Comment by dspillett

> only use old devices and old OSes. Things that have been cracked and/or are easy to root.

> "But it's not secure!" -- yeah, that really is the point.

Well, no.

The point isn't just to rail against impositions from someone else wanting what they see as essential for their security, but also to keep things secure and⁰ free¹ for you, the user.

Holding your devices back constrains both your security and your freedom rather than helping you in either manner. Security because you will be missing important updates in that regard, and freedom because your device won't be able to negotiate connections with external services² that you want to use³.

----

[0] And where these two conflict, you should be free to chose your threat model and therefore which compromises to make, except where that could negatively affect others.

[1] The freedom of reasonable action form of free, not monetarily free etc.

[2] We hit this a short while ago with some legacy code+infra using SOCKS via OpenSSH to make unauthenticated HTTPS calls from source addresses we can't fix (authentication is done with SSH, control is by the other end having the fixed address of the SOCKS host in the whitelist) - upgrading the VM running the SOCKS proxy upgraded OpenSSH which deprecated a number of encryption and negotiation options, the old client library used didn't support enough new ones to be able to negotiate a link, newer versions required a later .Net version that is supported inside SSIS, so we had to rearrange how those calls were made (obviously the long term fix is to kill all that legacy SSIS stuff, all SSIS stuff including the people that made it, with fire). The same will happen with parts of what you use your device for, if you keep it back in the way you are suggesting.

[3] Banking facilities being a key area that you'll likely hit problems with first, after that other online commerce flows, and so forth.