3 ms·
IMO a better/more subtle option: mandate at least 5-7 years of security patches for each device including for the kernel. Manufacturers will figure out real qui
by ryukafalz 4y ago
IMO a better/more subtle option: mandate at least 5-7 years of security patches for each device including for the kernel. Manufacturers will figure out real quick that their current practices are unsustainable in the long run.
Not better because I don’t think the drivers should be upstreamed, to be clear. Better because it leads the manufacturers to that conclusion on their own.
- tga_d 4y agoHow do you mandate future behavior? If the device shipped, it shipped, and if Google revokes the Play license four years from now when security patches still haven't been applied, what does the company care? The phones are already sold, Play services aren't going to uninstall themselves, and they can claim they pinky swear to do it this time. Google's only recourse at that point would be to cut out their own market share with no real path to settling the dispute (how can you tell if this time Samsung or whoever will follow through?). At least with a simple upstream requirement, there's an immediate resolution: you can ship the phones with Play once you're done with the upstream merges. Not saying that's in any way likely to happen -- making your terms contingent on the whims of Linus Torvalds does not sounds like a wise strategy IMO -- but it at least makes more sense than after-the-fact requirements.
- bpye 4y agoLicensing terms that have some financial penalty if the device does not receive security updates for the full term?