3 ms·

> The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase. This is IMHO a broader issue

> The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase. This is IMHO a broader issue with products that receive firmware or OTA updates, it's probably legally a breach of contract already to modify products after sale and change functionality to the disadvantage of the consumer.

bunderbunder 8y ago
You mean the contracts saying that the vendor gets to do exactly that that we all sign without reading?
leggomylibro 8y ago
Example off the top of my head: you have devices in the field which have not received an update since they were purchased 10 years ago. A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc. But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.) You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.
- lazyjones 8y ago
  > What do you do? Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.
  - leggomylibro 8y ago
    The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread. But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".
pbhjpbhj 8y ago
I bought a Roku via NowTV, and used it for NowTV and sideloaded an app for local media display on our TV (music, family photos). Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload. In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification. In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again. Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.

bunderbunder 8y ago

You mean the contracts saying that the vendor gets to do exactly that that we all sign without reading?

leggomylibro 8y ago

Example off the top of my head: you have devices in the field which have not received an update since they were purchased 10 years ago. A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc. But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.) You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.

lazyjones 8y ago
> What do you do? Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.
- leggomylibro 8y ago
  The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread. But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".

pbhjpbhj 8y ago

I bought a Roku via NowTV, and used it for NowTV and sideloaded an app for local media display on our TV (music, family photos). Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload. In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification. In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again. Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.