Ongoing support for software-based products is an area where I don't think we have good answers yet. On the one hand, it's unreasonable to expect indefinite sup

Ongoing support for software-based products is an area where I don't think we have good answers yet. On the one hand, it's unreasonable to expect indefinite support and continued development of a product when it's not generating additional revenue to pay for those activities. On the other hand, when it comes to security issues, usually we're not talking about continued development so much as fixing defects in the original product. If you bought a car or a refrigerator and it was found within a reasonable period after the sale that the car would break down suddenly under certain conditions or the fridge wouldn't keep food inside chilled properly, you would expect the manufacturer or vendor to make the product good at their own expense or to compensate you in one way or another; indeed, at least for consumer products, the law in many places would require them to do so. Software companies have been given a bye on this one for a long time, but partly because we've also had a culture where they fixed their mistakes voluntarily. If they're no longer willing to participate in that informal arrangement, maybe it's time for statutory rules about minimum support levels and standardised, transparent disclosure of how long something will or won't be supported for, how updates will be handled, data privacy and portability including after the end of the minimum support period, and so on.