Hacker News Reader

Comment by repelsteeltje | Hacker News Reader

19 years!!

So imagine - you're relying on some piece of software released around 2005. 2.6.10 Linux kernel, ext2 (maybe reiserfs?) TLS is called SSL and you're good if your DSA key has 512 bits... This essential service your company needs had long been abandoned and all attempts to mitigate the imminent disaster have failed. (Migrate to competitor, revive the code base, run in a VM)

... Or some CTO has seriously done a bad job anticipating whatever maintenance necessary over last decade.

I appreciate that change is hard sometimes, but maaaan life is so much easier if you upgrade/migrate/rebuild every now and then with some frequency.

View on HN

Well, I'm still running critical services on Solaris 10 everyday and will be running them for the foreseeable future. Granted it's on an airtight network, but still, every time I see CDE, I'm brought back 15 years ago.

I wish we could migrate to something more modern, but vendor lock-in is strong in certain instances, let alone in the embedded space.

Solaris 10 with zones was amazing, I miss it.

I understand being stuck on Solaris 10, but if you don't like CDE you could theoretically install something else; didn't it even officially ship with GNOME 2 out of the box?

(This is slightly funny to me, too, because I sometimes run CDE on my shiny new Linux boxes out of a combination of nostalgia and dislike for the endless change of new things. As you say, I can install the latest CDE release, fire it up, and return to 15 years ago, if not more. Windows 11? Never heard of it. GNOME? Well Sun brands it the "Java Desktop", but whatever. CDE is the same as last time I saw it, and it will be the next time I see it. It's clunky, but that's a small price to pay for a quiet corner of the world frozen in time.)

Not everything is online.

If you’re operating critical infrastructure like a sewage treatment plant sometimes you just want stuff to work as long as possible without messing with it.

The point is that you're probably going to have to mess with it eventually, and the amount of work that takes goes up the longer you put it off.

If you're talking a completely offline system that's basically a utility and doesn't even need security patches, then how many years of support the OS provides becomes irrelevant, because you theoretically don't need those patches anyway.

But if you're concerned with staying "technically up-to-date," as in "the vendor says it's supported even though it's X years old," then there will almost certainly come a time when you reach the end of the line and have to reconcile that with everything you didn't keep up with. (It might be after you're out of there, though.)

I'm thinking I'd actually prefer that for a air-gapped industrial control computer.

using USB thumb drives to move csv data into the real world where there's internet

> TLS is called SSL

SSL was renamed to TLS in 1999...

Even today you'll see lay-persons use SSL, and some professionals refer to SSL for HTTPS and other secure connections.

Two decades ago TLS was still not in common use among common tech professionals. While TLS was released in 1999, informally many still just thought of 'SSL secured' connections, possibly using SSL / TLS certificates.

Additionally, as the Wikipedia article points out, TLS 1.0 was nearly still SSL 3.0, while 1.1 was released in 2006 and 1.2 in 2008 (which, offhand, is around the time I think the term TLS started to see more traction): https://en.wikipedia.org/wiki/Transport_Layer_Security#Histo...

""" TLS 1.0 was first defined in RFC 2246 in January 1999 as an upgrade of SSL Version 3.0, and written by Christopher Allen and Tim Dierks of Certicom. As stated in the RFC, "the differences between this protocol and SSL 3.0 are not dramatic, but they are significant enough to preclude interoperability between TLS 1.0 and SSL 3.0". Tim Dierks later wrote that these changes, and the renaming from "SSL" to "TLS", were a face-saving gesture to Microsoft, "so it wouldn't look [like] the IETF was just rubberstamping Netscape's protocol".[40] """

Your rant would have been more poignant had you gotten the ext3 and reiserfs dates right.

Doesn't Google run something like Linux 2.2 with several thousand backported patches?

Er, does it? Do you have a source to suggest that?

I stand corrected -- there are thousands of patches but the base kernel is only two years old: https://lwn.net/Articles/871195/

Reply on news.ycombinator.com