In my opinion critical security patches should continue to remain available on a similar basis to other manufacturers issuing safety fixes to physical products -- more or less forever! To be more specific and more practicable, I would say security patches need to be released for known problems so long as:
a) user licenses remain valid;
b) significant numbers of users continue to use the product; and
c) there is no other way for them to get the problem fixed.

Part a) is forever on most typical product licenses. Refusing to support the product when it has been legally bought and licensed is little more than extortion, an attempt to force users to buy a new product they don't want.
Part b) tends to much longer than folks think -- I am aware of a large company that still had Windows for Workgroups 3.11 on desktops as recently as a couple of years ago. It is at least 10 years after product release, sometimes longer for infrastructural systems. Basically, for all practically purposes this should be something like "one year after the last download".
Part c) means that if the company ever wants to drop support, they have two choices; open source the product, or outsource the support for it. How they pay for outsourcing I don't care so long as the customer doesn't have to pay.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/348/32285#32285