32 ms·

I am generally in favor of being able to repair things, but this is complicated and I have yet to see a good discussion (let alone legislative proposal) that ta

I am generally in favor of being able to repair things, but this is complicated and I have yet to see a good discussion (let alone legislative proposal) that takes into account all of the nuance I see as necessary: 1. There has definitely been abuse of cryptographic locking by parties such as John Deer. I feel that places where such locking is used only to prevent third-party repairs it should be illegal. 2. I feel that manufacturers should have ways of showing that third-party repairs have been done, and so enable them to make reasonable denials of warranty claims when those repairs are the cause of damage (no idea how to codify that into law). 3. There are cases, such as the touch-id sensor on Apple's iPhone that are legitimate cases of cryptographic locking. Absent that there is no way for Apple to defend against hardware-based attacks without this locking, and they need to have some way of trusting technicians (and the hardware involved) who make replacements. There is a complicated conversation to be had here (an no-one seems to be having it). 4. Devices that are built to be repaired are in the general best-interests of everyone at large (e.g.: environmental issues), but the forces of capitalism are generally against reuse. So we clearly need some system to rebalance the scales a bit, but how to do this without killing progress seems difficult (e.g.: the system-on-a-chip makes most of the guts of a cell phone one piece, and that is the direction of better devices). (edited for better spacing)

laughinghan 7y ago
I love everything about your discussion. 1. 100% agree 2. I've thought a little bit about this. I think it would be fine if the warranty can't be voided if the consumer can show in court that there's a preponderance of evidence that the issue they're having is unrelated to the third-party repair. This might mean in practice warranties hard to enforce if you've gone in for third-party repair, but I feel like usually it's old devices that you're fixing with third-parties anyway. It's also possible there's a perverse incentive to make components very sensitive to the case being opened or something, but it seems unlikely that that's possible without making the device fragile overall in situations where it would still be covered by warranty, which would cost the manufacturer money and also make the device less popular in the first place. Another thing I was thinking, either instead of or supplemental to such a policy, is to require manufacturers of a certain size to have an open certification program that third-party repair shops can participate in, and to honor warrantees if repair has only been done by certified shops. This could be abused if the manufacturer makes the certification program really really shitty so no one does it, and if repairs by the manufacturer themselves is a huge revenue stream then that would almost certainly what would happen; but someone like Apple makes most their money selling new devices (I assume), so why risk the fines from regulators and the bad PR? And so while Apple won't have much incentive to make it easy to get certified, the fact that they have to honor warrantees of devices repaired by certified shops means they'll at least be incentivized to teach the certified shops not to break the devices. 3. I'm skeptical of the importance of this. The security should be in the entropy of my fingerprint, not the right fingerprint scanner being used, no? Like how locking down which keyboard are allowed to be connected to your laptop is not important to securing the password lock? Spyware on the touch ID sensor is worrisome, but no more than spyware on any of the other input sensors, and is there really anything the manufacturer can do, technically rather than legally, about someone who physical accesses to your device and then hands it back to you to put your fingerprint and password back into? 4. This seems to me like a lack of information problem and an incentives structure problem. In theory, if everyone had total information and knew which of the alternatives lasted the longest and therefore had the lowest total-cost-of-owernship, and some kind of financial engineering let them buy the product on lease or something so the upfront cost could be competitive with the cheaper, shorter-lived alternatives, then everyone would do that, right? The main theoretical problem here is designing the "lease" to incentivize the consumer to take good care of the product, without being predatory; if we had that, we wouldn't even need total information because it could be viable for the vendor to provide the product on lease or something with a low upfront cost. Obviously there's a lot of other practical problems like, people who buy new smartphones usually don't want it to last 10 years, they want the latest and greatest cutting edge device; but that seems like it could maybe be solved by saying, you pay $200 now and give us the phone back in 2 years; if you don't give it back then, in 2 years we charge you another $400 (or something?); and then reselling the refurbished phone? There's also the fact that lots of people who buy iPhones specifically like it in part for the status symbol, so they're not looking for the lowest upfront cost. But the idea that the right pricing structure should theoretically let a company that makes a long-lasting, repairable device with a low total-cost-of-ownership be competitive seems like it should be possible, no?
- CDSlice 7y ago
  I think that for 3 the problem isn't having a spyware fingerprint sensor that steals your fingerprint but rather having a fake fingerprint reader that always reports a match which would let you break into any iPhone.
  - brokenmachine 7y ago
    Seems silly to me if that's the way it works. Why not have a "dumb" reader and verify the fingerprint on the main CPU? You're just adding complexity with having to have a secure channel between the reader and the CPU.
  - magduf 7y ago
    I know someone else said this, but why would the sensor be verifying anything at all? It should just be reading the pattern of the fingerprint, and feeding that to the CPU where it's verified in software. Does your keyboard store all your passwords and let your OS know your login was valid? Of course not. The keyboard just tells the OS which keys you pressed.
magduf 7y ago
>4. Devices that are built to be repaired are in the general best-interests of everyone at large (e.g.: environmental issues), but the forces of capitalism are generally against reuse. So we clearly need some system to rebalance the scales a bit, but how to do this without killing progress seems difficult (e.g.: the system-on-a-chip makes most of the guts of a cell phone one piece, and that is the direction of better devices). I don't see how it's a difficult concept that not everything needs to be repairable at the molecular level. Is a phone "less repairable" because it uses a CPU instead of discrete logic chips? Is some 1971-vintage arcade game "less repairable" because it uses discrete logic chips instead of resistors and transistors? Is some electronic item from the 60s "less repairable" because it uses resistors and transistors instead of resistors and diodes? It's pretty simple: if a part is easily available in a factory for assembly into a final device, that's probably a repair part. For a modern smartphone, that would be the motherboard, not the CPU. (It is possible to replace cellphone CPUs however, but it's a very difficult operation requiring special equipment and training.) For legal issues, however, I think it's pretty simple: if the manufacturer is able to repair it, then anyone should be able to offer that same service, if they can acquire the tools. No one should be held back by laws that only benefit the manufacturer. >1. There has definitely been abuse of cryptographic locking by parties such as John Deer. I feel that places where such locking is used only to prevent third-party repairs it should be illegal. This is much trickier than the SoC issue, but I agree with you: if the only purpose of something is to prevent 3rd-party repairs or replacement parts (as with printer ink/toner), then it should be illegal.

laughinghan 7y ago

I love everything about your discussion. 1. 100% agree 2. I've thought a little bit about this. I think it would be fine if the warranty can't be voided if the consumer can show in court that there's a preponderance of evidence that the issue they're having is unrelated to the third-party repair. This might mean in practice warranties hard to enforce if you've gone in for third-party repair, but I feel like usually it's old devices that you're fixing with third-parties anyway. It's also possible there's a perverse incentive to make components very sensitive to the case being opened or something, but it seems unlikely that that's possible without making the device fragile overall in situations where it would still be covered by warranty, which would cost the manufacturer money and also make the device less popular in the first place. Another thing I was thinking, either instead of or supplemental to such a policy, is to require manufacturers of a certain size to have an open certification program that third-party repair shops can participate in, and to honor warrantees if repair has only been done by certified shops. This could be abused if the manufacturer makes the certification program really really shitty so no one does it, and if repairs by the manufacturer themselves is a huge revenue stream then that would almost certainly what would happen; but someone like Apple makes most their money selling new devices (I assume), so why risk the fines from regulators and the bad PR? And so while Apple won't have much incentive to make it easy to get certified, the fact that they have to honor warrantees of devices repaired by certified shops means they'll at least be incentivized to teach the certified shops not to break the devices. 3. I'm skeptical of the importance of this. The security should be in the entropy of my fingerprint, not the right fingerprint scanner being used, no? Like how locking down which keyboard are allowed to be connected to your laptop is not important to securing the password lock? Spyware on the touch ID sensor is worrisome, but no more than spyware on any of the other input sensors, and is there really anything the manufacturer can do, technically rather than legally, about someone who physical accesses to your device and then hands it back to you to put your fingerprint and password back into? 4. This seems to me like a lack of information problem and an incentives structure problem. In theory, if everyone had total information and knew which of the alternatives lasted the longest and therefore had the lowest total-cost-of-owernship, and some kind of financial engineering let them buy the product on lease or something so the upfront cost could be competitive with the cheaper, shorter-lived alternatives, then everyone would do that, right? The main theoretical problem here is designing the "lease" to incentivize the consumer to take good care of the product, without being predatory; if we had that, we wouldn't even need total information because it could be viable for the vendor to provide the product on lease or something with a low upfront cost. Obviously there's a lot of other practical problems like, people who buy new smartphones usually don't want it to last 10 years, they want the latest and greatest cutting edge device; but that seems like it could maybe be solved by saying, you pay $200 now and give us the phone back in 2 years; if you don't give it back then, in 2 years we charge you another $400 (or something?); and then reselling the refurbished phone? There's also the fact that lots of people who buy iPhones specifically like it in part for the status symbol, so they're not looking for the lowest upfront cost. But the idea that the right pricing structure should theoretically let a company that makes a long-lasting, repairable device with a low total-cost-of-ownership be competitive seems like it should be possible, no?

CDSlice 7y ago
I think that for 3 the problem isn't having a spyware fingerprint sensor that steals your fingerprint but rather having a fake fingerprint reader that always reports a match which would let you break into any iPhone.
- brokenmachine 7y ago
  Seems silly to me if that's the way it works. Why not have a "dumb" reader and verify the fingerprint on the main CPU? You're just adding complexity with having to have a secure channel between the reader and the CPU.
- magduf 7y ago
  I know someone else said this, but why would the sensor be verifying anything at all? It should just be reading the pattern of the fingerprint, and feeding that to the CPU where it's verified in software. Does your keyboard store all your passwords and let your OS know your login was valid? Of course not. The keyboard just tells the OS which keys you pressed.

magduf 7y ago

>4. Devices that are built to be repaired are in the general best-interests of everyone at large (e.g.: environmental issues), but the forces of capitalism are generally against reuse. So we clearly need some system to rebalance the scales a bit, but how to do this without killing progress seems difficult (e.g.: the system-on-a-chip makes most of the guts of a cell phone one piece, and that is the direction of better devices). I don't see how it's a difficult concept that not everything needs to be repairable at the molecular level. Is a phone "less repairable" because it uses a CPU instead of discrete logic chips? Is some 1971-vintage arcade game "less repairable" because it uses discrete logic chips instead of resistors and transistors? Is some electronic item from the 60s "less repairable" because it uses resistors and transistors instead of resistors and diodes? It's pretty simple: if a part is easily available in a factory for assembly into a final device, that's probably a repair part. For a modern smartphone, that would be the motherboard, not the CPU. (It is possible to replace cellphone CPUs however, but it's a very difficult operation requiring special equipment and training.) For legal issues, however, I think it's pretty simple: if the manufacturer is able to repair it, then anyone should be able to offer that same service, if they can acquire the tools. No one should be held back by laws that only benefit the manufacturer. >1. There has definitely been abuse of cryptographic locking by parties such as John Deer. I feel that places where such locking is used only to prevent third-party repairs it should be illegal. This is much trickier than the SoC issue, but I agree with you: if the only purpose of something is to prevent 3rd-party repairs or replacement parts (as with printer ink/toner), then it should be illegal.