Hacker News Reader

Comment by Freak_NL | Hacker News Reader

> Cargo couldn’t fetch the index from crates.io if you were using an older Windows without having applied security fixes.

Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016.

> libgit2 created a fix, using the WinHTTP API to request TLS 1.2. On master, we’ve updated to fix this, but for 1.24.1 stable, we’re issuing a warning, suggesting that they upgrade their Windows version.

That's really a neat and responsible way of handling this.

View on HN

Although developers should know and do better, I think a big part of why they aren't doing it is because Microsoft has made it so hard to update Windows 7 since a year or two ago, all in the name of forcing people to switch to Windows 10.

You now have to visit and manually download the updates from Microsoft's Update Catalog website. Oh, and that website only works on Internet Explorer.

No idea what you mean. Windows 7 receives updates from Microsoft through Windows Update just fine.

Are you sure about that? I know plenty of people with Windows 7 that just get updates through the normal channels.

Windows Update generally still works on 7.

Maybe you ran into this issue? https://www.myce.com/news/windows-7-dont-receive-security-up...

>Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016.

The issue shows up on patched machines. The patch does not enable TLS 1.2 by default. You have to add reg keys for it.

https://github.com/rust-lang/cargo/issues/5065#issuecomment-...

I've never understood why Microsoft adds support for new crypto protocols but turns them off by default.

To avoid breaking badly designed programs?

(To be clear, Windows 7 without the patch also supports TLS 1.2. The patch adds a registry key to configure the default protocols for applications that don't explicitly override the default.)

> Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016.

Enterprise. It’s only recently I’ve stopped seeing XP boxes around, but Windows 7 is everywhere.

Even in Enterprise environments, having boxes which haven't gotten security patches from 2 years ago is just careless.

Oh please don’t for a second believe I excuse this behavior in any way. I 100% agree with you, yet at the same time that is the reality you have to adjust to at times. Enterprise IT often moves at glacial speeds, and that’s on a good day...

Speculating here: Maybe developers are testing/debugging on some VM with older Windows, without that machine be their development machine.

Reply on news.ycombinator.com