10 ms·

The FCC absolutely must clamp down on EOL policies and security updates for phones. It's a telecom infrastructure issue. Sure it places a burden on companies

by lvs 10y ago

The FCC absolutely must clamp down on EOL policies and security updates for phones. It's a telecom infrastructure issue. Sure it places a burden on companies like Google and Verizon, but they're the ones who deserve to carry that burden -- not consumers. The secure lifetime of a device that is hundreds of dollars should not be only 2-3 years. That leaves a dramatic number of consumers fully exposed and eliminates the secondary market for used technology. Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.

Someone1234 10y ago
I agree entirely with you. That being said, the FCC is a little toothless, and every time they try and do something consumer friendly the courts kick them in the shins. More likely to see something positive come out of the EU than FCC, but in either case these companies will make changes to all markets because it is more efficient than just doing the EU. Android in particular could learn a lot from Linux's distribution model (package managers, et al). I've been tempted to move to iOS just because of how much better updates and device lifespan are.
- lvs 10y ago
  At a smaller scale, California or perhaps Massachusetts could do this independently -- as they often do -- and it will have the effect of reverberating across the country.
- deleted 10y ago
  [deleted]
01Michael10 10y ago
Don't you mean Android phone OEMs and carriers? Google already updates their phones every month for three years which is long enough for a device most people replace or break within two years. Verizon isn't the only carrier of course.
- mjevans 10y ago
  Security updates need to be for the lifetime of the /device/ through all parties. Think of it the same way you would an airbag or break recall for a car. Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).
  - 01Michael10 10y ago
    Who supplies security updates for the "lifetime" of their product in your fantasy world? Three years is a good amount of time for security updates but could be extended to four years since people are keeping their phones longer these days. You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
    - danudey 10y ago
      The iPhone 5, introduced in 2012, is getting iOS 10, which means security updates into 2015. That's a five-year span, which is much longer than the average person uses their iPhone 5. iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016). I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead. So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
    - mjevans 10y ago
      With replacement of consumable parts (mostly batteries), I would not be surprised to see current phones in use for 10+ years. Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow. For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need. It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list. This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).
ultramancool 10y ago
Be careful what you wish for, this type of legislation may unintentionally prevent consumer level device modifications like rooting and custom roms which allow security researchers the ability to find these issues and basically restrict this to an NSA level of funding. If I were qualcomm that'd be my first response in order to minimize effort on my part. Ideally Google would just produce a version that was more directly update-able.
- lvs 10y ago
  First, a nitpick that the FCC makes regulation not legislation, and it could do this under existing authority. Second, I think a fine solution would be to force open the buildable source including all drivers and firmwares upon EOL. If top-down security updates will stop, then all components must be open source at that point.
  - mjevans 10y ago
    All information required to build, package, and install; as well as a license for anyone using or working on affected hardware to the copyright and patents involved for use with affected devices.
  - vanattab 10y ago
    Aside from one being voted on by an elected body and on and unelected body what exactly is the difference between regulation and legislation?
- andrey_utkin 10y ago
  I think qualcomm or anybody would have hard time justifying how rooting prevention (which actually already has some place) helps here. I hope this trend also eventually brings us proper no-bullshit free and open-source firmware. As long as there are organizations to request some sanity from vendors.
- sbhere 10y ago
  Disagree. How about a simple "devices selling in excess of 500 units must have security devices updates provided for four years from the first date of sale"? Legislation doesn't have to be onerous. Automobile manufacturers are required to produce parts for a certain number of years in support of their vehicles...
pasbesoin 10y ago
I bought a 2013 Moto X in early 2014. A significant factor in my decision was "owned by Google" and a "promise" of "timely updates". It was significantly less than two years before I was left on a vulnerable version of 5 with no further updates. Well before my two year "phone agreement" or whatever term ('it's not a "contract"') Verizon was then using, was up. Because of a special deal, I'm on a Nexus 5x right now. (That Verizon does not officially support -- whatever...) But it may well be my last Android phone. I've no confidence left in the Andriod ecosystem. I cringe more than a bit at Apple's "walled garden". But, at least they keep it up-to-date. And increasingly, I view the cell phone as a quasi-public medium. If I want true privacy for some aspect of communication, I simply have to take it out-of-band. For the time being, I may also trust the likes of Signal (Whisper Systems). But most other parties I communicate with have no clue and no desire to get one. Fortunately, three letter agencies and scammers don't seem to be too interested in my semi-disfunctional relationships. And I don't do banking, shopping, etc. on the thing nor use email accounts tied to same. P.S. Just found this comment: https://news.ycombinator.com/item?id=12249195 https://news.ycombinator.com/item?id=12249195 http://www.androidcentral.com/quadrooter-5-things-know-about-latest-android-security-scare http://www.androidcentral.com/quadrooter-5-things-know-about... on this thread: https://news.ycombinator.com/item?id=12248824 https://news.ycombinator.com/item?id=12248824 The cited article having a bit more perspective -- albeit one essentially wrapped in speculation as opposed to confirmed fact. And yeah, save your upvotes for the user who actually posted it.
- kevin_thibedeau 10y ago
  The problem you have is with Verizon and their pathetically delayed updates. They do it to tease their impatient customers into new phones with fresh contracts. Just switch to Cyanogen and get your Nougaty goodness today without a middleman to screw you over. And stop buying subsidized carrier phones in the first place. They need to disappear into the annals of history like landline phones owned by AT&T.
  - pasbesoin 10y ago
    Why do you think I switched to a Nexus 5x? For some of my and my family's use when traveling, Verizon is the only non-local carrier to provide coverage. Anyway, as I said, I don't trust the Android "ecosystem". Even if and when one can, sometimes with considerable time and effort, find local maxima within it, it overall just sucks in this respect. By contrast, even on Verizon, Apple has the muscle to tell them to fuck off and to push updates directly. On Verizon, buy an iPhone and you stay as up-to-date as everyone else.
curt15 10y ago
If the OEMs are choosing to sign off on the OS and be the gatekeeper for core system updates, then they effectively own the security flaws and they should be held responsible for defects in their product. To me, this is a consumer protection issue.
mattaltieri 10y ago
I think either what you said needs to happen, or they need to unlock the devices before declaring them EOL so that the user is free to load something open source if they so choose... Or, they could be nice, and allow it from the beginning... Like that's ever going to happen.
posterboy 10y ago
Given that the unsuspecting consumer expects a working device, it would be in the suppliers best interest to keep updating to not be held liable for damages. It's debatable how reasonable that expectation is nowadays. Otherwise the consumer would be liable. I don't think this counts as an unavoidable accident unlike a hail storm might.
wyager 10y ago
Jesus, can we not encourage this? Getting the FCC to more tightly regulate phones will have two primary effects: 1. No more open source phones. We'll be even worse off than we are now. 2. Phone prices go up. Huge regulatory cost increases for little (or perhaps negative) gain. Just because you think devices should be supported for longer doesn't mean you should try to use the government as a bludgeon to screw over poor people, security-oriented people (who don't want locked-down phones in the long run), and tinkerers/open source advocates. A vastly better approach would be to require phones to be open source in the same way as gambling machines in the US. The code isn't entirely out in the open if the company doesn't want it to be, but anyone can audit it. In the case of phones, people could also fix bugs if they wanted to.
- lvs 10y ago
  Elsewhere I've agreed with exactly this. The regulators will inevitably take action on this, and they should, but it's up to us to influence that outcome toward open devices. The device should either be pre-EOL with a process for security review or fully open or both. We want the company to take primary responsibility for the products they sell, obviously.
mercora 10y ago
While i like the idea and most of the others here i think a more practical approach would be to force a labeling requirement for the guaranteed time span a device will get timely security updates. This way it becomes part of the specs manufactures try to be competitive on and therefore creates an incentive to let that number go up. It would be clear from the start what is the lifespan i could expect of the device and makes me able to better understand price advantages which now are often hidden or not exposed.
- mtgx 10y ago
  Maybe a mix of both would work best. Like right now in the EU they are considering making software updates mandatory for all devices for as long as the warranty exists (which is 2+ years for all electronics). Maybe do that, too, in the U.S., and then do something like "We guarantee warranty period +1/+2/+5 years of updates." Smartphones aren't even the devices with the longest lifecycle. Think about all of the "smart TVs" and "smart fridges" out there that people want to use for 10+ years, but they may never get a single update. Something definitely needs to do be about this regulatory wise, and it needs to happen soon before we're already surrounded by dozens of smart electronics everywhere we go, and not one of them had received a single updated after purchase.
smrtinsert 10y ago
This seems like a market thing more than regulation. If you believe Android is always drowning in malware, go iOS.
NEDM64 10y ago
Or you could buy a decent phone from a decent company.

by lvs 10y ago

Someone1234 10y ago

I agree entirely with you. That being said, the FCC is a little toothless, and every time they try and do something consumer friendly the courts kick them in the shins. More likely to see something positive come out of the EU than FCC, but in either case these companies will make changes to all markets because it is more efficient than just doing the EU. Android in particular could learn a lot from Linux's distribution model (package managers, et al). I've been tempted to move to iOS just because of how much better updates and device lifespan are.

lvs 10y ago
At a smaller scale, California or perhaps Massachusetts could do this independently -- as they often do -- and it will have the effect of reverberating across the country.
deleted 10y ago
[deleted]

01Michael10 10y ago

Don't you mean Android phone OEMs and carriers? Google already updates their phones every month for three years which is long enough for a device most people replace or break within two years. Verizon isn't the only carrier of course.

mjevans 10y ago
Security updates need to be for the lifetime of the /device/ through all parties. Think of it the same way you would an airbag or break recall for a car. Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).
- 01Michael10 10y ago
  Who supplies security updates for the "lifetime" of their product in your fantasy world? Three years is a good amount of time for security updates but could be extended to four years since people are keeping their phones longer these days. You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
  - danudey 10y ago
    The iPhone 5, introduced in 2012, is getting iOS 10, which means security updates into 2015. That's a five-year span, which is much longer than the average person uses their iPhone 5. iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016). I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead. So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
  - mjevans 10y ago
    With replacement of consumable parts (mostly batteries), I would not be surprised to see current phones in use for 10+ years. Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow. For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need. It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list. This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).

ultramancool 10y ago

Be careful what you wish for, this type of legislation may unintentionally prevent consumer level device modifications like rooting and custom roms which allow security researchers the ability to find these issues and basically restrict this to an NSA level of funding. If I were qualcomm that'd be my first response in order to minimize effort on my part. Ideally Google would just produce a version that was more directly update-able.

lvs 10y ago
First, a nitpick that the FCC makes regulation not legislation, and it could do this under existing authority. Second, I think a fine solution would be to force open the buildable source including all drivers and firmwares upon EOL. If top-down security updates will stop, then all components must be open source at that point.
- mjevans 10y ago
  All information required to build, package, and install; as well as a license for anyone using or working on affected hardware to the copyright and patents involved for use with affected devices.
- vanattab 10y ago
  Aside from one being voted on by an elected body and on and unelected body what exactly is the difference between regulation and legislation?
andrey_utkin 10y ago
I think qualcomm or anybody would have hard time justifying how rooting prevention (which actually already has some place) helps here. I hope this trend also eventually brings us proper no-bullshit free and open-source firmware. As long as there are organizations to request some sanity from vendors.
sbhere 10y ago
Disagree. How about a simple "devices selling in excess of 500 units must have security devices updates provided for four years from the first date of sale"? Legislation doesn't have to be onerous. Automobile manufacturers are required to produce parts for a certain number of years in support of their vehicles...

pasbesoin 10y ago

I bought a 2013 Moto X in early 2014. A significant factor in my decision was "owned by Google" and a "promise" of "timely updates". It was significantly less than two years before I was left on a vulnerable version of 5 with no further updates. Well before my two year "phone agreement" or whatever term ('it's not a "contract"') Verizon was then using, was up. Because of a special deal, I'm on a Nexus 5x right now. (That Verizon does not officially support -- whatever...) But it may well be my last Android phone. I've no confidence left in the Andriod ecosystem. I cringe more than a bit at Apple's "walled garden". But, at least they keep it up-to-date. And increasingly, I view the cell phone as a quasi-public medium. If I want true privacy for some aspect of communication, I simply have to take it out-of-band. For the time being, I may also trust the likes of Signal (Whisper Systems). But most other parties I communicate with have no clue and no desire to get one. Fortunately, three letter agencies and scammers don't seem to be too interested in my semi-disfunctional relationships. And I don't do banking, shopping, etc. on the thing nor use email accounts tied to same. P.S. Just found this comment: https://news.ycombinator.com/item?id=12249195 https://news.ycombinator.com/item?id=12249195 http://www.androidcentral.com/quadrooter-5-things-know-about-latest-android-security-scare http://www.androidcentral.com/quadrooter-5-things-know-about... on this thread: https://news.ycombinator.com/item?id=12248824 https://news.ycombinator.com/item?id=12248824 The cited article having a bit more perspective -- albeit one essentially wrapped in speculation as opposed to confirmed fact. And yeah, save your upvotes for the user who actually posted it.

kevin_thibedeau 10y ago
The problem you have is with Verizon and their pathetically delayed updates. They do it to tease their impatient customers into new phones with fresh contracts. Just switch to Cyanogen and get your Nougaty goodness today without a middleman to screw you over. And stop buying subsidized carrier phones in the first place. They need to disappear into the annals of history like landline phones owned by AT&T.
- pasbesoin 10y ago
  Why do you think I switched to a Nexus 5x? For some of my and my family's use when traveling, Verizon is the only non-local carrier to provide coverage. Anyway, as I said, I don't trust the Android "ecosystem". Even if and when one can, sometimes with considerable time and effort, find local maxima within it, it overall just sucks in this respect. By contrast, even on Verizon, Apple has the muscle to tell them to fuck off and to push updates directly. On Verizon, buy an iPhone and you stay as up-to-date as everyone else.

curt15 10y ago

If the OEMs are choosing to sign off on the OS and be the gatekeeper for core system updates, then they effectively own the security flaws and they should be held responsible for defects in their product. To me, this is a consumer protection issue.

mattaltieri 10y ago

I think either what you said needs to happen, or they need to unlock the devices before declaring them EOL so that the user is free to load something open source if they so choose... Or, they could be nice, and allow it from the beginning... Like that's ever going to happen.

posterboy 10y ago

Given that the unsuspecting consumer expects a working device, it would be in the suppliers best interest to keep updating to not be held liable for damages. It's debatable how reasonable that expectation is nowadays. Otherwise the consumer would be liable. I don't think this counts as an unavoidable accident unlike a hail storm might.

wyager 10y ago

Jesus, can we not encourage this? Getting the FCC to more tightly regulate phones will have two primary effects: 1. No more open source phones. We'll be even worse off than we are now. 2. Phone prices go up. Huge regulatory cost increases for little (or perhaps negative) gain. Just because you think devices should be supported for longer doesn't mean you should try to use the government as a bludgeon to screw over poor people, security-oriented people (who don't want locked-down phones in the long run), and tinkerers/open source advocates. A vastly better approach would be to require phones to be open source in the same way as gambling machines in the US. The code isn't entirely out in the open if the company doesn't want it to be, but anyone can audit it. In the case of phones, people could also fix bugs if they wanted to.

lvs 10y ago
Elsewhere I've agreed with exactly this. The regulators will inevitably take action on this, and they should, but it's up to us to influence that outcome toward open devices. The device should either be pre-EOL with a process for security review or fully open or both. We want the company to take primary responsibility for the products they sell, obviously.

mercora 10y ago

While i like the idea and most of the others here i think a more practical approach would be to force a labeling requirement for the guaranteed time span a device will get timely security updates. This way it becomes part of the specs manufactures try to be competitive on and therefore creates an incentive to let that number go up. It would be clear from the start what is the lifespan i could expect of the device and makes me able to better understand price advantages which now are often hidden or not exposed.

mtgx 10y ago
Maybe a mix of both would work best. Like right now in the EU they are considering making software updates mandatory for all devices for as long as the warranty exists (which is 2+ years for all electronics). Maybe do that, too, in the U.S., and then do something like "We guarantee warranty period +1/+2/+5 years of updates." Smartphones aren't even the devices with the longest lifecycle. Think about all of the "smart TVs" and "smart fridges" out there that people want to use for 10+ years, but they may never get a single update. Something definitely needs to do be about this regulatory wise, and it needs to happen soon before we're already surrounded by dozens of smart electronics everywhere we go, and not one of them had received a single updated after purchase.

smrtinsert 10y ago

This seems like a market thing more than regulation. If you believe Android is always drowning in malware, go iOS.

NEDM64 10y ago

Or you could buy a decent phone from a decent company.