2

Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months?

On GRC Security I remember the author cautioning against Windows 7 as it has a new TCP/IP stack whereas the old one was tried-and-true. Does this line of reasoning make sense? For example it seems logical to conclude Windows 8 has more time to be tested than Windows 10, therefore Windows 8 has more of its bugs caught than Windows 10 and is thus safer.

1
  • Unless the old software is so broken it can't be fixed ... Or the new software is so new that no one has been able to determine ways to break it ...
    – schroeder
    Commented Mar 16, 2017 at 7:47

4 Answers 4

5

There are way too many factors to consider in your question.

  • older software has had a chance to have its bugs discovered and fixed
  • older software might have known bugs that have not been fixed or can't be fixed (famous IE examples over the years)
  • newer software has not had a chance to have the same level of review and might have unknown bugs
  • newer software will not have had a chance to have published bugs for others to exploit

You cannot make a blanket statement about new or old software. The whole point is to perform a risk analysis of staying with old software as opposed to new software in the light of all of these possibilities. Statements, like the ones made by GRC, are about reminding people about the potential risks and cannot be used as advice to avoid anything specific.

2

Older software that still gets regular security updates should generally be more secure than new software.

Another issue is stability - for the same reasons - new features yield bugs, those bugs sometimes affect stability, sometimes security, sometimes both. That's pretty much the reasoning behind Ubuntu's LTS distributions.

Now... this reasoning goes out of the window if it's no longer patched in a timely manner against each and every CVE out there.

6
  • 1
    A (occasionally) good example would be openSSL - their repo (github.com/openssl/openssl) goes back 18 years Commented Mar 16, 2017 at 8:48
  • New patches can introduce stability problems, too. There is a lot to weigh.
    – schroeder
    Commented Mar 16, 2017 at 9:00
  • @schroeder while this is true, there's no plan B for immediate and urgent application of security fixes. Not if securing your infrastructure is the primary concern, such as in a PCI environment.
    – bbozo
    Commented Mar 16, 2017 at 9:06
  • 1
    @bbozo sure there is. There can always be a plan B. There are mitigations, compensating controls, replacement, rigorous testing, etc. Even for PCI.
    – schroeder
    Commented Mar 16, 2017 at 9:07
  • @schroeder, true, but in practice, there's so many CVEs that come and go in the scope of the month in a complex environment that treating each CVE as a special sownflake backfires because you keep prodding at your infrastructure continuously. Generally it's better to just apply all of the CVE fixes and do a rolled upgrade when possible. Exceptions to the rule being ofc, black swan events like Heartbleed
    – bbozo
    Commented Mar 16, 2017 at 9:13
0

I'd say older software is less safe to use. You have more eyes on software early looking to fix vulnerabilities. Once the software is old, maybe so old it's out of support, then no one is interested in fixing vulnerabilities but people could be still looking to exploit it.

If you are trying to weigh the risk of being on the bleeding edge vs using legacy systems that depends on exactly what software you are talking about. But if I was choosing which online PC is a greater security risk and computer A was running Windows 95, and computer B was running Win 10 LTSB, then I would say computer A is the greater risk.

6
  • 1
    I think you mean to say that software can get so old that it is no longer safe. Your answer states that there is an age where it is getting sufficient review.
    – schroeder
    Commented Mar 16, 2017 at 8:58
  • Software is still new after sufficient review, depending on what you decide 'new' and 'old' are. I made some fungineering estimates on how old 'old' software is to show that there are examples of old unsafe systems all the way back to the enigma machine if we are including hardware.
    – daniel
    Commented Mar 16, 2017 at 9:29
  • Why do you specify LTSB instead of CB in your example?
    – northerner
    Commented Mar 16, 2017 at 10:04
  • Because if you wanted a safe PC you would have a brick wall between it and the internet, and patching it would be a pain so you would go for a branch that is updated less frequently.
    – daniel
    Commented Mar 16, 2017 at 10:18
  • @daniel your answer is confusing - you appear to contradict yourself. I'm not debating how to define 'new' and 'old'. I'm saying that you appear to mean that there is a threshold where something gets so old that it no longer benefits from its age, but you say the opposite.
    – schroeder
    Commented Mar 16, 2017 at 10:23
-2

Older Hadware don't create any issue but yes using older software create an issue of vulnerability which is less secured for your data. Always use up-to-date software to fight against vulnerability in this cybercrime world. Updated software adds additional protection for your computer. Sometimes it can happen that you will have to suffer from issue like 'file is not opening with old browser(if that file has already created with new software version).

3
  • 2
    This is wrong. Not only hardware can have security vulnerabilities (ever heard of CIH or Rowhammer?), but they are also often impossible to fix once the hardware is released. Commented Mar 16, 2017 at 9:21
  • The question isn't about updated software, but 'new' software (new versions). And yes, your comment about hardware is wrong.
    – schroeder
    Commented Mar 16, 2017 at 10:21
  • Yes, accepting for the hardware comment.
    – Dana
    Commented Mar 16, 2017 at 10:46

Not the answer you're looking for? Browse other questions tagged .