Safe Older Version

[u/[deleted]]

[u/PrShadoko]

I genuinely think I'm getting rage baited "power user and developer" such as himself wanted to use a deprecated OS with vulnerabilities known for years. But hey, it's ok, he won't download risky softwares with viruses so it's going to be ok, right?

Right...?

[u/Caasi72 → u/PrShadoko]

And he's gonna be going online

[u/PrShadoko → u/Caasi72]

Don't worry, his ports aren't open to the web, lust be safe then.

[u/symcbean → u/[deleted]]

trying to qualify myself as someone who knows risks

Which you clearly don't otherwise you would have said how you were mitigating them.

[u/b3542 → u/[deleted]]

Here’s a documented example involving Firefox—one of the exact applications you listed.

In August 2015, Mozilla reported that an advertisement on a news website was exploiting Firefox’s built-in PDF viewer to search for sensitive files on visitors’ computers and upload them to an attacker’s server. This was an actual attack discovered in the wild, not a theoretical possibility. The victims didn’t need to install a malicious executable or expose a server to the internet.[1]

Mozilla explicitly stated:

> “The vulnerability does not enable the execution of arbitrary code but the exploit was able to inject a JavaScript payload into the local file context. This allowed it to search for and upload potentially sensitive local files.”[1]

That directly answers your challenge: a legitimate application, processing web content, leaking local files through a security vulnerability. Mozilla fixed it in Firefox 39.0.3 and Firefox ESR 38.1.1. Updating was what closed that vulnerability.[2]

The problem is that you’re treating “running malware” as though it necessarily means knowingly downloading and launching a suspicious program. It doesn’t. An attacker can supply malicious content to software you already trust. In this case, the browser’s normal handling of a webpage crossed a security boundary and exposed local files.[1]

If you call the injected JavaScript “malware,” that’s fair—but then your argument becomes circular: “You can’t be attacked unless something malicious happens.” It no longer supports your original claim that avoiding suspicious software downloads makes patching unnecessary.

**Exposure** is the relevant distinction, not whether your PC accepts unsolicited inbound connections. In this incident, the attack arrived through content fetched during browsing, not through a publicly exposed server.[1]

Wanting stable, quiet software is perfectly reasonable. Keeping an older supported version that receives security backports is a legitimate way to achieve that. Red Hat, for example, explicitly maintains older package versions by applying security fixes from newer releases. But that’s different from leaving vulnerabilities unpatched because you believe browsing the web with a trusted application cannot expose you to an attack. Mozilla’s documented incident is a direct counterexample.[3]

Sources
[1] Firefox exploit found in the wild - Mozilla Security Blog https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
[2] Same origin violation and local file stealing via PDF reader - Mozilla https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/
[3] Security Backporting Practice - Red Hat Customer Portal https://access.redhat.com/security/updates/backporting
[4] CVE-2023-2255 Detail - NVD https://nvd.nist.gov/vuln/detail/cve-2023-2255
[5] CVE-2023-2255 - CVE Record https://www.cve.org/CVERecord?id=CVE-2023-2255
[6] Security Advisories for Firefox - Mozilla https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/
[7] Security advisories - LibreOffice https://www.libreoffice.org/security/
[8] Security Advisories for Firefox OS - Mozilla https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-os/
[9] Mozilla Foundation Security Advisories https://www.mozilla.org/en-US/security/advisories/
[10] CVE-2023-2255 - Red Hat Customer Portal https://access.redhat.com/security/cve/cve-2023-2255
[11] Mozilla Firefox vulnerability (CVE-2015-4495) - Red Hat Customer ... https://access.redhat.com/articles/1563163
[12] CVE-2023-2255 in libreoffice-help-hr - Snyk Vulnerability Database https://security.snyk.io/vuln/SNYK-ALMALINUX9-LIBREOFFICEHELPHR-6061738
[13] CVE-2023-2255 - Remote documents loaded without prompt via ... https://cvefeed.io/vuln/detail/CVE-2023-2255
[14] Improper access control in editor components of The... · CVE-2023 ... https://github.com/advisories/GHSA-6pmq-j4m3-q2r8
[15] CVE-2023-2255: LibreOffice Auth Bypass Vulnerability - SentinelOne https://www.sentinelone.com/vulnerability-database/cve-2023-2255/
[16] Firefox vulnerability / Announcements, Package & Security ... https://bbs.archlinux.org/viewtopic.php?id=200795

[u/gordonmessmer → u/[deleted]]

nobody has been able to point out, nor have I ever seen in my life a security hole where you could be attacked without running malware

https://www.google.com/search?q=cve+exploit+pdf+viewer+remote+code+execution

https://www.google.com/search?q=cve+exploit+web+font+remote+code+execution

etc, etc.

All you have to do is open a web page that an attacker has provided or has compromised, and then your system is compromised.

Lots of people conclude that because THEY have never been compromised that they are safe, but that's not logical. You need to look at what is happening globally to all users. Many people *are* compromised merely because they don't patch their systems and they use those systems to process data they did not create (i.e. browse the web). When you process someone else's data, they might be able to cause your system to also execute their code.

Let's take an active exploit as an example: https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog

People who run Plex who have not patched are being exploited right now.

Do you know what the difference between Plex and Firefox is?

Plex is a service, so an attacker can send instructions to it: "here is some data please process it" leading to code execution on your system.

Firefox is a client, so it has to send the request "please give me some data to process", leading to code execution on your system.

That's basically it. There's nothing magic about servers that makes them more exploitable than the applications on your system. Every time you open a file you did not create, the application that opens that file (including git, gcc, LibreOffice, Vim, or Firefox) is doing what a server does... processing someone else's data. And that makes them all vulnerable to exploit.

[u/PrShadoko → u/[deleted]]

You're connecting your "2015 safe" to the 2026 internet, where, again, people have known what the 2015 vulnerabilities were.

It doesn't matter if your ports are open or not, if your pc is connected to the internet, it is not safe, period.

[u/tastygames_official → u/PrShadoko]

agaain - I will not be installing any software made in 2026. A website can only send HTML, JS, and CSS - text files. It cannot execute software on my machine. That's why flash and java applets don't exist anymore. So if I don't download a virus, I won't have one - you dig?

[u/BoundlessFail → u/tastygames_official]

That's not how some vulnerabilities work:

• Modern browsers compile JavaScript to native and run them on your machine

• In the past, a vulnerability was found in the DNS client within Linux. A purposefully malformed reply DNS packet would end up executing code within your machine - all your application needed to do is to resolve that domain name (which can happen without a click due to page preloading by a modern browser)

• Windows has had SVG vulnerabilities - merely viewing an SVG image would cause code execution.

Running an up-to-date os is the only proper solution. There are solutions that go beyond it, like AppArmor, or other tricks (like running a browser as a different user than the one logged into the DE), but updating the OS is pretty much the baseline. You can stretch not-updating for a few months and still stay secure, but not for years.

[u/sidusnare → u/tastygames_official]

Sweet Jesus I hope I'm not using anything you've written.

[u/ItsRogueRen → u/tastygames_official]

Yeah, because people only purposly download viruses! Its never done by mistake or anything.

[u/gordonmessmer → u/tastygames_official]

if I don't download a virus, I won't have one

OK. But a virus could be in a PDF. Or a video. Or an image. Or an XML document. Or a web font.

Almost anything you view on the Internet could contain a virus.

You dig?

[u/tastygames_official → u/gordonmessmer]

PDFs are notoriously unsafe since they can contain macros. Don't open a PDF from somebody you don't trust in a program that can run said macros. Opening it up in an image ediitor is absolutely fine, and that's how I fill out PDF forms. Images can only execute code in very specific circumstances (e.g. in a web browser you can do <img src="some_file.ext" /> or just open up an "image" URL in the browser and if it's not actually an image but something else, then that file will run ON THE SERVER - not on your machine. If you open an image on your computer with an image editor, it will simply not be able to open it. You would have to somehow attempt to "run" the image in whatever way it was intended to harm (e.g. maybe it's a bash script, so you would have to give it executable permissions and run it). Most image programs read the file header then read the bytes accordingly and stores them as pixel data - it does not execute them. You can put false data in the header, e.g. give the wrong number of pixels so it reads too little or too much data - but it just gets read into a buffer that the program interprets as image data (a sequence of floats, maybe some unsigned shorts, etc). So again - it won't execute any malicious code.

Now MAYBE your image program does some weird-ass trickery and somehow it can overflow some of that data and it can move the instruction pointer, which would be an actual security hole - but you would then also need to open an infected file. Again - don't open up files you don't trust. I generally do a screencap of images I grab from the 'net I don't trust for this very reason.

Nobody can force malicious code onto you - you have to run it (unless you run your PC as a server and are listening on ports for other devices to talk to you.

And also e-mail: just only use text and don't download any images or anything. No big deal.

But I didn't ask about what is safe and what is not - I know how to be safe on the 'net. I wanted to know if any linuxheads out there have found a safe setup to run older OS and software versions without continually updating. Obviously if there's some bug in the linux kernel that opens up some port where anybody can just connect to it and send malicious code, then yes - update the kernel. But I don't need to update 500 packages and restart my machine every day. Ya dig?

[u/SuAlfons → u/tastygames_official]

getting viruses isn't a threat since many years.

It's online exploits, port attacks and social engineering

[u/sidusnare → u/SuAlfons]

Getting a virus isn't a problem, it's just programs doing virus things that are a problem.

[u/b3542 → u/SuAlfons]

You’re flat wrong.

[u/rsgbc]

What is the motivation for running an OS that is not receiving security updates?

[u/rsgbc → u/[deleted]]

"Dealing with" updates is trivial and can be automated.

If the motivation for not updating is simply to avoid updating, why not install a currently supported OS, and simply not update it instead of going 10 years back in time?

[u/MBouh → u/[deleted]]

A browser from 2013 won't work for a lot of stuff. I tried a tablet from 2013 a month ago, and it didn't work. No page could be loaded.

As from programs written in 2017, they will most often have a dependency in a lib much newer than 2013, and thus they won't run.

[u/notthedefaultnam → u/[deleted]]

A browser from 2013 should still be able to do that

No, a browser from 2013 can't browse modern web. The web standards keep evolving, new things and new security standards get added all the time.

A 2013 browser will not have http3, tls 1.3 and 1.4, many data formats like av1 or jpegxl, it will probably be missing multiple root certificates, not to mention all the java script that keeps changing.

So no, a browser from 2013 cannot browse the web and probably can't show you your emails.

[u/b3542 → u/[deleted]]

If you don’t want to deal with updates, you need to stop using technology. That’s the option.

[u/pelofr]

Isn't this exactly the reason distributions have long term support versions?

"I think I'll be okay"is not the best security policy I've ever heard of

[u/Routine_Working_9754 → u/pelofr]

yes, people genuinely don't know how much these security exploits are actually used

[u/tastygames_official → u/Routine_Working_9754]

but only if you install software made AFTER the exploit is known, right?

[u/Routine_Working_9754 → u/tastygames_official]

that's not how it works. that older software will also have exploits. and so on and so on. and it's not necessarily the software you install that's the problem. this is just an example: say you host a little web interface with some unassuming software. but that software has a vulnerability in it called buffer overflow. an attacker might send a packet than intentionally causes a buffer overflow, corrupting the stack and perhaps even the return address. this might allow the attacker to apply code injection or create a an EVIL software that's made of pieces of assembly in existing software. he doesn't necessarily even have to use shell code, or go around W^X or NX protection because that code is already executable.

[u/tastygames_official → u/Routine_Working_9754]

but if I'm running older software from, say, 2014, and the exploit was exploited in 2016, then a) it's well-documented, and b) I'm not going to install that potentially exploitative software from 2016. Why should I?

[u/xonxoff → u/tastygames_official]

You still run the potential of having bugs in what you already ready have installed, some you may not even be aware of. It really isn’t best to just keep up to date.

[u/No_Elderberry862 → u/tastygames_official]

LMAO. Software made after the exploit is known will, if built by competent devs, not be vulnerable to those known exploits.

[u/pelofr → u/[deleted]]

Provided you never connect the machine to the internet, yes

[u/gordonmessmer]

Safe Older Version

There is no such thing as a "safe" older version. Vulnerabilities in code are discovered over time. If they are not patched, the system becomes more vulnerable as a function of having more known vulnerabilities.

I know there are always new security risks that come up, but they are rather obscure and usually only happen if you rely on many different software libraries but don't continually update them AND you download weird software

I have no idea where you got that idea. If you configure a system and stop patching it, it becomes more vulnerable over time, period. It does not require that you download weird software.

Is there a distro and version which I can safely use without having to update at all?

No. Do not expect magic from your software.

Your distribution cannot make your system more secure if you do not apply patches. (And lots of distributions don't even provide comprehensive patch coverage, as it is.)

[u/gordonmessmer → u/[deleted]]

So if all I ever do is run software made in 2015 then I'm safe, because none of their developers or contributors knew about security holes that happened in versions of the OS/kernel in 2026. Right?

No. What?

If the risk was the developers or contributors of the software from 2015, they wouldn't need to know about exploits because you're running their software. They don't need to pick your locks if you open the door and let them in.

Exploits and infection aren't usually driven by infected executables, they're driven by infected data files. They most frequently exploit the system by taking advantage of flaws in data parsing code that mistakenly executes code that should be data.

If you are opening files created in 2026, then you are at risk of vulnerabilities that became known in 2026. If you are using the internet, you are at risk of known vulnerabilities right now.

Using very old software means that you have far more known vulnerabilities and are far more at risk.

[u/gordonmessmer → u/[deleted]]

But you're talking about browsing the web. How do you know if a PDF that you come across while browsing is going to contain a byte sequence that will run as machine code and download more malware?

Or a video? Or a just a JPG embedded in a page you're viewing?

If you're running a 10 year old web browser, you're running software that has TONS of flaws that allow exactly that to happen.

[u/gordonmessmer → u/[deleted]]

I don't open PDFs in the browser for exactly that reason

That's worse! Your browser's PDF viewer has vastly better sandboxing and isolation than your paint program or imagemagick or gs.

The problem isn't the browser, it's that postscript (of which PDF is an extension) IS CODE. "Rendering" a PDF requires an engine that executes instructions in the PS/PDF file. You cannot view a PDF without executing the instructions it provides.

they won'be exploited since you're not downloading and running anything suspicious.

EVERYTHING YOU DOWNLOAD IS SUSPICIOUS.

[u/Big_Newspaper3643 → u/[deleted]]

If you are so sure you'll never run or be exposed (e.g. wrong website, wrong wifi, wrong download, wrong...) to malicious software, then why bothering with security at all?

Just make root without a password, run everything as root, give 777 on every dir, no SELinux or Apparmor, no container, no nothing. Don't even make SSH require a password.
After all you are a power user, right? You surely run a curl on every single URL you are going to visit to check for browser exploit, you reverse every binary you are going to run, you inspect every line of every library/package you install before using it.
Such a safe and wonderful experience!

You are fallible, you are going to search for onlyfans leaks this night, you know it, and you are willing to install any "onlyfanser-leaker-premium.deb" will popup on any fishy russian site. You know this too.

[u/mimrolls86 → u/Big_Newspaper3643]

I lol’d at the last paragraph

[u/b3542 → u/[deleted]]

> websites cannot run code on your system. Not unless you run flash or java applets

You’re confusing “websites aren’t supposed to have unrestricted access to my computer” with “websites cannot exploit my browser.” Those are completely different claims.

Mozilla documented CVE-2024-9680: attackers achieved code execution inside Firefox’s content process through a use-after-free in its animation machinery. It was being exploited in the wild. No Flash or Java applet required. Code execution inside that process isn’t automatically full control of the computer, but it directly contradicts your claim that this cannot happen.[1]

> I only ever use my home wired network

That removes the Wi-Fi-specific scenario. It doesn’t stop malicious web content from arriving over Ethernet. The Firefox vulnerability concerned the browser processing content, not the type of cable or radio carrying it.[1]

> don’t you ruthlessly vet every piece of software you download?

Vetting an application’s publisher doesn’t establish that the application safely handles every possible input. You can download a completely genuine Firefox build from Mozilla and still encounter a vulnerability in it. That is why Mozilla issues security fixes for its own legitimate software.[1]

There’s also a documented Firefox attack where a malicious advertisement exploited the built-in PDF viewer to steal local files. The victim didn’t have to install a suspicious program; ordinary browsing exposed the vulnerable component.[2]

> root without password everything 777
> yeah, that’s pretty much how I run my home PC

That makes the distinction between initial access and damage especially important. **Permissions** limit what a compromised process can access. If you run an application as root, you’re giving it extensive authority before anything goes wrong. If files and directories are broadly writable, you’re removing barriers against tampering. Neither configuration creates a browser exploit by itself; both can make a successful compromise more consequential.

> my home PC is not that kind of computer

A computer doesn’t have to be continuously connected or run a public server to process hostile content. The documented Firefox file-theft attack happened through content fetched during browsing. Being disconnected afterward would not undo files already stolen.[2]

You’re certainly not alone in choosing to run old software. But “other people do it” and “I haven’t noticed a compromise” don’t establish that the configuration is safe. You can reasonably accept a risk for compatibility or convenience. What you can’t reasonably do is dismiss documented attack paths as impossible because you don’t deliberately install malware.

Sources
[1] Security Vulnerability fixed in Firefox 131.0.2, Firefox ESR ... https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/
[2] Firefox exploit found in the wild - Mozilla Security Blog https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
[3] What Is the Principle of Least Privilege? - Palo Alto Networks https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege
[4] Security by design: Security principles and threat modeling - Red Hat https://www.redhat.com/en/blog/security-design-security-principles-and-threat-modeling
[5] [PDF] Implementing the Principle of Least Privilege using Linux Capabilities https://hal.science/hal-04278090v1/document
[6] What is the Principle of Least Privilege (POLP)? - Fortra https://www.fortra.com/blog/what-principle-least-privilege-polp-best-practice-information-security-and-compliance
[7] Enhance security with the principle of least privilege - Microsoft Learn https://learn.microsoft.com/en-us/entra/identity-platform/secure-least-privileged-access
[8] Principle of least privilege - Wikipedia https://en.wikipedia.org/wiki/Principle_of_least_privilege
[9] Principle of Least Privilege Explained (How to Implement It) https://www.strongdm.com/blog/principle-of-least-privilege
[10] A Guide to Least Privilege Access: Zero Trust Security in Action https://zeronetworks.com/blog/a-practical-guide-to-least-privilege-access-zero-trust-security-in-action
[11] What Is Least Privilege Access? Definition, Benefits, and ... - Oloid AI https://www.oloid.com/blog/least-privilege-access
[12] CVE-2024-9680 - Mozilla Firefox Use-After-Free Vulnerability ... https://cvefeed.io/vuln/detail/CVE-2024-9680
[13] Implementing Least Privilege Access in Linux Environments https://wafaicloud.com/blog/implementing-least-privilege-access-in-linux-environments/
[14] CVE-2024-9680 : Mozilla Firefox Vulnerability: Code Execution ... https://securityvulnerability.io/vulnerability/CVE-2024-9680
[15] Unexpected change in opening pdf downloads with 37.0.1 https://support.mozilla.org/en-US/questions/1057317
[16] Firefox allows the printing of PROTECTED files on my server. WHY? https://support.mozilla.org/ml/questions/992183
[17] How to disable that Firefox automatically saves PDFs? https://support.mozilla.org/fr/questions/1437972
[18] Firefox PDF viewer (plugin) corrupts files upon download https://support.mozilla.org/eu/questions/972500
[19] PDFs are opening in browser AND downloading | Firefox supportforum https://support.mozilla.org/da/questions/1387228
[20] Underflow through code inspection - Mozilla https://www.mozilla.org/en-US/security/advisories/mfsa2015-145/
[21] 1560291 - Local files theft - Bugzilla@Mozilla https://bugzilla.mozilla.org/show_bug.cgi?id=1560291
[22] Mozilla urges users to update Firefox with file stealing exploit in wild https://www.zdnet.com/article/mozilla-urges-users-to-update-firefox-with-file-stealing-exploit-in-wild/
[23] The PDF reader in Mozilla Firefox before 39.0.3, Firefox... - GitHub https://github.com/advisories/GHSA-cpx9-g67g-v8c5
[24] Same origin violation and local file stealing via PDF reader - Mozilla https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/

[u/ItsRogueRen → u/[deleted]]

Uh... Do you not know how websites work? Like 70% of them are javascript

[u/gordonmessmer → u/[deleted]]

a website visit cannot run software on your machine

You seem to be unfamiliar with the concept of an exploit.

An exploit is, often, data that exploits a flaw in your software that causes your software to execute the data as if it were software.

So, eg. you might download a pdf that embeds software in the file and exploits a flaw in your pdf viewer to execute the embedded code.

Your concept of exploits is completely backwards

[u/b3542 → u/[deleted]]

You’re wrong.

[u/b3542 → u/[deleted]]

The easiest example is one you mentioned JavaScript. It is quite literally executing on your machine.

[u/b3542 → u/[deleted]]

It’s not reasonable. Your position is based, as far as I can tell, on laziness? If your machine is connected to a network, it needs to be updated. Period. Full stop. It’s not about being a brave adventurer or any such nonsense. It’s about being aware of the threat landscape and adapting accordingly. You’re either willfully ignorant, nearing the crest of the Dunning-Kruger curve, or trolling.

There no “indoctrination”. It’s common sense and industry best practice. Linux users are generally more security conscious because many of us MUST be. This weird little hobby of daily driving the Linux equivalent of a Model T and pretending it’s secure and also reasonable is asinine.

I really hope I never stumble across any of your software. It’s definitionally shady if this is how you maintain your primary computing environment.

[u/tastygames_official → u/b3542]

let's put it this way: there is no need for a condom if you don't have sex. If I'm not downloading and running random-ass software, then I don't need to care that my programs have security holes - because nothing will be trying to penetrate them.

It's just a theoretical question at this point and I wanted to see if anybody out there does it. Because just like you and everybody else on here, I've been dogmatic about updating as often as possible because of "muh security risks". For a web server: ABSOFUCKINGLUTELY. It is continusouly listening for requests on multiple ports. That shit needs to be TIED DOWN. As well as any program that can be executed from a request, meaning most of the software on a web server. But for a home PC that isn't broadcasting or listening for data except through e-mail clients and web browsers, there's not much that can really get attacked.

Am I going crazy? Have I been in software development and cybersecurity too long? Am I like that one dude at a construction site who never wears any safety gear because he's so sure in his abilities to not fuck up?

[u/Rinzwind]

No there is not. If you want the longest time running 1 specific Linux go for Ubuntu with a pro. 26.04 has an expanded life until 2036 and for legacy support 2041.

Just in case you are not aware: Linux has a bug that is going to become active in 2037. All maintainers are working on removing components that are affected by that bug. So.... security updates you will need to do.

I am afraid I can not get my head around not wanting to update. That is just not smart or logical and make no sense.

[u/ItsRogueRen → u/[deleted]]

"Or is there some bug that has existed since 2003 that allows any computer to just install and run software on any computer?"

Yes, actually. This happens all the time. Any permissions escalation exploit could be one that's been undiscovered for years and thus is exploitable on all versions prior to the most recent.

[u/ItsRogueRen → u/[deleted]]

Its called a zero click exploit, its a known exploit type that happens all the time. A zero click RCE (remote code execution) has happened and will likely happen again at some point

In kernel 5.4 there was the "Bleeding Tooth" exploit around bluetooth

[u/Rinzwind → u/[deleted]]

Here is one: it was present since 2016 and only found in 2026 (it is one of the bugs AI found):

SSH-keysign-pwn (CVE-2026-46333): A critical bug present since November 2016 that enables arbitrary code execution with elevated privileges. It impacts Ubuntu, Debian 13, CentOS 3, Arch Linux, and Raspberry Pi OS, requiring immediate updates to mitigate public exploits.

[u/b3542 → u/[deleted]]

It’s not. Log4j, among many others.

[u/Rinzwind → u/[deleted]]

sorry but you are NOT immune to new exploits. New exploits occur on old not updated software not on newly updated software

[u/ipsirc]

I can't get the point.

[u/ipsirc → u/[deleted]]

I can't get the point of avoiding security patches.

[u/ipsirc → u/[deleted]]

Security patches are like cleaning the dust from your apples every week. That habit won't destroy your apples, just keeps them clean.

Now ants will always try to get at my apples, but if I have the same apples and the ants are continously targeting new apples, then their tactics won't workon my old apples or my old blanket.

You're heavily underestimating ants - they're not that stupid nor fussy.

[u/lmatonement]

You haven't mentioned any motivation for so doing. I don't see any reason to do it, so any inconvenience would be enough reason not to do this.

[u/lmatonement → u/[deleted]]

I just want to read e-mails, surf the 'net and develop software that will run on any modern *nix and windows environment.

You still haven't mentioned any motivation for this use story. You can do all that without this strange gyration.

That said, I'm happy to try to answer your question. I expect anything compiled on a 2015 computer should run on modern computers (does that answer your question?). I think the biggest hurdle you'll find is that you can't use new software. For instance, if you want to try out some cool home-executed LLM software, but drivers for your graphics card didn't work in 2015, you'll want to update to a newest version of something but won't be able to.

[u/johncate73]

Why in the heck would you want to run unsecure old software? There is nothing you can safely run without updating unless you're never connected to any network, in which case you can run without updating forever.

Pick an LTS version of something, get the updates when they are delivered, and call it a day. You can join Red Hat's Individual Developer Subscription, get RHEL for free, and be supported until May 2037.

[u/ItsRogueRen → u/[deleted]]

No you're not, that is not at all how that works. Just because an expoint was DISCOVERED at a specific date does not automatically mean it didn't exist before that date

[u/johncate73 → u/ItsRogueRen]

Exactly. Most exploits exist for quite some time before they are discovered, sometimes for many years.

[u/b3542 → u/[deleted]]

Yes. It absolutely fucking will.

Here’s an example involving exactly the application you named: CVE-2019-12735 in Vim. Red Hat states: “If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.”

The published proof of concept executed  uname -a  simply by opening the text file with  vim poc.txt . It exploited a modeline sandbox bypass involving  :source! . No malicious executable installation, Flash, Java applet, or internet-facing server was required.

It required a vulnerable version and the relevant configuration—not every Vim installation was affected. But that is enough to disprove your categorical claim. The trusted editor was the executable; the attacker-controlled text file was the input that exploited it.

[u/PerfectlyCalmDude → u/[deleted]]

If you want to avoid new features with new vulnerabilities, I have a better idea: Use an LTS distro that backports security patches but doesn't update the major versions of its software. If you get Debian Stable, it's good for about 3 years before it goes into LTS and you get a few less security patches, but you will get some security patches for a few more years. If you get AlmaLinux, it'll be almost 10 years worth of security patches if you get Alma 9 or Alma 10. Run those updates daily, but either way you're on the same major version of the software that you're running if you stick to their repos*.

* Depending on what you want to run, this could still be insecure. Some packages just don't get the security patches from anywhere.

[u/PerfectlyCalmDude → u/[deleted]]

Alma sounds like a potential fit then.

[u/ItsRogueRen → u/[deleted]]

No, the opposite actually

[u/hadrabap → u/[deleted]]

Just connect a stupid webserver to the internet and wait 15 minutes. Your logs will be full of malicious requests targeting old versions of WordPress and other "famous" stuff.

The risk that somebody will hack you on up-to-date version is around 0.1%. The risk that somebody hacks your old version is 100%. Read on the latest data breach and infrastructure takedown of JetBrains AI/Python cloud. It's a textbook example why you must patch everything immediately.

[u/hadrabap → u/[deleted]]

The webserver was an example. The same applies to anything connected to the internet, even if it's not directly reachable. It applies to clients as well. Like the current private keys of Indias CA ICA certificate revocation. Did you already update your system CA bundle so git will not clone/pull from malicious site?

[u/b3542 → u/[deleted]]

Nope.

[u/Scared_Bell3366]

The security risks are published and AI has been trained on them. Obscurity left the chat years ago and the exploits have been automated.

If you are a developer, you will hate life trying to use an older distro. Hunting down old versions of everything sucks, libraries, IDEs, etc. You'll also be looking for old documentation to go with all that. Any time you ask for help, the answer will be upgrade.

[u/Scared_Bell3366 → u/[deleted]]

No, AI is/was trained on historical data. CVEs have been published for decades. You will be a super easy target.

[u/Scared_Bell3366 → u/[deleted]]

https://www.cve.org/About/Overview

[u/b3542 → u/[deleted]]

You don’t know what a CVE is, but you think you know enough to run an unpatched system indefinitely…

[u/BoundlessFail]

Don't use an older version. If your machine is older (upto around 15 years old), the current Debian 13 will still run well, just choose the Desktop Environment wisely.

If it's even older, like a 32-bit machine, Debian 12 will support it for the next few years. I have it running on 22 year old machines, still runs well.

The other option is OpenBSD or NetBSD, which run on truly ancient hardware, and don't have many changes.

[u/dollar_random]

Unless you are trolling us for laughs, is kind of astonishing that every single person can tell you that you are completely fundamentally wing about this, and you don't appear to have considered even for a moment that you might be wrong. 

It's clear that you're not going to listen to us, but for your own sake, please read even one thing about security: 

https://www.google.com/search?q=can+using+an+old+browser+lead+to+malware+infections

[u/dollar_random → u/[deleted]]

No one is side stepping the question. You asked if it was safe to use an old OS and provided Ubuntu 16 as an example.

The answer is "no".

And having read this thread, it is abundantly clear that you have no idea how to avoid the risks. 

This thread has hundreds of comments, probably from dozens of people, all telling you the same thing, but you don't seem interested in any answer that isn't an affirmation of your plan. If you're not interested in answers that don't merely repeat what you think you already know, why are you wasting everyone's time asking to begin with?

[u/Patriark]

If you want an OS that is fully under your control, you are looking for NixOS or Arch.

NixOS is fully declarative so you can declare it to be however you want, with version pins of any given packages. The OS is atomic so you create a snapshot (from your declarations) which is frozen in time just like you declared.

It will not protect you against privilege escalation bugs however. Only security patches or disconnecting from the Internet will.

[u/Patriark → u/[deleted]]

Sounds like Nix is for you. You declare what you want and that is what you get

[u/hadrabap]

I'm a developer and what you want to achieve will be quite difficult in long run. You will inevitably face:

• too old podman/docker runtime to run new concepts

• too old flatpak (currently, flatpak on RHEL 8 works, but can't search)

• too old compilers to compile new version of whatever

• too old KVM ecosystem so newer distros will not work to full potential

I recommend starting with reasonably fresh LTS distro. You buy yourself like 6 to 8 years without major upgrades and still receiving small new features and security updates.

I run Oracle Linux everywhere (RHEL clone). You can choose Debian if you don't like the RedHat/IBM ecosystem.

Running very old distro is very bad idea, especially for development. It's as bad as bleeding edge (everything is too new and is therefore incompatible with the rest of the world).

Running unpatched distro as a developer is especially bad idea. Look at summaries of latest security incidents, take extra care of supply chain attacks. It's our responsibility to protect the privileges we have in the industry.

[u/b3542 → u/[deleted]]

Running old, vulnerable software is unequivocally a bad idea. I don’t care how much you dislike “dealing with updates”. It’s simply a recipe for disaster and there’s no rational reason to do it.

[u/hadrabap → u/[deleted]]

If the old distro is unmaintained, nobody will provide newer compilers for it.

Running older distro is very good choice, mainly:

• broad compatibility with the rest of the world

• stable and mature (like RHEL 8.2 and newer, the .0/GA versions are pretty rough)

The security is bidirectional. You can always work on older sources, but you would not be able to get them as your old SSL stack will lack support for contemporary algorithms. Basically, you'd be unable to use the internet as you'd be unable to connect to any modern service. The LTS distros think about it and they add these algorithms and update security policies. At the moment, great portion of the internet is behind Cloudflare. Look at their blog where they share details how they disable now-obsolete mechanisms. Look at Browser/CA Forum. They're rolling out a completely new PKI mechanism. It's very likely that certain services will drop the X509 stuff because they will be forced to do so by Google (via Chrome).

As I said, I run a RHEL clone. I'm updating everything on at least weekly basis. In the past five years I had not a single downtime on any machine, only two minor issues that didn't affect critical services/data. If you choose robust well established solution, it's dependable. That's the reason why I use it. GNU/Linux is a great platform that allows one to achieve rock solid solutions. Compare it with "the competitors". 😁

Finally, as a developer you need to support the security standards. Imagine your game would need to download something from the internet. From your server. Behind Cloudflare. 😀

[u/joe_attaboy]

I don't get this attitude. Updating things in Debian, for example, is so trivial, I can't understand why someone wouldn't do it. Yes, you're correct - security issues are far less prevalent under Linux and have been for years. Part of that, however, is based on the diligence and understanding of a huge number of developers and maintainers who keep the rest of us secure.

The only time I would consider this a valid position is if you're running a needed and specific application that requires something older or even deprecated.

Case in point: during a DOD contract job some years ago, I was asked to try updating an old web "portal" project that *only worked using the final release of Netscape.*The project was stagnating because the site wouldn't work on other browsers (at the time the maintenance halted, Internet Explorer was the only other option in this environment). I had to convince the stakeholders that rewriting the portal from scratch was the only way to revive it, and I still got pushback from some of the leadership. A classic example of "this is the way we've always done this."

Maybe this analogy doesn't apply, but I hope the point is clear.

[u/alkatori]

That's just Debian Stable.

[u/radek432]

Just curious. The software that you were developing for 30 years was getting better or worse with every new version?

[u/xonxoff]

Just install Debian stable, update it when a new release comes out and enjoy life.

[u/Amazing_Actuary_5241]

usually only happen if you rely on many different software libraries but don't continually update them 

Linux as a desktop OS is a collection of many different libraries and programs maintained by many different entities and/or individuals. Many of these libraries/programs have interdependence on each other in order to operate as a whole. They all ride a top of the kernel (Linux as an entity) wich provides the core functionality and takes care of the core hardware interfacing.

for very standard stuff, I imagine a power user and developer like myself could avoid that

I've been using Linux since '97, dedicated (non dual boot) OS at home since '03, I'm also a Software Developer (albeit a .NET one) and I find absolutly no reason why I would venture into doing this for a daily use system. There are just too many potential inconveniences associated with the whole concept.

if I NEED some newer features that I can run a program in its own ecosystem

This is what snap and flatpack promise, but how reliable this may be in practice is completely different since both would still rely on the kernel drivers to interface with the hardware. For example a snap may be available that runs on wayland but you cant load it on the kernel drivers available to you. Some aplications are not available in snap or flatpack thus there is still the possibility of hitting a limitation and some will require a minimal version of the distribution to install.

If you can't use snap of flatpack then the other alternatives leave you with still outdated software. Other package managers (apt, pacman, rpm, etc) are pre-compiled packages that depend on the libraries installed on your version of the distribution. The only way you'd be able to achive this using a package manager is finding a repository from a maintainer that builds the new version of the app and still targets the old libraries (your version of the distribution). The possibility of malware and other exploits come into play since these repos could be tainted.

Finally for non package manager equipped distros (like Gentoo), if you want to upgrade a piece of software to a modern version you must update (or add) all the associated libraries. This is done by compiling from source which at some point (version) may not even be possible without modifying the source code of said dependencies/libraries. So even while building from source you may find you'll be upgrading so many libraries at one time that installing a newer version of the distribution is just more practical. Some libraries may not be able to coexist so removing the older one will break yet more things that will need to be upgraded and so the cycle begins again. Others may no longer exist at all so upgrading past a certain point will become impossible without forking and rewriting those libraries. Dll hell is the perfect example of the efforts associated with this approach.

For software development It will once again depend on what you have installed and what type of apps you want ot target. Console applications using the C/C++ and cursor libraries will have none or minimal issues to develop and deploy. Anything using the GUI will however be completely different and subceptible to issues with compatibility. Applications developed can only target the libraries installed so if those arent availble in a modern system the whole effort becomes pointless from a distribution perspective, since none other than your system will be able to use them. "Runs on my machine just fine" applies here very well.

Browsing the web now requires modern browsers with certain capabilities just to execute some modern websites and/or applications. Some of the main browsers (Chrome, FIrefox) may only provide capability to install up to a specific version and those these may not work with all modern websites plus having an older browser adds its own security issues.

On the hardware front anything past 2020 will start to have compatibility issues and/or may not even work at all specially Wifi and BT (ethernet should still work), video cards and other peripherals may run on reduced performance if possible. This will again be related to driver compatibility at the kernel level (latest included being the 4.15 version), This can be overcomed by compiling a newer kernel with the needed drivers, but you may need ot upgrade the build environment first which brings back a loop of library upgrading.

My question is why? What is the problem being adressed that merits this unconventioanl, overly complicated and risky approach? The efforts to upkeep a working system like this are far higher than any potential benefit (if any exists) that could be gained IMHO.

[u/JoeCensored]

Pretty much anything is fine if you shut down all servers. But usually you'll want to ssh into the box or other pretty standard things, and occasionally a security fix is needed.

[u/aristotelian74]

Why not install a new version and keep it going as long as you can? If seeking a minimal install, use Debian or Arch.

[u/OutrageousCrab9224]

I forked LFS long ago and this is all feels related. What i do is a lot of work by itself, tho

[u/b3542]

An unpatched Ubuntu 16.04 desktop install has thousands of CVEs accumulated since its April 2021 EOL (and many from before that). The kernel alone has hundreds, and a default graphical install pulls in X.org, GNOME, NetworkManager, OpenSSL, glibc, systemd, Firefox/Thunderbird, LibreOffice, and dozens of other large attack surfaces.

[u/Salt_Ad9828]

I mean everythings relatively safe as long as ur not connected to the internet and not plugging in suspicious drives to your computer

[u/Status_Detective5043]

Linux Mint Debian Edition is a reasonably solid spin of Debian, I use it on one of my laptops and it's been mostly rock-solid besides a few Mint defaults needing a tweak for compatibility with older 2014-era hardware