3 ms·

Making it easier for users to run software with unpatched vulnerabilities, even accounting for some extra slowness, isn’t a good thing..

dredmorbius 9y ago
That "isn't a good thing" is paired against another "isn't a good thing": forcing people along an (expensive, disruptive, often utility-losing) upgrade path simply to drive revenue goals. Perhaps we might look at this as a set of goals: 1. Users shouldn't run software with unpathed vulnerabilitities. 2. Users shouldn't have to discard devices after a small number of years (1-3, from date of purchase, in many cases). 3. Hardware, OS, and software vendors should have a functioning ecosystem in which they can operate profitably. Unfortunately, the economics of hardware + information goods with an ongoing support liability but a one-time purchase point are pretty much pathological. This isn't a new problem. It's one that AT&T and IBM solved, in the 1930s and earlier, by leasing rather than selling hardware. IBM has continued that model through the present, for its enterprise computing hardware. There are few general-public devices that fall under this category, though.
- d10r 9y ago
  I think a fundamental problem here is that most information and knowledge goods don't fit well into an economic framework which is based on the assumption of scarcity. Of course you can artificially add scarcity with DRM tech, patent law etc. But what mostly happens in practice is that you need to come up with some kind of indirect business model. Like e.g. Google, developing a lot of great tech, but ultimately being a broker of user attention and data. This disconnect between business model and products leads to a lot of unaligned incentives between makers and users of product. That's the innocent looking root of evilness - no bad people required.
  - dredmorbius 9y ago
    Pretty much, yes. Market economics works for commodities. For wages, it tends to subsistence levels. For public goods (including information) it under-provisions. For rents (fixed-quantity goods or services, including both land and attention), this tends to absorb surplus valley. For assets and risk-based elements, I'm still sorting out the dynamics, though they also appear to be poor. There's various precedent for much of this: * Adam Smith's classifications of types of goods: commodities, wages, stock (capital), rents, assets (gold and silver), interest, and "expenses of the sovereign" (public goods). * Various economic-sector classifications. Alexandre Dumas, Simon Kuznets, Clark, and Beniger come up with 3-5 elements, generally: extractive/sourcing, manufacture & construction, transport and distribution, risk and finance (especially FIRE), governance and information. I'm finding these fascinating. * Industrial classifications including SIC, NAICS, and ISIC. * A classification of technological methods I've been looking at for a few years, including materials, networks, information, control, knowledge, and power transmission & transformation. But yes: inoformation and markets play poorly. Software and systems incorporate both information and risk elements. (And probably others.)
CaptSpify 9y ago
Then manufacturers should fix that problem. The reason people don't like security updates, is that they are tied to feature updates. Most people don't like the new feature updates, and would happily take just the security updates. If users were given that option, I'm betting that a lot of the push-back to updates would drop fast.
- ben_w 9y ago
  I bet most people find digital security too abstract to understand why it’s important, and not bother with updates that didn’t include shiny new features. Also, Generic Phones Inc. don’t see any money in pushing out pure security features — only big players get that benefit, because it’s a type of quality thats a tragedy of the commons thing. I’d change the laws by international treaty to require security patches for all devices for whatever the 2σ lifetime is. If the manufacturers don’t want to do it themselves, then an open source requirements and a sales tax to fund hiring developers to fix it.
  - CaptSpify 9y ago
    I'm arguing the opposite: I think people would update if updates didn't break their shit. I have no statistics on this, and would gladly welcome some, but IME people heavily complain that "the last update broke my $x, so I don't want to update again". If we had 2 different channels of updates: security and feature, then this wouldn't be an issue. I completely agree with you about the laws and open-sourcing.
- 0xfeba 9y ago
  Manufacturers have no incentive now to do so.
  - CaptSpify 9y ago
    They absolutely do. Android is known to be a security nightmare. That means a bad reputation, which also means less sales. I hate Apple and their products, but if someone said that they got an iPhone because it's more secure than Android, I can't really argue that they are wrong.

dredmorbius 9y ago

That "isn't a good thing" is paired against another "isn't a good thing": forcing people along an (expensive, disruptive, often utility-losing) upgrade path simply to drive revenue goals. Perhaps we might look at this as a set of goals: 1. Users shouldn't run software with unpathed vulnerabilitities. 2. Users shouldn't have to discard devices after a small number of years (1-3, from date of purchase, in many cases). 3. Hardware, OS, and software vendors should have a functioning ecosystem in which they can operate profitably. Unfortunately, the economics of hardware + information goods with an ongoing support liability but a one-time purchase point are pretty much pathological. This isn't a new problem. It's one that AT&T and IBM solved, in the 1930s and earlier, by leasing rather than selling hardware. IBM has continued that model through the present, for its enterprise computing hardware. There are few general-public devices that fall under this category, though.

d10r 9y ago
I think a fundamental problem here is that most information and knowledge goods don't fit well into an economic framework which is based on the assumption of scarcity. Of course you can artificially add scarcity with DRM tech, patent law etc. But what mostly happens in practice is that you need to come up with some kind of indirect business model. Like e.g. Google, developing a lot of great tech, but ultimately being a broker of user attention and data. This disconnect between business model and products leads to a lot of unaligned incentives between makers and users of product. That's the innocent looking root of evilness - no bad people required.
- dredmorbius 9y ago
  Pretty much, yes. Market economics works for commodities. For wages, it tends to subsistence levels. For public goods (including information) it under-provisions. For rents (fixed-quantity goods or services, including both land and attention), this tends to absorb surplus valley. For assets and risk-based elements, I'm still sorting out the dynamics, though they also appear to be poor. There's various precedent for much of this: * Adam Smith's classifications of types of goods: commodities, wages, stock (capital), rents, assets (gold and silver), interest, and "expenses of the sovereign" (public goods). * Various economic-sector classifications. Alexandre Dumas, Simon Kuznets, Clark, and Beniger come up with 3-5 elements, generally: extractive/sourcing, manufacture & construction, transport and distribution, risk and finance (especially FIRE), governance and information. I'm finding these fascinating. * Industrial classifications including SIC, NAICS, and ISIC. * A classification of technological methods I've been looking at for a few years, including materials, networks, information, control, knowledge, and power transmission & transformation. But yes: inoformation and markets play poorly. Software and systems incorporate both information and risk elements. (And probably others.)

CaptSpify 9y ago

Then manufacturers should fix that problem. The reason people don't like security updates, is that they are tied to feature updates. Most people don't like the new feature updates, and would happily take just the security updates. If users were given that option, I'm betting that a lot of the push-back to updates would drop fast.

ben_w 9y ago
I bet most people find digital security too abstract to understand why it’s important, and not bother with updates that didn’t include shiny new features. Also, Generic Phones Inc. don’t see any money in pushing out pure security features — only big players get that benefit, because it’s a type of quality thats a tragedy of the commons thing. I’d change the laws by international treaty to require security patches for all devices for whatever the 2σ lifetime is. If the manufacturers don’t want to do it themselves, then an open source requirements and a sales tax to fund hiring developers to fix it.
- CaptSpify 9y ago
  I'm arguing the opposite: I think people would update if updates didn't break their shit. I have no statistics on this, and would gladly welcome some, but IME people heavily complain that "the last update broke my $x, so I don't want to update again". If we had 2 different channels of updates: security and feature, then this wouldn't be an issue. I completely agree with you about the laws and open-sourcing.
0xfeba 9y ago
Manufacturers have no incentive now to do so.
- CaptSpify 9y ago
  They absolutely do. Android is known to be a security nightmare. That means a bad reputation, which also means less sales. I hate Apple and their products, but if someone said that they got an iPhone because it's more secure than Android, I can't really argue that they are wrong.