5 ms·
And we don't? I want my phone to be as secure as possible because I use it for work, but of course, since it's not brand new I can't get updates.
by 6d6b73 8y ago
And we don't?
I want my phone to be as secure as possible because I use it for work, but of course, since it's not brand new I can't get updates.
- WrtCdEvrydy 8y agoThat's a symptom of cybersecurity. If a law made a security bug a refundable or warrantied defect, I bet you this shit would stop. But noone gives a shit.
- hnnh44 8y agoIt would also seriously stymie innovation. If I risk having to refund an item when I push out improvements, I'm never bothering to push out improvements except bug fixes. I'm also incentivized to release a new model every month with ANY improvement in order to limit my liability to a smaller window of revenue. The current system isn't perfect, but it could be much worse.
- WrtCdEvrydy 8y agoWhat's worse that thousands of pieces of throwaway hardware that don't get updates? How about thousands of enterprise systems where the security updates are hidden behind support contacts? > when I push out improvements No, if your software has a security issue, it's refundable. Write good software. > release a new model every month with ANY improvement Good, but that doesn't remove your liability from your last model.
- joshuamorton 8y ago>No, if your software has a security issue, it's refundable. Write good software. There are 0 companies that can provide consumer software on the lifecycle consumers have come to expect without any bugs. You write software. Are you willing to claim that you can just "write good software" and never ship anything with a security issues? Because otherwise you're advocating for consumer tools that use nasa's release cycle. Which like, that's cool and all but I don't want to rely on hardware from 2012 or 2005 running software that was developed from 2010-2014 and has just finished its verification process. You're advocating for a world where we just got the verifiably bug-free Nokia 3310. And that doesn't even begin to discuss the clusterfuck that would be open-source in this situation. Am I liable for heartbleed because I use OpenSSL? Are the openSSL devs?
- WrtCdEvrydy 8y agoSame bullshit argument was made about GDPR and we survived that... there's just too much money to be made by outsourcing your shitty code's security bugs onto the customer.
- joshuamorton 8y agoThose aren't the same though. GDPR is basically "you are liable if you are actively exploited and data is stolen". You're saying that a company is liable if they ship bugs, which the GDPR absolutely doesn't care about.
- WrtCdEvrydy 8y ago> you are actively exploited and data is stolen Not even close, you are liable for keeping the data you collect as a data processor or controller safe.
- joshuamorton 8y agoAnd "encrypt data at rest" is most of what you need to do to comply with the GDPRs data security stuff. Which again, is nothing like "write bug free code or you're liable".
- WrtCdEvrydy 8y ago> encrypt data at rest What? No, you have to have a DPO, provide clear language on what you do with data, who it's shared with and no intrusive prompts having opt-in by default just to have a few.
- joshuamorton 8y agoNone of those things have to do with the actual security of your code/data storage. They're procedural. The GDPR focuses on procedural liabilities. You're asking for application level liabilities, which like I've said 3 times now, are a whole different ballgame. Since you're so deadset on this, I'll just ask again: Who is liable for Heartbleed or for Meltdown? Who gets sued, and for how much, and why?
- ribosometronome 8y agoThis update is available to iPhones from the 5S and newer. The 5S was released in 2013. If your phone is older than that, it's a bit older than "not brand new".
- jtbayly 8y agoI think the point is that he has an Android, but he can't update, while Apple users can.
- he6s4vyu 8y agoIf he bought an Android it's because he doesn't care about the security of his phone. Not trying to be snarky; Android has been around for over 10 years and we all know how irresponsible all OEMs are, including Google. He had the information when he made his purchase.
- skybrian 8y agoOr alternately, you buy from Google, keep up with OS upgrades, and plan on buying a new phone every 2-3 years or so. While not ideal, this is certainly doable.
- scarface74 8y agoSo the only way that you can get an Android phone with any type of security is by buying one from Google. So much for Andy Rubin and his promise of openness and choices...