, one should generally be able to use a Win XP in a VM running say, on a Win 10 OS.

Fixing by writing drivers may not be cheap for the vendor of the software, but they should do it. You simply can't get around the fact that each new version of the OS is more secure than previous versions.

Yeah, but let's not punish customers for choosing a vendor that sucks more than they already get punished. Bad decisions have their own consequences, that should be punishment enough. Also, who knows how many good vendors are out there for medical equipment. I'm not an expert, but I only hear horror stories, which may or may not just be because only the horror stories are worth telling others.

Healthcare is a mission critical business and they need to be responsible when purchasing capital equipment including of course, software. If it doesn't operate properly for example, in the US there could not only be patient harm or disclosure of their private information, the firm could be liable for malpractice or HIPAA (law regarding health record security) the later two can have financial consequences as well as direct patient health consequences.

Running on an unsupported and even if supported, not updated, software, invites failure and nobody can feel that their health records are secure.

Airplane maintenance for a Boeing or Airbus is very expensive, but you have to do it. The same may be true of devices and software in healthcare. Still need to do it right.

I don't see the alternative. Do you?

"The only people to blame are those that don't follow manufacturers instructions."

I disagree. I think it was the folks that thought it was OK to encrypt files and hold them for ransom in the first place.

Banks have vaults to store money and other valuables.

Theft is going to happen even with great policemen. People who don't follow manufacturers instructions (especially when they are told the software is no longer supported and yet they fail to upgrade to a supported OS) are culpable. To run on unsupported software or not to run security updates on supported software is like banks without vaults. Just unrealistic in either case.

Best i recall, the NHS had signed an extended maintenance contract for XP. But it had recently been dropped because some beancounter had decided they could not afford it.

In the end it may well be a big validation of the FSF message, as then the NHS (or anyone really) could hire someone to maintain the software beyond the existence of the original company.

This much like how i can find someone to repair something for me that physically broke, because the tools and such are widely available and known (or even attempt to do so myself).

According to an NHS blog post about the matter, the NHS corporate (or whatever) had been warning hospitals, etc. that Microsoft was discontinuing maintenance of XP and to upgrade. They purchased an additional year of coverage giving hospitals yet another year to upgrade to a supported version of Windows. Many ignored the one year time they had as well as the earlier warnings.

> get accredited

By whom?

It's the other way round: shutting down an NHS hospital is the sort of thing that would normally be a front-page disaster for the government, so it's almost never going to happen.

Accreditation is the US is done by The Joint Commission. Hospitals without Joint Commission accreditation cannot get paid for Medicare or Medicaid bills.

In Britain the accreditation is done by Care Quality Commission: http://www.cqc.org.uk

What's the point of an accreditation agency if they aren't going to ensure that the hospital is run safely which includes running on current software?

What about windows 7 and 8.1 ? They were also hacked.The uncertain nature of windows 10 update and the bad press about the telemetry issues was also the reason for the IT Departments to stay clear of it. Why would someone ignore a free windows upgrade ?

It is always best policy in my opinion, to upgrade to the next OS version after the first (point) release. Each new version of the OS (eg, Win 10 over 8.1) has additional security measures not in the previous version. I use Mac primarily and I always do fresh install at the .1 update (eg, 10.12.1 and not 10.12). I run Win 10 on my Parallels VM.

Yes i also the same point, why would any one want to miss the free upgrade. The whole update hijack and privacy concerns kept some people away. Organization running bulk of window's xp and 7, for sheer cost cutting purposes. But still the whole thing affected all, if some people weren't hesitant to migrate to the newer update , they would have been saved.

> "Organization running bulk of window's xp and 7, for sheer cost cutting purposes."

I agree with this observation. I believe this also was the reason that Target and Home Depot did not follow manufacturers (Microsoft) recommendations to upgrade point of sale terminals from the (now) unsupported Windows XP embedded to a later version of the OS still supported. Because they disregarded the advice, millions of people had their credit cards hacked.

At least the CEO of Target got sacked as a result.

It is tough to discern whether the instruction from Microsoft is to safeguard customers or to increase their marketshare.

Windows XP was released in 2001. Just exactly how long should a company supported outdated software?

Since XP there have been the following releases. (1) Windows Vista (2) Windows 7 (3) Windows 8 (4) Windows 8.1 (5) Windows 10.

Actually, it is the best policy to upgrade to the latest version of the OS, for security reasons if for no other reason.

Reply on news.ycombinator.com