Re: [arch-d] How old is too old and what this means for product lifecycles? Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[Randy Bush <[e-mail]>]

[ where are we going and why am i in this handbasket? ]

< rant >

when you have a plant which can turn out a jillion new thingies with a
day of set-up, the costs of the infrastructure to securely maintain and
upgrade them in the field for three, let alone 20, years is astronomical
in comparison.  now multiply that by a new and different thingie being
manufactured next month.  now multiply that by a few hundred
manufacturers.

perhaps the only way to understand in one's gut the scale of this
problem is to spend a few weeks in shenzhen.

to improve the math one would have to amortize the cost of maintenance
over many many flavors and makers of thingies.  so the acme thingie mfr,
and the hackme thingie mfr, and the ... need to have a common code base
and upgrade infrastructure.  this is seen as stifling innovation in a
highly innovative and competitive space.

the time from first pitch to vc term sheet and funding has gone down to
two weeks.  and the resulting landfill rivals the problem of plastics in
the oceans.

android is the only example i can think of with a multi-manufacturer
upgrade and maintenance infrastructure; and it is notoriously horrid.
researchers publish papers on how bad it is.  but credit to android for
trying.  long way to go.

alternatively, one could be in a regulated environment, e.g. military,
medical, etc., where multiplying the cost of the thingie by orders of
magnitude is seen as worth the social benefit.  but, even in these
environments, do not underestimate the attack surface due to sloppy ops.

we, for some value of we, are used building a reliable network from
unreliable components.  distributed protocols are the key.  that is a
different universe from a reliable and long-term maintainable thingie.
and maybe we don't want to use our favorite vendors' boat anchors as
examples.

randy, who still has a curta and a k&e log log duplex decitrig