[webmobdev]

If Apple isn't fixing atleast security related bugs on old Oses, then they should just declare that particular macOS version has reached end-of-life and they are not supporting it. There is no middle path here - if you are not fixing all the known security bugs that can be patched, then the whole thing is just point-less and would seem to be more about PR than security.

[my123]

It's much more complex than that. Security bugs have different levels of severity, with different reactions to those.

Let's for example see the Microsoft ESU policy: https://docs.microsoft.com/en-us/lifecycle/faq/extended-secu...

For Windows 7, only Critical and Important security updates are shipped to those _paying_ customers. This leaves Moderate and Low as uncovered.

For Linux: http://www.kroah.com/log/blog/2018/08/24/what-stable-kernel-...

> Older LTS release

> There is one huge caveat when using a kernel like this. The number of security fixes that get backported are not as great as with the latest LTS release, because the traditional model of the devices that use these older LTS kernels is a much more reduced user model. These kernels are not to be used in any type of “general computing” model where you have untrusted users or virtual machines, as the ability to do some of the recent Spectre-type fixes for older releases is greatly reduced, if present at all in some branches

> So again, only use older LTS releases in a device that you fully control, or lock down with a very strong security model (like Android enforces using SELinux and application isolation). Never use these releases on a server with untrusted users, programs, or virtual machines.

[webmobdev]

While I am aware about different levels of severity and the need for prioritising security bugs according to their severity, I wasn't aware about this kind of security model for LTS software where not all security bugs are fixed - seems quite illogical to me (unless, ofcourse, if you are making money of it as a service).