Solaris

First, not having something "connected" to the Internet is no excuse for running obsolete code (at least to me, maybe to you it is). In my many decades of cybersecurity work, I have never seen the (bad) cybersecurity policy ... " if the host is not connected to the Interest, feel free to never upgrade obsolete code and feel free to call it 'beating a dead horse' if anyone suggests you upgrade".

FWIW, I have servers not connected to the Internet, but I keep them upgraded. Maybe I forgot to read this "it's a dead horse if not connected to the Internet policy"... LOL

So, in my view it is not a "dead horse" to encourage people to secure their systems, upgrade obsolete servers, and not run obsolete code; especially when it is trivia (and basically free) to replace.

You are free to disagree, of course; but I am free to disagree back (and I will push back).

In fact, if you run 17 year old server code and call up any company for support, the first thing they will tell you is "we do not support that version, so please upgrade and call us back when you do".

It's really basic, everyone should run servers and apps with the latest code and if you have an NTP server which is buggy, the first think you should do it upgrade it, not the last.

Also, we at unix.com should be encouraging people to run the latest version of all software and to insure the code they are running is a free of defects as possible.

Feel free to disagree, of course; but don't expect me to agree with this "it's beating a dead horse to encourage people to update buggy 17 year old code" worldview But of course, you are free to reply with any and all technical approaches you want. It's always good to have many different ideas and approaches.

Additional Info:

The security issues raised when running obsolete security is basically irrelevant to "connected to the Internet or not" as MIG and the OP have mentioned. IT security is defined (in brief) as (1) confidentiality, (2) integrity and (3) availability. You do not need a "hacker from the dark web" to have an IT security issue. Running obsolete software which is known to be buggy is a larger cause of availability issues than "hackers from the web". In fact, in my many years as a leading expert in cybersecurity, the biggest security breeches mostly / always come from "insiders" (not outside hackers). In my view, running 17 year old, known to be buggy software, is a much larger security breech by "insiders" (who permit and encourage this kind of bad configuration management) than worrying about "hackers from the scary Internet".