starseerdrgn | On OS Upgrades

So, I keep seeing people telling others that the need to upgrade to Windows 10 if they run Windows 7 or 8. This is due to Microsoft ending extended support for the OS, and therefore security updates.

I'm sitting here on my iMac, running Mac OS X Snow Leopard (10.6.8), with a Macbook running the exact same. It runs perfectly fine. I have no issue with it (aside from outdated browsers). All the applications I want to run (aside from some games) will run on it, like word processors (Word 2008 and Pages '09) and media players (XimpleMOD, iTunes, Quicktime Player, VLC). I can run Photoshop and Illustrator. I have IRC access. I can run Telegram.

I literally have 0 solid reason to update these two systems past Snow Leopard. They're Core2Duo machines that don't do well past Mountain Lion (10.8), and can only officially run up to El Capitan (10.11). I mean, I could install a Linux distro on them, but I really don't wanna make myself suffer down that road again. And I don't really have a reason to do that.

And the security upgrades? Well, to be blunt, most people have their data in the cloud these days. I don't, as my stuff is on local drives with backups, and some stuff is on cloud, but the point is that a majority of people who would be affected don't really use local storage all that much. The real security vulnerabilities are 1) the browser, and 2) the cloud storage providers. Yeah, you can get login info, but a simple breach or use of an OAuth token could give an attacker plenty of access to what they want. Hell, Facebook was caught storing millions of user's passwords in plain text. That's a lot more valuable than data found on a user's drive these days.

Should security be taken seriously? Yes. But these days, with the idea of everything being always on and connected to the cloud regardless of whether it needs to be, it's a race to the bottom. You're only delaying the problem, not solving it.

This is especially true when some people legitimately can't afford anything but their phones, which aren't exactly secure when a majority of users tie them to their cloud data. Get that yanked from your bag, and suddenly, the attacker has access to everything, and it'll take you some time to get everything re-secured, if you're even able to. E.g. Timed One-Time Passwords that the user no longer has recovery keys for.

SPoF (Single Point of Failure) is the single largest issue when it comes to security, since it's all you'd need to compromise to get everything. Use a password manager for all your passwords, but have the TOTP generated on a device that can access it? You've got a SPoF right there. Only have one device and no backup access to that password manager? You're gonna be fucked hard if it gets out.

So, what about me? I have backups of my data, use an offline password manager with backups of that, I don't make my systems outward-facing if they have sensitive data, use firewalls, use a hardware firewall on my router that reroutes port 80 to an unoccupied internal IP that won't even resolve. I've exceptionally careful with what sites I go to, and most won't work in their entirety anyway since I use an older browser. And being that I use an older OS and older browser, I'm statistically slightly better protected than people who use more modern OSes, since they're going to be the bigger targets (not something I'll take for granted, though). But the big thing is that I am careful, and take steps to avoid being smacked by the stupid.

For some of us, using an older OS is perfectly safe. For others... Yeah. Run the latest everything, though it won't help the worst of users. Not everyone is tech savvy or net savvy. OS and software updates can only go so far.

I'll be chilling back here, using Snow Leopard (or even Tiger if I can get my hands on a PowerPC system), and I'll be enjoying myself every step of the way.