5 ms·
Microsoft isn't entirely wrong, and "right to repair" advocates conspicuous failure to acknowledge this tradeoff is one of the weaker and more irritating parts
by xoa 7y ago
Microsoft isn't entirely wrong, and "right to repair" advocates conspicuous failure to acknowledge this tradeoff is one of the weaker and more irritating parts of the movement. Note tradeoff as the word, it's not as if good things don't come with it too, nor does it mean the same weighting applies to everyone. It doesn't mean that those who want to shouldn't be able to hack on their devices. A similar tradeoff applies to pure software signing, where I am very much in favor of a legal requirement that hardware "possessors" [1] should be able to load their own master signing keys into any cryptographic roots of trust, and thus be able to run software of their choice with no further relationship with the manufacturer even in a system that has full signing required.
But the power to do that is also the power to screw it up. If any 3rd party can repair something like biometric hardware, any 3rd party could also compromise said hardware. Some people may find the benefits of the former outweigh the latter, but I do think it should be a choice in the law, and that liability should adjust accordingly. Ie., you can upfront on buying a device request that it not enforce cryptographic reqs for hardware repairs (this could be controlled by a permanent fuse or many other ways), but alternately you can also request that continue to be a requirement. In my case for example I do not want to buy an iPhone that is "right to repair enabled". I don't want the magic circle of who can mess with it expanded any further than the minimum, which is Apple themselves who are by definition inside the tent anyway.
I also think the "right to repair" movement is a symptom rather then cause thing, and obscures the real problem for the vast majority of the market. The true core issue is that, in America in particular, legal standards for fitness for purpose are simply way, way too loose. The reasonable expectation most people have for buying something expensive is that it'll be in working order for a proportionate number of years. Not forever of course, but a $200-400+ bit of electronics shouldn't be dead in 13 months either. A $500-1k one should probably last at least 4-5 years without further cost, etc. The retail price should reflect whatever it takes to make that happen. Manufacturers are the ones in a position to deal with that, who have the best stats on failure rates, and can make decisions about tradeoffs between cheapness of repairs, more on QA, where more expensive repair reqs might reduce repair need even farther in the first place (or provide other feature value), etc. It simply shouldn't be the consumers' problem at all, beyond evaluating the retail price. Yet it's completely standard to have something ludicrous like a single year warranty.
Essentially, it's a classic market Externality problem. Everyone does expect their devices to last, but are forced to roll the dice on whether they specifically have bad luck and have to pay expensive rare repairs all by themselves. The manufacturer gets to advertise an artificially low price but externalizing the failure rate percentage onto the customers, and even charge extra for what should be standard. Instead warranties should be adaptive, something like "1 month for every $12 retail price up to a maximum of 5 years" say. Then let the market sort it out from there. I'm worried "right to repair" will ultimately be camouflage that let manufacturers skip out on their real responsibilities in some cases. Right to repair could make out of warranty repairs cheaper, but you shouldn't have to pay at all within a reasonable normal life.
----
1: which would be defined as something alone the lines of "anyone who has paid, either upfront or on an ongoing plan basis, for hardware and possesses the right to control access to it." Lawyers could make it watertight, but basically a definition which would explicitly not allow any sort of "oh we were only leasing it to them!" loopholes.
- jeremyjh 7y agoIf I upgrade my phone every 12 or 18 months, I shouldn't have to pay extra for a 3 year warranty. It should be optional to purchase that warranty, just like it is today.
- xoa 7y agoYes, you should. If you choose to throw that phone in the garbage after 12-18 months, you should pay a price for wasting something that should last much longer. If like a normal person you instead just wipe it and sell it (or pass it on) then you will recover remaining value anyway.
- 8note 7y agonot from a warranty though; some kind of pollution tax instead
- jeremyjh 7y agoNothing needs to be thrown in the garbage. My point is only that insurance costs money, and not everyone may see the need to pay it. So it shouldn't be built into the cost of everything. I myself currently uses an iPhone 6 and recently paid to have its battery replaced.
- stefan_ 7y agoYou are deluding yourself if you think cryptography can be the solution to an attacker with access to the physical machine. No crypto in the world can help you if I simply bug the fricking physical keyboard!
- xoa 7y ago>You are deluding yourself if you think cryptography can be the solution to an attacker with access to the physical machine. Of course it can be part of a solution. Responses like yours, which display zero consideration of threat scenarios, time/info/resource costs, or any potential improvements are somewhat tiresome these days. >No crypto in the world can help you if I simply bug the fricking physical keyboard! I'm sorry, can you point to that "fricking physical keyboard" on my iPhone? I'll wait. And even if you want to talk purely about PCs and attached keyboards, there is no inherent reason those couldn't be locked down too were it a general problem, and have a system refuse to trust any peripheral by default. HSMs can also be part of an overall plan that can mitigate some damage even from a keyboard bug. Furthermore, breaking into a private residence or business is a significantly more time/information/resource intensive problem then subverting a centralized repair place through which lots of hardware passes and is left unattended, and which will not in fact generally include peripherals (if my computer is broken, I bring just the computer in, not the keyboard/mouse/monitor).