Manchester, UK, police still relies on Windows XP

I work for a tech company in Taiwan. The factory downstairs is making microSD cards. I write some driver software to talk to the machines, sending commands using SECS-II and getting the machines to log data to a SQL server.<p>The testing machines still run Windows 2000.<p>There is no SQL library for Visual C++ 5. I couldn&#x27;t use the .NET framework, or any other libraries - everything running on the testing machine had to be bundled into a single .exe file.<p>Why not update? The testing machine was built by another company, and sold with a 20-year warranty. Updating Windows, or even installing software would void the warranty.<p>My program was designed to be easily deleted in case of an audit.<p>These machines were on their own LAN with no Internet access, thankfully. I&#x27;ve realised that for my software to endure, I should write it standalone, without needing libraries, and in a very common language that is likely to still be around for a while (C, JavaScript, Bash). The code is more verbose, but that puts the burden on the developer (me) instead of the user, who is more likely to make really dodgy workarounds than file a bug report.

&gt; The UK&#x27;s biggest force - London&#x27;s Metropolitan Police Service - was among those that refused to share an up-to-date figure.<p>&gt; But in June it said about 10,000 of its desktop computers were still running XP.<p>&gt; &quot;Disclosing further information would reveal potential weaknesses and vulnerability,&quot; the force&#x27;s information manager, Paul Mayger, said.<p>So they&#x27;re concerned enough about security not to disclose the number of XP machines, but not so concerned as to actually fix the problem.

&gt; The remaining XP machines are still in place due to complex technical requirements from a small number of externally provided highly specialised applications,&quot; a spokeswoman told the BBC.<p>This is the real heart of the issue. In my (very limited) experience, software choices are made by different people than the ones that deal with them each day.<p>My hope is that more and more applications will become web based, and big enterprises can move to a cut down linux desktop with a limited attack surface, so internal IT teams can focus more on securing servers.

For hecks sake just put the foot down and cancel the money going to the tardy vendors.<p>Cutting off the money supply magically fixes software issues fdast.

From the article:<p>&quot;So, if the [police&#x27;s] Windows XP computers are exposed to the public internet, then that would be a serious concern. &quot;If they are isolated, that would be less of a worry - but the problem is still that if something gets into a secure network, it might then spread. That is what happened in the NHS with the recent Wannacry outbreak.&quot;<p>Only problem being that KryptosLogic tests confirmed that WannCry did not infect &quot;properly&quot;[1] Windows XP machines on the network (while if the malware is executed locally XP is vulnerable):<p><a href="https:&#x2F;&#x2F;blog.kryptoslogic.com&#x2F;malware&#x2F;2017&#x2F;05&#x2F;29&#x2F;two-weeks-later.html" rel="nofollow">https:&#x2F;&#x2F;blog.kryptoslogic.com&#x2F;malware&#x2F;2017&#x2F;05&#x2F;29&#x2F;two-weeks-l...</a><p>[1] if SP3 the infected machine would blue screen without encrypting anything and without having the possibility to spread the malware to other machines, if SP2 (improbable) the machine would not be infected.

They could be using the POS version which IIRC will get regular updates until 2019. Probably illegal, unless they have some special license, but surely not a bad thing given the huge boost in performance compared to newer OSes and the shrinking number of compatible malware around.

They should try ReactOS.

Last I heard Northumbria Police still use COBOL...

Yes, my hometown is on the front page on HN!<p>Oh, damn.