From: arne@vajhoej.dk   
      
   On 2/6/2026 10:46 PM, Arne Vajhøj wrote:   
   > There are two consistent approaches to that:   
   >   
   > A) Always update to supported version. For VMS that   
   >     means VSI VMS On Alpha, Itanium or x86-64. And expect   
   >     VSI to close vulnerabilities when they are found.   
   >   
   > B) Live by the "If it ain't broke, don't fix it" mantra.   
   >     Old OS, old TCP/IP, old everything. Security is not   
   >     provided by the system but around the system. Network   
   >     security, physical security etc. mitigate the risk from   
   >     the old stuff. This is not a great solution, but it may   
   >     be possible to achieve an acceptable security level. Not   
   >     all servers are running internet web servers.   
   >   
   > But it sounds like they are asking for the inconsistent:   
   >   
   > C) Keep the old OS as is without updating it, but always   
   >     update the software packages on it.   
   >   
   > Difficult to provide. Many/most software packages will   
   > not support very old VMS versions. For business reasons:   
   > too few customers to make a business case. For technical   
   > reasons: the software package need newer C RTL or   
   > newer system services or something else new.   
      
   For illustration let me show the same options for   
   desktop Windows and web browser.   
      
   A) Windows 11 with latest Edge/Chrome/FF.   
      
   B) Windows XP with some old IE or some old FF. Not   
       connected to internet - only used to access   
       intranet. Isolated network wise.   
      
   C) Windows XP with latest Edge/Chrome/FF.   
      
   Arne   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)