Re: [Iotops] How old is too old and what this means for product lifecycles? Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[Amyas Phillips <[e-mail]>]

> On 5 Dec 2020, at 18:10, Randy Bush <[e-mail]> wrote:
> 
> to improve the math one would have to amortize the cost of maintenance
> over many many flavors and makers of thingies.  so the acme thingie mfr,
> and the hackme thingie mfr, and the ... need to have a common code base
> and upgrade infrastructure.  


Exactly right, it’s hard to imagine any other economically viable way of maintaining devices which aren’t sold with a service contract. Even for devices which are sold with a service contract, this is still a cheaper and likely better way of delivering the security maintenance part of that service. 

There’s a few commercial products which do this. They essentially offer modules with an OS and application environment which they maintain for you, to a more or less hands-off degree: msoft Sphere, Balena, Particle, Electric Imp, Ubuntu Core. They don’t maintain your application but that may well be a relatively small part of the attack surface, and possibly defended by features of the maintained environment. 

Microsoft Sphere in particular is interesting because the maintenance is completely hands off and the costs are folded into the initial BOM cost of the module, there’s no service fee.

Amyas