Nobody Tells You When Software Dies. OpenEoX Wants to Help Change That

The issue of software obsolescence is a critical concern that few people realize until it's too late. Many devices, from home electronics to enterprise systems, run outdated software that may no longer receive security updates or support. This problem is particularly prevalent in consumer devices like routers, printers, and smart home gadgets, where manufacturers often prioritize cost and convenience over long-term software maintenance.

The lack of standardized information about a product's lifecycle makes it difficult for consumers and businesses to determine when a device will stop receiving updates. This lack of transparency can lead to devices running on outdated software that may be vulnerable to attacks, leading to potential security risks and costly downtime.

One effort to address this issue is the OASIS OpenEoX group, which is developing a common, machine-readable standard for publishing product lifecycle information across software and hardware. This standard would provide a clear way for vendors, manufacturers, and developers to communicate when a product is launched, when sales stop, when security fixes stop, and when everything stops. The first piece of the standard is currently in public review, and the group is seeking input from the community.

The lack of standardized information about a product's lifecycle makes it difficult for consumers and businesses to determine when a device will stop receiving updates. This lack of transparency can lead to devices running on outdated software that may be vulnerable to attacks, leading to potential security risks and costly downtime.

The OpenSSF built Scorecard, a tool to evaluate open-source software projects, but even this tool has difficulty determining when a project is still "alive" or "maintained." The HeroDevs dataset, which tracks over 12 million products, highlights the scale of the problem and the challenges in identifying when a product is still supported.