2

Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months?

On GRC Security I remember the author cautioning against Windows 7 as it has a new TCP/IP stack whereas the old one was tried-and-true. Does this line of reasoning make sense? For example it seems logical to conclude Windows 8 has more time to be tested than Windows 10, therefore Windows 8 has more of its bugs caught than Windows 10 and is thus safer.

closed as too broad by Arminius, S.L. Barth, Matthew, Dmitry Grigoryev, Purefan Mar 16 '17 at 10:09

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unless the old software is so broken it can't be fixed ... Or the new software is so new that no one has been able to determine ways to break it ... – schroeder Mar 16 '17 at 7:47
5

There are way too many factors to consider in your question.

  • older software has had a chance to have its bugs discovered and fixed
  • older software might have known bugs that have not been fixed or can't be fixed (famous IE examples over the years)
  • newer software has not had a chance to have the same level of review and might have unknown bugs
  • newer software will not have had a chance to have published bugs for others to exploit

You cannot make a blanket statement about new or old software. The whole point is to perform a risk analysis of staying with old software as opposed to new software in the light of all of these possibilities. Statements, like the ones made by GRC, are about reminding people about the potential risks and cannot be used as advice to avoid anything specific.

2

Older software that still gets regular security updates should generally be more secure than new software.

Another issue is stability - for the same reasons - new features yield bugs, those bugs sometimes affect stability, sometimes security, sometimes both. That's pretty much the reasoning behind Ubuntu's LTS distributions.

Now... this reasoning goes out of the window if it's no longer patched in a timely manner against each and every CVE out there.

  • 1
    A (occasionally) good example would be openSSL - their repo (github.com/openssl/openssl) goes back 18 years – iwaseatenbyagrue Mar 16 '17 at 8:48
  • New patches can introduce stability problems, too. There is a lot to weigh. – schroeder Mar 16 '17 at 9:00
  • @schroeder while this is true, there's no plan B for immediate and urgent application of security fixes. Not if securing your infrastructure is the primary concern, such as in a PCI environment. – bbozo Mar 16 '17 at 9:06
  • 1
    @bbozo sure there is. There can always be a plan B. There are mitigations, compensating controls, replacement, rigorous testing, etc. Even for PCI. – schroeder Mar 16 '17 at 9:07
  • @schroeder, true, but in practice, there's so many CVEs that come and go in the scope of the month in a complex environment that treating each CVE as a special sownflake backfires because you keep prodding at your infrastructure continuously. Generally it's better to just apply all of the CVE fixes and do a rolled upgrade when possible. Exceptions to the rule being ofc, black swan events like Heartbleed – bbozo Mar 16 '17 at 9:13
0

I'd say older software is less safe to use. You have more eyes on software early looking to fix vulnerabilities. Once the software is old, maybe so old it's out of support, then no one is interested in fixing vulnerabilities but people could be still looking to exploit it.

If you are trying to weigh the risk of being on the bleeding edge vs using legacy systems that depends on exactly what software you are talking about. But if I was choosing which online PC is a greater security risk and computer A was running Windows 95, and computer B was running Win 10 LTSB, then I would say computer A is the greater risk.

  • 1
    I think you mean to say that software can get so old that it is no longer safe. Your answer states that there is an age where it is getting sufficient review. – schroeder Mar 16 '17 at 8:58
  • Software is still new after sufficient review, depending on what you decide 'new' and 'old' are. I made some fungineering estimates on how old 'old' software is to show that there are examples of old unsafe systems all the way back to the enigma machine if we are including hardware. – daniel Mar 16 '17 at 9:29
  • Why do you specify LTSB instead of CB in your example? – northerner Mar 16 '17 at 10:04
  • Because if you wanted a safe PC you would have a brick wall between it and the internet, and patching it would be a pain so you would go for a branch that is updated less frequently. – daniel Mar 16 '17 at 10:18
  • @daniel your answer is confusing - you appear to contradict yourself. I'm not debating how to define 'new' and 'old'. I'm saying that you appear to mean that there is a threshold where something gets so old that it no longer benefits from its age, but you say the opposite. – schroeder Mar 16 '17 at 10:23
-2

Older Hadware don't create any issue but yes using older software create an issue of vulnerability which is less secured for your data. Always use up-to-date software to fight against vulnerability in this cybercrime world. Updated software adds additional protection for your computer. Sometimes it can happen that you will have to suffer from issue like 'file is not opening with old browser(if that file has already created with new software version).

  • 2
    This is wrong. Not only hardware can have security vulnerabilities (ever heard of CIH or Rowhammer?), but they are also often impossible to fix once the hardware is released. – Dmitry Grigoryev Mar 16 '17 at 9:21
  • The question isn't about updated software, but 'new' software (new versions). And yes, your comment about hardware is wrong. – schroeder Mar 16 '17 at 10:21
  • Yes, accepting for the hardware comment. – Dana Mar 16 '17 at 10:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.