4 ms·

So does this mean anything for clients worth supporting? I don’t care if some museum piece like an iPhone 4 no longer works.

mixologic 5y ago
I'm concerned that my smart tv might start to fail, or that older embedded devices that use http like my irrigation controller that gathers weather data from the internet might run into problems.
tialaramex 5y ago
If you care mostly about web browsers or equivalent technology, because you make an actual web site, for visiting with web browsers, probably no, everything is fine, anybody who would be broken by this is probably already annoyed for something else your modern site does. If your only TLS clients are under your control (e.g. you own an app, the app uses HTTPS or some other TLS protocol to talk to your servers) then you should be able to easily work out if there's any problem [edited to add: Hint, use a tool to wind their clock forward past the deadline by a day or so and see what happens] and decide whether and how to mitigate such problems. But, if you allow third parties (customers, suppliers, or worst of all, the General Public) to use some protocol (whether that's a RESTful HTTPS server or some custom text protocol from the 1980s) over TLS, you are potentially in for a lot of trouble when DST Root CA X3 expires and you should be on top of that by now. * If you need everybody and their dog to connect using rusty garbage from last century, too bad, figure out which certificates you need to pay $$$ for to make that happen and authorise the purchases today. In this case though I'm astonished Let's Encrypt has ever worked for you. DST Root X3 was widely accepted, but it was hardly the most popular. * If you can live with some clients dropping away e.g. because it's a free service anyway, or your SLA or other Ts&Cs say that you use Let's Encrypt and so it's actually in some sense "their problem" when this breaks, or you just hate money and love being sued, you can do nothing. * Otherwise you really need to figure out what fraction of your users will blow up. You should be capturing User Agent info (if HTTPS) and metrics on the types of cipher suite used and other fingerprints that can help you figure out what's connecting and thus what to expect. You need to be contacting "at risk" customers if possible to warn them what's about to happen and point them to resources for what they should do: 1. Software upgrades. Archaic OpenSSL is the biggest problem, if they can go to a much new OpenSSL it's much less likely they're suffering. 2. Trust store updates. By now, just telling them to rip out the (expiring) DST Root CA X3 cert if they have it might be easier than trying to figure out whether it's safe to leave it. But keep it or leave it, they need to make sure they trust ISRG Root X1.
bigiain 5y ago
If you're targeting general consumers (ie, not the HN crowd or only people who upgrade their phones every year to two), there's still double digit percentage of Android devices in the wild running older than version 8 Android. https://gs.statcounter.com/android-version-market-share/mobile-tablet/worldwide https://gs.statcounter.com/android-version-market-share/mobi... Some of the inexpensive phones you can buy new right now (where I am) come with Android 7.
- xxpor 5y ago
  The brand new Garmin GPS I purchased in June is running Android 6. Completely absurd. Granted, it does its job of navigating fine, but it still has wifi connectivity.
  - bigiain 5y ago
    At least, one can hope, that whatever ssl certs it relies on to do the job you bought it for - are under control of Garmin who can pay for non LetsEncrypt certs with Root CA trust chains that will work with their devices. How much non-map based access to Android does it expose? It'd suck if it loses Google Traffic API connectivity, for example.
    - xxpor 5y ago
      It doesn't directly expose anything more or less, every app you have access to by default is Garmin controlled (except perhaps iOverlander). There's no play store or services, as far as I can tell. You can sideload whatever you want though.
- initplus 5y ago
  Honestly as a society we should not be putting any effort into supporting manufacturers who are producing hardware that are immediately e-waste. Right to repair needs to cover this issue. Either keep devices in your ecosystem up to date, or open it up for third party support.
  - 5y ago
GuB-42 5y ago
My "museum piece" (Galaxy Note4) still works and I want to keep it that way. Why should I throw away perfectly good hardware? It is rooted, so I can fix the problem, but still, I find the idea that smartphones should only last 3 or so years when their hardware is good for 10 to be... annoying. Especially considering that modern smartphones tend to be more expensive, without a removable battery or headphone jack, and not fundamentally better than smartphones from 5 years ago. And the custom ROM community that kept old phones running is not what it used to be, especially considering that more and more apps refuse to run if you are not running the official (outdated) ROM. Planned obsolescence replaced real obsolescence.

mixologic 5y ago

I'm concerned that my smart tv might start to fail, or that older embedded devices that use http like my irrigation controller that gathers weather data from the internet might run into problems.

tialaramex 5y ago

If you care mostly about web browsers or equivalent technology, because you make an actual web site, for visiting with web browsers, probably no, everything is fine, anybody who would be broken by this is probably already annoyed for something else your modern site does. If your only TLS clients are under your control (e.g. you own an app, the app uses HTTPS or some other TLS protocol to talk to your servers) then you should be able to easily work out if there's any problem [edited to add: Hint, use a tool to wind their clock forward past the deadline by a day or so and see what happens] and decide whether and how to mitigate such problems. But, if you allow third parties (customers, suppliers, or worst of all, the General Public) to use some protocol (whether that's a RESTful HTTPS server or some custom text protocol from the 1980s) over TLS, you are potentially in for a lot of trouble when DST Root CA X3 expires and you should be on top of that by now. * If you need everybody and their dog to connect using rusty garbage from last century, too bad, figure out which certificates you need to pay $$$ for to make that happen and authorise the purchases today. In this case though I'm astonished Let's Encrypt has ever worked for you. DST Root X3 was widely accepted, but it was hardly the most popular. * If you can live with some clients dropping away e.g. because it's a free service anyway, or your SLA or other Ts&Cs say that you use Let's Encrypt and so it's actually in some sense "their problem" when this breaks, or you just hate money and love being sued, you can do nothing. * Otherwise you really need to figure out what fraction of your users will blow up. You should be capturing User Agent info (if HTTPS) and metrics on the types of cipher suite used and other fingerprints that can help you figure out what's connecting and thus what to expect. You need to be contacting "at risk" customers if possible to warn them what's about to happen and point them to resources for what they should do: 1. Software upgrades. Archaic OpenSSL is the biggest problem, if they can go to a much new OpenSSL it's much less likely they're suffering. 2. Trust store updates. By now, just telling them to rip out the (expiring) DST Root CA X3 cert if they have it might be easier than trying to figure out whether it's safe to leave it. But keep it or leave it, they need to make sure they trust ISRG Root X1.

bigiain 5y ago

If you're targeting general consumers (ie, not the HN crowd or only people who upgrade their phones every year to two), there's still double digit percentage of Android devices in the wild running older than version 8 Android. https://gs.statcounter.com/android-version-market-share/mobile-tablet/worldwide https://gs.statcounter.com/android-version-market-share/mobi... Some of the inexpensive phones you can buy new right now (where I am) come with Android 7.

xxpor 5y ago
The brand new Garmin GPS I purchased in June is running Android 6. Completely absurd. Granted, it does its job of navigating fine, but it still has wifi connectivity.
- bigiain 5y ago
  At least, one can hope, that whatever ssl certs it relies on to do the job you bought it for - are under control of Garmin who can pay for non LetsEncrypt certs with Root CA trust chains that will work with their devices. How much non-map based access to Android does it expose? It'd suck if it loses Google Traffic API connectivity, for example.
  - xxpor 5y ago
    It doesn't directly expose anything more or less, every app you have access to by default is Garmin controlled (except perhaps iOverlander). There's no play store or services, as far as I can tell. You can sideload whatever you want though.
initplus 5y ago
Honestly as a society we should not be putting any effort into supporting manufacturers who are producing hardware that are immediately e-waste. Right to repair needs to cover this issue. Either keep devices in your ecosystem up to date, or open it up for third party support.
- 5y ago

GuB-42 5y ago

My "museum piece" (Galaxy Note4) still works and I want to keep it that way. Why should I throw away perfectly good hardware? It is rooted, so I can fix the problem, but still, I find the idea that smartphones should only last 3 or so years when their hardware is good for 10 to be... annoying. Especially considering that modern smartphones tend to be more expensive, without a removable battery or headphone jack, and not fundamentally better than smartphones from 5 years ago. And the custom ROM community that kept old phones running is not what it used to be, especially considering that more and more apps refuse to run if you are not running the official (outdated) ROM. Planned obsolescence replaced real obsolescence.