[BoxOfRain]

I've not used Windows in a very long time so forgive my ignorance, but I always heard that it was a bad idea to connect an XP machine to the internet because of the amount of malware sloshing about. In practice is that much of a problem for modern-day XP enthusiasts?

[ROllerozxa]

The kind of passive infection that is shown in popular videos like this one (https://www.youtube.com/watch?v=6uSVVCmOH5w) tend to only happen if you hook up an XP machine to be directly accessible to the Internet. Like, if you connect your XP machine to your router sitting in the middle of your Internet connection and don't forward every port, you should be fine in that regard at least.

There is also Supermium which is a relatively recent version of Chromium backported to run on Windows XP with all the security patches that brings, but with that being said I still would not do anything security critical on it.

[ndiddy]

Yeah it was more of a problem back in the day when dial-up and DSL were more common, and home users would often have their computers directly connected to the internet if they didn't have multiple computers and a router. This was especially problematic before XP SP2 came out with the firewall enabled by default.

[zamadatix]

There were 2 separate risks bundled into this folklore.

One was it was common enough of to have a home internet setup without any inbound filtering external to the PC. That'd be nearly unheard of nowadays as nearly everyone has a router configured to perform as stateful firewall (the out of the box config of a home router, this system being the same underlying system that builds the session table for masquerade NAT). So you can have your XP machine sit there until the cows come home, nothing external is going to scan it anymore.

The other is just general "having internet access means malware can upload your information and download more malware". In practice for hacking with XP these days, that's "do you trust whatever you're copying over to mess with" and not an issue.

The only combination I'd caution against is "using XP as a daily driver for internet browsing" as there are unpatched security bugs in XP malware can target which don't require you to click anything, even in the somewhat more modern browser offerings. Even then, it's still just a matter of "how much do you care if this machine & the data on it get hacked" vs "how much do you want to do it that way" just like any other security question. There is no such thing as a universally agreed line on how much constitutes a bad risk in security.