4 ms·
It's hard to see how this could be enforced meaningfully. After all, who gets to decide if the updates represent a reasonable effort at bug fixing and security
by simonh 5y ago
It's hard to see how this could be enforced meaningfully. After all, who gets to decide if the updates represent a reasonable effort at bug fixing and security patching? What's to stop a company throwing out rudimentary updates as a box ticking exercise? In some ways that could be worse by creating a superficial appearance that phones are up to date.
- foepys 5y agoHow about "you didn't fix a known security flaw within 3 months, pay 10% of MSRP to all your customers"?
- simonh 5y agoSounds wonderful, but the entire Android platform relies on patches from upstreams (Linux kernel devs, Google, device driver vendors. Numerous other open source projects that contribute critical components). Timelines like that simply aren't possible. It would kill Android stone dead.
- southerntofu 5y agoI upvoted because it's an actual concern, but don't agree with your point. Of course non-profit vendors should be excluded from such regulations, providing a best-effort solution. For other vendors, that would actually be a feature. It would incentivize hardware manufacturers to stop bundling bad/broken Androids with their hardware, open the bootloader and partner with serious free-software organizations who won't break your system or backdoor it. If you really want to roll out broken software for your customers and not give them a choice, pay up.
- tgsovlerkhgsel 5y agoThen the commercial upstreams will have to provide patches in time in order to still be able to sell their products downstream-wards. For the open source upstreams... I've heard they accept patches. If not, the source is open, the downstream vendors can fix that. They can even put together a pool, pay into it together, and use the pooled money to develop (and hopefully upstream) a patch...
- ryan93 5y agoHow do you people never consider the difficulty of implementing these policies. I dont get why some people love new rules and schemes so much.
- VortexDream 5y agoThese are massive companies with revenue in the billions of dollars. If this was regulated, they would figure it out. Frankly, in a lot of cases, it's their own fault that phones aren't updated anymore, not because of any inherent difficulties. If a handful of volunteers can push the latest Lineageos to 7 year odl devices, then Samsung can too. It's just that they have no financial incentive to do so and there are no regulations forcing them to implement what's necessary for long-term support.
- baggy_trough 5y agoThey have no financial incentive to do so because people don't care. So why should the government try to substitute its own remote, bureaucratic judgement?
- VortexDream 5y agoPeople generally don't see long-term or on a societal level. Do you think most people wanted seatbelts or the founding of the EPA? A lot of times these are issues that are outside the purview of individuals, outside of their visibility. Most people only care about a small number of things like where their next paycheck is coming from and what to wear going out tonight. This is what government is for.
- postingawayonhn 5y agoMany phone manufacturers really struggle to make a profit. See HTC, LG, Nokia, etc.
- worldofmatthew 5y agoThis will put many smaller brands out of business, driving up prices on the poor. Most lower end brands barely make a profit as if (often selling at a loss when doing sales).
- Vespasian 5y agoIt could be enforced on EU level through CE compliance. No updates -> No sale of future models Reasonable (security) updates could, for example, include a timely reaction to published vulnerability, A (responsible) disclosure process etc.
- wizzwizz4 5y agoI was going to argue, but this could be considered an environmental concern – and hence, it would be in the remit of CE.
- Vespasian 5y agoCouldn't the CE requirements just be expanded to include "software security"? Environmentalism and sustainability are the political motivation but are not legally required afaik.
- Manfred 5y agoYou write down a set of pretty good guidelines and then let it go to court when a manufacturer is found lacking. Court decides. Update guidelines, repeat.
- kwertzzz 5y agoOne could check if the phone is vulnerable to any published issues in the CVE database. (I applaud this effort in reducing e-waste).
- ryukafalz 5y agoI think there are some pretty clear-cut cases where it's easy to argue that a phone isn't up to date. For example: a critical severity vuln in the Linux kernel that's already been patched upstream >6m ago, but that phones don't have yet. If this legislation starts to get the SOC manufacturers and device manufacturers to play ball, I think it could be a huge win.
- eptcyka 5y agoForce listing specific CVEs that have been fixed. A big enough issue currently is that different devices with the same chipsets won't always get the same firmware fixes, thus this ckuld easily be hepled via market competition - if a device A has a fix and device B doesn't, the manufacturer of B can either explain it or pay the fine.