5 ms·

Yeah, gee. Thank god for the security update treadmill. Prefect excuse to force other people to accept unwanted changes. This is the way bills in congress work

by c_m_u 10y ago

Yeah, gee. Thank god for the security update treadmill. Prefect excuse to force other people to accept unwanted changes. This is the way bills in congress work, so let's apply the same social engineering to software. Someone else gets to ruin my system by bundling a non-essential change with an "essential" change. Never waste a good disaster.

ikeboy 10y ago
On the other hand it costs time and money to backport fixes to older versions. We add feature X and remove feature Y, refactoring a bunch of code. Now we fix a security bug. Applying that patch to the old version won't build. Someone needs to fix that, right? Microsoft supported XP for a long time, but that was paid. At some point it becomes unfeasible to maintain older versions.
- icebraining 10y ago
  Smartphones are paid too. To me, this should be covered under the EU's warranty laws, since it's clearly a defect of manufacturing (even if it's software manufacturing), so it should be guaranteed for a minimum of two years.
  - ikeboy 10y ago
    They give you updates. They don't give you updates to old versions that only fix bugs. Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply. Phone security updates are sometimes provided for some time, actually. I know Samsung at least went back and made new releases for abandoned phones after stagefright.
    - pjmlp 10y ago
      Not for S3.
      - ikeboy 10y ago
        http://androidcentral.com/list-devices-stagefright-patches http://androidcentral.com/list-devices-stagefright-patches
        pjmlp 10y ago
        Sprint doesn't exist in Germany. I am pretty sure what my "Search for updates" returns as error message.
    - icebraining 10y ago
      They give you updates. They don't give you updates to old versions that only fix bugs. True, and that would mostly likely fulfill their obligation, though personally I don't think I should have to accept what is essentially a new product to get a manufacturing flaw repaired. Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply. Ah, with that I wholly disagree, and I expect the law to do as well. Android (and Chrome nowadays) is clearly part of the package that I buy with the phone, and advertised as such. That the phone OEM got it for free from Google is irrelevant to me as the consumer; I paid for the whole thing.
      - smt88 10y ago
        Android is now supported the same way as Windows: security patches are backported to old versions to benefit users who aren't able to upgrade. Chrome is free and also optional. If you don't like the new features that come with the security updates, you can easily use a different browser.
        icebraining 10y ago
        If Chrome comes bundled, as AFAIK it currently does, it should be considered part of the product being bought and subject to the same rules, as shown in the ads and as the consumer clearly does. I disagree with the EU's decision to force MS to have that browser selection dialog, but that doesn't mean bundling should be consider a "gift" by the manufacturer. A browser is an expected part of a current smartphone OS, and as such they should be responsible for the one they include.
  - smt88 10y ago
    > since it's clearly a defect of manufacturing 1) Perfectly secure software has never been invented and may never be. Does that mean all software has "manufacturing defects"? It definitely means you can't penalize the "manufacturer". 2) Not all security holes are defects that are discoverable when a program is released. There are attacks that no one has thought of. Someone invents the attack, tests it, and then discloses it (or uses it). The average coder isn't anywhere near smart enough to think of all these things (and that includes me). Even if we were, we wouldn't have time to test and mitigate all of them. If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you.
    - icebraining 10y ago
      1) Yes, I do think all software has manufacturing defects. I don't wish to penalize the manufacturer, only hold them to the two year mandatory guarantee that they will fix those problems for any consumer product they sell. They should be penalized if they don't fix them, though. 2) True. So what? Why should that get them off the hook? Statistically, we also know that people will always make mistakes, does that mean companies shouldn't be responsible for the blunders of their employees? The fact that we know our software will have problems we can't fix at launch time just means we need to account for that post-launch cost, plus possibly have insurance for major screw-ups. It doesn't mean we get to claim "caveat emptor" unlike any other industry. If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you. Yes, that's currently the case, as I admitted in my other post, but it's not an immutable law of nature.
smt88 10y ago
No one forces you to use any particular browser, and you're getting some incredibly complicated, useful software for free. If you find that Chrome updates come with unwanted changes, you might want to try Firefox or Opera.

by c_m_u 10y ago

ikeboy 10y ago

On the other hand it costs time and money to backport fixes to older versions. We add feature X and remove feature Y, refactoring a bunch of code. Now we fix a security bug. Applying that patch to the old version won't build. Someone needs to fix that, right? Microsoft supported XP for a long time, but that was paid. At some point it becomes unfeasible to maintain older versions.

icebraining 10y ago
Smartphones are paid too. To me, this should be covered under the EU's warranty laws, since it's clearly a defect of manufacturing (even if it's software manufacturing), so it should be guaranteed for a minimum of two years.
- ikeboy 10y ago
  They give you updates. They don't give you updates to old versions that only fix bugs. Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply. Phone security updates are sometimes provided for some time, actually. I know Samsung at least went back and made new releases for abandoned phones after stagefright.
  - pjmlp 10y ago
    Not for S3.
    - ikeboy 10y ago
      http://androidcentral.com/list-devices-stagefright-patches http://androidcentral.com/list-devices-stagefright-patches
      - pjmlp 10y ago
        Sprint doesn't exist in Germany. I am pretty sure what my "Search for updates" returns as error message.
  - icebraining 10y ago
    They give you updates. They don't give you updates to old versions that only fix bugs. True, and that would mostly likely fulfill their obligation, though personally I don't think I should have to accept what is essentially a new product to get a manufacturing flaw repaired. Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply. Ah, with that I wholly disagree, and I expect the law to do as well. Android (and Chrome nowadays) is clearly part of the package that I buy with the phone, and advertised as such. That the phone OEM got it for free from Google is irrelevant to me as the consumer; I paid for the whole thing.
    - smt88 10y ago
      Android is now supported the same way as Windows: security patches are backported to old versions to benefit users who aren't able to upgrade. Chrome is free and also optional. If you don't like the new features that come with the security updates, you can easily use a different browser.
      - icebraining 10y ago
        If Chrome comes bundled, as AFAIK it currently does, it should be considered part of the product being bought and subject to the same rules, as shown in the ads and as the consumer clearly does. I disagree with the EU's decision to force MS to have that browser selection dialog, but that doesn't mean bundling should be consider a "gift" by the manufacturer. A browser is an expected part of a current smartphone OS, and as such they should be responsible for the one they include.
- smt88 10y ago
  > since it's clearly a defect of manufacturing 1) Perfectly secure software has never been invented and may never be. Does that mean all software has "manufacturing defects"? It definitely means you can't penalize the "manufacturer". 2) Not all security holes are defects that are discoverable when a program is released. There are attacks that no one has thought of. Someone invents the attack, tests it, and then discloses it (or uses it). The average coder isn't anywhere near smart enough to think of all these things (and that includes me). Even if we were, we wouldn't have time to test and mitigate all of them. If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you.
  - icebraining 10y ago
    1) Yes, I do think all software has manufacturing defects. I don't wish to penalize the manufacturer, only hold them to the two year mandatory guarantee that they will fix those problems for any consumer product they sell. They should be penalized if they don't fix them, though. 2) True. So what? Why should that get them off the hook? Statistically, we also know that people will always make mistakes, does that mean companies shouldn't be responsible for the blunders of their employees? The fact that we know our software will have problems we can't fix at launch time just means we need to account for that post-launch cost, plus possibly have insurance for major screw-ups. It doesn't mean we get to claim "caveat emptor" unlike any other industry. If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you. Yes, that's currently the case, as I admitted in my other post, but it's not an immutable law of nature.

smt88 10y ago

No one forces you to use any particular browser, and you're getting some incredibly complicated, useful software for free. If you find that Chrome updates come with unwanted changes, you might want to try Firefox or Opera.