teceem: Sure sure, but most exploiting of exploits needs user interaction (like phishing emails). Otherwise, any and all current system still running XP that is internet connected would be part of a botnet or be infested with some form of malware. And that's simply not the case.
I'm not saying you're wrong, but you paint an overly dramatic picture.
Yeah, but isn't that a bit tangential?
Sure you can run a system full of big gaping holes and millions of viruses targetting it if you just take security seriously and prevent those things from reaching the system in the first place.
Unfortunately some of the largest botnets of recent years (ranging from hundreds of thousands to millions of infected devices) came to be due to vulnerable routers & IoT devices. No, you don't need to run an email client on that IoT lamp and open fishy.pdf.exe to get it infected. See e.g. [url=https://en.wikipedia.org/wiki/Mirai_(malware]https://en.wikipedia.org/wiki/Mirai_(malware[/url])
And if you rely on NAT to keep outdated PCs safe from the big bad internet, too bad, those infected devices could be used to launch an attack against wide open devices on the local network.
Also, if you've been on the internet long enough, you might've seen drive-by downloads. All it takes is an outdated browser + a malicious ad. These are pretty common since, unfortunately, "legit" ad networks have created a problem for themselves by allowing complicated javascript/flash/etc ads and they can't properly screen all the ads they distribute for malware, so bad shit slips through. And then you have all those "legit" blogs, forums, etc. that unfortunately happen to get pwned and someone slips a malicious ad or just straight up malware on them. In a similar manner, sites distributing patches, fixes, mods, cracks, etc. can easily turn into trojan & virus distribution networks and some viruses are damn good at infecting everything including things like USB flash drives. See e.g. Ramnit which infected more than three million PCs...
https://www.symantec.com/security-center/writeup/2010-011922-2056-99 I'm just saying that "legacy operating system is not prone to viruses because it's not popular enough among malware authors" is a complete BS theory if we're talking about a popular OS that has a history of being targeted by malware and still has millions of PCs running it.
And yet, yes, of course one can take the most vulnerable piece of software and take care not to let it get in touch with malware. Pretty risky though, if you're planning to use it for daily activities such as having it internet-connected, browsing the web, and downloading crap to run on it.
