Hacker News Reader

I've got an original iPad and an iPad Air (I think 2nd gen).

Both still have great battery life and screens are still responsive ... but I made the mistake of wiping both to give as gifts for some nieces in El Salvador, and you can't actually install anything on them anymore.

They come with Safari and the other baked-in Apple apps, but that's it. None of the most common apps in their store have versions available for the iOS version the devices are limited to.

What the hell am I supposed to do with two fully functional (hardware-wise) devices?

Mount them as interactive views for a calendar page or something? I'm not sure how far behind their web browser is but that's the last real use for them I know of.

if you have an existing account that downloaded a particular app already, you can download the old version of an app. https://support.apple.com/en-ca/HT201377

or you jailbreak...

Another tip:

If the same app is still available on the store, but the newest version isn't compatible with your old OS, you won't be able to buy the that app on your old OS.

However, if you can log into the same Apple account on a new OS, you can buy the app there (pressing "get" on a free app counts as buying for our purposes). Once purchased, you'll be able to install the last compatible version on your old device.

This also works on the Mac App Store.

Beware of situations where what's currently available on the store isn't actually the same app. If the developer released a new version as a separate app at one point, this process won't work.

iPad Air 2nd still gets updates. It's probably a iPad Air 1st gen

Are you sure? I have a 4th gen iPad (A1460) and it's stuck forever at iOS 10.3.4, so I imagine an older one would also be end-of-lifed.

I am typing this from an iPad Air 2 (A1567) running iOS 13

I think there's some confusion here, iPad Air 2 ≠ 2nd gen iPad.

This is made more confusing by the fact that GP mentioned the original iPad and the iPad Air in the same sentence.

You're correct; I misread the comment.

I'm not sure of the state of Linux on Mac but my first guess would be install Linux and use them as normal.

These are iPads, though.

This was the solution on Macs at least. I know someone that still uses a Mac mini G4 as their daily runner but running the latest Debian. Only way they can get any decent software support.

Well, no.

Or at least no in the near futur.

Debian dropped support of ppc32 with stretch.

Could you share why 10.9 is so appealing to you? I am not a Mac user so very curious.

Mavericks is the last version before Apple did a huge visual makeover, to bring everything more in line with the visual style of modern iOS. I could rant for a while about why I dislike the new visuals, but my single biggest issue is the lack of contrast, which I find physically tiring on my eyes. Old OS X has a wide range of tones and well-placed accents, which make everything easy to scan.

In some ways, I actually see the advent of dark mode as Apple recognizing this problem—and papering over it with a bad solution. Old OS X was neither light nor dark to begin with. (Particularly circa-10.5—after Snow Leopard they began slowly brightening everything).

Separately from the visuals... this is a bit more opaque because I'm not a developer, but Yosemite introduced a lot of instability, and I'm convinced that Apple has never fully recovered. El Capitan (10.11) and High Sierra (10.13) were pretty stable by their final releases, but 10.9.5 is just really rock solid.

Yeah "what's the last version that runs on X" is a tough question in many cases, even old Windows versions. In case you run a blog or are member of some public forum, news group or anything that's indexed by search engines consider dumping your findings there. Someone might try to do the same in a decade or so. For your license key issue, did you try to just contact the vendors? Maybe some are even willing to make these old versions free now, they might just not have seen the point in it...

I definitely need to do a larger writeup somewhere when I'm "done" with this project.

> For your license key issue, did you try to just contact the vendors?

Yes, I have! I've received some very nice responses, but none that actually helped. Which I kind of get, I guess, but it feels like this shouldn't happen.

Where possible, I've actually turned to pirating stuff—I normally hate doing this, but if you're not going to sell to me, I don't think it's wrong for me to find another way. I finally found a copy of NetNewsWire this way, after a lot of searching.

P.S. This isn't an offline app, but shoutouts to Bitwarden for the stupidest problem. The old version of their desktop app keeps helpfully replacing itself with the newer, incompatible version, which then won't open. If I mark the app read-only, Bitwarden just endlessly asks for my admin password.

10.9 hasn’t received security updates for three years and a half years. https://support.apple.com/en-us/HT201222

Running an old version of an operating system that’s not actively getting security updates, let alone gotten any at all for over three years, is crazy. It’s one thing to run it offline or heavily firewalled for a limited purpose, like running some important application that doesn’t work on current versions. But to actually use it day to day is absolute madness.

I hope you’re not handling any information that you have a duty to someone else to keep safe. Putting it on such an old OS release, through intentional and tedious effort on your part, would be outrageously negligent. Even logging into work email through that setup would be irresponsible. Or accessing any email account to which someone has sent private information (so just about any email account you actually use). It’s negligent with regards to your own data too of course, but at least that’s just your problem.

I hear this a lot but never with any actual quantification of the risk. The population still running 10.9 has to be so low its just not worth attacking.

The burden of using the current version is so low (op is in fact expending significant effort to not make the safe choice), that imposing any additional risk on others is unjustified. That kind of analysis—the burden of caution vs. the risk of not taking it—is how the law measures negligence. I’m not giving legal advice of course. But the law tracks the morality of negligence pretty closely in my opinion.

My 2011 macbook is already not supported by new versions and Mac hardware are not backwards compatible with older OS versions. It's extremely likely that they can't even run newer versions even if they wanted to. If not now then in the near future.

I think trying to make any moral argument in this situation is pointless as the risks are so minuscule. But should we go down that road the environmental benefits of keeping older hardware in use for longer far outweighs any security risks they may impose on others.

> op is in fact expending significant effort

And the reason I'm expending effort is because this is important to me. My computer isn't just a tool, it's where I spend a significant portion of my life.

I want Mavericks's beautiful interface in my life. That has inherent value.

Is that a justification you'll be comfortable giving after the fact? "I know a took a risk with your private and sensitive [business/intimate] data that you trusted me with, and now it has been compromised, but you have to understand, the interface was so beautiful. It was worth it."

Small part of me agrees with you, but then again I see fortune 100 companies, banks and government getting away with similar or worse on regular.

A few weeks ago, I pointed out to one of our clients that they are using vulnerable TLS library (with know exploits) on internet facing service.

They scheduled upgrade for service in august next year.

So honestly op running obsolete version of osx is really drop in the bucket.

If he's using an up-to-date browser and a firewall it feels like the practical risk is relatively low.

What remote exploits are you concerned about in that scenario? Where it would affect 10.9, but not 10.16.

I'm not doubting they exist, but I'm really curious the threat scenario that would apply here, and how likely you think that might be.

Can you please provide more detail as to what attack vectors you forsee being a problem? I want to be conscientious of security concerns, but I legitimately can't think of a scenario that would make what I'm doing genuinely unsafe.

This machine:

• Is connected to the internet.

• Is behind a router. All incoming ports are closed, except one for ssh. (An updated SSH binary has been installed via Macports.)

• Runs Little Snitch, so I can monitor what data gets sent out of my machine.

• Is running an up-to-date copy of Firefox.

• Has all important data backed up to cold storage regularly.

I consider any application I install locally to be trusted code, so the only source of untrusted code is the Javascript that I run inside of Firefox, which is up to date.

Some attack scenarios I can imagine:

1. There's a Firefox zero day. My vulnerable OS does not offer the extra layers of protection that a newer one might.

2. Someone exploits Spectre/Meltdown/etc via Javascript. My attacker is incredibly lucky, and the tiny portion of memory they retrieve just so happens to be the bit that contains something vital, like my master password.

3. Someone emails me a malicious image, which isn't caught by Gmail (personal accounts) or Microsoft Exchange (work account), and infects my machine when it's rendered by Apple Mail.

4. A person I know/trust is tricked into sending me an infected document, likely a PDF or MS Office file. Even though I don't have Acrobat or Microsoft Office installed, the vulnerability is compatible with Preview or iWork '09.

I'm not a particularly important person, so I think I'm more likely to die in a plane crash than get hit by 1 or 2. The latter two scenarios are maybe a bit more concerning, but not to the point where I consider them real threats. Particularly given that I also have cold data backups and Little Snitch.

For one, a large number of native applications use the OS's webview widget, so you remain exposed to the outdated Safari engine even if you don't use Safari.

You're also going to have to use outdated versions of various software packages, as you describe in your post. That's another security hole.

As you note, bugs are often found in video and image decoders. The one in your OS isn't being updated anymore.

And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues. I imagine most engineers fix the buggy code and move on, and never really consider if there was a security hole there. In other words, it's common for vulnerabilities to be discovered long after they were fixed. And there are probably many more that remain undiscovered despite being present in old versions.

Yeah, the chances I'd run into those things just seems incredibly low.

Separately:

> And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues.

But this would imply that the newer version is inherently less buggy, wouldn't it? At least in terms of user-visible bugs, Mavericks is actually a lot more solid in my experience. That's a part of why I want to do this. Apple keeps adding new features and breaking old ones in the process.

There is no question Mavericks has more known vulnerabilities, and that's significant. But as an academic question, I'm not at all convinced that Mavericks has more unknown vulnerabilities. If nothing else, it almost certainly has a smaller attack surface.