3 ms·

They can and they do. Mozilla uses NSS, Chrome their own OpenSSL fork (BoringSSL). This only really affects IE and other applications which don't have to be act

• caf 11y ago
  Couldn't you use a your-own-CA-signed cert and update the OS's trust list to include your CA?
  • pilif 11y ago
    Yes. That would also be an option. We'll see what works best (read: with the least amount of work. We're not selling these devices any more, so effort spent in supporting them is basically wasted)
    • ptaipale 11y ago
      I wouldn't call product support "wasted" effort. It's the responsible thing to do, and if you don't do it, you deserve to go down the drain.
      • pilif 11y ago
        No need to guilt-trip me. Of course we're going to make sure the scanners keep working (as I said in my previous comment). However, it's also clear that we'll have to take the route that requires the least amount of effort for the fix as any time spent on these old scanners is time we can't spend on the current android based scanners that provide a vastly superior user experience.
        • ptaipale 11y ago
          I don't mean to guilt-trip you. I merely think that maintenance of provided solutions is what a responsible company should do. So in this case, personally, I think what you do is not wasted effort. It's not wasted effort because (I hope that) customers will remember whether the provided solution broke down and vendor just walked away, or whether your company took responsibility of architectural decisions.
          • pilif 11y ago
            > It's not wasted effort because (I hope that) customers will remember whether the provided solution broke down and vendor just walked away, or whether your company took responsibility of architectural decisions. sure. But at some point you have to make a cut off. Customers can't expect a solution they bought once to work for all eternity. Otherwise we'd all still be supporting IE5 on Windows 98 these days. At some point, the time invested in keeping the old stuff running cuts too much into the time available to move the current stuff forward. If all you do is spending time to patch up the old solution, you open yourself to be overtaken by competitors that either don't care about their old infrastructure, or by competitors that just entered the market without any prior customers to care about. So really, keeping old stuff working (for some reasonable amount of time) is the ethical thing to do and certainly goes a long way to keep customers happy, at some point, you have to move forward or you will not be able to gain new customers, or worse, your old customers jump to a competitor that has the new, shiny thing and you end up maintaining a dwindling amount of legacy installations forever until you go out of business. This is why I think spending time on maintaining outdated, 10 year old solutions is wasting time compared to maintaining the new and greatly improved thing. Again: Despite these scanners being 10 years old now, we will do the effort required, but I still will try to do it the easiest way possible as every minute spent on this is a minute not spent on improving the non-outdated solution.
• userbinator 11y ago
  One solution is to use a proxy. I run a filtering proxy, and force all HTTP and HTTPS traffic through it. It can be upgraded easily since it uses the standard OpenSSL DLLs. Courtesy of that, this comment has been posted to HN with TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, from a client that only supports TLS 1.0 and nothing beyond RC4-MD5. (It's actually configured to ask for ECDHE-RSA-AES256-GCM-SHA384 first, which is probably overkill, so I don't see many servers that choose it.)
  • pilif 11y ago
    That's another very good idea I'm going to look into, though I'm a bit weary of dealing with writing and/or finding and compiling a proxy server for a version of Windows CE that's now 4 years out of support.