Comment by meindnoch 2 days ago
EoL devices are a huge liability. We need laws that require vendors to equip smart devices with remote hardkill switches, so they can be permanently disabled by the vendor when they reach EoL. A disabled smart device is better than one that can be weaponized by threat actors.
How big percentage of customers even logged to their home router. It will be way below 10% (I would wager in lower single digit percents).
So
* manufactures open source it
* "someone" is going to maintain it, for free
* all these people are going to find non-malware infested fork
* upload custom ROM to their devices.
I just don't see it.
Automatic updates/killswitch are the only way forward.
Auto-applying security updates is actually a major threat vector. It's often easier to compromise a cloud deployment system/key rather than thousands of edge-deployed devices.
An EOL device that has withstood the test of time, and has had many security patches but is no longer connected if often one of the most secure devices.
Right, but do you want these still usable devices to become e-waste?
for those that can secure them properly (e,g air-gapping) why do we need to make old iot stuff non-functional bricks?
something I'd be more ok with is to disable it, but in the device's settings, allow it to be re-enabled
Go ahead and disable 47% of gaming PCs in 2025 then. lmao ur insane.
That is insane. I mostly buy and use “EOL” devices because they’re cheaper and have no issues. Recently bought my son an old Intel Mac Mini and he loves it.
You can easily still secure an EOL device- with the old Mac I just use it with the firewall on, no ports open, and a modern secure browser. There is really no attack surface from the OS which is EOL, and this old device has aged past being worth developing attacks for.