Hacker News Reader

Comment by tinus_hn | Hacker News Reader

So does this mean anything for clients worth supporting? I don’t care if some museum piece like an iPhone 4 no longer works.

View on HN

If you're targeting general consumers (ie, not the HN crowd or only people who upgrade their phones every year to two), there's still double digit percentage of Android devices in the wild running older than version 8 Android.

https://gs.statcounter.com/android-version-market-share/mobi...

Some of the inexpensive phones you can buy new right now (where I am) come with Android 7.

The brand new Garmin GPS I purchased in June is running Android 6. Completely absurd. Granted, it does its job of navigating fine, but it still has wifi connectivity.

At least, one can hope, that whatever ssl certs it relies on to do the job you bought it for - are under control of Garmin who can pay for non LetsEncrypt certs with Root CA trust chains that will work with their devices. How much non-map based access to Android does it expose? It'd suck if it loses Google Traffic API connectivity, for example.

It doesn't directly expose anything more or less, every app you have access to by default is Garmin controlled (except perhaps iOverlander). There's no play store or services, as far as I can tell. You can sideload whatever you want though.

Honestly as a society we should not be putting any effort into supporting manufacturers who are producing hardware that are immediately e-waste.

Right to repair needs to cover this issue. Either keep devices in your ecosystem up to date, or open it up for third party support.

I know this ship has sailed but I think building on a trust system that by design has an expiration and no built-in method for rotating certs date would go a long way in helping the e-waste problem.

> Honestly as a society we should not be putting any effort into supporting manufacturers who are producing hardware that are immediately e-waste.

I am staring right now at two mobile dev test devices I have on my desk, a Samsung Galaxy S6 and an iPhone 6. iPhone is running iOS 15 released this week. Galaxy is stuck on Android 7 because Samsung don't bother providing updates to devices beyond 2 years.

It's no coincidence that my latest personal phone purchase was from Apple.

(Well, that's not _quite_ true. I have a PinePhone on the way. But I'm expecting everything I deserve for buying a beta version of a Linux phone from a niche manufacturer with _that_ one...)

I have a Samsung Galaxy J1 (2016) that runs Android 5 and was (I later realised) already out of manufacturer support when I bought it new at retail in April 2018. That’s insane.

It’s as if Samsung was selling dishwashers and Apple was selling entry into an ecosystem.

Glad that this behavior from Sams is changing. I have S10, that were on Android 9, now it's updated to 11. I guess there will be no major releases, but I still will and do get now security updates for a few years. At least there is now predictable pattern on device support.

(iPhone 6s). The latest release for the iPhone 6 is iOS 12 due to having lower RAM (1GB vs 2GB).

Also didn't see it mentioned in your comment, but both were released in the same year (2015). Additionally, although the iPhone 5s (2013) and 6 (2014) are stuck on iOS 12, they're still getting security updates! [0] That's 8 years of support so far.

I'm still using a 6s, but planning on upgrading in the next few months. It's nice to have the option to keep using the phone though without losing support.

[0] https://support.apple.com/en-us/HT212548

> Either keep devices in your ecosystem up to date, or open it up for third party support. Infinite support for old devices is not viable so you are just trying to force open source.

My "museum piece" (Galaxy Note4) still works and I want to keep it that way. Why should I throw away perfectly good hardware?

It is rooted, so I can fix the problem, but still, I find the idea that smartphones should only last 3 or so years when their hardware is good for 10 to be... annoying. Especially considering that modern smartphones tend to be more expensive, without a removable battery or headphone jack, and not fundamentally better than smartphones from 5 years ago. And the custom ROM community that kept old phones running is not what it used to be, especially considering that more and more apps refuse to run if you are not running the official (outdated) ROM. Planned obsolescence replaced real obsolescence.

If you care mostly about web browsers or equivalent technology, because you make an actual web site, for visiting with web browsers, probably no, everything is fine, anybody who would be broken by this is probably already annoyed for something else your modern site does.

If your only TLS clients are under your control (e.g. you own an app, the app uses HTTPS or some other TLS protocol to talk to your servers) then you should be able to easily work out if there's any problem [edited to add: Hint, use a tool to wind their clock forward past the deadline by a day or so and see what happens] and decide whether and how to mitigate such problems.

But, if you allow third parties (customers, suppliers, or worst of all, the General Public) to use some protocol (whether that's a RESTful HTTPS server or some custom text protocol from the 1980s) over TLS, you are potentially in for a lot of trouble when DST Root CA X3 expires and you should be on top of that by now.

* If you need everybody and their dog to connect using rusty garbage from last century, too bad, figure out which certificates you need to pay $$$ for to make that happen and authorise the purchases today. In this case though I'm astonished Let's Encrypt has ever worked for you. DST Root X3 was widely accepted, but it was hardly the most popular.

* If you can live with some clients dropping away e.g. because it's a free service anyway, or your SLA or other Ts&Cs say that you use Let's Encrypt and so it's actually in some sense "their problem" when this breaks, or you just hate money and love being sued, you can do nothing.

* Otherwise you really need to figure out what fraction of your users will blow up. You should be capturing User Agent info (if HTTPS) and metrics on the types of cipher suite used and other fingerprints that can help you figure out what's connecting and thus what to expect. You need to be contacting "at risk" customers if possible to warn them what's about to happen and point them to resources for what they should do:

1. Software upgrades. Archaic OpenSSL is the biggest problem, if they can go to a much new OpenSSL it's much less likely they're suffering.

2. Trust store updates. By now, just telling them to rip out the (expiring) DST Root CA X3 cert if they have it might be easier than trying to figure out whether it's safe to leave it. But keep it or leave it, they need to make sure they trust ISRG Root X1.

I'm concerned that my smart tv might start to fail, or that older embedded devices that use http like my irrigation controller that gathers weather data from the internet might run into problems.

Reply on news.ycombinator.com