On a scale of 4 to php how bad is it

@rooster tbh I think that scale might be backwards

@kboyd @rooster 4 didn’t bring tons of sites down

@mercurial @rooster 4, for a wide swath of devices, _cannot be fixed_.

(Actually, now that I think about it, this is also true of "smart" devices with embedded php... what a wonderful day.)

@kboyd @rooster I mean, for the devices that can be fixed, 4 is a little less of a headache than updating a very old PHP that cannot be updated to the latest branch due to old systems of whatever.

AFAIK solving 4 is really just removing a CA from a trusted list of CAs.

Do correct me if I’m wrong though. I personally didn’t have to deal with it.

@mercurial @kboyd @rooster
How do you remove that from the list of trusted CAs in your TV or your thermostat, if the manufacturer no longer supports them?
Same with PHP.

@mercurial @kboyd @rooster
The vendors of Internet-connected devices need to be held legally liable for security issues for the _actual_ life of the product, not an artificially short planned obsolescence "support life".
That won't help with different-name-every-week Chinese vendors, but name brands that are going concerns need to do _much_ better.

@brouhaha @mercurial @rooster Or, as a way to honourably bow out of that liability, there needs to be a regulation that mandates open firmware, especially if the company goes out of business. (Perhaps with the access keys held in escrow until such an occurrence, but I'd prefer it just to be open from the beginning.)

@kboyd @brouhaha @mercurial @rooster

that assumes that they even HAVE it

@mercurial @rooster No correction needed. Just looooots of patches. Lol :)

@mercurial ...yet.

@kboyd @rooster