4 ms·

It wasn't that many months ago that I had a conversation with a customer that if they wanted to continue to use email (outside the browser) then the best option

by belorn 4y ago

It wasn't that many months ago that I had a conversation with a customer that if they wanted to continue to use email (outside the browser) then the best option was to buy a new mac because their current mac version don't support the new certificates required for modern tls and in order to get a new macos version they need to buy a new device. If I remember right their mac-thing was around 5 years old?

a2tech 4y ago
They may have bought it 5 years ago, but it wasn't 5 years old. Also for future reference you can update the certs on older OS X versions to get a few more years out of a system for someone thats happy with it: https://apple.stackexchange.com/questions/422332/how-do-i-update-my-root-certificates-on-an-older-version-of-mac-os-e-g-el-capi https://apple.stackexchange.com/questions/422332/how-do-i-up...
- belorn 4y ago
  An interesting hack. We went with a different hack to accomplish a working solution, but good to know there is alternatives. The idea in the link is that one transfer the System Root certificates from another (more modern) Mac to which the customer should already own. In theory I guess we as a email provider could continuously buy the latest version of mac and use that as the transfer host (hopefully do not transferring any account specific certificates). It must work without any corner cases (not overwriting anything on the customer end), the script need to work in future macos versions, and the assumption is that the first group of certificates is the relevant ones, and that it doesn't break anything on the customer end. For those who has not read the link, this do not update the System Roots keychain since users are not allowed to do that in macos. Instead this adds a trustRoot certificate. A nice trick. One of the comments say that it didn't fix the problem for them but who know what their situation was.
- nucleardog 4y ago
  Yep. My wife's still running a MBP from 2012 that I think finally got its last update to Big Sur (released 2020) without issue. Looking at the compatibility charts, everything from 2015 on-ward supports Monterey (2021, the latest version). The last laptop that couldn't update past El Capitan was 2009. As far as Macbooks (non-pro), last one stuck on El Capitan is the 2009 model as well. And it's not even that Apple broke anything on the 13 year old laptop, it's just that the rest of the world moved on and they're no longer fixing it.
rajamaka 4y ago
Weird, my MBP from 2015 runs fine. Don't think I have ever updated the OS either.
hagbarddenstore 4y ago
My old Macbook is 9 years old. It has no issues what so ever with browsing the web. The customer must be running some truly ancient version of Mac OS for this story to be true.
- belorn 4y ago
  email is not the same as the web. HTTPS seem a bit more permissible than smtp/imap. That said I know that some banking sites do reject old version of browsers on the basis of security. Some providers (email and others) can also continue to support deprecated/broken security for a very long time in order to not having to deal with customers using old deprecated software. 512 bits RSA public keys for example was used a very long time, long past where different standards and recommendation had a much higher minimum. Algorithm and key attacks are quite rare so companies can keep a low security standard for many years/decades before anyone exploits it. For customers that could be seen as a positive or a negative depending on perspective.
lotsofpulp 4y ago
My 2015 MacBook Air just got the newest MacOS update.
- lotsofpulp 4y ago
  Edit: I was wrong, macos 12 was the last one for 2015 Airs. Not bad though. It will still get Safari and security updates though.
bookofjoe 4y ago
I use my 2012 MacBook Pro and 2022 MacBook Pro interchangeably to publish my blog etc. with zero problems.
null_object 4y ago
> If I remember right their mac-thing was around 5 years old? My 2015 MacBook still runs absolutely fine. For that matter, I'm considering (but probably not) buying a new iPad to replace my TEN YEAR OLD iPad that I'm still using every single day, as it can no longer update to the latest iPad OS. But my 7 year old (soon 8 years old) laptop is as good as the first day I bought it.
maratc 4y ago
My 2010 Macbook still works fine after I've updated the expired X3 certificate [0]. [0]: https://macresearch.org/dst-root-ca-x3-expired-mac/ https://macresearch.org/dst-root-ca-x3-expired-mac/
mikestew 4y ago
My 2012 MBP that I'm using to write this piped up to disagree. It retrieves mail from a variety of sources every day, including work email, and there is never a problem. All using the stock Mail app that comes with the OS. So I'm guessing some details are being mis-remembered by the 2nd-hand information supplied by a person who doesn't sound technically-inclined enough to have gotten the story right in the first place. IOW, if one is going to supply anecdotal data, probably best to make sure it's your anecdote, maybe?

by belorn 4y ago

a2tech 4y ago

They may have bought it 5 years ago, but it wasn't 5 years old. Also for future reference you can update the certs on older OS X versions to get a few more years out of a system for someone thats happy with it: https://apple.stackexchange.com/questions/422332/how-do-i-update-my-root-certificates-on-an-older-version-of-mac-os-e-g-el-capi https://apple.stackexchange.com/questions/422332/how-do-i-up...

belorn 4y ago
An interesting hack. We went with a different hack to accomplish a working solution, but good to know there is alternatives. The idea in the link is that one transfer the System Root certificates from another (more modern) Mac to which the customer should already own. In theory I guess we as a email provider could continuously buy the latest version of mac and use that as the transfer host (hopefully do not transferring any account specific certificates). It must work without any corner cases (not overwriting anything on the customer end), the script need to work in future macos versions, and the assumption is that the first group of certificates is the relevant ones, and that it doesn't break anything on the customer end. For those who has not read the link, this do not update the System Roots keychain since users are not allowed to do that in macos. Instead this adds a trustRoot certificate. A nice trick. One of the comments say that it didn't fix the problem for them but who know what their situation was.
nucleardog 4y ago
Yep. My wife's still running a MBP from 2012 that I think finally got its last update to Big Sur (released 2020) without issue. Looking at the compatibility charts, everything from 2015 on-ward supports Monterey (2021, the latest version). The last laptop that couldn't update past El Capitan was 2009. As far as Macbooks (non-pro), last one stuck on El Capitan is the 2009 model as well. And it's not even that Apple broke anything on the 13 year old laptop, it's just that the rest of the world moved on and they're no longer fixing it.

rajamaka 4y ago

Weird, my MBP from 2015 runs fine. Don't think I have ever updated the OS either.

hagbarddenstore 4y ago

My old Macbook is 9 years old. It has no issues what so ever with browsing the web. The customer must be running some truly ancient version of Mac OS for this story to be true.

belorn 4y ago
email is not the same as the web. HTTPS seem a bit more permissible than smtp/imap. That said I know that some banking sites do reject old version of browsers on the basis of security. Some providers (email and others) can also continue to support deprecated/broken security for a very long time in order to not having to deal with customers using old deprecated software. 512 bits RSA public keys for example was used a very long time, long past where different standards and recommendation had a much higher minimum. Algorithm and key attacks are quite rare so companies can keep a low security standard for many years/decades before anyone exploits it. For customers that could be seen as a positive or a negative depending on perspective.

lotsofpulp 4y ago

My 2015 MacBook Air just got the newest MacOS update.

lotsofpulp 4y ago
Edit: I was wrong, macos 12 was the last one for 2015 Airs. Not bad though. It will still get Safari and security updates though.

bookofjoe 4y ago

I use my 2012 MacBook Pro and 2022 MacBook Pro interchangeably to publish my blog etc. with zero problems.

null_object 4y ago

> If I remember right their mac-thing was around 5 years old? My 2015 MacBook still runs absolutely fine. For that matter, I'm considering (but probably not) buying a new iPad to replace my TEN YEAR OLD iPad that I'm still using every single day, as it can no longer update to the latest iPad OS. But my 7 year old (soon 8 years old) laptop is as good as the first day I bought it.

maratc 4y ago

My 2010 Macbook still works fine after I've updated the expired X3 certificate [0]. [0]: https://macresearch.org/dst-root-ca-x3-expired-mac/ https://macresearch.org/dst-root-ca-x3-expired-mac/

mikestew 4y ago

My 2012 MBP that I'm using to write this piped up to disagree. It retrieves mail from a variety of sources every day, including work email, and there is never a problem. All using the stock Mail app that comes with the OS. So I'm guessing some details are being mis-remembered by the 2nd-hand information supplied by a person who doesn't sound technically-inclined enough to have gotten the story right in the first place. IOW, if one is going to supply anecdotal data, probably best to make sure it's your anecdote, maybe?