3 ms·

Given that many many many devices are not patched despite known vulnerabilities, I'd not be overly optimistic about this. Vendors do not provide patches for dev

Given that many many many devices are not patched despite known vulnerabilities, I'd not be overly optimistic about this. Vendors do not provide patches for devices, Vendors go out of business, Users don't patch even when patches are available. This affects everything, routers, phones, IP cameras, you name it. I'd rather expect that the access vectors get noticed and applied by criminals en masse.

mirimir 8y ago
Sure, but the key point is that the access vectors will get noticed, and publicized. And people who pay attention and care (including many criminals) will protect themselves.
anilakar 8y ago
Ah, the horrors of lifecycle management of consumer devices. Every networked product should come with a legally binding A4/letter-sized sheet that clearly shows the last date the product is guaranteed to receive security patches. Not fulfilling the requirements would have to result in a buyback with the sum directly proportional to whatever time of the promised lifetime is left unused. EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.
- TomMarius 8y ago
  > EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software. That is definitely covered by the standard 2 year warranty as insecurity (when security is expected) is seen as defect. If they don't fix it you get your money back. I successfully got my money back for several phones after 1 to 1.5 years.
  - andai 8y ago
    First time I've heard of this, this is really interesting. Don't most phones release updates for the first ~2 years? Maybe this law is the reason?
    - TomMarius 8y ago
      Indeed most phones do. This law however applies to resellers of cheap chinese phones of small brands as well, which was my case.

mirimir 8y ago

Sure, but the key point is that the access vectors will get noticed, and publicized. And people who pay attention and care (including many criminals) will protect themselves.

anilakar 8y ago

Ah, the horrors of lifecycle management of consumer devices. Every networked product should come with a legally binding A4/letter-sized sheet that clearly shows the last date the product is guaranteed to receive security patches. Not fulfilling the requirements would have to result in a buyback with the sum directly proportional to whatever time of the promised lifetime is left unused. EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.

TomMarius 8y ago
> EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software. That is definitely covered by the standard 2 year warranty as insecurity (when security is expected) is seen as defect. If they don't fix it you get your money back. I successfully got my money back for several phones after 1 to 1.5 years.
- andai 8y ago
  First time I've heard of this, this is really interesting. Don't most phones release updates for the first ~2 years? Maybe this law is the reason?
  - TomMarius 8y ago
    Indeed most phones do. This law however applies to resellers of cheap chinese phones of small brands as well, which was my case.