My friend is running CentOS 3.8 and i told him to update to 4.4 and he said he doesnt need to and that there is no security issues. Is this true? What so bad about running 3.8?

3.8 is still being supported and updated and if works why change it? Also FYI Centos 5.0 is out now as well

RHEL3 / CentOS3 is great / as long as it's kept up to date no problem using it

The biggest problem is that there is no upgrade path to Centos 5 from 3.8, so one day, when it stops being supported (and that day is getting closer), then he may have some difficulties.

Upgrading to 4.4 is well documented, and from there he could upgrade to 5 quite easily.

That's the only reason I can think of though, otherwise it works and there's no reason to break that.