Windows 11 is dying....

[SteveThackery]

It's not tabbed toolbars which are the problem. I've used them before. TINA had over one a decade before MS Office. As with many things with Microsoft, it's the implementation which is uniquely bad.

A ribbon is much more than a tabbed toolbar - it was genuinely innovative. In any case, I don't agree that Microsoft's implementation is uniquely bad. I think they've done a great job with it. Yes, really! I love using it.

But those full screen dialogs are bloody awful (in my view), and it's not just the Open dialog - the Print dialog is the same. Ditto the Save dialog.

[madires]

Even winXP will never get infected just by being internet-connected.

Disagree.

Your router's NAT will protect it.

Actually the router's stateful firewall. Without the router's firewall an XP system would be done for quite quickly (plenty of test reports available, see paulca's post). Possibly it takes a bit longer today as I would expect less bots scanning for XP vulnerabilities. However, the vulnerabilities are well known and can by checked by many scanning frameworks.

[PlainName]

Even winXP will never get infected just by being internet-connected.

Disagree.

Your router's NAT will protect it.

Actually the router's stateful firewall. Without the router's firewall an XP system would be done for quite quickly (plenty of test reports available, see paulca's post). Possibly it takes a bit longer today as I would expect less bots scanning for XP vulnerabilities. However, the vulnerabilities are well known and can by checked by many scanning frameworks.

That would be paulca's post where, in the video, the firewall that XP ships with, and that would normally be enabled, is specifically disabled so the box can be pwnd?

[soldar]

Back when Windows XP was relevant, it was much more common not to have a home router, but plug in to some DSL modem directly (or through a switch), ISP giving you a public IP address.

Yes, Windows XP getting infected on its own "within minutes" was a well-known anecdote. Not sure how common that really was, but I'm also sure that peter-h is wrong saying it never happened.

I am never going to say it never happened because I have no idea and I suppose it did happen but I can say confidently that it never happened to me or to any of the computers I support of friends and family.

As I have said, my setup, configuration and procedures were:

- Disable as much of browser addons as possible
- Never click on anything the least doubtful
- Scan the computer once in a while with online virus scanner (never found anything)
- Disable IPV6, only enable IPV4 through router NAT
- Use Zonealarm firewall restricted to the max
- No AV software.

I am not an expert, I know close to nothing about computer software, I am not saying my setup cannot be defeated, I am only saying I have never had a problem with malware in 20+ years using this configuration with Win XP. I am still using those rules and configuration every day on several computers with no problems. More than 20 years.

And telling me I might be infected and not know it, well, it sounds to me like those who say I might feel fine but my gut is full of debris which will kill me and I need to buy and use their snake oil which will clean my guts cleaner than clean. Thanks but no thanks.  If the computer is infected with malware than cannot be noticed in any way, including virus scans, then it is like it was not infected.

And when "legitimate" programs cause me problems I do not care that they are signed by MS, Norton, McAfee or Mother Theresa. To me those are the worst malware. 

[Siwastaja]

I had at least two or three virus incidents on first Windows 2000, later XP. One was from just using Outlook Express - which had a bug that just receiving the message with the virus was enough, no need to download any attachments. The later incidents I was not able to confirm where they came from.

I used varying virus protection and varying third party firewall programs.

That would be paulca's post where, in the video, the firewall that XP ships with, and that would normally be enabled, is specifically disabled so the box can be pwnd?

Remember that Windows XP didn't originally ship with the Windows firewall. That firewall was exactly Microsoft's response to the well known fact that "Windows gets infected within minutes on it's own" - as shown in the video, with said firewall disabled. So that video is a decent demonstration what would have happened in the early days of Windows XP. (Better yet would be to use the Windows image pre-SP2 for the test, when it didn't have that firewall, so that there would be no need to turn it off.)

I did hear the advice of installing Windows airgapped and having a 3rd party firewall software - it had to be 3rd party back then - on a CD, and only connect the Ethernet cable after the firewall was installed - and I remember following that practice. Probably ZoneAlarm if my memory serves correctly.

It was a real issue, but maybe relatively short-lived in the grand scheme of things.

[peter-h]

Actually the router's stateful firewall. Without the router's firewall an XP system would be done for quite quickly (plenty of test reports available, see paulca's post). Possibly it takes a bit longer today as I would expect less bots scanning for XP vulnerabilities. However, the vulnerabilities are well known and can by checked by many scanning frameworks.

How can it get infected when, behind NAT, it is invisible.

We are just going around in circles. The only way a machine can get infected without running any apps which connect to the outside and download stuff is by not being behind NAT or some similar firewall.

Some people just like to argue.

One was from just using Outlook Express

Of course, very possible.

As browsers got more and more secure, Outlook remained the #1 target, and HTML emails with easily disguised inline and attached exploits, were (and are) the easy way in, because if you block all media (whether in the HTML or on URLs) much of the email is unreadable. At work we use a 25 year old email client (Forte Agent) which does not do HTML and does not have any of these vulnerabilities, and we catch emails with likely or obvious exploits all the time, but with Outlook you would be relying on some countermeasures. Big firms struggle with this, using 3rd party email scanning services which rewrite the email with all these objects scanned and [re]hosted on a server.

IMHO, once you download and execute an image (or PDF etc) object, whether you are running win7 or win11 is not going to make a huge difference. In marginal cases it might... These objects are created to exploit a vulnerability in the display application.

[Zero999]

It's not tabbed toolbars which are the problem. I've used them before. TINA had over one a decade before MS Office. As with many things with Microsoft, it's the implementation which is uniquely bad.

A ribbon is much more than a tabbed toolbar - it was genuinely innovative.

How? Sorry, that sounds like marketing. I don't see how there's anything uniquely innovative about the MS Ribbon user interface.

[madires]

Actually the router's stateful firewall. Without the router's firewall an XP system would be done for quite quickly (plenty of test reports available, see paulca's post). Possibly it takes a bit longer today as I would expect less bots scanning for XP vulnerabilities. However, the vulnerabilities are well known and can by checked by many scanning frameworks.

That would be paulca's post where, in the video, the firewall that XP ships with, and that would normally be enabled, is specifically disabled so the box can be pwnd?

With XP's internal firewall disabled (and public IPv4 address) it should be easier and faster. With XP's internal firewall enabled and default settings (and public IPv4 address) it could take a bit longer as the internal firewall leaves many essential windows services open to the wild. By adding additional firewall rules manually things can be made harder for attackers, but this is nothing a typical user would do.

[peter-h]

and public IPv4 address

Only a total cretin does that, so it proves nothing

Today, 2026, or anytime in past 10-15 years, >99.9% of private users have their PCs behind a NAT router provided by the ISP. That is how ADSL/FTTC/FTTP is delivered.

A business user probably won't be using the ISP's cheap and nasty router but will still use a router which is either NAT or (hopefully) has been correctly configured.

[JPortici]

and public IPv4 address

Only a total cretin does that, so it proves nothing

Today, 2026, or anytime in past 10-15 years, >99.9% of users have their PCs behind a NAT router provided by the ISP. That is how ADSL/FTTC/FTTP is delivered.

Today. Or anythyme between 2010 and now.
But back then in the XP era we all had USB modems for ADSL, public IPv4. wifi was an unneded luxury which ran poorly, and routers were simply unheard of in most homes.
In my country, of course.
I remember the XP firewall being either completely useless, or bypassed by Internet Explorer. In fact, you wouldn't get most virus just by not using internet explorer. But you needed that to download firefox and avast first. (i also remember there beign a good reason for which i didn't keep them in a CD. But i don't remember why.

I clearly remember starting up a fresh XP install, opening the task manager, and counting the seconds it took to be flooded by rogue processes the moment i enabled internet connection

[madires]

Actually the router's stateful firewall. Without the router's firewall an XP system would be done for quite quickly (plenty of test reports available, see paulca's post). Possibly it takes a bit longer today as I would expect less bots scanning for XP vulnerabilities. However, the vulnerabilities are well known and can by checked by many scanning frameworks.

How can it get infected when, behind NAT, it is invisible.

We are just going around in circles. The only way a machine can get infected without running any apps which connect to the outside and download stuff is by not being behind NAT or some similar firewall.

I partly agree if you mean address masquerading. There are many flavours of NAT, e.g 1:1 mapping of an external address to/from an internal address which would be as bad as a PC having a public IP address (which it usually would have anyway for IPv6 ) . It's better to use the term 'statefull firewall’. The second point is that a PC won't be silent even without any additional apps installed or running. It might look for updates or run some network checks (am I connected to the internet?). And the most important point is that there's no 100% security. We can only make things harder for attackers. For example, if your router has a vulnerability and an attacker takes full control of your router, your PC might be pwned easily too.

[PlainName]

That would be paulca's post where, in the video, the firewall that XP ships with, and that would normally be enabled, is specifically disabled so the box can be pwnd?

Remember that Windows XP didn't originally ship with the Windows firewall. That firewall was exactly Microsoft's response to the well known fact that "Windows gets infected within minutes on it's own" - as shown in the video, with said firewall disabled.

Context!
Or do we get to trash everything based on the first iteration before any bugs or features got sorted out? We could start with Linux and how telnet was wide open until it got killed off. And not to miss out on early MacOS that had more holes than a colandar.

Or we could just say that once upon a time XP didn't have a firewall, but anyone running it would have had the firewall installed (and enabled) either from the off for later purchases or from an update.

[madires]

and public IPv4 address

Only a total cretin does that, so it proves nothing

Today, 2026, or anytime in past 10-15 years, >99.9% of private users have their PCs behind a NAT router provided by the ISP. That is how ADSL/FTTC/FTTP is delivered.

Answered in my previous post. It helps, but most users install and run software on their PCs.

A business user probably won't be using the ISP's cheap and nasty router but will still use a router which is either NAT or (hopefully) has been correctly configured.

I've seen businesses with multi-million revenue running routers like an EOLed D-Link for 30 bucks.

[peter-h]

That is however just moving the goalposts.

If the PC goes online periodically then there is an opening in NAT, for (typically) 180 secs after data cessation, and during that time an attacker can send in packets. The router (or more accurately the switch which is usually after the router; most routers have a 4 port switch) will forward those packets to that PC but only if they are addressed from the IP which the PC was addressing previously. So the attacker needs to a) make an assumption about the addressed site and b) malform that packet to exploit some vulnerability in the PC. This is a helluva stretch, frankly, but is the only known way to attack via NAT.

Of course many people have installed programs which open ports (possible on cheap consumer routers) but that is moving the goalposts some more.

[Cyclotron]

That would be paulca's post where, in the video, the firewall that XP ships with, and that would normally be enabled, is specifically disabled so the box can be pwnd?

Remember that Windows XP didn't originally ship with the Windows firewall. That firewall was exactly Microsoft's response to the well known fact that "Windows gets infected within minutes on it's own" - as shown in the video, with said firewall disabled.

Context!
Or do we get to trash everything based on the first iteration before any bugs or features got sorted out? We could start with Linux and how telnet was wide open until it got killed off. And not to miss out on early MacOS that had more holes than a colandar.

Or we could just say that once upon a time XP didn't have a firewall, but anyone running it would have had the firewall installed (and enabled) either from the off for later purchases or from an update.

Indeed, context. MS was the first, by a wide margin, to deliver a Desktop OS with an always-on Firewall. Windows XP SP2 2004.
Linux didn't generally adopt this behavior until 2012-2013, though Ubuntu had it a couple of years earlier. MacOS still does not enable the firewall by default, *sigh*.

The number of Linux routers/firewalls compromised during that time frame was enormous. Buffer overflows and the enormously bad default "admin/admin" credentials cause no end of trouble.

OpenBSD was still the security king.

[Siwastaja]

Context!

My context was peter-h's claim that even Windows XP does not get infected on its own. (To be fair, he did not use past tense, so yeah, maybe he's right.) But well, during its days it did, because it shipped with shitloads of security flaws in its internal processes, and without a firewall to protect those components, and because public IP addresses without NAT were commonplace at household DSL etc. connections. Video posted demonstrated exactly what would have happened - and DID happen - with the original WinXP release connected to a typical home internet of the day, unfortunately they used a newer version for demonstration and had to turn off the added firewall, causing confusion to the viewers. With older version, the firewall would not have existed.

That's all. The situation got better exactly because things got fixed: MS added firewall, fixed bugs, and consumers were sold routers with NAT+firewall: security doesn't need to be perfect; a few fundamental fixes reduced the problems by orders of magnitudes. All of this happened somewhere around 2004-2005 or so. But also remember back then we did not have quick security updates to everything. XP older than SP2 probably kept running long after the late 2004 when it was released.

[madires]

That is however just moving the goalposts.

... to make things harder for attackers.

If the PC goes online periodically then there is an opening in NAT, for (typically) 180 secs after data cessation, and during that time an attacker can send in packets.

It depends on the IP protocol (TCP/UDP/ICMP/...) and the firewall (router) implementation. But usually an attacker would have to guess several things correctly and spoof addresses, which isn't simple.

The router (or more accurately the switch which is usually after the router; most routers have a 4 port switch) will forward those packets to that PC but only if they are addressed from the IP which the PC was addressing previously.

The router forwards/routes IP packets, the built-in ethernet switch takes care about ethernet frames.

So the attacker needs to a) make an assumption about the addressed site and b) malform that packet to exploit some vulnerability in the PC. This is a helluva stretch, frankly, but is the only known way to attack via NAT.

Unfortunately not, but it's hard to circumvent a properly configured (and hopefully also properly implemented) firewall. The problems start with adding 'holes' for special applications/services.

Of course many people have installed programs which open ports (possible on cheap consumer routers) but that is moving the goalposts some more.

Many SOHO routers come with UPnP enabled by default. A bad idea!

[peter-h]

The problems start with adding 'holes' for special applications/services.

Sure, but that is moving the goalposts. Of course all bets are off if you run a machine on an open port.

The only machine that should ever be on an open port is a properly configured heavy duty hardened OS + web server (etc) e.g. Linux, Centos, Apache, NGINX... And then we get into the old IoT security debate (check the thread on how to secure a remotely controlled heating controller).

Is win11 more secure if run on an open port than winXP? Probably. But better than win7? Marginally. If you get external packets onto your LAN then all bets are off because they can be visible to more than one device (should not be if there is a switch which usually there is).

Is win11 better if your cheap router has loads of holes opened by stuff like webcams? Probably.

[SteveThackery]

It's not tabbed toolbars which are the problem. I've used them before. TINA had over one a decade before MS Office. As with many things with Microsoft, it's the implementation which is uniquely bad.

A ribbon is much more than a tabbed toolbar - it was genuinely innovative.

How? Sorry, that sounds like marketing. I don't see how there's anything uniquely innovative about the MS Ribbon user interface.

As you will have gathered, I love the cut and thrust of a vigorous debate. However, this is one I don't want to pursue. Firstly, we went through it all several months ago in another thread, so a lot would just be repeating the same old stuff.

Secondly - and I mean no discourtesy - I don't believe you are approaching this with a truly open mind. I think that no matter what arguments and evidence I present to you, you've already made up your mind about the ribbon and won't change it.  So on this occasion I'm not going to invest any effort into it.

If, one day, you feel like knowing more about the ribbon - why it was needed and how it was developed - I think the best place to start would be this talk by Jensen Harris.

 
(It's the first of a series.)

In particular you might be interested to learn that, before the ribbon, the majority of new feature requests from users were for features that already existed, but were hidden in a lengthy, nested menu or behind an obscure 32x32 icon in a toolbar. The big problem with the old menu/toolbar UI was a lack of discoverability. Ultimately the menu/toolbar paradigm just wasn't sufficiently scalable.

If you watch the video with a cynical mindset, you will be able to dismiss it as marketing bullshit and feel good about how you were right all along. If you watch with a truly open mind, open to being changed and willing to contemplate different ways of thinking, you might find it most enlightening.

Or you could not watch it at all on the grounds that you enjoy sneering at the ribbon, you like slagging off Microsoft for its ineptitude, and you have no intention of changing that position.

[madires]

Is win11 more secure if run on an open port than winXP? Probably. But better than win7? Marginally. If you get external packets onto your LAN then all bets are off because they can be visible to more than one device (should not be if there is a switch which usually there is).

Is win11 better if your cheap router has loads of holes opened by stuff like webcams? Probably.

And then comes your 14 years old son/nephew/grandson and installs some shady P2P file sharing app on your PC. Your router won't save you. IT security involves much more than a plastic box.

[soldar]

All this talk is bringing back memories of things I had totally forgotten.

I think I was using a home router from the very beginning because I was always messing about with several machines on home LAN. And I have not changed. I still always have several machines running at once.

I never used Windows native firewall. I used to spend time configuring ZoneAlarm and checking the privileges of every single program.I had quite a few programs blocked from internet access.  I *really* liked the philosophy of Zonealarm and I wish there was something similar for Linux. It is a really simple concept and easy to understand and set up.

I also used to visit GRC-Shields Up which I am surprised to see still exists.

And I remember visiting two or three sites that would do a one-time malware scan. I think MS had that too.  I would always scan any program before installing it.

All that was with Win XP, over ten years ago, when I started using Linux.

[soldar]

Is win11 more secure if run on an open port than winXP? Probably. But better than win7? Marginally. If you get external packets onto your LAN then all bets are off because they can be visible to more than one device (should not be if there is a switch which usually there is).

Is win11 better if your cheap router has loads of holes opened by stuff like webcams? Probably.

And then comes your 14 years old son/nephew/grandson and installs some shady P2P file sharing app on your PC. Your router won't save you. IT security involves much more than a plastic box.

If you are letting unreliable persons use your computer with your credentials.... well...

[PlainName]

Don't think I've weighed in on this one before, but feel free to skip anyway

In particular you might be interested to learn that, before the ribbon, the majority of new feature requests from users were for features that already existed, but were hidden in a lengthy, nested menu or behind an obscure 32x32 icon in a toolbar. The big problem with the old menu/toolbar UI was a lack of discoverability

I certainly agree that icons are overrated and, unless you use specific ones regularly, it can be hard to figure out what they do. Even with hover help (which wastes time). Generally, I use very few toolbar entries.

But... I can never find what I'm looking for on the ribbon. Sure, things that are most used are easy to find, but there are still icons whose purpose isn't necessarily clear. Worse, some open a popup with more selections possible, and now not only do you  have to figure if an icon is likely appropriate but also whether the thing you're looking for is in a popup that might be opened by that icon.

Menus also have problems of hiding sub-menus off not clearly relevant entries. But I find that usually one can just wave a mouse over and the sub-menus pop open and you can see very quickly if it's the one or not.

However, for me the big issue was that the ribbon just took up too much vertical space. Bad enough on 4:3 monitors but with the move to wide screen it was horrible. Now I have much more space to play with I don't mind so much, and a well thought out ribbon can be (gulp) OK.

[Cyclotron]

Is win11 more secure if run on an open port than winXP? Probably. But better than win7? Marginally. If you get external packets onto your LAN then all bets are off because they can be visible to more than one device (should not be if there is a switch which usually there is).

Is win11 better if your cheap router has loads of holes opened by stuff like webcams? Probably.

And then comes your 14 years old son/nephew/grandson and installs some shady P2P file sharing app on your PC. Your router won't save you. IT security involves much more than a plastic box.

If you are letting unreliable persons use your computer with your credentials.... well...

BINGO!!  During my children's school years, I made sure they were not admins and couldn't install anything.  I stayed sane though the number of requests for "can I get this" was high, it was better than dealing with the other side.
I also placed their machines on their own VLAN and firewall interfaces.

[Cyclotron]

All this talk is bringing back memories of things I had totally forgotten.

I think I was using a home router from the very beginning because I was always messing about with several machines on home LAN. And I have not changed. I still always have several machines running at once.

I never used Windows native firewall. I used to spend time configuring ZoneAlarm and checking the privileges of every single program.I had quite a few programs blocked from internet access.  I *really* liked the philosophy of Zonealarm and I wish there was something similar for Linux. It is a really simple concept and easy to understand and set up.

I also used to visit GRC-Shields Up which I am surprised to see still exists.

And I remember visiting two or three sites that would do a one-time malware scan. I think MS had that too.  I would always scan any program before installing it.

All that was with Win XP, over ten years ago, when I started using Linux.

I remember getting a cable modem in 1999, and I'm fuzzy on the months before I got my BEFW11S4 Linksys, then replaced it with the famous WRT line the next year, I think.
Before that, it was all dial-up for me at home. At work, we had a mix of P2P ATM lines, dial-up lines, T1s, fractional T1s, a DS3 or 3, Frame Relay, ISDN, both channel and primary.
This makes me feel a bit queasy in my stomach, given the complexity we used to handle in WANs. 

CheckPoint Firewall was way popular back then. We used a mix of firewalls and proxies.

Realistically, I think I spent maybe a few months with direct computer internet from 1999 to 2000?  Dial-up was not directly connected to the internet, and after I switched to wireless, the router had a firewall.
NAT was a thing on cable modems by the time I got service. That and Internet Connection Sharing (Wow, that made brain cells talk that haven't in a long time).

Given that cable modem connections started as early as 1996, some people may have had longer exposure to direct, publicly routed IPv4 to their home computer.