6 ms·

There is an easy solution to this problem. Pass a new "right to repair" law, such that any OEM that halts software patches on any network-connected device for

by chasil 5y ago

There is an easy solution to this problem. Pass a new "right to repair" law, such that any OEM that halts software patches on any network-connected device for more than 6 months will be required to unlock bootloaders and publish technical specs. Apple and Android will see enormous and wonderful community involvement if that were to happen, and congress could force it, should we motivate them.

buu700 5y ago
I've had some similar ideas: https://news.ycombinator.com/item?id=28247651 https://news.ycombinator.com/item?id=28247651 > We need a lemon-like law for consumer electronics. I wonder how this should apply to planned obsolescence of devices like smartphones. On one hand, it's obscene that manufacturers expect us to routinely spend ~$1k on a device that will in the best case scenario last for three years. There's no inherent reason that a flagship Samsung from 2017 shouldn't be perfectly serviceable today, and likewise for a Pixel 6 or iPhone 13 in 2030. However, the discontinuation of security updates makes it so that for all practical purposes they are not. On the other hand, we can't exactly compel speech or labor. It would be one thing if there were a kill switch triggered after N years, but in this case the obsolescence isn't caused by an active update, rather a lack thereof. Here's a possible middle ground: 1. Block device manufacturers from arbitrarily deprecating hardware. We can't compel the release of new software, but we can block the release of new software. Require manufacturers to submit a filing with request for approval before the release of any new mobile OS update, which must include an exhaustive list of all supported devices. In the event that a device is dropped from the list in a subsequent filing, it must be explained to the satisfaction of regulators that a specific hardware limitation makes continued support for the device problematic or impractical. Given approval to drop support for a device from an OS release, there would be no obligation on the manufacturer to backport security updates to prior releases. 2. Block component manufacturers from arbitrarily deprecating hardware. Any hardware included in a publicly available consumer electronic device must have its manufacturer commit to providing up-to-date driver software with support for the latest OS for the lifetime of the device. Failure to provide this within a certain time frame (say, three months) following the request of a device manufacturer would open them up to a lawsuit, wherein they could be compelled to publish the most recent release of the driver as open source / public domain. #1 would provide the incentive for each device manufacturer to proactively enforce this, as their entire product roadmap would be effectively frozen if they allowed component manufacturers to drag their feet. 3. Ban irreversible bootloader locking in new devices. Maybe an initial bootloader lock would be acceptable, but power users should have some way to override the lock and install a custom ROM without relying on vulnerabilities in the software.
pyrale 5y ago
Not a fan to drop maintenance on the community. Pass a law that taxes Google punitively for each app sale on an unmaintained phone, and see how quiclky they'll find a way to support their phones.
- thayne 5y ago
  > will be required to unlock bootloaders and publish technical specs is probably sufficient motivation. There's no way Apple would be willing to do that. Google might be, but they might have a lot of resistance from Qualcomm and possibly mobile carriers and other partners.
  - pyrale 5y ago
    That is imo a bad fix, because it would be very easy for Google and Apple to make sure the technical specs are unreadable and the bootloaders complicated to use, without much recourse for the lawmaker. Comparatively, it's much easier to make a law targeting the stores that's hard to avoid.
    - thayne 5y ago
      As has been mentioned in other comments that is also easy to avoid by simply making it impossible to download apps on older phones.
      - pyrale 5y ago
        Yes, indeed. But that is a massive footgun to use, and it creates a direct incentive to have longer service durations. It is likely that Google would stand to make more money by offering longer service duration for their OS, and by demanding phonemakers to maintain their firmware. I guess the info we need to see whether this would be a good decision or not is how much money Google makes from selling apps to phones 3 year and older.
- bmicraft 5y ago
  This actually sounds like a workable solution, the first one I've seen so far that could really solve the issue
gruez 5y ago
Disagree. For certain vendors you can already get unlocked bootloaders and kernel sources. That's how various aftermarket android ROMs are built. However, even for a project like lineageos, there's only one or two maintainers per device. Do you think one or two volunteer maintainer (presumably working in their free time), can keep the entire kernel up to date and patched?
- chasil 5y ago
  Fine. Let's try another law. Any locked device must brick itself after 6 months of no patches, to ensure the safety of the network. A few months of that, and we will arrive at the previous law.
  - gruez 5y ago
    > Fine. Let's try another law. >Any locked device must brick itself after 6 months of no patches, to ensure the safety of the network. What does this accomplish? Get people mad? Moreover, what prevents someone from making trivial patches to keep a device "up to date", kind of like how people make trivial changes to their passwords to keep up with password rotation policies?
    - chasil 5y ago
      Yes, aside from finally protecting our networks from hostile traffic, that is the intended purpose. I was thinking that we could name this law after you.
    - kevincox 5y ago
      To be fair if the devices bricked themselves people would start to value update lufetime even more and sales of devices with short support would drop like a rock.
      - gruez 5y ago
        But this suffers from goodhart's law. "support period" becomes the metric to game, so manufacturers would say they "support" for 10 years or whatever, but what that entails is having an inter bump up the version number every 6 months.
jay_kyburz 5y ago
Or you could hold the seller responsible for any harm caused security flaws for as long as the user chooses to use the phone.
ssivark 5y ago
What stops OEMs from publishing dummy updates that satisfy the legal checkboxes?
- Dylan16807 5y ago
  Dummy updates aren't security updates, so they can't satisfy the checkboxes. If you're asking how it gets enforced, there could be a government office tasked with enforcement, and the law could let people sue.
  - LtdJorge 5y ago
    Then leave one security patch out of the update and push it to the next one.
    - Dylan16807 5y ago
      So put in the full work to patch things, but do it slightly wrong on purpose? What do companies gain by being so passive-aggressive?
      - ssivark 5y ago
        Higher revenues through induced obsolescence?
        Dylan16807 5y ago
        Delaying patches slightly doesn't really help revenues unless it's widely publicized, in which case they look bad and possibly get sued and it doesn't even save them any effort. Maybe it's a risk, but I'll definitely take that risk over what we have today.

by chasil 5y ago

buu700 5y ago

I've had some similar ideas: https://news.ycombinator.com/item?id=28247651 https://news.ycombinator.com/item?id=28247651 > We need a lemon-like law for consumer electronics. I wonder how this should apply to planned obsolescence of devices like smartphones. On one hand, it's obscene that manufacturers expect us to routinely spend ~$1k on a device that will in the best case scenario last for three years. There's no inherent reason that a flagship Samsung from 2017 shouldn't be perfectly serviceable today, and likewise for a Pixel 6 or iPhone 13 in 2030. However, the discontinuation of security updates makes it so that for all practical purposes they are not. On the other hand, we can't exactly compel speech or labor. It would be one thing if there were a kill switch triggered after N years, but in this case the obsolescence isn't caused by an active update, rather a lack thereof. Here's a possible middle ground: 1. Block device manufacturers from arbitrarily deprecating hardware. We can't compel the release of new software, but we can block the release of new software. Require manufacturers to submit a filing with request for approval before the release of any new mobile OS update, which must include an exhaustive list of all supported devices. In the event that a device is dropped from the list in a subsequent filing, it must be explained to the satisfaction of regulators that a specific hardware limitation makes continued support for the device problematic or impractical. Given approval to drop support for a device from an OS release, there would be no obligation on the manufacturer to backport security updates to prior releases. 2. Block component manufacturers from arbitrarily deprecating hardware. Any hardware included in a publicly available consumer electronic device must have its manufacturer commit to providing up-to-date driver software with support for the latest OS for the lifetime of the device. Failure to provide this within a certain time frame (say, three months) following the request of a device manufacturer would open them up to a lawsuit, wherein they could be compelled to publish the most recent release of the driver as open source / public domain. #1 would provide the incentive for each device manufacturer to proactively enforce this, as their entire product roadmap would be effectively frozen if they allowed component manufacturers to drag their feet. 3. Ban irreversible bootloader locking in new devices. Maybe an initial bootloader lock would be acceptable, but power users should have some way to override the lock and install a custom ROM without relying on vulnerabilities in the software.

pyrale 5y ago

Not a fan to drop maintenance on the community. Pass a law that taxes Google punitively for each app sale on an unmaintained phone, and see how quiclky they'll find a way to support their phones.

thayne 5y ago
> will be required to unlock bootloaders and publish technical specs is probably sufficient motivation. There's no way Apple would be willing to do that. Google might be, but they might have a lot of resistance from Qualcomm and possibly mobile carriers and other partners.
- pyrale 5y ago
  That is imo a bad fix, because it would be very easy for Google and Apple to make sure the technical specs are unreadable and the bootloaders complicated to use, without much recourse for the lawmaker. Comparatively, it's much easier to make a law targeting the stores that's hard to avoid.
  - thayne 5y ago
    As has been mentioned in other comments that is also easy to avoid by simply making it impossible to download apps on older phones.
    - pyrale 5y ago
      Yes, indeed. But that is a massive footgun to use, and it creates a direct incentive to have longer service durations. It is likely that Google would stand to make more money by offering longer service duration for their OS, and by demanding phonemakers to maintain their firmware. I guess the info we need to see whether this would be a good decision or not is how much money Google makes from selling apps to phones 3 year and older.
bmicraft 5y ago
This actually sounds like a workable solution, the first one I've seen so far that could really solve the issue

gruez 5y ago

Disagree. For certain vendors you can already get unlocked bootloaders and kernel sources. That's how various aftermarket android ROMs are built. However, even for a project like lineageos, there's only one or two maintainers per device. Do you think one or two volunteer maintainer (presumably working in their free time), can keep the entire kernel up to date and patched?

chasil 5y ago
Fine. Let's try another law. Any locked device must brick itself after 6 months of no patches, to ensure the safety of the network. A few months of that, and we will arrive at the previous law.
- gruez 5y ago
  > Fine. Let's try another law. >Any locked device must brick itself after 6 months of no patches, to ensure the safety of the network. What does this accomplish? Get people mad? Moreover, what prevents someone from making trivial patches to keep a device "up to date", kind of like how people make trivial changes to their passwords to keep up with password rotation policies?
  - chasil 5y ago
    Yes, aside from finally protecting our networks from hostile traffic, that is the intended purpose. I was thinking that we could name this law after you.
  - kevincox 5y ago
    To be fair if the devices bricked themselves people would start to value update lufetime even more and sales of devices with short support would drop like a rock.
    - gruez 5y ago
      But this suffers from goodhart's law. "support period" becomes the metric to game, so manufacturers would say they "support" for 10 years or whatever, but what that entails is having an inter bump up the version number every 6 months.

jay_kyburz 5y ago

Or you could hold the seller responsible for any harm caused security flaws for as long as the user chooses to use the phone.

ssivark 5y ago

What stops OEMs from publishing dummy updates that satisfy the legal checkboxes?

Dylan16807 5y ago
Dummy updates aren't security updates, so they can't satisfy the checkboxes. If you're asking how it gets enforced, there could be a government office tasked with enforcement, and the law could let people sue.
- LtdJorge 5y ago
  Then leave one security patch out of the update and push it to the next one.
  - Dylan16807 5y ago
    So put in the full work to patch things, but do it slightly wrong on purpose? What do companies gain by being so passive-aggressive?
    - ssivark 5y ago
      Higher revenues through induced obsolescence?
      - Dylan16807 5y ago
        Delaying patches slightly doesn't really help revenues unless it's widely publicized, in which case they look bad and possibly get sued and it doesn't even save them any effort. Maybe it's a risk, but I'll definitely take that risk over what we have today.