6 ms·

The next thing I'd like to see is a rule on maintaining security updates for devices beyond 3-4 years. I'm going to have to give up my perfectly operating 4/5 y

The next thing I'd like to see is a rule on maintaining security updates for devices beyond 3-4 years. I'm going to have to give up my perfectly operating 4/5 year old Samsung phone shortly because it'll be falling into the "no support" bracket.

walterbell 5y ago
Microsoft Linux on Azure Sphere devices come with 10 years of security updates. If an Azure Sphere network router gains traction, it could influence the policy of competitors.
fastball 5y ago
Would you be happy to pay a subscription fee for this?
- ocdtrekkie 5y ago
  The cost of supporting a product for it's lifecycle should be baked into the original cost.
  - unfocussed_mike 5y ago
    In practice it often is -- even in the case of many bad Android phones. It's just that the lifecycle they work to is the two year phone contract replacement lifecycle, not the longer one you might imagine. It's Darwinian: as long as the phone is not abandonware by the time the user's contract runs out, it doesn't matter. And the only Darwinian pressure to resolve this would be longer plan terms.
    - hughrr 5y ago
      I think they should actually forcibly separate buying a phone from the carrier.
      - unfocussed_mike 5y ago
        In the UK and the EU at least, there's not much of a tie anymore, and the market probably has enough choice; not sure how much things have improved in the USA or elsewhere. I suspect the increasing discussion of longer support periods does suggest my Darwinian scenario is changing. A bit.
        jpindar 5y ago
        In the US it is a choice, at least for anyone willing and able to pay the full price of the phone up front.
  - brap 5y ago
    So would you be happy to pay this “baked in” cost (which will cost you the same as paying for a subscription)? And should all buyers be forced to pay this cost as well, even those who can’t afford it? Should we not allow any alternatives?
    - wolrah 5y ago
      > So would you be happy to pay this “baked in” cost (which will cost you the same as paying for a subscription)? And should all buyers be forced to pay this cost as well, even those who can’t afford it? Should we not allow any alternatives? An alternative would be to require that all products with an "expiration date" list it prominently on the packaging and marketing materials. Make it very clear that the device will no longer be receiving security fixes and will be increasingly likely to be dangerous to use after that date. Then you still have the option to produce and purchase devices that won't be supported a reasonable time, but the consumer is aware of exactly what those limits are before purchasing so they can compare prices accurately. What you seem to be suggesting is that it should be OK to sell people products that NEED to be supported to not be dangerous, with the knowledge that they will be used beyond their support period, just to save money. Sometimes there is a minimum cost a thing has to be to be done right, and anything cheaper than that is cutting corners somewhere. --- If it's connected to the internet it needs to be receiving security updates, period. No exceptions. If you can't update for whatever reason (crappy software, ancient but irreplaceable hardware, production requirements), it shouldn't be connected to the internet. --- edit: Another point to make, specifically when referring to cell phones and similar systems, is that in a lot of cases the vendors making these devices are themselves at fault for them being hard to support long term. They're the ones who choose to hack up the Linux kernel in their own weird ways, with no common base. A phone vendor should be able to update their entire line more or less one-shot for the majority of fixes, but they usually cant due to bad decisions made in-house or by their SoC vendor. And all of those bad decisions are things these vendors have been getting yelled at about for well over a decade now, so they know they're doing it wrong and choose to continue.
      - brap 5y ago
        How is this different than a warranty, which already comes with every device? I agree with you that this should be very explicit, although it’s the consumer’s responsibility as well to understand what they’re purchasing. Not sure I understand the 2nd part. If Apple or Google don’t want to issue security fixes after N years, should they remotely disable the device? How many of us are currently using devices beyond their warranty period? How many of us will appreciate it if our devices got disabled “for our own good”?
  - judge2020 5y ago
    the lifecycle of the unit, or the lifecycle of the model? Because there's already an issue with both Android phones and iPhones where you might buy a phone whose near the end of its production run, and that can mean you only get 1 year of updates on it if that.
- deleted 5y ago
  [deleted]
- blagie 5y ago
  I would be much happier with a law requiring this, or a tax if this doesn't happen. Windows, MacOS, Linux, and other systems receive updates nearly forever even on ancient hardware. The choice to not do this with Android or ChromeOS is one Google made pretty deliberately. Keeping hardware abstracted from higher layers has been a solved problem for at least a half-century now. It's an economic inefficiency that's exploiting information asymmetry between Google and consumers.
  - brap 5y ago
    Who do you think will pay for this tax or regulation, if not the consumer?
    - blagie 5y ago
      No one will pay for this. The point of a more efficient economic system is that everyone is better off. Capitalism assumes perfect information and transparency. When this doesn't happen, you have inefficiencies, and those require regulation to address. Throwing away my phone before it's broken is extremely inefficient economics. If you address that through regulation, those same resources will get reallocated elsewhere. Google might be an epsilon smaller, but that will be more than compensated for with more gainful employment elsewhere. Same thing with regulations to prevent polluting a commons, to prevent monopolistic trusts, truth-in-advertising laws, and otherwise. Indeed, in many of these places, without regulation, *everyone* is worse off. For example, if you can lie in advertising, and my business does and yours doesn't, mine will win in the free market system. As an executive, you don't have the choice to be honest. With truth-in-advertising laws, everyone is required to be honest, and that's better for the executives, businesses, and consumers.
      - brap 5y ago
        You said that you'd be happy to get security updates beyond 3-4 years, this is what I was referring to. This is HN, so I assume you're involved in tech, so surely you understand that releasing security patches for legacy devices requires more engineers and therefore more money. Who's paying?
- eulers_secret 5y ago
  It doesn’t make sense to gate security updates behind a subscription paywall. People in poverty deserve device security. Besides, this is a false dichotomy- chrome books are very cheap, but come with years of updates. Move them to Linux and it’s decades of updates.
  - fastball 5y ago
    Either people who care more pay a subscription for longer security update coverage or the cost of producing more security updates is baked in to the cost of the phone. Either way if people in poverty want security they're gonna have to pay for it.
pessimizer 5y ago
If it were mandatory for them to be rooted, we wouldn't need Samsung for updates.
- bencollier49 5y ago
  Good shout, actually.
the_duke 5y ago
I believe a law mandating 6 or 8 years of security updates is in an advanced stage already.
fsflover 5y ago
Pinephone and Librem 5 will have lifetime updates, because all drivers are FLOSS.
- Hackbraten 5y ago
  But unless you happen to be US-based, you’re going to throw away your Librem 5 anyway after two or three years, tops. Because there’s no way for you to buy a replacement battery. [1] Seriously. Don’t buy a Librem 5 unless you live in the US. [1]: https://shop.puri.sm/shop/librem-5-evergreen-battery/ https://shop.puri.sm/shop/librem-5-evergreen-battery/ [2]: https://forums.puri.sm/t/librem-v15-battery-replacement-europe/16504/11 https://forums.puri.sm/t/librem-v15-battery-replacement-euro...
  - fsflover 5y ago
    It's not a fault of Purism, and it's even worse for all modern phones that have no replaceable battery.
    - Hackbraten 5y ago
      I agree in that it’s not Purism’s fault. On the other hand, I feel that people who are not from the US and believe a Librem 5 to be a sustainable investment should be made aware of this issue. And it’s not worse for other modern phones. On the contrary: if I wanted my iPhone battery replaced, I’d have a choice between a nearby Apple Store and countless independent repair shops, all of whom would be able to source and replace the battery in no time. But with the Librem, I’ll be out of luck. Nobody in Europe would be able and willing to source that battery for me if I needed one. Few potential buyers aren’t aware of that; Purism understandably doesn’t advertise it. So here I am spreading the word.

walterbell 5y ago

Microsoft Linux on Azure Sphere devices come with 10 years of security updates. If an Azure Sphere network router gains traction, it could influence the policy of competitors.

fastball 5y ago

Would you be happy to pay a subscription fee for this?

ocdtrekkie 5y ago
The cost of supporting a product for it's lifecycle should be baked into the original cost.
- unfocussed_mike 5y ago
  In practice it often is -- even in the case of many bad Android phones. It's just that the lifecycle they work to is the two year phone contract replacement lifecycle, not the longer one you might imagine. It's Darwinian: as long as the phone is not abandonware by the time the user's contract runs out, it doesn't matter. And the only Darwinian pressure to resolve this would be longer plan terms.
  - hughrr 5y ago
    I think they should actually forcibly separate buying a phone from the carrier.
    - unfocussed_mike 5y ago
      In the UK and the EU at least, there's not much of a tie anymore, and the market probably has enough choice; not sure how much things have improved in the USA or elsewhere. I suspect the increasing discussion of longer support periods does suggest my Darwinian scenario is changing. A bit.
      - jpindar 5y ago
        In the US it is a choice, at least for anyone willing and able to pay the full price of the phone up front.
- brap 5y ago
  So would you be happy to pay this “baked in” cost (which will cost you the same as paying for a subscription)? And should all buyers be forced to pay this cost as well, even those who can’t afford it? Should we not allow any alternatives?
  - wolrah 5y ago
    > So would you be happy to pay this “baked in” cost (which will cost you the same as paying for a subscription)? And should all buyers be forced to pay this cost as well, even those who can’t afford it? Should we not allow any alternatives? An alternative would be to require that all products with an "expiration date" list it prominently on the packaging and marketing materials. Make it very clear that the device will no longer be receiving security fixes and will be increasingly likely to be dangerous to use after that date. Then you still have the option to produce and purchase devices that won't be supported a reasonable time, but the consumer is aware of exactly what those limits are before purchasing so they can compare prices accurately. What you seem to be suggesting is that it should be OK to sell people products that NEED to be supported to not be dangerous, with the knowledge that they will be used beyond their support period, just to save money. Sometimes there is a minimum cost a thing has to be to be done right, and anything cheaper than that is cutting corners somewhere. --- If it's connected to the internet it needs to be receiving security updates, period. No exceptions. If you can't update for whatever reason (crappy software, ancient but irreplaceable hardware, production requirements), it shouldn't be connected to the internet. --- edit: Another point to make, specifically when referring to cell phones and similar systems, is that in a lot of cases the vendors making these devices are themselves at fault for them being hard to support long term. They're the ones who choose to hack up the Linux kernel in their own weird ways, with no common base. A phone vendor should be able to update their entire line more or less one-shot for the majority of fixes, but they usually cant due to bad decisions made in-house or by their SoC vendor. And all of those bad decisions are things these vendors have been getting yelled at about for well over a decade now, so they know they're doing it wrong and choose to continue.
    - brap 5y ago
      How is this different than a warranty, which already comes with every device? I agree with you that this should be very explicit, although it’s the consumer’s responsibility as well to understand what they’re purchasing. Not sure I understand the 2nd part. If Apple or Google don’t want to issue security fixes after N years, should they remotely disable the device? How many of us are currently using devices beyond their warranty period? How many of us will appreciate it if our devices got disabled “for our own good”?
- judge2020 5y ago
  the lifecycle of the unit, or the lifecycle of the model? Because there's already an issue with both Android phones and iPhones where you might buy a phone whose near the end of its production run, and that can mean you only get 1 year of updates on it if that.
deleted 5y ago
[deleted]
blagie 5y ago
I would be much happier with a law requiring this, or a tax if this doesn't happen. Windows, MacOS, Linux, and other systems receive updates nearly forever even on ancient hardware. The choice to not do this with Android or ChromeOS is one Google made pretty deliberately. Keeping hardware abstracted from higher layers has been a solved problem for at least a half-century now. It's an economic inefficiency that's exploiting information asymmetry between Google and consumers.
- brap 5y ago
  Who do you think will pay for this tax or regulation, if not the consumer?
  - blagie 5y ago
    No one will pay for this. The point of a more efficient economic system is that everyone is better off. Capitalism assumes perfect information and transparency. When this doesn't happen, you have inefficiencies, and those require regulation to address. Throwing away my phone before it's broken is extremely inefficient economics. If you address that through regulation, those same resources will get reallocated elsewhere. Google might be an epsilon smaller, but that will be more than compensated for with more gainful employment elsewhere. Same thing with regulations to prevent polluting a commons, to prevent monopolistic trusts, truth-in-advertising laws, and otherwise. Indeed, in many of these places, without regulation, *everyone* is worse off. For example, if you can lie in advertising, and my business does and yours doesn't, mine will win in the free market system. As an executive, you don't have the choice to be honest. With truth-in-advertising laws, everyone is required to be honest, and that's better for the executives, businesses, and consumers.
    - brap 5y ago
      You said that you'd be happy to get security updates beyond 3-4 years, this is what I was referring to. This is HN, so I assume you're involved in tech, so surely you understand that releasing security patches for legacy devices requires more engineers and therefore more money. Who's paying?
eulers_secret 5y ago
It doesn’t make sense to gate security updates behind a subscription paywall. People in poverty deserve device security. Besides, this is a false dichotomy- chrome books are very cheap, but come with years of updates. Move them to Linux and it’s decades of updates.
- fastball 5y ago
  Either people who care more pay a subscription for longer security update coverage or the cost of producing more security updates is baked in to the cost of the phone. Either way if people in poverty want security they're gonna have to pay for it.

pessimizer 5y ago

If it were mandatory for them to be rooted, we wouldn't need Samsung for updates.

bencollier49 5y ago
Good shout, actually.

the_duke 5y ago

I believe a law mandating 6 or 8 years of security updates is in an advanced stage already.

fsflover 5y ago

Pinephone and Librem 5 will have lifetime updates, because all drivers are FLOSS.

Hackbraten 5y ago
But unless you happen to be US-based, you’re going to throw away your Librem 5 anyway after two or three years, tops. Because there’s no way for you to buy a replacement battery. [1] Seriously. Don’t buy a Librem 5 unless you live in the US. [1]: https://shop.puri.sm/shop/librem-5-evergreen-battery/ https://shop.puri.sm/shop/librem-5-evergreen-battery/ [2]: https://forums.puri.sm/t/librem-v15-battery-replacement-europe/16504/11 https://forums.puri.sm/t/librem-v15-battery-replacement-euro...
- fsflover 5y ago
  It's not a fault of Purism, and it's even worse for all modern phones that have no replaceable battery.
  - Hackbraten 5y ago
    I agree in that it’s not Purism’s fault. On the other hand, I feel that people who are not from the US and believe a Librem 5 to be a sustainable investment should be made aware of this issue. And it’s not worse for other modern phones. On the contrary: if I wanted my iPhone battery replaced, I’d have a choice between a nearby Apple Store and countless independent repair shops, all of whom would be able to source and replace the battery in no time. But with the Librem, I’ll be out of luck. Nobody in Europe would be able and willing to source that battery for me if I needed one. Few potential buyers aren’t aware of that; Purism understandably doesn’t advertise it. So here I am spreading the word.