5 ms·

This is worse, in a way - from what I can tell at the point of purchase the system didn't have the problematic data collection - that was added later in an upda

This is worse, in a way - from what I can tell at the point of purchase the system didn't have the problematic data collection - that was added later in an update. Even a savvy consumer who researched which product to buy would be screwed in this circumstance. It does seem to me that once a product is purchased, it ought to remain usable and supported under the terms it was purchased under, but that seems a long way from the current laws around user agreements.

bunderbunder 8y ago
The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase. That said, I'm not sure you can really pin this down. It's probably better to just assume that any device that requires a wi-fi connection to work is phoning home until proven otherwise. And you have to assume that any device that phones home is collecting data. It's not even a secret that this is the case. Pretty much every time I go to a lunch-and-learn for a data product, the major premise of the obligatory client case study is, "We sell this consumer product that does X, but our most exciting product is actually all the data we can harvest from it and then resell."
- lazyjones 8y ago
  > The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase. This is IMHO a broader issue with products that receive firmware or OTA updates, it's probably legally a breach of contract already to modify products after sale and change functionality to the disadvantage of the consumer.
  - bunderbunder 8y ago
    You mean the contracts saying that the vendor gets to do exactly that that we all sign without reading?
  - leggomylibro 8y ago
    Example off the top of my head: you have devices in the field which have not received an update since they were purchased 10 years ago. A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc. But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.) You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.
    - lazyjones 8y ago
      > What do you do? Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.
      - leggomylibro 8y ago
        The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread. But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".
  - pbhjpbhj 8y ago
    I bought a Roku via NowTV, and used it for NowTV and sideloaded an app for local media display on our TV (music, family photos). Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload. In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification. In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again. Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.
- dvfjsdhgfv 8y ago
  > any device that requires a wi-fi connection to work is phoning home until proven otherwise. It's really beyond me why people are buying these devices in case the wifi functionality is completely superfluous and has nothing to do with the main function of the device. It's like asking "hello strangers, tap me and track what I'm doing". This crap needs to stop.
- LoSboccacc 8y ago
  I think this should be approached more broadly, making void any clause on contracts that allow unilateral modification on the contract at a later date

bunderbunder 8y ago

The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase. That said, I'm not sure you can really pin this down. It's probably better to just assume that any device that requires a wi-fi connection to work is phoning home until proven otherwise. And you have to assume that any device that phones home is collecting data. It's not even a secret that this is the case. Pretty much every time I go to a lunch-and-learn for a data product, the major premise of the obligatory client case study is, "We sell this consumer product that does X, but our most exciting product is actually all the data we can harvest from it and then resell."

lazyjones 8y ago
> The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase. This is IMHO a broader issue with products that receive firmware or OTA updates, it's probably legally a breach of contract already to modify products after sale and change functionality to the disadvantage of the consumer.
- bunderbunder 8y ago
  You mean the contracts saying that the vendor gets to do exactly that that we all sign without reading?
- leggomylibro 8y ago
  Example off the top of my head: you have devices in the field which have not received an update since they were purchased 10 years ago. A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc. But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.) You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.
  - lazyjones 8y ago
    > What do you do? Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.
    - leggomylibro 8y ago
      The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread. But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".
- pbhjpbhj 8y ago
  I bought a Roku via NowTV, and used it for NowTV and sideloaded an app for local media display on our TV (music, family photos). Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload. In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification. In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again. Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.
dvfjsdhgfv 8y ago
> any device that requires a wi-fi connection to work is phoning home until proven otherwise. It's really beyond me why people are buying these devices in case the wifi functionality is completely superfluous and has nothing to do with the main function of the device. It's like asking "hello strangers, tap me and track what I'm doing". This crap needs to stop.
LoSboccacc 8y ago
I think this should be approached more broadly, making void any clause on contracts that allow unilateral modification on the contract at a later date