Registration card in hand, I went to register a newly purchased power tool yesterday. But when I arrived at the manufacturer's site, I was greeted by an ancient homegrown interface that was marked "Copyright (C) 2004" and looked like HTML 1.0. Attempting to connect via https yielded an invalid TLS certificate and no access to the page. The redirected registration URL looked very much like "http://apache.somecompany.com/cgi-bin/registration.htm" Everything stank of unpatched vulnerabilities, but the site admin replied to my query and assured me that their Oracle warranty registration system was secure. (Never mind that an Oracle machine probably wouldn't be named "apache".)
I decided owning an unregistered gasoline powered tool with giant spinning blades was safer than entrusting them with my name and address. I'm not even sending them the post-paid card in the snail mail, because I don't see any evidence of security at their end.
But what I really want to know is if there is a way for me to evaluate their site without really attacking them, or if there is someone offering a "Shellshock testing service", or a site or other trustable body that would let me know if they're patched to current levels or not.