3 ms·
> If you have an EOL device, it may not be necessary to throw it away, but you should consider the risks of continuing to use it. For consumers, this necessitat
by myself248 1y ago
> If you have an EOL device, it may not be necessary to throw it away, but you should consider the risks of continuing to use it. For consumers, this necessitates careful consideration not just of a device’s features but its entire security lifecycle, including manufacturer support commitments and community firmware options.
Which I read as "Don't buy it in the first place, if it's not already supported by OpenWRT."
Simple enough.
- iszomer 1y agoThis was my baseline 20 or so years ago starting from the WRT54G. Now, it's just a bullet point in the miscellaneous section of my cv.
- sidewndr46 1y agoI find the EOL aspect of this discussion out of place. These devices shipped like this. They didn't gain these vulnerabilities due to aging or something like that. You can have a device that is 100% supported by everyone from the chip vendor, board assembler, and an OEM that is still trivially vulnerable.
- yjftsjthsd-h 1y agoIf it's supported, then as soon as somebody finds a vulnerability (and notifies the vendor) it should get fixed.
- tonyhart7 1y agoor they sell them to blackmarket as 0 day exploit
- sidewndr46 1y agoWhy would I care if I have already been compromised? It's like I was murdered and the prosecutor leaves a "got em!" note on my grave after a conviction. I don't think I'm going to care very much.
- kej 1y agoIt would matter quite a bit to the next person on the murderer's hit list, just like it matters to people whose devices haven't been compromised yet.
- swinglock 1y agoMy thought too. They are not insecure because they won't be patched, they are just insecure. Even if patched, what's to say there are not 99 other vulnerabilities lurking, even in their supported products?
- sidewndr46 1y agoI seem to remember at least one case where a manufacturer attempted to patch an issue like this and managed to actually introduce another one in its place.
- Hilift 1y agoIt's probably relevant due to companies usually dump EOL hardware, and some of it gets a new life in a non-business environment. But if it needs a firmware update for a security vulnerability you're out of luck. There is legitimate commercial market for used EOL hardware as parts for people that keep old hardware a bit longer, but that's probably short term until it can be replaced.
- sidewndr46 1y agoBut no one should be buying or using these devices when they are brand new. Why would I care about them when used?
- Zigurd 1y agoI bought a TV on deep discount. The Android TV OS was already trailing-edge and soon went unsupported. Being just a little paranoid, I monitored the network for continued activity after I removed the network configuration from the built-in software, which I replaced with an external device that's fully supported. I doubt many of the other customers for this cheap TV are as vigilant.
- bee_rider 1y agoThere really ought to be an “open source your drivers or offer a refund” law for companies that want to EOL devices. It isn’t the 90’s anymore, hardware innovation has really slowed, a chip could be good for decades.
- nickpsecurity 1y agoThe differences are vulnerability disclosure, vulnerability class, and patch availability. The device is most-vulnerable between the moment common hackers know how to exploit it and when a patch (or mitigation) for that vulnerability is applied. Older hardware has had longer for vulnerabilities to be found. Some might not mitigate new classes of vulnerabilities. The EOL hardware will not receive patches for any vulnerabilities. So, they're at higher risk of attack. From there, the attack will be either malicious input to that machine over the network or a file that embeds an attack. Many problems can be mitigated by running secure software, esp for input validation, on that hardware. One might also use them offline or on trusted networks with software that's hand-chosen for them. (That's what I do.)
- ge96 1y agoI'm wondering if not upgrading from Win 10 to Win 11 will be considered EOL I have a powerful gaming desktop but says not eligible to upgrade to win 11
- gnopgnip 1y agoAfter Oct 14, yes. You won't receive security patches
- ge96 1y agosucks gotta dump the box, excuse to get an SFF I guess
- 01HNNWZ0MV43FF 1y agoIt's only really the CPU and motherboard that need updating, right? Uh I mean if you're gonna throw a big GPU in the trash I'll haul it away for only ten bucks...
- ge96 1y agoI thought it was some TPM thing My rig is not that impressive, i9 with 4070 what sucks is the ram is locked for some reason at 2400mhz even if I buy ram that is faster than that so idk. I swear it that was the specific cpu (10th gen) I did go through a bunch of steps checking trying to get it to work, stuff in bios enabling settings
- 01HNNWZ0MV43FF 1y agoI think the TPM lives in the mobo somewhere. Might as well reuse the HDD, SSD, GPU, PSU, and chassis
- ge96 1y agoGood point, find same size/socket You can have my Windows 10 from my cold dead hands ha