3 ms·

The real lesson is to mandate minimum support. Otherwise bigtech will use this as an excuse to destroy the environment for profit through increasing planned obs

The real lesson is to mandate minimum support. Otherwise bigtech will use this as an excuse to destroy the environment for profit through increasing planned obsolescence.

oezi 3y ago
I would require 5 year mandatory security updates for all devices and another 5 years of support which customers can purchase for a fee which is capped at 5% of the sale price per year. Manufacturers which don't fix CVEs within 90 days must accept returns at full sale price. That would fix the whole economics around vulnerablities.
- jeroenhd 3y ago
  The EU is working on a law that forbids selling devices with known vulnerabilities. This means manufacturers will either have to patch their stuff quickly or risk getting their entire lineup banned from sale if a serious security issue is found in their hardware. Stores will probably demand support lifetimes as well or they'll be stuck with unsellable stock once a company decides that three years of updates turned out to be too long after all. I think further provisions are necessary, such as source code escrow; once you go out of business or drop software support for a product, the entire code repository should open up to the public to fix it themselves, including the necessary keys to load the replacement software. It shouldn't matter if you use the same code base for other devices that you do support, if you're maintaining that code you may as well push those fixes out to older devices. The biggest issue with phones and tablets is that often the problem lies within kernel driver that the manufacturer has no control over. Qualcomm and friends are the biggest crooks here, sometimes dropping software support for their chips after only two or three years, with no realistic alternatives for sourcing SoCs.
  - scarface_74 3y ago
    > The EU is working on a law that forbids selling devices with known vulnerabilities. How does that help when most vulnerabilities are found after the phone was sold?
    - bzzzt 3y ago
      At least there would have to be a way to check on the official support status for a device to determine if it may be sold, so more transparency.
- ethbr0 3y ago
  Add in a mandatory portion of device sales that goes to responsibly-disclosed vulnerability bounties. It'd have some side effects of centralizing handset manufacture into a few manufacturers (and core component suppliers) and/or pushing more into using straight-Android. But making the economics more aligned with security, in a predictable way for the manufacturer, seems important enough to make the trade-off.
- hhh 3y ago
  Minimum 5 years seems like an okay one, second half is a bit weird… Capped at 5%, and mandatory to offer? Seems like it could influence prices of phones. Mandating fixes for CVEs in 90 days sounds nice on paper… Not sure about the implications of that
  - oezi 3y ago
    The idea is that there should be an option for customers to extend their coverage for a sensible fee. Without a cap on the price manufacturers could charge insane prices. Mandating a time to fix puts a lot of pressure on manufacturers to have security teams ready at all times and make sure their patch process works pretty flawlessly. The implications on device prices is certainly an increase by 10% but a lot of knock off devices would stop making economical sense.
scarface_74 3y ago
> The real lesson is to mandate minimum support. Otherwise bigtech will use this as an excuse to destroy the environment for profit through increasing planned obsolescence. If by $BigTech you mean Google. Apple just released a patch for iPhone 5S devices (circa 2013) earlier this year.

The real lesson is to mandate minimum support. Otherwise bigtech will use this as an excuse to destroy the environment for profit through increasing planned obsolescence.

oezi 3y ago

I would require 5 year mandatory security updates for all devices and another 5 years of support which customers can purchase for a fee which is capped at 5% of the sale price per year. Manufacturers which don't fix CVEs within 90 days must accept returns at full sale price. That would fix the whole economics around vulnerablities.

jeroenhd 3y ago
The EU is working on a law that forbids selling devices with known vulnerabilities. This means manufacturers will either have to patch their stuff quickly or risk getting their entire lineup banned from sale if a serious security issue is found in their hardware. Stores will probably demand support lifetimes as well or they'll be stuck with unsellable stock once a company decides that three years of updates turned out to be too long after all. I think further provisions are necessary, such as source code escrow; once you go out of business or drop software support for a product, the entire code repository should open up to the public to fix it themselves, including the necessary keys to load the replacement software. It shouldn't matter if you use the same code base for other devices that you do support, if you're maintaining that code you may as well push those fixes out to older devices. The biggest issue with phones and tablets is that often the problem lies within kernel driver that the manufacturer has no control over. Qualcomm and friends are the biggest crooks here, sometimes dropping software support for their chips after only two or three years, with no realistic alternatives for sourcing SoCs.
- scarface_74 3y ago
  > The EU is working on a law that forbids selling devices with known vulnerabilities. How does that help when most vulnerabilities are found after the phone was sold?
  - bzzzt 3y ago
    At least there would have to be a way to check on the official support status for a device to determine if it may be sold, so more transparency.
ethbr0 3y ago
Add in a mandatory portion of device sales that goes to responsibly-disclosed vulnerability bounties. It'd have some side effects of centralizing handset manufacture into a few manufacturers (and core component suppliers) and/or pushing more into using straight-Android. But making the economics more aligned with security, in a predictable way for the manufacturer, seems important enough to make the trade-off.
hhh 3y ago
Minimum 5 years seems like an okay one, second half is a bit weird… Capped at 5%, and mandatory to offer? Seems like it could influence prices of phones. Mandating fixes for CVEs in 90 days sounds nice on paper… Not sure about the implications of that
- oezi 3y ago
  The idea is that there should be an option for customers to extend their coverage for a sensible fee. Without a cap on the price manufacturers could charge insane prices. Mandating a time to fix puts a lot of pressure on manufacturers to have security teams ready at all times and make sure their patch process works pretty flawlessly. The implications on device prices is certainly an increase by 10% but a lot of knock off devices would stop making economical sense.

scarface_74 3y ago

> The real lesson is to mandate minimum support. Otherwise bigtech will use this as an excuse to destroy the environment for profit through increasing planned obsolescence. If by $BigTech you mean Google. Apple just released a patch for iPhone 5S devices (circa 2013) earlier this year.