If you believe what you read in the tech press, there are already bot nets out there composed of tens or even hundreds of thousands of hijacked PC's, mostly used for spamming purposes or DDos attacks, a big proportion of which are probably XP machines. And that's just a single bot net! I'm not sure how MUCH worse it's going to get when XP officially stops being supported. Many of those infected XP machines could be overseas, though, so maybe it could get worse here in the US.

An average XP user who practices safe computing/email practices and doesn't have their PC connected directly to the Internet (i.e. is behind a firewall or NAT router) can be reasonably secure from infection for a long time. For these people, visiting an infected website may be their biggest risk, so trying to do as much web surfing without Java and Javascript could improve their security tremendously, although you lose a lot of functionality, but it's a price to pay for more peace of mind.

Actually, online banking is something that should really worry anyone who does commercial banking, even for a small business. Banking laws and policies provide a lot of protection for consumers, but for business accounts, the onus is really on the banking customer. If your business account gets drained because your PC is infected, you're often out of luck and the money is gone. There are stories of small business owners who had to watch helplessly as they watched some hacker take control of their PC and steal money out of their accounts as they watched. Pulling the plug on the computer would not have necessarily helped since the hacker already captured their banking login info anyway. So, if you're a small business owner and still on XP and do online banking, I would HIGHLY suggest that you get something newer.

This is the biggest issue. Sadly many average XP users still use MSIE and MSOE with all the defaults enabled. I rebuilt my MIL's PC three times because she wouldn't update adaware, used IE and played yahoo games and now she pays a local PC shop to rebuild it rather than using safer software/sites.

Switch her to Linux and this will all become past history...

If the primary use for a computer is web browsing, watching video clips, listening to streaming music, etc., I see a lot of advantages from a security standpoint to the relatively inexpensive slew of Chromebooks available now. More tech aware folks may have privacy issues with Chromebook or lament its limitations as a "browser-only" platform, but the security model of Chromebooks is probably currently the best available for "mother-in-law" level users who don't have a tech saavy person around to help them when things get inevitably messed up.

If your "mother-in-law" screws up a Chromebook (well, besides physically damaging it) and something gets wonky, a quick reboot will restore the operating system to the way it should be, automatically. Same thing if it somehow gets infected with something--a quick reboot should ensure that you're starting with a clean machine to do your online banking and such. Updates happen automatically. When somethings gets screwed up, no need to know how to roll back the operating system to some "last known good" state or go digging up restore disks to get things working again.

That said, I haven't yet owned one, but I'm seriously considering buying one in the very near future to run one through its paces. You can even tweak one to make its underlying Linux operating system accessible and you get a Linux laptop, but that's for more adventurous folks and does deny you most of the automatic security advantages of Chromium, like secure boot.

That's certainly true, but the vast majority of people who know what safe computing/email practices are and practice them are already off of WinXP.

Some people don't realize that this is something they should learn. Others refuse to learn. This is possibly why I have a job .

MSIE I recognize and dumped it back when Firefox was still Netscape except for sites that won't run without it. What's MSOE? MS Outlook Express?

Yep, Outlook Express, or the second biggest security hole to core of Windows after IE

Sadly, the vast majority of people who I've met are those who still use IE OE, etc and refuse to replace them with anything having even a hint of security. Thats one reason I got away from anything desktop related

I just installed Linux (Lubuntu) as a dual-boot on an older XP netbook. (For the uninitiated, a "dual-boot" simply means that you're given a menu to choose which operating system will load during startup.) Mostly I will run Linux (esp. when online), but by keeping XP available I have the option to handle a native Word file if I really need to. BTW, I can't say enough about the Lubuntu installer; it handled everything including partitioning the hard drive without requiring any sudo-fu. (Lubuntu also runs on systems with as little as 512MB RAM while still giving a Windows-ish graphical interface and real web browsers. Not too shabby. End of commercial.)

Apparently the next (and last) two "Patch Tuesdays" for XP machines will include a pop-up warning from Microsoft regarding end of life support. There are also hints of a skinny, ad-driven version of 8 being offered for cheap/free, but I'll believe it when I see it.

BTW, Linux folks shouldn't get too smug. Just as Apple recovers from a gaping security hole, a serious hole of similar size has been found in Linux and affects most of the major distributions: http://arstechnica.com/security/2014/03/...-eavesdropping/

Good for you, its pretty easy isn't it. Installing windows on anything takes forever between applying all the patches and updates and drivers, I'm finding Linux to be easier.



The big difference between Apple/Microsoft and Linux is not that any of the three are immune to issues, its how they react. Apple and Microsoft will spend as much time trying to hide problems as they do fixing them. The Linux world will come up with a fix quickly and you can just install it and go back to life.

Actually, it affects more than your local desktop computer. It affects the websites you connect to. I don't believe it matters what you connect from (Windows, Linux, etc.) And since the vast majority of websites you connect to are running on Linux servers, it affects everyone. There are very few Microsoft websites are out there in the grand scheme of things - sorry Bill Gates. As I read the advisory, it requires a man-in-the-middle attack, which are not necessarily easy to implement, and not on a wide scale. So while it is a security flaw, it is not one that could be widely exploited.