3 ms·
A required support period of some number of years is problematic for products developed by startups, because startups cannot guarantee that they will still exis
by whats_a_quasar 3y ago
A required support period of some number of years is problematic for products developed by startups, because startups cannot guarantee that they will still exist to provide support in several years. They can have the best of intentions and excellent engineering, but still fail in the market and be unable to keep maintaining a device. So requiring security support for several years wouldn't have any effect on these devices, because the company will be gone and there won't be anyone to take an enforcement action against.
For a labelling program for this type of company, you could require additional disclosure to consumers at the time of sale, along the lines of "We can't guarantee that we'll provide security updates." Or you could require open-sourcing of firmware if a company goes defunct. Or perhaps device manufacturers could be required to hand the technology of to some third party maintainer if they go under.
Any regulation at end-of-support-life has the "company disappears" problem, so probably disclosure at time of sale is the only thing that could be reliably enforced.
- nikanj 3y agoAny guarantees and warranties have the same caveat: if the company goes under, you got nobody left to sue. And there’s no squeezing water from a rock anyway, a defunct company can’t pay for the updates nor the damages
- smingo 3y agoTotally valid point. Escrow then open sourced, or perhaps even some insurance policy so that the future patching and vulnerability remediation is guaranteed. There's a bunch of stuff consequential to EO 14028 which could allow for some automation of library vulnerability.
- whats_a_quasar 3y agoI was trying to think of ways to finance it, and "future patch insurance" is clever! There are other sorts of business insurance where the insurer is liable even if the business no longer exists, so it would be doable. Though a policy would require a level of technical competency that other insurance policies don't, since their providing a guarantee of service rather than a guarantee to pay out a certain amount in damages.