6 ms·

>Today, your example eight-years-obsolete install base of Android starts with version 4.2, which occupies 0.8 percent of the market. Instead of hoping that the

>Today, your example eight-years-obsolete install base of Android starts with version 4.2, which occupies 0.8 percent of the market. Instead of hoping that the 0.8% will shrink over the next 4 years, Let's Encrypt should understand that the 0.8% are the sane, reasonable people who realize that their Android devices still work fine for their intended purpose and do not have to be mindlessly upgraded because of mass-media pressure. We should work instead to expand that 0.8% to avoid ripping out the heart of the planet for pointless capitalism. This is one of the reasons why I objected to Let's Encrypt in the first place. Anyone who takes any measure to make older devices obsolete when they are still perfectly capable should be ashamed! We are in the middle of a mass extinction; we have destroyed the oceans with plastic and runoff; we have created an environmental catastrophe. Mindless media-driven consumerism must stop.

andylynch 6y ago
The issue here is not due to Let's Encrypt, it's due to these devices, like so many others, not being designed to be maintained for the long term. Solving this problem for 1/3 of Android users is going to help reduce the problem of electrical waste; even if they wear out Let's Encrypt will not be they reason why.
- cnst 6y ago
  > The issue here is not due to Let's Encrypt, it's due to these devices, like so many others, not being designed to be maintained for the long term. How so? Is www.google.com or www.bing.com doesn't work on those devices? Why are you putting the blame solely on the devices, completely ignoring the fact that Let's Encrypt is an advocacy group whose sole intention is to make non-SSL-based HTTP obsolete? Keep in mind that HTTP has no reason to ever stop working on such old devices! Noone's asking for indefinite support of old software. What we're dealing here is intentional device obsolescence, where the SSL protocol -- entirely optional if all you care about is reading text and watching pictures of cats from random anonymous sources -- is intentionally being used in such a way as to not be backwards compatible, by preemptively removing support for the earlier devices?
marcinzm 6y ago
They're not perfectly capable, they are security hole ridden messes which haven't gotten a software update of any kind in years. That's not the fault of Let's Encrypt. Shooting the messenger is generally not a winning strategy.
t0astbread 6y ago
Completely agree on the hardware part but software should really receive security updates, especially when you're dealing with other people's data as is the case on a phone. Blame the phone vendors that don't have an adequate support plan for their devices. Or the carriers that sell unsustainable phones with their plans. But Let's Encrypt is really not the one to blame here. They aren't responsible for outdated phones, they aren't responsible for expiring roots and they actually found a solution for these phones (as described in the article).
Jonnax 6y ago
Why are you going after Let's Encrypt and not the manufacturers and hardware vendors that abandoned the devices? The source code for the device drivers are not available to be able to update these phones to the latest version of Android. These devices are insecure. Using them is not sane.
- danmg 6y ago
  You're really going to scrap your car from 2015 because the off-brand android doo-hicky they stuck in it hasn't been updated? Even if you're technically inclined, it's not like installing some community provided roms image on your slightly out-of-date flagship phone. The device likely has some proprietary aspects to it which would render it useless even if you attempted.
  - Dylan16807 6y ago
    Don't scrap the car, but you shouldn't be connecting the doo-hicky to the internet any more. The manufacturer sold you a part that would break for many purposes after a few years. Be mad at them, and strongly consider replacing it.
    - danmg 6y ago
      The part didn't break. Someone who thinks they know better decided to make it not work, and complicated some normal person's life with some security theater. If a manufacture intentionally made a product they sold you not work, much like how Tesla disables fast charging capriciously, it would be a violation of the Magnuson-Moss Warranty Act.
      - cnst 6y ago
        Exactly! It's so upsetting that the narrative has been so distorted that most folk don't even understand that it's not the manufacturer that intentionally makes the device unusable, but instead the website operators, and those who support and misleadingly advise such operators. The biggest problem is that folks like Mozilla tell everyone to disable TLSv1.0, whilst themselves still supporting it; which shows the biggest case of hypocrisy there could ever be. Are you aware of any groups working against such planned device obsolescence? My latest gripe on this matter is Wikipedia -- it's beyond absurd that anonymous users can make changes to the contents of pretty much any of the millions of pages, yet getting said pages over pristine networks is conditional on TLSv1.2 support, limiting older devices from even read-only access to Wikipedia for absolutely no good reason.
gus_massa 6y ago
The main problem with old devices is the battery. I don't like changing my phone too much, so I use it until the battery only is good for a 10 minute call or a day without calls, or one of my kids drop the phone and it gets broken. So I change it probably every three years, and sometimes my wife use the new phone and I use her old phone. (She use the phone more than me.) One possibility is that the manufactures add more batteries, but it makes the phone more expensive and heavy, and it doesn't solve the accidents by the kids.
- Jach 6y ago
  To a large extent this is mitigated by having removable batteries. From what I've heard the Nexus 10 perhaps is a notable exception where the available alternate batteries aren't very good; mine needs a new battery but I don't really use it enough to justify one plus it's a somewhat more involved process than just popping it out. I'm still using a Note 3 from 2013, it's on its third battery (though the second probably could have been fine another year or more). I also recently upgraded it to Android 10 (LineageOS) -- the last supported Android OS was 5. It's a small pain to backup and restore, it's nicer to have a simple OS upgrade that preserves apps/data, but it's a viable option for many old devices. It's enough choice for me to decide between trying to limp along with outdated software (many random app crashes went away after upgrading), upgrading the OS yourself, and buying a new device.
  - Mirioron 6y ago
    I've been using a OnePlus One since release and I can still use the web for hours. No removable battery in this one, but it seems to work fine.
    - Jach 6y ago
      Yeah, batteries can go for a surprisingly long time. Still, I'll never buy a phone without the ability to replace it. Apart from the benefits of replacing old batteries that only hold a fraction of their original charge, swappable batteries means I can take a spare with me if I need to, and I can increase the size. I've got a 7500 mAh chonker in my Note 3, slightly over 2x the stock battery, and it does many hours even watching video.
2ion 6y ago
> Instead of hoping that the 0.8% will shrink over the next 4 years, Let's Encrypt should understand that the 0.8% are the sane, reasonable people who realize that their Android devices still work fine for their intended purpose and do not have to be mindlessly upgraded because of mass-media pressure. It may also be just people who don't want to throw their "smart" fridge out after only 4 years...IoT obsolescence will make this worse in the coming years.
google234123 6y ago
Shame on everyone for not sticking with their Apple 2s.

andylynch 6y ago

The issue here is not due to Let's Encrypt, it's due to these devices, like so many others, not being designed to be maintained for the long term. Solving this problem for 1/3 of Android users is going to help reduce the problem of electrical waste; even if they wear out Let's Encrypt will not be they reason why.

cnst 6y ago
> The issue here is not due to Let's Encrypt, it's due to these devices, like so many others, not being designed to be maintained for the long term. How so? Is www.google.com or www.bing.com doesn't work on those devices? Why are you putting the blame solely on the devices, completely ignoring the fact that Let's Encrypt is an advocacy group whose sole intention is to make non-SSL-based HTTP obsolete? Keep in mind that HTTP has no reason to ever stop working on such old devices! Noone's asking for indefinite support of old software. What we're dealing here is intentional device obsolescence, where the SSL protocol -- entirely optional if all you care about is reading text and watching pictures of cats from random anonymous sources -- is intentionally being used in such a way as to not be backwards compatible, by preemptively removing support for the earlier devices?

marcinzm 6y ago

They're not perfectly capable, they are security hole ridden messes which haven't gotten a software update of any kind in years. That's not the fault of Let's Encrypt. Shooting the messenger is generally not a winning strategy.

t0astbread 6y ago

Completely agree on the hardware part but software should really receive security updates, especially when you're dealing with other people's data as is the case on a phone. Blame the phone vendors that don't have an adequate support plan for their devices. Or the carriers that sell unsustainable phones with their plans. But Let's Encrypt is really not the one to blame here. They aren't responsible for outdated phones, they aren't responsible for expiring roots and they actually found a solution for these phones (as described in the article).

Jonnax 6y ago

Why are you going after Let's Encrypt and not the manufacturers and hardware vendors that abandoned the devices? The source code for the device drivers are not available to be able to update these phones to the latest version of Android. These devices are insecure. Using them is not sane.

danmg 6y ago
You're really going to scrap your car from 2015 because the off-brand android doo-hicky they stuck in it hasn't been updated? Even if you're technically inclined, it's not like installing some community provided roms image on your slightly out-of-date flagship phone. The device likely has some proprietary aspects to it which would render it useless even if you attempted.
- Dylan16807 6y ago
  Don't scrap the car, but you shouldn't be connecting the doo-hicky to the internet any more. The manufacturer sold you a part that would break for many purposes after a few years. Be mad at them, and strongly consider replacing it.
  - danmg 6y ago
    The part didn't break. Someone who thinks they know better decided to make it not work, and complicated some normal person's life with some security theater. If a manufacture intentionally made a product they sold you not work, much like how Tesla disables fast charging capriciously, it would be a violation of the Magnuson-Moss Warranty Act.
    - cnst 6y ago
      Exactly! It's so upsetting that the narrative has been so distorted that most folk don't even understand that it's not the manufacturer that intentionally makes the device unusable, but instead the website operators, and those who support and misleadingly advise such operators. The biggest problem is that folks like Mozilla tell everyone to disable TLSv1.0, whilst themselves still supporting it; which shows the biggest case of hypocrisy there could ever be. Are you aware of any groups working against such planned device obsolescence? My latest gripe on this matter is Wikipedia -- it's beyond absurd that anonymous users can make changes to the contents of pretty much any of the millions of pages, yet getting said pages over pristine networks is conditional on TLSv1.2 support, limiting older devices from even read-only access to Wikipedia for absolutely no good reason.

gus_massa 6y ago

The main problem with old devices is the battery. I don't like changing my phone too much, so I use it until the battery only is good for a 10 minute call or a day without calls, or one of my kids drop the phone and it gets broken. So I change it probably every three years, and sometimes my wife use the new phone and I use her old phone. (She use the phone more than me.) One possibility is that the manufactures add more batteries, but it makes the phone more expensive and heavy, and it doesn't solve the accidents by the kids.

Jach 6y ago
To a large extent this is mitigated by having removable batteries. From what I've heard the Nexus 10 perhaps is a notable exception where the available alternate batteries aren't very good; mine needs a new battery but I don't really use it enough to justify one plus it's a somewhat more involved process than just popping it out. I'm still using a Note 3 from 2013, it's on its third battery (though the second probably could have been fine another year or more). I also recently upgraded it to Android 10 (LineageOS) -- the last supported Android OS was 5. It's a small pain to backup and restore, it's nicer to have a simple OS upgrade that preserves apps/data, but it's a viable option for many old devices. It's enough choice for me to decide between trying to limp along with outdated software (many random app crashes went away after upgrading), upgrading the OS yourself, and buying a new device.
- Mirioron 6y ago
  I've been using a OnePlus One since release and I can still use the web for hours. No removable battery in this one, but it seems to work fine.
  - Jach 6y ago
    Yeah, batteries can go for a surprisingly long time. Still, I'll never buy a phone without the ability to replace it. Apart from the benefits of replacing old batteries that only hold a fraction of their original charge, swappable batteries means I can take a spare with me if I need to, and I can increase the size. I've got a 7500 mAh chonker in my Note 3, slightly over 2x the stock battery, and it does many hours even watching video.

2ion 6y ago

> Instead of hoping that the 0.8% will shrink over the next 4 years, Let's Encrypt should understand that the 0.8% are the sane, reasonable people who realize that their Android devices still work fine for their intended purpose and do not have to be mindlessly upgraded because of mass-media pressure. It may also be just people who don't want to throw their "smart" fridge out after only 4 years...IoT obsolescence will make this worse in the coming years.

google234123 6y ago

Shame on everyone for not sticking with their Apple 2s.