Safe to run unsupported OS with up to date browser?

[moose232]

If a basic user that only uses a web browser for typical tasks, such as shopping, online banking etc. is running an unsupported OS eg. El Capitan, from a security-perspective (ignoring the general lack of application compatibility), is it enough to run an up to date version of a web browser (eg. Chrome/Firefox) and not worry about getting any security updates for the operating system?

Any and all articles around lack of os support/security patches are too basic in nature - i.e. no patches/support = BAD!!

Ideally, I'd like anyone with a deep understanding of why it's bad to explain in greater detail please. Apologies if this has already been answered elsewhere.

 

[zarmanto]

I don't know if I have the "deep" understanding that you're seeking, but I may be able to offer some insights that could help. Consider this: The crux of the matter with malware and viruses is that you just don't know how the next vulnerability is going to present. Is it going to target the OS? Is it going to target the browser? Will it come over the internet, or over Bluetooth? Is it going to target the user with social engineering? Will it come in via an iMessage? Will it take advantage of something that allows it to launch even without any user interaction, so that it's deeply embedded in your system before you even wake up in the morning? Is it going to be only one exploit, or a combination of different exploits? And what all will it do, once it's there?

So if you knowingly choose not to address one potential source of vulnerabilities, the obvious conclusion is, you're setting yourself up for eventual failure.

Because what we do know is that malicious actors are constantly poking around in old and new systems alike. They're trying to find ways that they can get more access, more data and more resources. They're trying to find ways to get their fingers into every organization both large and small, in order to harvest data and deploy ransomware. They're trying to find exploitable systems to add to their botnets. And malicious actors don't just stop using old exploits, simply because the latest OS happens to have mitigations for them -- quite to the contrary: they research every scrap of documentation about the mitigation so that they can more effectively exploit those vulnerabilities on unpatched systems and so that they can evaluate even older unsupported systems to see if they are likewise exploitable. And they continue poking around with every one of the exploits in their inventory in the hopes that one of them eventually succeeds. And sometimes, they actually do succeed.

Now, having said all of that... many people do indeed follow exactly the path that you've described, particularly with old Macs. I'm one of them: alongside my primary 2019 iMac, I also have several Macs which are each over a decade old, and which are still serving various purposes around my house. It's hard to ignore the fact that Mac hardware consistently outlives its supported life-cycle, to the tune of two or three times the typical longevity of comparable Windows based computers, and many users of old Macs are understandably loath to dispense with a computer which still seems to work perfectly fine.

You just need to understand and always keep in mind that you're taking a calculated risk, and therefore treat that computer with the appropriate level of trust; that is to say, it's better if you don't actually do any banking or shopping from an out-of-support systems, and don't keep any critical and/or private files stored therein; if at all possible, do those things from something newer which is still receiving security updates.

 

[zarmanto]

Just to briefly circle back to this with a recent example of the nature of the problem, from Ars Technica: Zero-day used to infect Chrome users could pose threat to Edge and Safari users, too

That's an article about a recent zero-day vulnerability which affects potentially about 90% of web browsers in use today. The three referenced browsers have all received patches earlier this month, but were being actively exploited before that... and are likely still being exploited for any users who haven't gotten around to updating their browser.

 

[Minghold]

If a basic user that only uses a web browser for typical tasks, such as shopping, online banking etc. is running an unsupported OS eg. El Capitan, from a security-perspective (ignoring the general lack of application compatibility), is it enough to run an up to date version of a web browser (eg. Chrome/Firefox) and not worry about getting any security updates for the operating system?

Yes, since most of the security problems with Macs are browser-based (and especially with Safari, since that's the built-in browser analogous to Windows Internet Explorer that bad actors would design their infections to beat). And, IMO, the biggest piece of malware on a typical older Mac is the operating systems own "MRT" (malicious removal tool), which seems expressly designed to swallow up all your ram on a non-SSD machine and grind everything to a halt until you finally give up in frustration and throw more money at them for a newer computer. (That's my "planned-obsolescence is the ulterior motive" story, and I'm sticking to it.)

 

[zarmanto]

... the operating systems own "MRT" (malicious removal tool), which seems expressly designed to swallow up all your ram on a non-SSD machine and grind everything to a halt ...

In your case, I fully expect that the non-SSD drive certainly has a far greater impact than the offending software to which you've decided to direct your ire. (Personally, I've replaced the spinning-rust-platter drives in several older Macs with SSDs... and you might be shocked at just how much that improved their performance.)

 

[Minghold]

In your case, I fully expect that the non-SSD drive certainly has a far greater impact than the offending software to which you've decided to direct your ire. (Personally, I've replaced the spinning-rust-platter drives in several older Macs with SSDs... and you might be shocked at just how much that improved their performance.)

I'm a Mac tech with dozens of machines, many with and without SSDs and Fusion drives, so I am well aware of how nice SSDs are within the context of the manufacturer deliberately trying to obsolesce their own earlier product. But there's otherwise nothing wrong with "slow" spinners when treated right by the OS. The other day, I launched an old white iMac (1gb DDR2 ram) off an external 320gb spinner over USB2 with a Snow Leopard installation. It took no more than thirty seconds to reach a usable desktop (including launch goodies like fan controllers, etc) -- which is less than Mojave or Catalina stock-install on a thinside iMac with a Fusion drive.

And Apple has, within more recent memory than you'd generally assume, made some truly sluggish pieces of crap. For example, there's a shockingly slow 1.4(!)ghz i5 21.5" 2014 iMac they foisted on the school systems (a machine basically meant to just be running all day in libraries for internet browsing). They featured soldered ram (as are all 21.5" thinsides) and a 500gb 5400rpm(!) rotational (NOT Fusion) drive. Its saving-grace was 8gb of DDR3 ram, which it is not advisable for you to exceed, ever, unless were booting from an OS on an external SSD attached to a USB3 port (which, for some reason, Apple accidentally graced the travesty with). These absolute turds are floating around the used market now, where they're indistinguishable in appearance from any other "fast" thinside iMac made between 2012 to 2019. It takes them almost two minutes to boot from a stripped-down High Sierra install with boot-caches already in place, and Spotlight indexing and MRT disabled (among other Terminal tricks). The kicker: this utter chunk of garbage is green-lit by Apple for Monterey, while the aforementioned white iMac from 2006 with a 2ghz core 2 duo (an 8yr-older faster processor) is precluded from even running Yosemite (a seven generations' older OS for which at least one HTML5-capable browser, Waterfox Classic, is still being maintained). --So it's not like Apple was trying to get away from spinning drives, at least not in 2014, the same year in which they loosed one of their fastest iMacs ever, a 4ghz 5K 27".

 

[zarmanto]

I'm a Mac tech with dozens of machines, many with and without SSDs and Fusion drives, so I am well aware of how nice SSDs are within the context of the manufacturer deliberately trying to obsolesce their own earlier product. ...

Your commentary is mildly interesting and all, Ming -- but I would like to point out that nothing in that response contradicts my prior assertion, that an SSD would effectively solve the earlier performance issue you cited. Rather, on some level it seems to me that you agree, regardless of the various other issues about which you complain so stridently.

 

[Minghold]

Your commentary is mildly interesting and all, Ming -- but I would like to point out that nothing in that response contradicts my prior assertion, that an SSD would effectively solve the earlier performance issue you cited. Rather, on some level it seems to me that you agree, regardless of the various other issues about which you complain so stridently.

The context of the discussion, as provided by the OP's first sentence, was "a basic user that only uses a web browser for typical tasks". --Such persons are not buying SSDs to add to sub-$100 value old computers, and generally lack the level of expertise necessary for things you and I would consider basic, such as partitioning a drive with the correct scheme to hold a bootable Mac OS. Needless to say, they're not going to own a set of magnetic torx and pentalobe screwdriver bits either.

The "performance issue" only exists when someone attempts to run one of the newer bloated OSes (El Capitan onward, and especially Catalina onward) on a machine without at-minimum double Apple's minimum ram requirements (assuming that OS will install on the machine at all without OpenCore or other tricks, any of which relegate the attempt to the hobbyist realm).

The most effective solution to the "performance issue" is not throwing money at the problem for SSDs to run, say, OpenCore Monterey, but backdating an Apple-hoodwinked-you-into-installing-it "new & improved" OS to an earlier version that ran nicely on rotational drives and tiny ram. Yosemite supports modern browsers and Office 2016, and can manage it with 2gb of ram and a spinner drive. People acquiring a sub-$100 computer won't be rendering 4k film; they'll be going to Facebook Marketplace, YouTube, Netflix, and so forth. (Thus the OP's interest in browsers.)

It won't be fast, but that's not the issue (context: "Safe to run OS with unsupported browser?"). I'm merely answering the OP's question from a different direction.

Yes, get an SSD if the original drive is ailing. (DriveDX is a great little tiny utility tool for determining such, and, IIRC, free.) But I don't recommend that "noobs" attempt to put an SSD inside their computer (unless it's a model designed to be easily accessible, e.g., 2011 iMacs are not), since there's a healthy non-zero risk of damaging delicate internal bits, but rather run it as a boot device via USB with the aging original rotational drive relegated to data storage or just erased and ignored.

 

[zarmanto]

It won't be fast, but that's not the issue (context: "Safe to run OS with unsupported browser?"). I'm merely answering the OP's question from a different direction.

Conceded; this point is quite fair and reasonable. I just don't personally think it was necessary to inject quite so much vitriol against Apple into your response. How do your criticisms of Apple assist OP?

 

[zarmanto]

Oh! Also, to add one more thought for OP... (That's you, moose232, in case you weren't aware.)

In other parallel discussions both here and on other sites I frequent, it has been pointed out that in many cases another perfectly cromulent option is to ignore Apple's choice to not support your hardware... and upgrade anyway. There is a project called the OpenCore Legacy Patcher, which aims to add back in some of the hardware support that Apple has chosen to drop from their more recent OS releases, and it looks like some people swear by it.

Anyway, if Ming's performance issues do not concern you, it may be worth investigating.

 

[Minghold]

Conceded; this point is quite fair and reasonable. I just don't personally think it was necessary to inject quite so much vitriol against Apple into your response. How do your criticisms of Apple assist OP?

Like Louis Rossmann (of the popular YouTube mac-repair channel), I cheerfully let people know that Apple isn't the cuddly & helpful underdog company it was during the mid-1980s, and hasn't been for a long time. It is now a fully-evolved "evil" behemoth megacorp pursuing a deliberate scheme of tricking people into slow-bricking their older product by scaring them ("security updates"!) into "updating" to boobytrapped, privacy-invading newer versions of the OS, as well as colluding with fellow evil behemoths Microsoft, Google, and Facebook to artificially obsolesce earlier standards in a coordinated ring-around-the-rosie. (And what is the OS, anyway? It's just a GUI shell over a bunch of command-line code. So why do they need a cavernous 8gb of ram just to launch now when Snow Leopard made do with 1gb? And we haven't even opened an application yet, such as that bloated sow that Safari has become.)

In short: you cannot trust what Apple tells you anymore (and those recommending OpenCoreLegacy are essentially already aboard that assessment). Apple's primary interest is in prompting their customers into the newer operating systems designed to harvest their information more efficiently. (This "feature" is sugarcoated/sold as "cloud backup" and so forth, and seemingly ever more imperative today since the now-required APFS file system was specifically crafted to thwart popular third-party partition-archival utilities such as CarbonCopyCloner and SuperDuper, none of which are yet able to create a bootable backup volume of a Catalina or newer OS despite APFS nearing its 10yo birthday.)

People tend to forget how much more you could do with a computer of fifteen years ago. Sure, there wasn't 4K streaming video yet, but the plethora of available software and ability to customize were amazeballs. Today, Apple is pretty open about desiring to move the MacOS to a completely "closed" format, probably eventually merging it with the iOS, rendering desktop computers nothing more than glorified stationary tablets in which every software developer must genuflect at the shrine of the AppStore. (Even in 2022, I still sometimes blank-stare when somebody asks me about setting up Apple IDs, because I have never in my life ever installed anything by that means, and tend to forget that Apple clearly intends to make such the only way of acquiring software in the future.)

Given the context of "unsupported OS" (i.e., "too old", according to Apple), keeping our hackintoshes or older Macs of the late oughts and early teens humming along forever on Yosemite or High Sierra is an imperative until we're finally driven to a linux distro, or, ideally, some sort of "open MacOS" project similar to this. OpenCoreLegacy and Dosdude1's work permitting newer OSes to run on older architecture has considerable merit, but what I'd really like to see is the older OSes (or reasonable "open" facsimiles thereof) run on the newer computers as well, and tricking newer third-party software with artificially-elevated requirements into running on OSes they otherwise sniff at and decline. (Adding APFS viewability to Yosemite would also be a nice treat, so I could at least explore those partitions on my external drives.)