Re: [Iotops] How old is too old and what this means for product lifecycles? Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[Ted Lemon <[e-mail]>]

On Dec 5, 2020, at 1:27 PM, Randy Bush <[e-mail]> wrote:
> and open source is notoriously secure, inspected, formally verified, and
> well updated.  can you spell "m i r a i?"  how many kernel upgrades have
> you had to do over the last month; and what percentage of ops did them?

I think you misunderstand. I’m not saying there’s not a problem. I’m saying that solving it maybe isn’t quite as hard as you’re suggesting. Most of these products, the manufacturer has already moved on after a year. They have no interest in maintaining the software, but they can dump it on github. They don’t because they don’t have to, not because they strongly care not to. If you bought a thousand units, it’s probably worth hiring someone to update it to TLS 1.3.

Getting Cisco to dump IOS on github is probably a bigger ask, but if the enterprise that’s buying the equipment is required for regulatory compliance to subscribe to updates, that creates a cash flow that can then be used to pay to do them. If the regulatory environment similarly requires that Cisco either do the updates, or allow someone to do them, then that problem is solved too.

Yes, this costs more than disposable technology, iff you don’t count the externalized costs.