Let’s Encrypt comes up with workaround for abandonware Android devices

Exactly! It's so upsetting that the narrative has been so distorted that most folk don't even understand that it's not the manufacturer that intentionally makes the device unusable, but instead the website operators, and those who support and misleadingly advise such operators. The biggest problem is that folks like Mozilla tell everyone to disable TLSv1.0, whilst themselves still supporting it; which shows the biggest case of hypocrisy there could ever be.

Are you aware of any groups working against such planned device obsolescence? My latest gripe on this matter is Wikipedia -- it's beyond absurd that anonymous users can make changes to the contents of pretty much any of the millions of pages, yet getting said pages over pristine networks is conditional on TLSv1.2 support, limiting older devices from even read-only access to Wikipedia for absolutely no good reason.

It made the rounds in the press years ago. Here’s a first person account for ipsec, which was one of the first hits I found when looking for information about the SSL weakening:

https://www.mail-archive.com/cryptography@metzdowd.com/msg12...

It’s describing the same tactics, but a different protocol. Honestly, just crack open the SSL spec. In hindsight, it’s pretty obvious it was intentionally over-complicated.

The Wireguard protocol attempts to fix these issues by hardcoding everything behind a protocol version number. It’s vastly easier to implement and configure properly.

But I don't need crypto to read text and watch pictured posted by anonymous users, so, the crypto point is just moot.

You're also missing the context. Why does it matter if someone's browser has exploitable bugs if the only sites they visit are those that are not likely to use such exploits?

So, such planned device obsolescence is conditional on two explicit actions on site owner's side, (1), prohibiting http traffic, (2), prohibiting TLSv1.0 traffic. So, it's 100% site owner's actions that cause the device to become obsolete and make your own site inaccessible. The manufacturer has zero control over the actions of the individual site owners. On the other end of the spectrum, Google, Microsoft, Bing, Amazon, Mozilla, plenty of other businesses, don't intentionally go out of their way to disable both of those things, so, their sites still work -- including through HTTP in case of the search engines. Which manifests as a definitive proof that it's the fault of those other specific sites (like Wikipedia) that take explicit actions to make the older devices obsolete.

P.S. Incidentally, this also proves the point about capitalism -- as a result of misleading propaganda campaigns promoting HTTPS everywhere, most smaller sites are automatically and inadvertently acting as precursors for planned device obsolescence, whereas the big players that need to make the last cent out of every person in the world regardless of how old their device is, or what actions their provider takes against the encrypted traffic, are fully capable of getting exceptions to the PCI compliance or whatnot, and continuing to serve their sites through TLSv1.0 as well as plain old HTTP.

> Even if all you want is plain HTTP, when HTTPS breaks it's mostly the fault of the device, and the product is still experiencing planned obsolescence caused by the manufacturer.

"Mostly"?! That's quite a stretch! You're attributing direct and explicit actions taken by a specific subset of site operators as caused by the device manufacturer, which it is clearly not!

> And it would be stupid of a site to allow old versions of TLS, since that compromises the people depending on HTTPS; if there's going to be an insecure access method it should be HTTP.

This argument doesn't stand -- if you're running the latest User-Agent software in December 2020, access to pre-TLSv1.2 sites is likely already disabled (or at least it was supposed to have been disabled earlier in 2020 -- did they back out of their own plan all over again?), so, how would the site allowing older versions of TLS at all allow the compromise that you describe to take place? It's simply not possible, because the User-Agent won't allow it!

To the contrary, if thousands of sites that don't actually need crypto wouldn't have been mistakenly made to use crypto since a few years ago, then we could have disabled pre-TLSv1.2 in newer browsers at a much faster rate; whilst still leaving TLSv1.0 support at the server level for the older clients that don't have the newer crypto.

So, ironically, the HTTPS lobby actually shot themselves in the foot by making everyone adopt TLS without any actual need.

> Crypto isn't just for banking.

Yes, sadly, crypto works great for planned device obsolescence, too!

> Also it's not really a capitalism thing, capitalism is too busy trying to sell you an update every 2 years to care about the difference between 8 years and forever.

The evidence appears to show otherwise. Capitalism -- Google, Bing, Amazon -- doesn't care if anyone still uses TLSv1.0; they'll still serve everyone to make a sale. Ironically, it's the non-profits "socialists" -- Wikipedia, Mozilla, EFF -- who (inadvertently?) promote planned device obsolescence by intentionally deprecating all backwards compatibility on the internet.

When you start with a premise that all sites MUST have HTTPS and MUST NOT support TLSv1.0 in each argument, then your arguments are simply unsound, because they're based on an incorrect premise, so, the conclusion couldn't possibly follow, because the underlying premise is false and thus cannot support any of your conclusions.

My point about capitalism is exactly that -- capitalism -- Google, Bing, even Amazon (i.e., companies that make the most money from the web) -- show that HTTPS is entirely optional (Google Search and Bing both work over HTTP just fine), and TLSv1.0 provided by the server is just as secure at TLSv1.2-only servers (Google, Microsoft, Amazon).

I can still use any device from the last 20+ years to access both Google Search and Bing. If you intentionally disable your blog from working on such older devices, shifting the blame to device manufacturer is simply ludicrous! All my sites are HTTP-only, so, anyone anywhere can access them, from any device, over any connection (some WiFi via satellite links only allow HTTP-only traffic for free -- I win again), and with any browser. They are not in any way "insecure", either, unlike what the newer browsers might tell you. I can reach as large a variety of visitors as Google and Bing if I simply don't listen to what Mozilla, EFF and Google itself tells me on how to run my website.