Windows XP is “past its security expiration date”

If you’re still using Windows XP, please stop. Seriously, figure out how to migrate to Windows 7 or Windows 8. Or to an modern alternative platform if you don’t trust Microsoft.

Don’t take my word for it. Listen to Justin Schuh, an Information Security Engineer at Google, who wrote this interesting post recently on Hacker News:

I’m one of the lead devs on the Chrome Windows sandbox, and I can assure you that what we do with Vista+ on the security front is leaps and bounds ahead of what we’re stuck with on XP. DEP is unreliable and pretty worthless anyway without ASLR. You also don’t have things like SEHOP or other memory mitigations that are the first line of defense between your system and the average stale pointer exploit against WebKit.

As for the sandbox itself, we run as “Untrusted” integrity level under Vista+, which buys a solid layer of defense on top the SID, rights, and job based sandboxing we do on XP. Our GPU process sandbox in particular (used for accelerated graphics) relies heavily on Vista+ integrity levels due to deficiencies in the Windows XP driver and graphics model. Then there’s the fact that XP is lacking hundreds of security fixes that Microsoft has chosen not to backport.

Seriously, I’ve spent many weeks trying to wring every last bit of security I can out of XP, and I really do think that Chrome does the best anyone possibly could on that front. But in the end XP is just an OS that’s far past its security expiration date, and running it at all means taking a big risk.

Read that last sentence again and tell me why you’re not planning an update?

[Hat tip to Troy Hunt]