Re: [Iotops] [arch-d] How old is too old and what this means for product lifecycles? Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[Michael Richardson <[e-mail]>]

Henning Schulzrinne <[e-mail]> wrote:
    > It used to be that vendors announced end-of-life for products years after
    > introduction. For example, there was no way for a purchaser of Windows NT
    > to know, at purchase time, how long Microsoft was intending to support the
    > operating system. Now, better vendors seem to have started to make some
    > commitments, e.g., "this Android phone will receive new versions of the OS
    > for three releases and security updates until 2025". All the major Linux
    > distributions now have some kind of an LTS version, with long-term
    > stability and security/bug upgrades planned. There have been proposals (in
    > the UK?) of making vendors of IoT equipment state their support commitment,
    > so that a purchaser can choose "cheap" or "lasts a lifetime".

yes, that's in the upcoming legislation.
This document hints at it:
     https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/773867/Code_of_Practice_for_Consumer_IoT_Security_October_2018.pdf

This was a call for views that ended in September:
  https://www.gov.uk/government/publications/proposals-for-regulating-consumer-smart-product-cyber-security-call-for-views/proposals-for-regulating-consumer-smart-product-cyber-security-call-for-views

  Box 4 - Requirement 3 - Provide transparency on for how long, at a minimum,
  the product will receive security updates

  Exact wording and approach to be finalised

  The ‘defined support period’ for the relevant ‘product’ shall be published
  in an ‘accessible way’ that is ‘clear and transparent’.

  This clause aligns with provision 5.3-13 of European Telecommunications
  Standards Institute (ETSI) European Standard (EN) 303 645 v2.1.1.

    > One reason for not upgrading: OS dependencies. Apple Big Sur (and Catalina)
    > broke a lot of printer drivers, so I had a choice: Upgrade my OS or keep my
    > printer working. Dell, the distributor of the printers (made by Fuji-Xerox,
    > apparently) simply states that "due to circumstances beyond their control",
    > they won't be providing any Catalina/Big Sur printer drivers.

My mom's computer is just "too old", yet it is perfectly functional.

    > Given that most commercial systems are now assembled out of open-source
    > components, with customization or glue on top, you'd want some kind of
    > automated component checker. "17 of your components have not committed to
    > long-term support. Are you prepared to fix them yourselves?"

Some kind of expert system perhaps.
Who'd pay to maintain this?  And would it, itself, go out of support?

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide