People don’t update machines because updates break what they were doing with those machines. It always happens: you think you’re smart and pro active updating some stuff, thinking it won’t change anything. And then you can’t work. Something isn’t right. Security patches deleted some cached stuff, set a variable to 0 instead of 1 and now the software you were using refuses to work or is unstable for some obscure, complex and code-based reasons.
A lot of places like hospitals don’t have the margin for that kind of bullshit, thus they don’t update. If things work, don’t fucking update, don’t change nothing. That’s not negligence, that’s common sense at this point.
The biggest thing in this ransom story is that yes, computers as they were running in 2000 are enough and do a great job almost twenty years later. No, we do not need the last version of Windows, the very last hardware. It’s not fucking fashion, these are computers. They’re used to do some stuff and that’s it.
Maybe we should leave a lot of (most) computers offline, like we used to.