Comment Re:Typical Stupidity (Score 1) 132
If the people building the stuff are not onboard with security issues, then have a modern kernel which could run on their hardware will not improve the situation.
Why the distinction? The point is that in some cases security would be just fine if the software were kept up to date. The fact that a device has a listening port open doesn't mean security is good or bad, it means it has specific functionality. One of the biggest problems in the consumer IoT world is that 99% of the shit out there is set and forget, open to any bug regardless of whether the vendor has patched it in newer products. Deploying modern software is fundamental to the issue under discussion.
In order for a product to upgrade to newer kernels, they necessarily have to build their system so that you CAN upgrade it to a newer kernel, and then you have to have a team periodically rebasing the product onto the newer kernel - with a ton of testing to figure out if things still work (hopefully mostly automated, but you still need proper real testing behind that). This is just not the case in a lot of embedded systems, because building your system to those standards takes proper engineering capabilities in the first place and an ongoing engineering support team. Generally they ship with the kernel they were using when developing the product, and they have a bunch of half-assed patches against that kernel to customize it to their hardware. If you're lucky they'll pull in some patches backported from later kernels, but often even that is asking too much.
Hmm. Let me invert the entire point - as a result of this change, we aren't going to see tons of i486-based embedded systems only upgrade to 6.19 or whatever and then be orphaned. Because there were likely still running on 2.0.28 or 2.6.16 or something at the point where they stopped releasing firmware updates 12 or 15 years ago.