Hacker News Reader

If the device is explicitly past EOL what is the point anyways? Just to wait 60 days and hear they aren't going to do anything?

View on HN

not necessarily! If the 0day is bad enough the vendor may patch it or release further guidance - most recent case is Ivanti this week (https://cyberscoop.com/ivanti-vulnerability-cisa-kev/)

likely used by vendor as sales strategy to upgrade device:

we will give you patch for this EOL 0day, but this will be the last one. Please buy new version and btw here is 20% discount code, you are welcome

they could offer to send you a $15 grubhub gift card for your trouble

Still better than leaving devices unpatched. The end user still has the final word, can totally refuse to buy a new one if he/she doesn't think getting a new one is worth it.

Reply on news.ycombinator.com